Balabit SCB - privileged session control with Shell Control Box

In 2017 the management infrastructure of the organisation needed one controlled way in for everybody who administered it: the organisation's own operators and the engineers of several partner companies, connecting from their VPNs to jump servers in the management LAN and to out-of-band jump servers in remote sites. I designed and built that way in with Balabit Shell Control Box (SCB) 5 LTS: a high-availability pair of SCB T-10 appliances in site 1, one in each datacenter, later a second pair in site 2. The SCB stands between the client and the jump server, terminates SSH, SCP, SFTP and RDP on both sides, lets through only the channels a policy allows, and records every session into an audit trail that is encrypted, timestamped and signed, so that what an administrator did can be replayed later and cannot be altered.

This Solution is that work, written up from my design document of the site 1 cluster (its configuration chapter shows the settings as they were made in production), the end-user access guide, the connection summary, the network sheets, a pre-design analysis, my working notes on certificates, LDAP and the open questions, the operation and troubleshooting notes with the answers of the vendor's support, and a support bundle of the site 2 cluster that holds its exported configuration. The site 2 cluster has no design document of its own; it is described from that export and from the sheets, and where it differs from site 1 the documents say so.

The system in one picture

flowchart LR
  subgraph users["Users on their VPNs"]
    org["ORG operators"]
    prt["Partner engineers"]
    adm["SCB administrators"]
  end
  subgraph site1["Site 1, management LAN"]
    subgraph scb["SCB cluster dc1-s-xblb001"]
      n1["dc1-a-ablb001, datacenter A"]
      n2["dc1-b-ablb001, datacenter B"]
    end
    jmp["Jump servers SSH, RDP, SCP"]
    ad["Active Directory"]
    nas["NetApp NFS"]
    svc["DNS, NTP, mail, syslog, Sensu"]
  end
  oob["Out-of-band jump servers, sites 1 to 5, over IPv6"]
  org -- "SSH, RDP, SCP to 10.11.16.65" --> scb
  prt -- "SSH, RDP, SCP to 10.11.16.65" --> scb
  adm -- "HTTPS, SSH to 10.11.16.81" --> scb
  n1 -- "DRBD and heartbeat" --- n2
  scb -- "recorded sessions" --> jmp
  scb -- "recorded sessions" --> oob
  scb -- "LDAPS" --> ad
  scb -- "backups and archives" --> nas
  scb --> svc

The fictional environment

Every Article and every Config document uses the same names and addresses.

The address plan is the one of the NetApp and Email Solutions; the NetApp Solution describes the storage end of the SCB's backups. The other private ranges of the original plan are 10.19.x, public addresses come from 198.51.100.0/24, and the remote sites' IPv6 ranges are in 2001:db8::/32.

Articles

Read in this order.

Configuration

Each document holds one answer set, one file, one command set or one listing as it was configured or used, with comments and a check against the current release. The appliance is configured in its web interface, so most documents are answer sets: one line Page / Field = value per setting, transcribed from the configuration chapter of the design document. The site 2 documents are elements of its exported config.xml.

Design and connections

Network and hardware

High availability and IPMI

Basic settings, logging and monitoring

Active Directory and access control

Certificates and keys

Audit, backup and archive

Connection and channel policies

End-user access and operations