Skip to main content
Version: 3.23

Technical Specification

Introduction

senhasegura is a security platform composed of software, operating system and hardware. This modularized platform meets the most stringent security standards in the industry.

In this document we will cover the main technical aspects of senhasegura .

System Modules Architecture

The senhasegura software solution is divided into the following modules:

Modules Architecture

These components support the operation of the senhasegura , from the physical layer to the application layer.

  • Business layer: where all senhasegura features are located, from integrations to activity recording

  • Application Server layer: where Orbini is located, MT4 developed framework to support all solution features

  • Virtual Appliance: virtual device where the solution is executed

  • Appliance layer: senhasegura hardware solution

Basic Systems Solution Components

In addition to the modules presented, the solution has basic embedded software components integrated into the solution itself, without the need for external resources:

  1. Optimized and hardenized over all aspects (Application, Data Base, File System, etc) Linux-based operating system. The system has only the minimum services running, obeying the Minimum Privilege Principle, and kernel adapted to the functionality of the solution.

  2. Own database, no license required

  3. Own and integrated web server

  4. Embedded web interface, no licenses or additional features to use. With just a single network configuration interface, it is already possible for the deployer to have access to the HTTPS web interface so that all other configurations can be performed in a secure and user-friendly graphical environment.

Ports

On virtual and physical appliances senhasegura , only service ports are released:

Protocol/PortFunction
TCP/22SSH Server
TCP/80Web Server with redirection to port 443
TCP/443Web Application Server
UDP/161SNMP
UDP/162SNMP
TCP/3389RDP Proxy
TCP/3306Database cluster
TCP/4444Database cluster
TCP/4567Database cluster
TCP/4568Database cluster
UDP/4567Database cluster

Language

info

Beta language users may encounter misspellings, typos, and words in another language like English. Translation errors can be reported via Support PAM Solution.

The solution has all interfaces in the following languages:

  1. Brazilian Portuguese (PT-BR)

  2. United States English (EN-US)

  3. Germany (DE) [BETA]

  4. Spanish (ES)

  5. Polish (PL) [BETA]

  6. French (FR) [BETA]

  7. Russian (RU) [BETA]

The solution allow user input and storage using UTF-8 charset:

  1. Arabic

  2. Arabic Extended-A

  3. Arabic Extended-B

  4. Arabic Mathematical Alphabetic Symbols

  5. Arabic Presentation Forms-A

  6. Arabic Presentation Forms-B

  7. Arabic Supplement

  8. Basic Latin

  9. Bopomofo Extended

  10. CJK Compatibility

  11. CJK Strokes

  12. CJK Symbols and Punctuation

  13. CJK Unified Ideographs

  14. CJK Unified Ideographs

  15. CJK Unified Ideographs Extension B

  16. CJK Unified Ideographs Extension C

  17. CJK Unified Ideographs Extension D

  18. CJK Unified Ideographs Extension E

  19. CJK Unified Ideographs Extension F

  20. Cyrillic

  21. Cyrillic Supplement

  22. Enclosed CJK Letters a

  23. French

  24. Hangul Compatibility J

  25. Hebrew

  26. Hiragana

  27. Kanbun

  28. Katakana

  29. Katakana Phonetic Exte

  30. Latin Extended-A

  31. Latin-1 Supplement

  32. Syriac

  33. Syriac Supplement

  34. Russian

  35. Yijing Hexagram Symbol

Language support

Russian:

  • Support for typing and persistence in the target language in the web interface
  • Support for typing and persistence in target language in RDP proxy interface
  • Support for typing and persistence in target language in Terminal proxy interface
  • Session text indexing (OCR) support
  • Keyboard layout
  • Translation of the web interface
  • Translation of the Terminal proxy system
  • Web proxy system translation

Spanish:

  • Support for typing and persistence in the target language in the web interface
  • Support for typing and persistence in target language in RDP proxy interface
  • Support for typing and persistence in target language in Terminal proxy interface
  • Session text indexing (OCR) support
  • Keyboard layout
  • Translation of the web interface
  • Translation of the Terminal proxy system
  • Web proxy system translation

Manuals

The solution has user manuals in the following languages:

  1. Brazilian Portuguese (PT-BR)

  2. United States English (EN-US)

  3. Spanish (ES-ES)

  4. Russian (RU-RU)

Compatibility ISO 27001, PCI, SOX, GDPR, PQO BM&F

senhasegura enables organizations to deploy the most stringent and complex privileged credential access controls required by standards such as ISO 27001, PCI, SOX, GDPR and PQO by automating privileged access controls, protecting the IT park from data breaches and potential compliance violations.

Hardening

Hardening reduces the attack surface on a system by changing default passwords, removing unnecessary software, removing unuseful users or logins, and disabling or removing unnecessary services.

senhasegura uses a series of hardening processes at different levels of application and its components, recognized by the security market to mitigate attempted attacks.

Among other models, senhasegura uses hardening processes indicated by the organizations NIST (National Institute of Standards and Technology) and CIS (Centro de Internet Security, Inc.).

The hardening process is periodically reviewed with each new release of the solution so that it is always in compliance with the best practices and the main security processes adopted by the market.

Component Update

senhasegura Research and Development team is aligned with updates to the third party components that make up the solution. The process of updating these components is done through a fast communication channel, and is performed on customers if a critical demand is released.

The tool update process is aligned with the client's own update policy. In this case, a team will be deployed to fulfill the installation flow with the least risk of impact to the customer's business.

Functional Feature by Modules

caution

The senhasegura do not allow the installation of other softwares.

Base Module - System Access Settings

This module has the following functions:

  • senhasegura Authentication: senhasegura has its own authentication module with functionality that: Implies in user blocking after a determined amount of unsuccessful login attempts. Change the password in the first login, validation of the complexity of the new password created with comparison of the history of passwords used.

  • User Registration: Complete user registration with change and configuration traceability.

  • Profile Management: Advanced granular profile management with ability to create according to each user profile.

  • Screen's Log: System screen view log.

  • Screen Identification by codes: Each system screen is uniquely identified with a code, making service and support easy.

