Skip navigation
6704 Views 5 Replies Latest reply: Nov 4, 2010 4:03 PM by Eric Perraudeau RSS
Jodi Pruitt Level 1 11 posts since
Oct 11, 2010
Currently Being Moderated

Oct 29, 2010 12:46 PM

Authentication Vault Issues

Help!  We use CyberArk at our company.  I have added a vault (which my CyberArk admin tells me is actually a safe in CyberArk terms - a vault is the physical (or virtual) server, a safe is a logical area with distinct security rules applied to it within the vault server.)

 

First, we added an account to CyberArk for Qualys to access the safe and gave that account a 14 character password.

 

Then I created the Authentication Vault (Safe) in Qualys with that account and password.  (The first problem I encountered was that the 14 character password appeared to reset to an 8 character password no matter how many times I saved.)

 

I also added an authentication record to call a specific account from that safe with the IP address of my test machine.

 

Then I tried to do an authenticated scan (using an option profile called 'authenticated internal scan" that I had created previously).  The authentication failed and CyberArk did not log an access attempt to the safe.


Then we tried changing the password on the safe to an 8 character password thinking that it was truncating part of the 14 character one and retried the same steps, but still authenticaiton failed and no logon attempt was logged on the CyberArk Safe.

 

 

What am I doing wrong?

    • Eric Perraudeau Level 4 273 posts since
      Jul 15, 2010
      Currently Being Moderated
      Oct 29, 2010 4:22 PM (in response to Jodi Pruitt)
      Re: Authentication Vault Issues

      Hello Jodi,

       

      Interesting feedback, thanks for sharing your experience.

       

      Concerning the length of the password to connect to the vault, we support 28 characters as specified in the Cyber-Ark documentation.
      When you view or edit the authentication vault record, the password is replaced by 8 "obfuscating" dots, not matter the size of the real password. So you should not worry, the 14 characters password is correctly saved.

      Concerning the length of the password to connect to the vault, we support 28 characters as specified in the Cyber-Ark documentation.

      When you view or edit the authentication vault record, the password is replaced by 8 "obfuscating" dots, not matter the size of the real password. So you should not worry, the 14 characters password is correctly saved.

       

      Concerning the other issue, you need to check multiple points (no specific order - I am pretty sure you already did a lot):

      • Network connectivity between the scanner appliance and the vault
      • Privileges of the cyber-ark. This user needs right to get the password in the specified vault/safe
      • Make sure that your Cyber-Ark installation is ready to accept external API calls from a third party solution like the Qualys scanner appliance. I would recommend to reach out to a Cyber-Ark representative to check this point.

       

      Last, the authentication record doesn't contain the safe name  a in the current QualysGuard version. We did that on purpose based on user feedback and the way they use their cyber-Ark EPV. But this is something we will consider as a future change.

       

      Thanks,

      Eric

    • czhao Level 1 1 posts since
      Jul 23, 2010
      Currently Being Moderated
      Oct 29, 2010 5:30 PM (in response to Jodi Pruitt)
      Re: Authentication Vault Issues

      Hi Jodi,

       

      There may be several reasons for the failure:

        1. QG does not pick up this new authentication record for your scan or, ip/username/password is not correctly set;

        2. Scanner may not have access to the Safe. For example, scanner is not in safe's authorized area;

        3. Your Vault account may not be the owner of the safe where password file resides; you have to manually add the safe to the account after you create it;

        4. You may not uncheck the “User Must Change Password at Next Logon” check box, when you first create the account;

        5. Your Vault account may not have “Retrieve files from safe” privilege for the particular safe, you have to manually grant the privilege to the new created account.

       

      If you can, please check your scan result. In information gathered section, you should see “Unix|Windows Authentication Failed” entry, in case you were scanning windows or unix targets. The error message can help us narrow the problem down. The message looks like:

       

      Error Message: Vault:,*.*.*.* Port:****, Safe:***, Error:Errorwhileloggingonwithlogonfile./.cyberark-auth-23731-23930.ini(Code:9, Error:ITATS203EPasswordhasexpired.)Authentication RecordCyber-Ark

       

       

      For the password truncation issue, I didn’t see it in my scan. My Vault account has 10 characters password and I can use it to have a successful authentication scan.

       

      Thanks

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 6 points