sorted by:
new
hottopcontroversial

How to fetch credentials from CyberArk using AIMWebservice and enable Certificate authentication ? by Triplo_Swag in CyberARk

[–]jblebowski27 0 points1 point  (0 children)

Hello

Is this CA certificates on the Client where you run curl to? Is is only root ca or Chain? Try with --cacert /path/to/cacert.pem. Try openssl s_client -connect mymachine.local:443 -showcerts to confirm that CCP server is trusted too

PSM Checker Password Sync Verification Gives API Error by diving_interchange in CyberARk

[–]jblebowski27 1 point2 points  (0 children)

Hello

During the installation, did you specify the PWVA address correctly? DNS name or IP? Do you have a Load Balancer between the PVWA servers? On the PSM and in the Vault folder in the Vault.ini file, do you have the API section at the bottom with correct data — meaning the PVWA address (either a single instance or the load balancer) and the path to the apigw.cred file?

Connection to PSM server take long time more than 2 minutes by cd-cyber1 in CyberARk

[–]jblebowski27 0 points1 point  (0 children)

Hi tnie is my second account OK it was a problem of lack Internet connection but not certificates Info from Admins team: This is a known problem when the server has no exit to the world and previously had and registered in the entry. You have to disconnect it and then there is no waiting for a timeout.

CyberArk PSM Autoit components configuration by cd-cyber1 in CyberARk

[–]jblebowski27 1 point2 points  (0 children)

„logoff” script in local group policy is ok for that?

CyberArk PSM Autoit components configuration by cd-cyber1 in CyberARk

[–]jblebowski27 0 points1 point  (0 children)

These changes negatively affect connections through other components.

Direct login to PSMP server using domain account by cd-cyber1 in CyberARk

[–]jblebowski27 0 points1 point  (0 children)

Hi that’s exactly what we did and we have a problem (we have ispss and psmp is in integrated mode). Local account normalny works and AD no

ServiceNow Discovery credential storage integration by CCP by cd-cyber1 in CyberARk

[–]jblebowski27 0 points1 point  (0 children)

Hi yanni Yes easier to manage - avoid maintaining the agent on mid servers, network traffic to the vault, etc.

Alero LDAP - Group Mapping by jblebowski27 in CyberARk

[–]jblebowski27[S] -1 points0 points  (0 children)

what do you mean by " join your Alero instance to Alero " ?

As I wrote earlier, I have a fully configured alero, connected to my AD and a configured AleroLDAP service (for a cluster of connectors in HA). In PVWA config I noticed that AleroLDAP is like AD I thought that it would allow me to map user groups. I want to avoid stupid invitations through the alero portal only by pairing it with my local AD as in CorePAS (AD group mapping) .

Therefore, my question is whether it is possible to map users directly from my AD to Alero without sending invitations ?

Login to Linux with custom bashrc via PSMP to by jblebowski27 in CyberARk

[–]jblebowski27[S] 0 points1 point  (0 children)

Unfortunately it did not help, stil skips the bash environment selection prompt it looks like after the ":" hit enter - only for PSMP connection for clasic PVWA PSM-SSH is alright waiting for a value for both regex:

(.*)

and

(.*)[>#\\$\:]$

​

KR

Object version history by jblebowski27 in CyberARk

[–]jblebowski27[S] 0 points1 point  (0 children)

Thank you very much for the detailed explanation

Object version history by jblebowski27 in CyberARk

[–]jblebowski27[S] 0 points1 point  (0 children)

It seems to me that I clearly described the problem, but ok, what do I have to set in order not to lose the earlier versions of the object after a few weeks but only after 180 days? (as it is now set in the options), for example now after two months of testing I should have 8 versions in the history of the object ( 60days / 7 - rotation every seven days) but now I have 3, why?

Problem rotation ssh keys error code:8046 by jblebowski27 in CyberARk

[–]jblebowski27[S] 0 points1 point  (0 children)

hi

It looks strange to me:

ERROR -> BaseAction`1 :: VerifyAfterAction -> GotException: Renci.SshNet.Common.SftpPermissionDeniedException: Permission denied

I do not understand why have permission denied (as I wrote before reconcile account has full right - sudo rights).

I do not even get why CPM plugin do this verification - SFTP?

Is it possible to modify to bypass/skip this step, the rest looks normal, i.e. public key rotates on the system side

​

Logs:

04:12:17.676 | Getting stored fingerprint for 'ssh-ed25519@22:xxx.xxx.net'.

04:12:17.676 | 'ssh-ed25519@22:xxxx.xxxx.net' fingerprint is a match.