  • External Authentication Servers: In addition to its own authentication module, senhasegura can be used in conjunction with other directory services. You can set up senhasegura to perform authentication across multiple servers, including establishing an authentication order. The main authentication servers that integrate with senhasegura are Active Directory, LDAP, TACACS and RADIUS.

  • Two Factor Authentication: You can reinforce the authentication process through Multi-factor authentication using, for example, the Google Authenticator application.

  • IP Access Blocking: senhasegura is able to block access through a pre-established IP denylist.

  • Session Management: In the tool, the session management module is responsible for checking session validity and setting a timeout until the next login.

  • Authentication with A1 and A3 Certificates: The authentication process can be carried out using A1 and A3 certificates as the second authentication factor.

Base Module - Password and Information Vault

This module is the core of the password vault, and has the following functions:

  • Password Guard: Storage of passwords in the vault, encrypted in AES 256 algorithm with double encryption factor. Passwords can only be accessed in this module through the Access Management module.

  • Protected Information Guard: The password vault allows encrypted storage of information such as tokens, certificates and files in general.

  • Backup of Secrets: Passwords, protected information, and SSH keys require an independent backup unit in the solution.

    The information vault and passwords are responsible for writing the secrets to a backup encrypted by the Shamir algorithm-based master vault key.

  • HSM Integration: Integration with external or internal Hardware Security Module devices

Base Module - Equipment Register

This module is the password senhasegura interface with the assets that will have their passwords managed, and includes the following functions:

  • Registration Interface: Where the equipment registration occurs, either by web screen individually, or by the batch registration process.

  • Connector Management: Each device has ports for connection and protocol for access. This module manages the configured connections and communicates with the devices.

  • Connectivity Test: Periodically, senhasegura will connect to registered devices and validate their connectivity. Users can be alerted of test results.

  • Equipment Profile: Equipment types and models have default swap profiles and password templates in the tool. This module relates devices to these policies.

Base Module - Access to Information, Passwords, and Session Policies

The access policy module is the only one with access to the password and information vault, and has the following functions:

  • Access Workflow: The access workflow initiates an approval process for the delivery of the authenticated session or password. This process has different configurations and routes, depending on the client configurations.

  • Access Approvation: The access approval function allows the approving user to respond to the access request by:

    • User screen

    • E-mail

    • SMS

    • Emergency Access

  • Password Split: This function is responsible for breaking the password in two parts. for segmented delivery, and is relevant for PCI compliance.

  • Access Control: The access control module unifies the three entities considered in the decision to surrender the credential or access:

    • Delivery Policy

    • Involved Users

    • Related Equipment

    The joining of these entities defines the session delivery criteria in the system.

  • User Timing: The access control module can be synchronized with an authentication server. Users of a particular group on the authentication server are loaded into the senhasegura access groups, making access management easier.

Base Module - Reports

  • Reporting Configuration: Through the interface, the user can remove or add information to a particular report. You can create a whole new view of information that is useful to your needs.

  • Shipping Schedule: The reports you create can be set to automatically send to certain users.

  • PCI Reports: Set of specific reports to meet requirements required by PCI audits.

  • Audit Trails: senhasegura has reports with all relevant system events. Events can be exported to SIEM and Syslog.

Base Module - Dashboards

  • System Health: Responsible for graphically displaying the overview of senhasegura hardware and Virtual Machines. You can view data such as I / O, memory, and processing.

  • Process Monitoring: Monitors execution of key vault processes:

    • Password Changes

    • Access Group Synchronisms

    • Password Reconciliation

    • Connectivity Tests

    • Settings Backup

    • Password's backup

  • Business Monitoring: Monitors health for credential and information protection:

    • Number of Passwords changed x Failures

    • by period

    • Number of Sessions:

    • Active and Concurrent x System Average

    • Recorded (by period)

    • Average session time logged in

    • Users logged in to the system

Password Change Module

  • SSH Password Change: Make the connection and run the default password exchange script on the device using the SSH protocol, without the need for agents installed.

  • Windows Server: Windows Password Exchange connects to a Windows server and runs local password exchange scripts without the need for agents installed.

    Through the use of native Microsoft protocols (RPC, RM / WMI) senhasegura is able to interact with the device using commands from the protocols or through PowerShell commands if protocol support is enabled.

  • Network Asset: Make the connection and run the default password exchange script on the device using the SSH protocol, without the need for agents installed.

  • Desktop: Make the connection and execute the default exchange script for that password on that desktop using various desktop-based protocols.

  • Database: Make the connection and execute the default exchange script for that password in that database using the base protocol.

Password Reconciliation Module

Password reconciliations happen in the same way on servers, network assets, desktops and banks: Access to devices and accounts is periodically performed trying to authenticate with the last password in custody, validating whether custody remains under the password safe.

Windows Session Management Module

  • Session Delivery: Authenticated session delivery is performed without entering a username or password.

  • Session Recording: During access to the authenticated session, the system records the session in video and text.

  • MP4 Video Generation: Recorded video can be generated in mp4 format to be downloaded and uploaded.

  • Audited Proxy Support: Native audited proxy support for SSH and RDP connectivity of client applications installed on clients. For compatibility between manufacturers, all proxy modules use current encryption algorithms and native protocol.

Management Module - Linux Sessions

  • Linux Web Session Delivery: Authenticated session delivery is performed without entering a username or password

  • Web Session Recording: During access to the authenticated session, the system records the session in video and text.

  • MP4 Video Generation: Recorded video can be generated in mp4 format to be downloaded and uploaded.

  • Audited Proxy Support: Native audited proxy support for SSH and RDP connectivity of client applications installed on clients. For compatibility between manufacturers, all proxy modules use current encryption algorithms and native protocol.

SSH Gate Session Management Module - senhasegura Terminal Proxy

  • Linux Session Delivery via SSH Gate: Authenticated session delivery is performed without entering a username or password. This is done transparently to the user through any SSH client.

  • Web Session Recording: During access to the authenticated session, the system records the session in text.

