topic Re: runas command and user-id monitoring in General Topics

runas command and user-id monitoring

Sec101 — Wed, 20 Feb 2019 17:18:37 GMT

How are you guys managing the "runas" command alongside user-id. In our test environment, I'm finding with the user-id windows agent, you get the last login event from the domain controller, with the new "runas" user. Once that times out- no more internet access to the original user, unless you generate an authentication event to the domain controller again. However, with global protect, if I "runas" a new user- globalprotect (internal only- no tunnel) will NOT update the firewall with the latest user for that program, so the "runas" user, has the rights that the initial user has, per the firewall "show user ip user mapping". Have you locked this down through other means, such as group policy-etc? Any insights into this? I'm guessing there is no priority order for a user-id agent vs. global protect agent? The firewalls user ip user mapping only appears to care about the last login/network interface change that it's seen?

Re: runas command and user-id monitoring

Raido_Rattameister — Wed, 20 Feb 2019 17:47:43 GMT

What is your goal? What do you want to accomplish?

Re: runas command and user-id monitoring

Sec101 — Wed, 20 Feb 2019 17:52:25 GMT

How do you accuratley follow/map/update a user based upon the user that is actively traversing the firewall from an endpoint? It appears that the "runas" command has the ability to break this mapping.

Re: runas command and user-id monitoring

Raido_Rattameister — Wed, 20 Feb 2019 18:07:01 GMT

Regular users don't run runas usually.

If this is concern then GlobalProtect will overcome this issue as user is identified by account who's credentials were used to log into vpn.

If user knows credentials of other users then (s)he can update GlobalProtect login and still gain access to resources of other person.

Re: runas command and user-id monitoring

Brandon_Wertz — Wed, 20 Feb 2019 19:32:00 GMT

@Sec101 wrote:

I'm guessing there is no priority order for a user-id agent vs. global protect agent? The firewalls user ip user mapping only appears to care about the last login/network interface change that it's seen?

Correct, it's the most recent update source.

Like @Raido_Rattameister posted, I think if we understand more about what you're trying to accomplish we can more accurate info on what we've seen work.