cyberark / psm Goto Github PK

View Code? Open in Web Editor NEW

16.0 5.0 12.0 177 KB

Ansible role to deploy Cyberark Privileged Session Manager

Home Page: https://www.cyberark.com/products/privileged-account-security-solution/privileged-session-manager/

License: Other

PowerShell 100.00%

ansible-role cyberark automation conjbot-skip-stalepr

psm's Introduction

PSM Ansible Role

This Ansible Role will deploy and install CyberArk Privileged Session Manager including the pre-requisites, application, hardening and connect to an existing Vault environment.

Requirements

Windows 2016 installed on the remote host
WinRM open on port 5986 (not 5985) on the remote host
Pywinrm is installed on the workstation running the playbook
The workstation running the playbook must have network connectivity to the remote host
The remote host must have Network connectivity to the CyberArk vault and the repository server
- 443 port outbound
- 1858 port outbound
Administrator access to the remote host
PSM CD image

Flow Variables

Variable	Required	Default	Comments
psm_prerequisites	no	false	Install PSM pre requisites
psm_install	no	false	Install PSM
psm_postinstall	no	false	PSM post install role
psm_hardening	no	false	Apply PSM hardening
psm_registration	no	false	Connect PSM to the Vault
psm_clean	no	false	N/A

Deployment Variables

Variable	Required	Default	Comments
vault_ip	yes	None	Vault IP to perform registration
vault_port	no	1858	Vault port
vault_username	no	administrator	Vault username to perform registration
vault_password	yes	None	Vault password to perform registration
secure_vault_password	no	None	Secure Vault password to perform registration
dr_vault_ip	no	None	Vault DR IP address to perform registration
accept_eula	yes	No	Accepting EULA condition (Yes/No)
psm_zip_file_path	yes	None	CyberArk PSM installation Zip file package path
connect_with_rdp	yes	No	Disable NLA on the server
psm_installation_drive	no	C:	Destination installation drive
psm_out_of_domain	no	false	Flag to determine if server is out of domain

Dependencies

None

Usage

The role consists of a number of different tasks which can be enabled or disabled for the particular run.

psm_prerequisites

This task will run the PSM pre-requisites steps.

psm_install

This task will deploy the PSM to required folder and validate successful deployment.

psm_postinstall

This task will run the PSM post installation steps.

psm_hardening

This task will run the PSM hardening process.

psm_registration

This task will perform registration with active Vault.

psm_validateparameters

This task will validate which PSM steps have already occurred on the server to prevent repetition.

psm_clean

This task will clean the configuration (inf) files from the installation, delete the PSM installation logs from the Temp folder and delete the cred files.

Example Playbook

Below is an example of how you can incorporate this role into an Ansible playbook to call the PSM role with several parameters:

---
- include_role:
    name: psm
  vars:
    - psm_prerequisites: true
    - psm_install: true
    - psm_postinstall: true
    - psm_hardening: true
    - ps_clean: true

Running the playbook:

For an example of how to incorporate this role into a complete playbook, please see the pas-orchestrator example.

License

Apache License, Version 2.0

psm's People

Contributors

Stargazers

Watchers

Forkers

rkamisetti792 anusorn mfreshmen laashub-soa ekmixon luis-maeda bab29 junhong0902 drerik elvenspellmaker smialkowskim

psm's Issues

Upgrade option

Please include an option to upgrade components to newer versions. If this is in progress, is there a rough ETA you could give?

Hi,
during the manual install of PSM in version 12.1 it is possible to set the name of the users that will connect to the vault, and so the name of the PSM registered.
Is it possible to add this setting in the xml config file used in psm_install.yml ?
Regards,

PSM service name variable is wrong - Correct name is cyber-ark privileged session manager.

Describe the bug
The psm_service_name variable in defaults>main.yml is incorrect, which causes automation to stop mid-way. The PSM service name should be cyber-ark privileged session manager, NOT cyberark privileged session manager.

To Reproduce
Steps to reproduce the behavior:

run PSM automation
psm software is installed, sets the psm_exists variable, however since the service name is spelled wrong, it stops here. As the psm service name doesn't match whats in the playbook.3.

Expected behavior
Using the correct PSM service name allows the PSM install pb to move on/work correctly.

Screenshots
n/a

Environment(please complete the following information):

Ansible version - n/a
Deployment environment - on-prem, but would impact all.
Version [e.g. 22] - v12.6 PSM installs

Additional context
If the PSM service name changes in newer PSM versions, maybe the pb can be adjusted to check for either service naming, old or new.

Hardening and Registration fails due to new PowerShell Security-Features

Describe the bug

Step: convert to securestring fails with ConvertFrom-SecureString : Access is denied.
Step: Run PSM registration fails with ConvertTo-SecureString : Key not valid for use in specified state.
Step: Run PSM hardening fails with ... some steps failed: AppLocker

To Reproduce
Run psm role on Windows Server 2019 with latest Patches installed.

Expected behavior
No error, successful PSM-Installation.

Additional context
After some googling I think the issue is related to those commands requiring a "user"-session:
https://www.reddit.com/r/PowerShell/comments/jafyin/convertfromsecurestring_in_pssession_results_in/

I got the automation working by adding become (https://docs.ansible.com/ansible/latest/user_guide/become.html) to those 3 steps:

    - name: Run PSM hardening
      become: yes
      become_method: runas
      become_user: Administrator
      win_shell: |
        ...

Hardening issues on PSM in secure environment

PSM Hardening fails when setting ACLs on the C drive, I was able to get around this by making it a non terminating error by altering the code in C:\program files (x86)\CyberArk\PSM\hardening\psmhardening.ps1, replacing "cacls $path /E /R $account" with "cacls $path /E /R $account /C"

Hardening got past the terminating error, but would sometimes turn off the services netlogin and workstation services on the PSMit was running against, which would cause login and remoting issues until discovered and turned back on.

The environment is Airgapped Windows 2016 servers.