  • Command Audit: All commands sent to the server through senhasegura , and can be audited and generated Command Execution alerts.

  • Privilege Control: It has granular control of commands that can be executed with the possibility of blocking those not authorized for execution to the user.

  • Audited Proxy Support: Native audited proxy support for SSH and RDP connectivity of client applications installed on clients. For compatibility between manufacturers, all proxy modules use current encryption algorithms and native protocol.

Management Module - HTTP Sessions

  • HTTP and HTTPS Session Delivery: Authenticated session delivery to a page is done without the need for a username or password.

  • Web Session Recording: During access to the authenticated session, the system records the video session.

  • MP4 Video Generation: Recorded video can be generated in mp4 format to be downloaded and uploaded.

Discovery Module

  • Windows Passwords: Discover administrative credentials on Microsoft platform servers and desktops, identifying which ones are privileged, and importing into the vault.

  • Linux / Unix / AIX Passwords: Discover administrative credentials on Linux / Unix / Aix servers and desktops, identifying which ones are privileged, and importing into the vault.

  • AD Passwords: Discover administrative credentials on the Microsoft platform Active Directory server, identifying which ones are privileged, and importing into the vault.

  • SQL / Oracle Passwords: Discover administrative credentials in databases, identifying which ones are privileged, and importing into the vault.

  • SSH Keys: Discovers public and private SSH keys that are present on the target device.

  • Certificates: Find local or Windows user certificates stored in devices, containers or on the domain.

  • Local Authorities: Find local authorities for the devices.

  • Services: Find out what services are being performed on the target device.

  • DevOps: Find DevOps artifacts that are present in the devices.

  • Glossary of Provisions: Allows to create scan list with segmentation by type

Module A2A - App to App

  • .Net: Password delivery via lib on .Net to be added to platform application code.

  • Java: Password delivery via passwords lib in Java to be added to platform application code.

  • PHP: Password delivery via passwords lib in PHP to be added to the platform application code.

  • Application Server: Password change in the main Application Servers of the market.

  • senhasegura API: Password delivery through the senhasegura API.

Module senhasegura.go

senhasegura.go allows you to invoke administrator privileges to run applications on local workstations. This module is based on .NET Framework for 4.8.

Supported Integrations

senhasegura has several types of integration, besides the possibility of configuring integration templates. The templates are open and can be modified by the administrator.

Performing integration may require specific plug-ins. Password architecture and integration features allow senhasegura to develop plug-ins quickly.

senhasegura is noninvasive. Therefore, no agent installation is required on the systems managed by the solution. For some applications it is possible to use senhasegura through agents to create more integration possibilities.

Operational System

VendorsModels
AppleOS X
CiscoCisco IOS, NX-OS (Nexus)
EMCUNIX
F5Big IP, LTM
HPHPUX, Tru64, NonStop (Tandem), Open VMS, HP5500, Tande
IBMAIX, iSeries, Z/OS, CICS, OS/390
LinuxFedora, Ubuntu, Red Hat, SUSE Linux, Debian
MicrosoftWindows XP, Windows Vista, Windows 7, Windows 8 / 8.1, Windows 10, Windows Server 2003, 2008, 2012, 2016
NetAppNetApp
OracleSolaris, Solaris Intel, Enterprise Linux
JuniperJUNOS

Network Equipment

VendorsModels
3ComSwitches
A10 NetworksA10
AdtranNetVanta 838, Tracer 6420
AlcatelSwitches, Switches (Omniswitch 7000 Series), Intelligent Services Access Manager (ISAM)
AllotAllot Secure Service Gateway, Allot Service Gateway, Allot SmartEngage, Allot WebSafe Personal
Applied InnovationAISCOUT-S02
Aruba NetworksArubaOS
AvayaMedia Gateway
AvocentDSView management
BlueCoatPacketShaper
BrocadeSilkworm
BTI Photonic SystemsNETSTENDER 1030
CiscoRouters, ACS (Access Control Server), Switches Catalyst, Switches Nexus, JMC, Wireless LAN Controller 5508, WAAS, ONS, ESA (Email Security Appliance), Privilege 15, Unified Communication Manager, ISE (Identity Services Engine), UCS (Unified Computing System)
CitrixNetscaler
DellSwitches
EnterasysRouters, Switches
EricssonServiceOn Element Manager (SOME)
F5BigIP, LTM
FujitsuFSC iRMC
GemaltoSafeNet KeySecure, SafeNet HSM
HPProCurve, HPE 5500
HuaweiS1720, S2700, S5700, S6720, S6720 V200R011C10
JuniperRouters (JUNOS), Pulse secure
McafeenDLP
MeinbergLantime
NetscoutInfinistream
NokiaNetAct, DX200
NortelBayStack, VPN Router, Ethernet Routing Switch
RadwareISR Infiniband Switch, ODS1 Load Balancer, Alteon, Linkproof
RadwareISR Infiniband Switch, ODS1 Load Balancer, Alteon, Linkproof
RFL ElectronicsIMUX 2000
RiverbedCMI, Xilinx
RuggedComRouters, Switches
SymmetricomSymmetricom Xli
VoltaireISR Infiniband Switch
Extreme NetworksSwitch, Router
YamahaRTX

Applications Servers

VendorsModels
Red HatJboss
KasperskyKaspersky Endpoint Security for Business
MicrosoftSQL Server, Exchange Server 2007 - 2019, entre outras aplicações que permitam interatividade via RemoteApp, Windows RPC e Windows RM
VeritasNetBackup 7.7, 8.0, 8.1 e 8.2
IBMWebsphere Application Server, Websphere Datapower
Apache FoundationApache HTTP Server, Apache tomcat
OracleWebLogic Server, Peoplesoft, Oracle Application Server
MicrosoftIIS

Security Devices (Firewall, UTMs, IPSs)

