Single Connect High Level Design

high level design high level design section i logical architecture single connect has modular and integrated architecture to support wide range of protocols and features on one platform users logon to single connect from web based interface to use services such as web based remote desktop connection to a windows server, web based client connection to a network device, password checkout from secure vault, etc users may prefer to connect using their regular native clients instead of web based interface for example, users can use their own cli client applications (e g putty, securecrt, etc ) or sql client (toad, datagrid, navicat, etc ) applications to connect directly to single connect proxy services which are ssh/telnet and sql respectively in this case in some use cases, users do not directly connect to single connect or even aware of single connect for example, if a network device is managed by single connect tacacs manager, then when a user directly connects to that network device for device administration purposes, single connect runs behind the scenes and user is not even aware of single connect single connect admins connect via web based interface for administration and configuration purposes such as changing user privileges, creating new policies, adding/removing endpoints section ii internal layers there are four logical layers within single connect, integration interfaces layer, core functions layer, main modules layer, supported protocols layer integration interfaces layer integration with directory services (e g active directory, ldap server, aaa server) is supported through ldap, tacacs+ and radius protocols to sync user profiles and enable single sign on within enterprise siem (security information and event management) integration is supported through syslog protocol single connect administration activities (e g changing privilege of a user, changing configuration of a device/server), user logon/logout actions, session activities (e g user sessions to devices/servers and activities in sessions) can be sent to a siem server alarms on single connect such as resource (e g cpu, memory, storage) utilization, service stop down events can be sent as snmp traps to a snmp server which are most of the time monitored by technology operations center email integration with an email server is supported via smtp protocol based on the configuration of single connect modules, when an email is required to be sent (e g notification messages, managerial approval requests) during an internal process, smtp interface is used and message is delivered to user/admin as an email sms integration with an sms service provider is supported via rest api for example, during a 2 factor authentication process when an otp (one time password) is configured to be sent to user via sms, then this interface is used and otp is sent to user as a regular sms core functions layer user management and device management functions manage life cycle (create, change settings and configurations, delete) of users and endpoints (e g servers, devices, dbs), respectively policy management function manages the life cycle of policies there are different types of policies such as allow/reject specific user activities during an active session, otp to connect to an endpoint or to run a command, managerial approval to run a command, time\&date based access filters, geographical validation, etc license manager controls how the single connect instance is able to run, such as which modules and interfaces are allowed to run log manager collects and stores the log records there are many types of logs, such as user/admin logons and activities on single connect user interface, activities of users while connected to a device through single connect, failed attempts, task executions, send messages, video record of user sessions, etc report management function uses log records and generates summary results including texts, tables and graphics in a presentable form task management function manages the tasks such as changing/rotating passwords periodically replication management function replicates configuration data among single connect instances when two or more single connect instances are running in order to provide local or geographical redundancy conf db stores all configuration data (user profiles, end points, policy rule sets, etc ) log db stores all session and transaction log records (logon/off time, executed commands, session details, etc ) modules layer each module (session manager, dynamic password controller, mfa manager and tacacs manager, data access manager, cloud pam) runs the main business logic of their own services while consuming functions from other layers for example, when a user connects to a windows server through remote desktop connection, session manager orchestrates user authentication and connection establishment processes with user management, device management, policy management, and rdp proxy functions after the session is established, session manager continues to control session by orchestrating rdp proxy, log management and policy management functions for each module, positioning in network topology and delivered services are described separately in this document below supported protocols layer each proxy (ssh, telnet, rdp, vnc, http/s, sftp and sql proxies) provides man in the middle function for example, when a user connects to a network device via ssh proxy in the middle, ssh proxy runs as a ssh server towards to user and meanwhile runs as a ssh client towards the target network device as a result, ssh proxy runs transparently in the middle of ssh session and is able to monitor and log all session activities and enforce policies on the other hand, tacacs+ and radius servers are used by tacacs manager module in order to provide built in tacacs and radius server protocol descriptions ssh (secure shell) and telnet protocols provides bi directional interactive text oriented communication to cli (command line interface) interface of servers or devices rdp (remote desktop protocol) and vnc (virtual network computing) are protocols for graphical desktop sharing most of the time unix/linux based systems supports vnc while windows based systems supports rdp protocol http/s (hypertext transfer protocol / secure) is the de facto protocol for web sessions, mostly used between a browser and a web server sftp (secure file transfer protocol) is a protocol to transfer (upload or download) files between computers/servers sql (structured query language) is used for storing, manipulating and retrieving data in databases tacacs ( terminal access controller access control system) and radius (remote access dial in user service) protocols are used to control remote access (e g authentication and authorization) to servers or devices section iii single connect modules dynamic password controller single connect dynamic password controller is a central secure password vault and helps to prevent stealing or unauthorized sharing of passwords users check out the credentials of a privileged account from single connect dynamic password controller and then uses the password to connect to