Help! We use CyberArk at our company. I have added a vault (which my CyberArk admin tells me is actually a safe in CyberArk terms - a vault is the physical (or virtual) server, a safe is a logical area with distinct security rules applied to it within the vault server.)
First, we added an account to CyberArk for Qualys to access the safe and gave that account a 14 character password.
Then I created the Authentication Vault (Safe) in Qualys with that account and password. (The first problem I encountered was that the 14 character password appeared to reset to an 8 character password no matter how many times I saved.)
I also added an authentication record to call a specific account from that safe with the IP address of my test machine.
Then I tried to do an authenticated scan (using an option profile called 'authenticated internal scan" that I had created previously). The authentication failed and CyberArk did not log an access attempt to the safe.
Then we tried changing the password on the safe to an 8 character password thinking that it was truncating part of the 14 character one and retried the same steps, but still authenticaiton failed and no logon attempt was logged on the CyberArk Safe.
What am I doing wrong?
Interesting feedback, thanks for sharing your experience.
Concerning the length of the password to connect to the vault, we support 28 characters as specified in the Cyber-Ark documentation.
When you view or edit the authentication vault record, the password is replaced by 8 "obfuscating" dots, not matter the size of the real password. So you should not worry, the 14 characters password is correctly saved.
Concerning the other issue, you need to check multiple points (no specific order - I am pretty sure you already did a lot):
Last, the authentication record doesn't contain the safe name a in the current QualysGuard version. We did that on purpose based on user feedback and the way they use their cyber-Ark EPV. But this is something we will consider as a future change.
There may be several reasons for the failure:
1. QG does not pick up this new authentication record for your scan or, ip/username/password is not correctly set;
2. Scanner may not have access to the Safe. For example, scanner is not in safe's authorized area;
3. Your Vault account may not be the owner of the safe where password file resides; you have to manually add the safe to the account after you create it;
4. You may not uncheck the “User Must Change Password at Next Logon” check box, when you first create the account;
5. Your Vault account may not have “Retrieve files from safe” privilege for the particular safe, you have to manually grant the privilege to the new created account.
If you can, please check your scan result. In information gathered section, you should see “Unix|Windows Authentication Failed” entry, in case you were scanning windows or unix targets. The error message can help us narrow the problem down. The message looks like:
Error Message: Vault:,*.*.*.* Port:****, Safe:***, Error:Errorwhileloggingonwithlogonfile./.cyberark-auth-23731-23930.ini(Code:9, Error:ITATS203EPasswordhasexpired.)Authentication RecordCyber-Ark
For the password truncation issue, I didn’t see it in my scan. My Vault account has 10 characters password and I can use it to have a successful authentication scan.
Working with representatives from Qualys, Cyber-Ark and Williams revealed that the Qualys Vault User had to be setup with the following parameters in order to successfully connect to the vault:
Vault User Parameters:
Authorized Interfaces: AIMAPP,PAPI
User Auth method: CyberArk
Additionally, the following Safe Permissions had to be set in order to allow Qualys to perform its standard scan with the retrieved password:
Safe Permissions: List Files, Retrieve Files, View Audit, Use Password.
Once these changes were made, QualysGuard was able to retrieve a Windows local admin password from the Cyber-Ark Vault and successfully perform a standard authenticated scan.