VendorsModels
Acme PacketNet-Net OS-E
AkerAker Firewall UTM
Blue CoatProxy SG
CheckpointFireWall-1, SPLAT, Provider-1, GAIA
Cisco SystemsPIX, ASA, IronPort, Mail Gateway
Critical PathMemova Anti-Abuse
FortinetFortiGate, Fortimanager
IBMDataPower Integration Appliance
JuniperNetscreen
McafeeNSM (Network Security Manager), SideWinder, ePO
NokiaCheckpoint FireWall -1 on IPSO
Palo Alto Networks®Panorama
ProofPointProtection Server
RSAAuthentication Manager (SecurID)
SafenetLuna HSM
SchneiderIndustrial Defender
SonicWallFirewalls
SophosAstaro Security Gateway
SourceFireSourceFire 3D
SymantecBrightmail Gateway
TippingPointIPS, SMS
WatchGuardFirebox X Edge e-series, Firebox X Core e-series, Firebox X Peak e-series, WatchGuard XTM

Virtualization Environments

VendorsModels
VMwareESX/ESXi Server
CitrixXen Citrix
MicrosoftHyper-V, Azure
GoogleGoogle Cloud Platform (GCP)
AmazonAmazon Web Services (AWS)
RackspaceRackspace Cloud, GoGrid
IBMIBM SmartCloud
GenericISO installation media

Database

VendorsModels
IBMDB2, Informix, Datastage
InterSystemsCaché Release 2010 - 2017 (and other supported ODBC versions connected to devices with supported connectivity)
MicrosoftSQL Server
MongoDBMongoDB
MySQLMySQL
ODBCODBC compatible databases
OracleOracle Database, Oracle Enterprise Manage, RDBMS, Mysql 4 - 8, Oracle RAC
PostgresqlPostgresql 6 - 11
SAPHANA
SybaseSybase Database, IQ

Storages

VendorsModels
DellDell EMC PowerMax 2000, Dell EMC PowerMax 8000, Dell EMC SC5020, Dell EMC SC5020F, Dell EMC SC7020, Dell EMC SC7020F, Dell EMC SC9000 , Dell EMC SCv3000, Dell EMC Unity XT 380F, Dell EMC Unity XT 480F, Dell EMC Unity XT 680F, Dell EMC Unity XT 880F, Dell EMC XtremIO X2, Dell PowerVault, Dell EMC Isilon, Dell EMC VMAX Among other models compatible with supported connections.
IBMStorwize V7000 Gen 3 ”Next Gen”, Storwize V7000 Gen 2+, Storwize V7000 Gen 2, Storwize V7000 family, Storwize V5100E, Storwize V5030E, Storwize V5010E, Storwize V5030, Storwize V5020, Storwize V5010, Storwize V5000
HuaweiOceanStor 18000F V5, OceanStor 5300 V3, OceanStor 5300F, OceanStor 5500 V3, OceanStor 5500F, OceanStor 5600 V3, OceanStor 5600F , OceanStor 5800 V3, OceanStor 5800F V5, OceanStor 6800 V3, OceanStor 6800F V5 Among other models compatible with supported connections
NetAppNetApp ONTAP (BSD)
Pure StorageFile Storage

Windows applications

VendorsModels
MicrosoftApplications developed under Java, .Net, PHP, Phyton, SQL accounts, Windows scheduled tasks, Windows services, Apache applications, IIS applications, COM+ services, Clustered applications

Directory Systems

VendorsModels
DigiDigi Remote Manager
FujitsuiRMC
MicrosoftActiveDirectory
NovellNovell Directory Services (NDS)
SunJava System Directory Server
OracleODI Oracle

Remote Access and Monitoring

VendorsModels
AmazonAmazon Web Services (AWS)
DellDell Remote Access Card (DRAC)
HPStorageWorks, iLO

DevOps environment, VSC and others SDLC softwares

VendorsModels
AnsibleAnsible
AtlassianBamboo CI/CD, JIRA Core, Bitbucket
GitLab Inc.GitLab CI/CD
GoogleKubernetes
JenkinsJenkins CI/CD

ITSM Tools

VendorsModels
AtlassianJira Service Desk
ZendeskZendesk
FreshworksFreshdesk
ServiceNowServiceNow ITSM

TOTP Tools

senhasegura MFA function works with any Time-based One-Time Password (TOTP) tool. Here you can see some options:

VendorsModels
GoogleGoogle Authenticator
MicrosoftMicrosoft Authenticator
AuthyTwilio Authy 2-Factor Authentication
Red HatFreeOTP Authenticator
SophosSophos Authenticator
LastPassLastPass Authenticator
andOTPandOTP

Integration Plugins

IntegrationFunction
JenkinsAllows the consultation of secrets in the senhasegura

SIEM Solutions

VendorModel
ExabeamVersion i31 onwards.
IBM QRadarVersion 7.3 onwards.
LogRhythmVersion 7.4 onwards.
Rapid7 - InsightIDRVersion 20180814 onwards.
Rapid7 - InsightOpsVersion 20190204 onwards.
SecuronixVersion 6.3 onwards.
SplunkVersion 6.3 onwards.

SSO solutions

VendorModel
OktaLifecycle Management
RSARSA SecurID
DuoDuo Multi-factor Authentication

Authentication Integrations

Here are the available SSO and MFA integration tools.

SSO

ToolProtocolIntegration
Active DirectoryLDAPComplete
Azure ADSAML 2.0Complete
ForgeRockSAML 2.0Complete
GoogleOpenIDComplete
KeycloakOpenID SAML 2.0Complete
OktaOpenID SAML 2.0Complete

MFA

ToolProtocolIntegration
DuoTOTP OpenIDComplete
EmailTOTPPartial
Google AuthenticatorTOTPComplete
Microsoft AuthenticatorTOTPComplete
OktaTOTP OpenIDPartial
RSAComplete
SmartCardsA3 x.509Partial
SMSTOTPPartial
Symantec VIPTOTPComplete
TokensA3 x.509Partial

Embedded browser version

ToolVersion
Firefox78.13.0esr (64-bit)

Encryption and Security Features

Encryption

All sensitive information provided is stored encrypted in the solution database using the AES-256 cipher.