target endpoint in order to fulfill their tasks indexed logging and audit trail is generated to meet the security and compliance requirements dynamic password controller supports integration with the existing directory service of enterprises so that users continue to use their existing personal accounts to login to single connect dynamic password controller and check out the credentials of the target privileged accounts they are authorized to dynamic password controller secures the user credentials of operating systems (windows, linux, unix), databases (oracle, mysql, mssql, postgresql, etc ), virtually any network device or appliance that has an ssh/telnet interface and any application that provides user credential management api’s application to application password management (aapm) to eliminate static passwords in configuration files and source codes of application is supported with agent less architecture secret vault function enables secure storing, tracking and sharing of confidential data/file or unmanaged credentials among employee privileged session manager single connect privileged session manager (psm) has the capability to control, monitor and audit encrypted administrator sessions session manager runs as a gateway between users and target end points man in the middle approach of privileged session manager requires no software agents to be deployed to target end points and also no specific access portal or client application is required to go through it is fast to implement and has no impact on end user experience users are authenticated from the existing directory service of the enterprise, and the entire session goes through privileged session manager therefore indexed logs, audit trails, videos and statistics are generated indisputably any custom policy can be created flexibly on privileged session manager and can be assigned to user groups to implement the least privilege practices within the enterprise single connect privileged session manager supports a wide range of interfaces including ssh/telnet for command line interface sessions, rdp/vnc for remote desktop connections, http(s) for web sessions, sftp for file transfer multi factor authentication (mfa) manager usernames and passwords were the most common combination to identify users, but today passwords are vulnerable and hackers may easily steal passwords with phishing, social or dictionary attacks mfa manager delivers an additional code (one time password) to mobile phones of users that is required to be entered during authentication which assures users are who they say they are mfa manager can work with any application or device that supports radius access challenge mechanism mfa manager supports integration with the existing directory service of enterprises so that users continue to use their existing personal accounts codes (one time passwords) can be delivered to users in real time through single connect mobile application or sms offline code generation is also supported through single connect mobile application and key generator hard tokens tacacs access manager controlling access to who can login to a network device or server via ssh/telnet sessions to configure them has always been a high priority concerns for carriers and enterprises longstanding de facto protocols for device administration access management are radius (remote access dial in service) and tacacs (terminal access controller access control system) every authentication and command execution attempt of a user is forwarded from device/server to single connect tacacs manager which enables many features –including single sign on, custom/least policy enforcement, indisputably logging, multi tenancy) to be centrally managed and delivered data access manager single connect data access manager has the capability to control, monitor and audit encrypted database administrator sessions data access manager runs as a gateway between users and target databases man in the middle approach of data access manager requires no software agents to be deployed to target end points and no specific access portal or client application is required to go through it is fast to implement and has no impact on end user experience users are authenticated from the existing directory service of the enterprise, and the entire session goes through data access manager therefore indexed logs, audit trails and statistics are generated indisputably any custom policy can be created flexibly on data access manager and can be assigned to user groups to implement the least privilege practices within the enterprise single connect privileged session manager supports a wide range of sql and nosql database types for db sessions including oracle, mssql, mysql, cassandra, teradata and hive single connect data access manager efficient and centrally secures and controls privileged access to databases single connect data access manager also provides dynamic data masking feature to prevent access to sensitive data privileged task automation single connect privileged task automation manager provides virtual and physical network and task automation suite for enterprises even a simple mistake in a network configuration can create a vital problem within the network therefore, the validation of network tasks is critical to a successful operational environment due to the lack of validation mechanisms and potential service outage concerns, most of the mission critical tasks must be performed during night shifts single connect privileged task automation improves operational efficiency, mitigates operational risk and reduces the cost of operations configuration rollback support prevent unexpected failure occurred on target devices single connect privileged task automation frees up hours by automating time consuming, repetitive and routine tasks in an operator’s daily life single connect privileged task automation generates executive workflow reports to make network operations more visible provides pta provides central management, unified visibility and granular access control of privileged tasks while augmenting staff operations cloud pam single connect cloud pam solution supports amazon web services, azure and google cloud platforms through api integration with cloud platforms, seamless zero touch instance on boarding and tag management are supported cloud pam eliminates disclosure/sharing of privileged account passwords on enterprise servers and network elements on cloud platforms single connect cloud pam provides indexed and searchable logging of all sessions, including video recording and re play system admins can apply policies based on target endpoint list, date & time of access, command filtering (blacklist/whitelist) dual control provides real time, “over the shoulder” viewing of sessions with session control take over and release capabilities built in mfa module enables second layer authentication to connect to a server or network element installed on cloud services users can access directly from their web browsers, without any install and vpn less section iv single connect topology single connect for 2 nodes high level single connect web page and database activity for 2 nodes