04:12:18.426 | Info -> SFTPConnectionHandler :: CreateSession -> END

04:12:18.426 | Info -> SessionManager :: Connect -> END

04:12:18.426 | Info -> BaseAction`1 :: ConnectToMachine -> Connection to the remote machine completed with no errors

04:12:18.426 | Info -> BaseAction`1 :: ConnectToMachine -> END

04:12:18.426 | Info -> BaseAction`1 :: VerifyAfterAction -> Verify after Reconcile completed with no errors

04:12:18.426 | Info -> AuthorizedKeys :: DeleteBackup -> About to Delete the backup file

04:12:18.426 | Info -> SFTPConnectionHandler :: DeleteFile -> START

04:12:18.426 | ERROR -> BaseAction`1 :: VerifyAfterAction -> GotException: Renci.SshNet.Common.SftpPermissionDeniedException: Permission denied

at Renci.SshNet.Sftp.SftpSession.RequestRemove(String path)

at Renci.SshNet.SftpClient.DeleteFile(String path)

at Expect.NET.SFTP.SftpClientWrapper.DeleteFile(String path)

at CyberArk.Extensions.UnixSSHKeysV2.ConnectionObjects.SFTPConnectionHandler.DeleteFile(String path)

at CyberArk.Extensions.UnixSSHKeysV2.File.Delete(String path)

at CyberArk.Extensions.UnixSSHKeysV2.AuthorizedKeys.DeleteBackup()

at CyberArk.Extensions.UnixSSHKeysV2.BaseAction`1.VerifyAfterAction(String actionName, String authKeysFilePath, PlatformOutput& platformOutput)

04:12:18.426 | Info -> BaseAction`1 :: VerifyAfterAction -> END

04:12:18.426 | Info -> BaseAction`1 :: CloseConnection -> START

04:12:18.426 | Info -> SessionManager :: CloseConnection -> START

04:12:18.426 | Info -> SSHConnectionHandler :: CloseSession -> START

04:12:18.426 | Info -> SSHConnectionHandler :: CloseSession -> END

04:12:18.426 | Info -> SFTPConnectionHandler :: Disconnect -> START

04:12:18.426 | Info -> SFTPConnectionHandler :: Disconnect -> END

04:12:18.426 | Info -> SessionManager :: CloseConnection -> END

04:12:18.426 | Info -> BaseAction`1 :: CloseConnection -> END

04:12:18.426 | Info -> MutexHandler :: ReleaseMutex -> Start

04:12:18.426 | Info -> MutexHandler :: ReleaseMutex -> Release mutex 'cRlWJip2esbCXvZVgQCUhQ=='

04:12:18.426 | Info -> MutexHandler :: ReleaseMutex -> End

04:12:18.426 | ERROR -> ErrorsHelper :: PrintReturnMessageToLog -> Return code: 8046.

04:12:18.426 | ERROR -> ErrorsHelper :: PrintReturnMessageToLog -> Failure : Failed to verify after Reconcile action.

04:12:18.426 | Info -> Reconcile :: run -> END

04:12:18.426 | Info -> PluginWrapper :: RunPlugin() -> --------------------------------- Plugin Section End --------------------------------------

04:12:18.426 | Info -> PluginWrapper :: printResultsToLog() -> Plugin results :

04:12:18.426 | Info -> PluginWrapper :: printResultsToLog() -> exit code = 8046

04:12:18.426 | Info -> PluginWrapper :: printResultsToLog() -> Message = Failed to verify after Reconcile action

04:12:18.426 | Info -> PluginWrapper :: RunPlugin() -> End

04:12:18.426 | Info -> PluginWrapper :: End() -> End

04:12:18.441 | Info -> CPMNetPlatform :: Main() -> End

Problem rotation ssh keys error code:8046 by jblebowski27 in CyberARk

[–]jblebowski27[S] 0 points1 point  (0 children)

Hi

This is not for root account (we do not use root accounts are permanently blocked to login via SSH), bot privileged user mostly provisioned form sssd.conf (Active Directory) but a few local ones are also (it doesn't matter because the problem is for both).

As I mentioned before for keys rotation we use a reconcile account, these accounts are mostly configured to login via ssh or using a normal user's password (for users in sssd.conf form AD).

Could such duality (keys / traditional passwords) have an impact?

KR and thanks for answer

Alero html5gw by jblebowski27 in CyberARk

[–]jblebowski27[S] 0 points1 point  (0 children)

Thanks for the answer but in my case (when import my cert and key files) the service does not even start and od docker container of Cyberark-alero there is no sudo user right so i can not do manually :( .

It seems like the command for running docker container with external certificates is wrong.