For authentication to the senhasegura web interface - both locally and via external authentication servers - all user passwords are stored in SHA-256 hash format. The communication between the client workstation and the senhasegura is made through encrypted communication respecting the encryption standards of the protocols used. Independent of the communication channel, be it RDP, SSH or HTTPS.

Likewise, access to remote target devices respects the same encryption standard in all protocols that allow configuration.

HSM Encryption

For companies that need a higher level of security, you can opt for the Hardware Secure Module (HSM), a hardware security and encryption device with military specification and tamper-evident standards.

HSM Technical Specifications
  • Encryption

  • RSA (PKCS #1 V2.1) (1024, 2048, 4096 bits)

  • ECDSA (NIST FIPS PUB 186-3)

  • FIPS 197 AES 128, 192, 256

  • FIPS 46-3 DES/3DES

  • Supports certificates x509v3

  • Supports import and internal key generation

  • Random Number Generator

  • Internal, hardware based

  • Meets AIS31 P2 standard

  • Real time clock (RTC)

  • Internal, maximum deviation of 1 minute per year

  • Appliance and Appliance Security Features

  • HSM Kryptus

  • HSM Thales

  • HSM GEMALTO

  • HSM DINAMO

  • HSM YUBICO

Encryption for SSH sessions

Symmetric ciphers
  • 3DES

  • AES128-cbc

  • AES192-cbc

  • AES256-cbc

  • rijndael-cbc

  • AES128-ctr

  • AES192-ctr

  • AES256-ctr

  • AES128-gmc

  • AES256-gmc

  • chacha20-poly1305

Symmetric ciphers that support authenticated encryption
  • AES128-gmc

  • AES256-gmc

  • chacha20-poly1305

MAC
  • hmac-sha1

  • hmac-sha1-96

  • hmac-sha1-256

  • hmac-sha1-512

  • hmac-md5

  • hmac-md5-96

  • umac-64

  • umac-128

  • hmac-sha1-96-etm

  • hmac-sha1-256-etm

  • hmac-sha1-512-etm

  • hmac-md5-etm

  • hma-md5-96-etm

  • umac-64-etm

  • umac-128-etm

Key exchange algorithms
  • diffie-hellman-group1-sha1

  • diffie-hellman-group14-sha1

  • diffie-hellman-group14-sha256

  • diffie-hellman-group16-sha512

  • diffie-hellman-group18-sha512

  • diffie-hellman-group-exchange-sha1

  • diffie-hellman-group-exchange-sha256

  • ecdh-sha2-nistp256

  • ecdh-sha2-nistp384

  • ecdh-sha2-nistp521

  • curve25519-sha256

Certificate Key
  • ssh-ed25519-cert-v01

  • ssh-rsa-cert-v01

  • ssh-dss-cert-v01

  • ecdsa-sha2-nestp256-cert-v01

  • ecdsa-sha2-nestp384-cert-v01

  • ecdsa-sha2-nestp521-cert-v01

Key types

  • ssh-ed25519

  • ssh-ed25519-cert-v01

  • ssh-rsa

  • ssh-dss

  • ecdsa-sha2-nestp256

  • ecdsa-sha2-nestp384

  • ecdsa-sha2-nestp521

  • ssh-rsa-cert-v01

  • ssh-dss-cert-v01

  • ecdsa-sha2-nestp256-cert-v01

  • ecdsa-sha2-nestp384-cert-v01

  • ecdsa-sha2-nestp521-cert-v01

Availability and Contingency

The senhasegura system supports operation on virtual or physical appliances. The senhasegura virtual appliance is customized for installation without releasing administrative users in the operating system.

In any configuration, the system supports high availability and external contingency disaster configurations.

  • High Availability

  • Contingency and Disaster Recovery

Backup

senhasegura has several mechanisms to recover information in case of failure:

Encrypted Password Backup

External in client infrastructure. The backup file of this information is password protected, which is distributed in multiple custody among trusted participants at the client's free choice. At least two custodian users are required to receive and retrieve the information. Once the senhasegura delivery ceremony has taken place, all passwords to the safe will be reset and the client will receive their respective custody, except for the passwords to the senhasegura database and operating system.

From version 3.10 on the backup procedure will also be performed for user passwords and Access Keys of the DevSecOps module.

Backup Fast Recovery

Internal and rapid recovery. Stores more critical information, is considered faster, because with the content of the base available the environment is recovered quickly and already becomes accessible upon request.

Encrypted Backup of Settings

Allows not only the stored data but also the password settings to be available for retrieval. This backup is not enabled by default, but its activation is available in system settings.

Safe Video Backup

The senhasegura allows the backup of the videos to be stored in a remote directory under the responsibility of the client. By default the videos are stored in the solution's file system.

Secrets Backup

The backup of secrets: console credentials and access keys are stored in dedicated directories.

Monitoring and Syslog and SIEM

senhasegura has monitoring capabilities designed to alert administrators of any process, integration, connectivity, or access failure.

This system issues on-screen alerts to the administrator or via email, SMS, snmpmibs and snmptraps.

The solution can be integrated with any industry tool using SNMP V1, V2 or V3 standard.

Integration with Syslog and SIEM services.

Own integration with ArcSight.

Browser Compatibility

The senhasegura web interface is accessible only through HTTPS protocol, and it is recommended that you provide your own SSL certificate in accordance with current security assumptions.

senhasegura uses HTML5 and WebSocket technology and only browsers that support these technologies will provide a complete passwords security experience. It also maintains compatibility with browsers in their most recent versions:

  • Internet Explorer

  • Google Chrome

  • Microsoft Edge

  • Mozilla Firefox

Network Operating Conditions

Connections between users and the senhasegura application have a minimum bandwidth of 180 Kbps per remote session without loss of functionality.

Connections between users and the senhasegura application have a maximum latency of 900 ms without any loss of functionality.

senhasegura application allows IPV4 and IPV6 protocol support following IETF RFC 2460 specification.

Supported Protocols and Ports

senhasegura allows the use of several protocols, through their respective standard ports or any other configured in the solution, for the following operations: remote connections, password changes, Scan Discovery, authentication and web access.

Operations are performed based on the ports configured on the device.

