Interesting feedback, thanks for sharing your experience.Concerning the length of the password to connect to the vault, we support 28 characters as specified in the Cyber-Ark documentation.When you view or edit the authentication vault record, the password is replaced by 8 "obfuscating" dots, not matter the size of the real password. So you should not worry, the 14 characters password is correctly saved.
Concerning the length of the password to connect to the vault, we support 28 characters as specified in the Cyber-Ark documentation.
When you view or edit the authentication vault record, the password is replaced by 8 "obfuscating" dots, not matter the size of the real password. So you should not worry, the 14 characters password is correctly saved.
Concerning the other issue, you need to check multiple points (no specific order - I am pretty sure you already did a lot):
- Network connectivity between the scanner appliance and the vault
- Privileges of the cyber-ark. This user needs right to get the password in the specified vault/safe
- Make sure that your Cyber-Ark installation is ready to accept external API calls from a third party solution like the Qualys scanner appliance. I would recommend to reach out to a Cyber-Ark representative to check this point.
Last, the authentication record doesn't contain the safe name a in the current QualysGuard version. We did that on purpose based on user feedback and the way they use their cyber-Ark EPV. But this is something we will consider as a future change.
There may be several reasons for the failure:
1. QG does not pick up this new authentication record for your scan or, ip/username/password is not correctly set;
2. Scanner may not have access to the Safe. For example, scanner is not in safe's authorized area;
3. Your Vault account may not be the owner of the safe where password file resides; you have to manually add the safe to the account after you create it;
4. You may not uncheck the “User Must Change Password at Next Logon” check box, when you first create the account;
5. Your Vault account may not have “Retrieve files from safe” privilege for the particular safe, you have to manually grant the privilege to the new created account.
If you can, please check your scan result. In information gathered section, you should see “Unix|Windows Authentication Failed” entry, in case you were scanning windows or unix targets. The error message can help us narrow the problem down. The message looks like:
Error Message: Vault:,*.*.*.* Port:****, Safe:***, Error:Errorwhileloggingonwithlogonfile./.cyberark-auth-23731-23930.ini(Code:9, Error:ITATS203EPasswordhasexpired.)Authentication RecordCyber-Ark
For the password truncation issue, I didn’t see it in my scan. My Vault account has 10 characters password and I can use it to have a successful authentication scan.
Working with representatives from Qualys, Cyber-Ark and Williams revealed that the Qualys Vault User had to be setup with the following parameters in order to successfully connect to the vault:
Vault User Parameters:
Authorized Interfaces: AIMAPP,PAPI
User Auth method: CyberArk
Additionally, the following Safe Permissions had to be set in order to allow Qualys to perform its standard scan with the retrieved password:
Safe Permissions: List Files, Retrieve Files, View Audit, Use Password.
Once these changes were made, QualysGuard was able to retrieve a Windows local admin password from the Cyber-Ark Vault and successfully perform a standard authenticated scan.