Protecting Linux Systems with SGNL

Introduction

Protected Systems are applications, services, or infrastructure that you want to protect with SGNL. In this guide, we’ll enhance access control for your Linux Servers by integrating them with SGNL’s Pluggable Authentication Module (PAM) for Linux.

With this integration, your Linux Servers need not know about the policies, systems of record, or any of the data in SGNL - it simply needs to pass to SGNL:

  • Who/What is requesting the access (The Principal)
  • (Optional) What is attempting to be accessed (The Asset)
  • (Optional) What operation is being attempted on the asset (The Action)
  • An access token that ensures the Protected System is a legitimate caller into SGNL

Prerequisites

  • One or more Linux Servers, running a supported Linux distro (RHEL, Ubuntu)
  • A C Linux Development Environment
  • A SGNL Client
  • A SGNL User Account with Admin privileges
  • At least 1 system of record integrated to SGNL, containing principals and (optionally) assets that will be evaluated in access evaluations
  • (Optional) 1 or more policies that you want assigned to the integration

Creating a Protected System in SGNL

  1. Log-In to your SGNL Client with an Admin Account
  2. From the left navigation pane, select Protected Systems and Add, or simply click Add from the SGNL Dashboard
  3. Select ‘Linux’ from the Infrastructure category in the list of integrations
  4. Give your integration a descriptive display name and description
  5. Specify the Default Policy to be applied to Linux
    • Allow: If no policies provide a decision for an access request, SGNL will respond to the access request with an Allow decision
    • Deny: If no policies provide a decision for an access request, SGNL will respond to the access request with a Deny decision
  6. Next, you’ll need to configure which identifier Linux is using to describe your user/principal
    • This may be an email address or Username that can be found in your IdP, or an EmployeeID in your HRIS system. This should be in the format of the Principal ID of the user that will request access to the Protected System.
    • e.g. If an Okta user will be requesting access to this Protected System, Linux, the principal identifier should be the Okta email address.
  7. You’ll also need to define an asset to protect
    • This might be as simple as the names of the Linux Servers you’re protecting
  8. Once configured, click Continue to save your Linux configuration and move on to other configuration steps

Configuring Authentication

  1. Authentication ensures that only authorized systems can make requests into SGNL, as well as verifying the identity of an integration in order to effectively evaluate Policies - to access Authentication settings, open your Linux protected system and select the Authentication tab

    SGNL - Authentication

  2. Click Generate Token

  3. Give your token a descriptive name so that you know how it’s being used in the future and click to Generate Token

    SGNL - Generate Token

  4. On the next screen, copy the token - this will be used by Linux to make access requests to SGNL using the SGNL Access Service API

    Note: The value of this token is not available again after this screen, so ensure you securely store it for steps later in this guide

    SGNL - Token

Integrating the SGNL Linux PAM with SGNL

The SGNL PAM for Linux is available to all SGNL Customers - if you’re interested in deploying this solution in your Enterprise, please get in contact with your Account Manager.

Once you have the PAM, you’ll need to provide configuration for your SGNL Client. This will require updating the config JSON file with details about your SGNL deployment and Authentication Token, e.g.

{
	"url": "https://access.sgnlapis.cloud/access/v1/evaluations",
	"token":"Authorization:Bearer {insert integration token}"

}

In your C Linux Development environment, you’ll need to ensure you have the appropriate packages installed, these are OS dependent and detailed below:

Red Hat

sudo yum install gcc
sudo yum install pam-devel
sudo yum install json-c-devel
sudo yum install libcurl-devel

Debian Based Linux (Ubuntu)

sudo apt update
sudo apt install gcc
sudo apt install libpam-dev
sudo apt install libcurl4-openssl-dev
sudo apt install libjson-c-dev

To install the PAM, simply run the build script:

./build_pam.sh

Finally, you can enable the PAM for a Linux service such as sudo. For sudo, modify the /etc/pam.d/sudo file and add the following line:

account  required   sgnl_pam.so

After you save your sudo PAM configuration, the operating system will now call the SGNL PAM and consequently the SGNL Access Service API to authorize the user based on SGNL policy. To disable the PAM, simply edit the sudo file and remove/comment the line that refers to the sgnl_pam.so module.

At this point, it’s likely that all decisions will either be Allow or Deny, based on the Default Decision you’ve selected for the Linux Integration - if that’s the case, you’re ready to start assigning policies to be applied to Linux

Assigning Policies

  1. Once the Integration is created, you can start assigning versions of Policies to the integration - to get started, select Policies from the tabs in your newly created integration

    SGNL - Policies

  2. Select ‘Assign Policies’

  3. Select:

    • The Policies you want to apply to the integration with the check box
    • The version of the Policy you want applied

    SGNL - Select Policies

  4. Click Next once you have the Policies and Versions configured as is appropriate

  5. Select the Enforcement mode for the Policies you chose in the previous step

    • Simulated: Policy Versions that are being simulated will only log their access decision in the SGNL logs and will not impact the access decision that SGNL hands back to an integration. Simulated policies are useful for performing what-if analysis of new policy versions as well as debugging policy changes.

      Note: It’s considered best practice to start with policies in Simulated mode, to verify that policies have been created an applied as expected

    • Enforced: Policy Versions that are being enforced will impact the access decisions that SGNL hands back to an integration. Enforced Policies will determine access for an integration

    SGNL - Set Enforcement

  6. Select your desired Enforcement mode and select Assign

  7. Versions of Policies will now be Assigned to your integration

    SGNL - Policy Assignments