ConnectivityDefault PortDescription
HTTP80Web Access
HTTPS443Secure Web Access
LDAP389Scan Discovery / Authentication
LDAPS636Password Change / Scan / Discovery / Authentication
MySQL3306Remote Connection* / Password Change
Oracle1521Remote Connection* / Password Change
PostgreeSQL5432Remote Connection* / Password Change
RDP*3389Remote Connection
RM HTTP5985Password Change / Scan Discovery
RM HTTPS5986Password Change / Scan Discovery
SQL Server1433Remote Connection* / Password Change
SSH22Remote Connection / Password Change
Telnet23Remote Connection / Password Change
VNC**5900Remote Connection
Windows RM5986Password Change
Windows RPC135Password Change / Scan Discovery
X11 Forward**22Remote Connection / Password Change

The supported protocols are only available on TLS1.2 and TLS1.3, once connected to the senhasegura vault.

*RemoteApp only

**graphical interfaces

Performance

The senhasegura architecture is designed for maximum performance in all operations performed through the solution.

All tests were performed on senhasegura PAM Crypto Appliances with the following configuration:

Hardware Settings

  • Model: senhasegura PAM Crypto Appliance Titanium

  • Processor: Intel E5-2630v4

  • RAM Memory: 128GB

  • HD: 2x2TB NLSAS RAID1

senhasegura Settings

  • Cores: 38 vCPUs

  • RAM Memory: 126GB

  • HD: 2TB

SSH sessions via senhasegura Terminal Proxy

ConnectionsCPURAMDISK W
5005%10GB4.500 KB/s
200020%50GB6.000 KB/s
350055%85GB8.000 KB/s

SSH sessions via senhasegura Web Proxy

ConnectionsCPURAMDISK W
25010%10GB7.500 KB/s
75035%15GB5.000 KB/s
125045%20GB2.000 KB/s

RDP sessions via senhasegura RDP Proxy

ConnectionsCPURAMDISK W
5005%15GB8.500 KB/s
125010%30GB5.000 KB/s
200015%50GB2.000 KB/s

RDP sessions via senhasegura Web Proxy

ConnectionsCPURAMDISK W
2505%10GB16.000 KB/s
100010%20GB9.000 KB/s
175020%30GB1.000 KB/s

Web HTTP Connections (High Usage)

ConnectionsCPURAMDISK W
1010%5GB2.100 KB/s
2018%10GB1.800 KB/s
3020%15GB1.500 KB/s

Web HTTP Connections (Medium Usage)

ConnectionsCPURAMDISK W
1010%4GB80.000 KB/s
2020%8GB40.000 KB/s
3020%10GB10.000 KB/s

Connections Web HTTP (Low Usage)

ConnectionsCPURAMDISK W
1010%10GB40.000 KB/s
3520%15GB20.000 KB/s
6030%20GB10.000 KB/s

Resource limit

The platform senhasegura has some features that are technically limited, either for reasons for database limitations, operating system limitations, file-system limitations or software architecture limitations.

The limitations relating to contract or license are fixed by contract, and will not be addressed in this topic.

The limitations relating to the number of contracted instances, in a cluster scenario, will also not be addressed in this topic. We will focus on limitations on an instance and its components.

User Limit

Technically, the application will support up to 16,500,000 user records. This number is shared with WebService A2A users, service users, and actual system users. This number does not express the ability of all these users are using the system simultaneously. Simultaneous use capacity may vary according to the type of use, quantity of contracted instances and network latency supplied.

Device Limit

The technically application will support up to 16,500,000 device records. This number contains even inactivated devices over time. This number does not express the ability of all these devices are being accessed via proxy, or any other asynchronous process that accesses the device simultaneously. The ability to manage devices can vary by the number of contracted instances, supported systems and protocols and the network latency provided.

Credentials Limit and Protected Information

The application technically will support up to 16,500,000 credential records. This number contains even inactive credentials over time. This number does not express the ability of all these credentials are being accessed and used by asynchronous tasks or proxy sessions simultaneously. The ability to manage credentials can vary by the amount of contracted instances and the network latency provided.

Proxy session recording

Different from other market solutions, the senhasegura does not perform screen captures in image format, or real-time mp4 videos or other media formats. The real persistence of protocol ensures a faithful and optimized copy of the session. Inactivity times are recorded through 4 Bytes timestamp per second, unlike screens capture that would consume much more resources. Native format recording of the protocol already considers the native compression format of the protocol.

User behavior will define the amount of sessions that can be stored. Not excluding the possibility of disk expansion or remote storage mapping to increase storage capacity.

This combination of factors makes the limit of sessions virtually unlimited. The limit of recorded sessions from simultaneous users is also virtually unlimited. Consider the performance table described in the techspec-performance session to calculate your need.

Simultaneous proxy sessions

The amount of simultaneous sessions may vary with the amount of contracted instances, making the solution appropriate to its need without excessive hiring of resources. The cluster architecture also allows the definition of dedicated nodes for specific protocols, or the definition of dedicated instances for different datacenters or network segments. This combination of factors makes the limit of sessions virtually unlimited. Consider the performance table described in the techspec-performance session to calculate your need.

senhasegura versioning

The senhasegura versioning nomenclature follows the M.N.P format (eg: 3.22.1-9):

Release TypeDescription
M - MajorIncludes profound architecture and/or technology changes.
N - MinorIncludes new features and/or improvements to existing features. Also includes known bug fixes and minor architectural changes.
P - PatchIncludes critical bug fixes and security patches. (immediate update recommended)

New versions frequency of release

senhasegura N Updates can vary from 1 to 5 months, depending on the period of the year.

As for the available formats, there are two ways:

  1. For the new senhasegura environment, can be used the virtual machines available in the partner support.
  2. Updates are always available through our repositories, with new releases updated as soon as they become available.

Implementation requirements

Use cases

For the correct functioning of the solution, the possible Use Cases must be defined where privileged access management will be performed.

Here are some examples of these cases:

  • Active Directory: The Active Directory administrator wants to have remote desktop access (RDP) to Active Directory Server Windows Server 2016 using the “Administrator” user.
  • Databases: The DBA wants to have access to the SQL software client Server Management Studio 2014, which manages SQL database using the local administrator user of the production instance of the “sa” database.
  • Network Assets: The infrastructure administrator requires access to via command line, shell, or console to a Cisco router, via SSH or Telnet port, using the “operator” or “admin” user.
  • Web Applications: Access to the portal https://aws.amazon.com/, using the Cloud Computing administrator account using the account “senhasegura@gmail.com”.
  • Deletion of credentials in hardcore: If you want to eliminate the Database credentials recorded in the source code of an accounting app, change password synchronized in configuration files and services dependent on authentication or provide a connection API for your subscription.
  • Registration Of Activities With Generic Users: You desire to obtain a record of activities during any session, including logs of custom audit, look for any command executed by keyboard during the session and on recordings.
  • Segregation Of Functions And Segmentation Of Functions: You want to create user profiles broken down by denylist lists of commands using the same privileged credential. You want to define groups with privileged access to associated users belonging to the same area.
  • VPNs Optimization: Do you want to control and monitor in real-time the access of suppliers and outsourced users to the corporate environment, provide remote access only to specific applications or services on the network for a predetermined time.
  • Cloud Environment Recording: Do you want to manage access to cloud applications and ensure user legitimacy that will connect to the same IT governance standards as all other internal network environments.
  • Shared Access: With critical applications whose licensing is very expensive, senhasegura can deliver shared access not-simultaneous from multiple locations for different users making use of the same privileged credential, obtaining information independent and personalized of each session and your recording of video.
  • Repository For Strength Analysis: You can get an analysis of behavior to get metrics, model usage reports, inventory planning, and policy structuring for the efficient use of resources. Online access to session recordings for troubleshooting purposes.
  • Information Protection: Do you want to store information with Digital certificates, connection keys, encryption keys, and passwords personal access, with which you can define flows and controls of accesses, which evidences and monitors its use and visualization.

Requirements in Managed Systems

prerequisites

Define the following information for managed systems:

  • Hostname: Hostname of the device. It will be the identifier of queries. (For example, apl001s10 or Facebook).
  • IP Management: Device management IP used by the vault for connection. (For example, 192.168.10.1 or facebook.com).
  • Manufacturer: Device manufacturer. It will be created if you are not registered. (For example, Microsoft, Oracle).
  • Type: Device type. It will be created if you are not registered. (ex: server, Subscription)
  • Model: Device model. It will be created if you are not registered. (For example, Windows Server 2012).
  • Location: Geographic location. Where the device is located. It will be created if not registered. (For example, Data Center Guatemala).
  • Additional 1: Additional Information. (Ex: Platform, Core, Accounting).
  • Additional 2: Additional Information. (For example, System, Database Data, Main Application)
  • Connectivity: Device and gateway connectivity, separated by comma and colon. (Ex: RDP: 3389, SSH: 22).
  • Domain. Device domain. (For example, domain.com)

Privileged account requirements

To access managed systems, you must have the following information from credentials or privileged accounts:

  • Password type: Password policy. (For example, local user Privileged)
  • User: Username. (Ex: root)
  • Password: Password value. If not filled in, the password is not will update. (For example, Da@lU!83m$1)
  • Domain: Domain of the credential. (For example, domain.com)
  • Additional information: Additional information on the current credential. Used for DB instances, password changes, or links in general. (For example, ORAC19).
  • Labels: Password labels, separated by commas. It is used to group or filter certain credentials. (Ex: cellphone, dev)
  • Enable Auto Change: Indicate whether the password will be changed automatically by the safe (Yes or No)
  • Swap plugin: Plugin used in change model. (Ex: NetSSH)
  • Change Template: Template used to change password. (For example, Linux as root)
  • Status Control: Indicates whether the password status will be controlled automatically by the vault. (Yes or No)
  • Plugin activation: Plugin used by activation model. (Per example: Net SSH)
  • Activation model: The model used to perform the activation of the credential. (For example: Enable credentials as root)
  • Plug-in inactivation: Plugin used by the inactivation model of the credential. (For example, Net SSH)
  • Inactivation model: Template used to perform the inactivation of the credential. (For example: Disabling credentials as root)
  • User for connection: The user used to connect to the equipment and perform status changes and control operations. You can use the same credential. (ex: root or even password)
  • Hostname for connection: Hostname used to connect to the device and perform control and status change operations. You can use the same password value. (For example, apl001s10 or Even of the password).
  • Credential owner: User of the credential.

Requirements on access groups and users

To be able to start the senhasegura vault and certain privileged accounts, some access groups must be defined that will allow filtering by segments or groups, the different managed systems, privileged accounts, and privileges to which users who enter the solution must have their own credentials access, and you can create locally in the vault or integrate with an authentication source such as Active Directory, Radius, or TACACS, to configure these features:

Prerequisites:

  • Number of Access Groups
  • Names of Access Groups
  • Systems Privileged by Access Groups
  • Privileged Accounts by Access Groups
  • Users by Access Groups
  • Options by Access Groups (Access to the session and view of the password must be set if you need to enter a reason or get approval.
  • Access limitations by days of the week and time slots (8:00 AM - 12:00 PM, 12:00 PM - 16:00 PM, 16:00 PM - 20:00 PM, 20:00 PM - 00:00 AM, 00:00 AM - 04:00 AM, 04:00 AM - 08:00 AM).
  • Example of how to fill in the access group field:

Access group

NameSystemPrivileged AccountsUsersOptionsAccess limitations
ServersSRV Win 2016 (10.235.x.x)Administratora.martinezonly access to the session without reason or approvalEvery day from 8 am to 5 pm

If there is a growth in the number of users and devices initially defined, the solution must be dimensioned with a gap of 20% to grow without the needing to modify the hardware. If the growth is more significant, it is always possible to scale the solution by integrating it with other hardware with superior capabilities.

User profiles in senhasegura

For the solution to work as intended, it is proposed to have the following access profiles:

  • Administrator: User with greater privileges in the vault, in charge of the configuration activities, modification, and elimination of any configuration, during its operation. It is recommended that there is only one administrator profile and that any activity performed by them is previously documented and authorized.

  • Configurator: User with high privileges in the vault, responsible for privileged account or system modification activities it manages. It is recommended that there are at least two users with a configurator profile and that any action performed by them is previously documented and authorized.

  • Auditor: User only with privileges to view recordings of sessions and their audit logs. There may be multiple users with this profile and may be part of the company’s staff or third parties.

  • User with privileged access: Only users with session access to managed systems that use privileged credentials defined in the access group to which the user belongs. As many users as are allowed in the user license can be configured.

  • View of user with a privileged password: User with access to view the password of the privileged account of the managed systems defined by the access group to which the user belongs. As many users as are allowed in the user license can be configured.

  • User with privileged access and view: User with privileged access, login view, a password for managed systems, and privileged credentials defined by the access group to which the user belongs. As many users as allowed can be configured in the user license. There may be multiple users with this profile who They can be part of the company’s staff, applications, or third parties.

  • Example of filling in the user field:

Users

NameUsernameDepartmentEmailPhoneAccess groupProfile
Alex Martineza.martinezAdministrationalex.m@gmail.com+000 000XXXXServersUser with privileged access

Technical Requirements - (SaaS)

Infrastructure

The infrastructure of the S senhasegura environment has a Cloud Computing infrastructure, which has the following premises:

  • The senhasegura instance is not accessible
  • The user will be able to access senhasegura through the client’s public IP
  • The client can allow more than one IPS to access the senhasegura GUI

In addition, senhasegura has two connection models to follow between the client’s corporate network and the senhasegura SaaS environment.

IPsec VPN Architecture (Standard)

In this scenario, the customer must enable a gateway or perimeter feature to establish an IPsec VPN tunnel against the senhasegura SaaS environment.

IPsec VPN Architecture (Standard)

NOVPN Architecture (Optional)

In this scenario, you must purchase the senhasegura Network Connector, which establishes a secure tunnel between the senhasegura SaaS environment and the customer’s corporate network perimeter resource.

NOVPN Architecture (Optional)

Network Connector Agent (only in case of NOVPN architecture)

All senhasegura’s communication with the corporate network is done through the Network Connector. The agent is a container that must be added to a host on the customer’s network.

High Availability

The provision of the environment, restoration, and updating of the product are the responsibility of senhasegura.

Monthly uptime * >=99.5%

Availability is guaranteed only on the senhasegura connection side. End-to-end availability is subject to proper configuration of the interconnected VPN gateway, client firewall rules, and client-side connection quality. It is important to remember that this calculation does not consider scheduled maintenance. For more information about the GCP SLA, you can validate it at: GCP Compute Engine Service Level Agreement (SLA)

Vertical scalability

The offer is based on the number of users and devices. As demand increases, capacity adjustments automatically increase.

Safe harbor

Respecting the sovereignty of each country/region, each client’s application is located on a geographically close server. We guarantee that data is not stored or processed in international areas, as prohibited by local legislation, and we guarantee better latency.

Available regions

4 regions, North America. 2 regions, LATAM. 3 regions, Europe 5 regions, APAC

Hardware requirements

Hardware requirements depend on the maximum number of simultaneous sessions handled by the solution and the recording retention time given by each scenario in the different environments. For senhasegura’s SaaS environment, as the demand for requirements increases, capacity adjustments automatically increase. The only requirements that the customer must evaluate in this SaaS scenario are a Gateway or perimeter resource to establish the IPsec VPN. As it has a Network Connector senhasegura, the Gateway is not necessary, the bandwidth required for the number of simultaneous sessions between the customer’s corporate network and the SaaS environment, which are defined according to the following information:

  • RDP/SSH: When the Terminal Proxy does the access.
  • Web: When access is made through the browser.

Consumption per connection

NET: Network traffic per connection(Server Side RX / TX)(kbps / con.
Moderate3/145/5
NET: Network traffic per connection(Client Side RX / TX)(kbps / con.)
Moderate0.2/1.010/80

Hardware Requirements - RDS Server (Only if Applicable)

If necessary, it is defined as applications segmented in Windows environments (dedicated software clients, database piers, etc.). It is required to implement a Remote Desktop Services (RDS) server, whose licensing and implementation are not covered by senhasegura. Feature Availability For this service, hardware availability requirements and licenses must be multiplied by the number of features: Remote desktop

As must be published from this server, and then senhasegura will use a Remote Application API to consume the service. The sizing of this server depends on the number of specific concurrent servers for this type of session. /role/remote-desktop/session-hosts)

We recommend that this server be purchased with at least one Windows Server 2008 R2 operating system and with licenses per user or server, which the manufacturer must offer: “RDS Per User CALs”, the manufacturer’s link with licensing information is also listed : remote desktop client access license

On the other hand, about the hardware needed for the work of the manufactured server, there is a table of functionality load levels of the facilities Remo desktop workloads

The manufacturer has guides for implementing this feature with information about it: Remote desktop virtual machine recs

Based on all the above, in the case of customers, we recommend evaluating the number of use cases that require segmented access by application. With this, we have the number of simultaneous users, and we can obtain the necessary hardware requirements for the RDS server, which must be installed on-site.

Technical Requirements - Virtual Device - PAM

Compatibility

You can implement senhasegura in virtualized environments. The virtualization assumptions depend on the solution used for deployment and the appliances needed. According to the defined architecture, the compatible environments are as follows:

  • VMware® (ESX/ESXi Server): support ESXi 7.0 and ESXi 6.x (OVA deployment), must use VMXNET3 network adapter driver, plus paravirtualized disk. When performing virtual machine (VM) deployment, the upgrade must be done on the machine’s hardware. Virtual machines can be used in OVA/OVF format.
  • Xen Citrix®: support Citrix Hypervisor 8.2 LTSR, Citrix XenServer 7.0, XenServer 7.1 LTSR, and Xen Project 4.x.x Series (OVA deployment). You must use the HVM generator. RAW format virtual machines can be used.
  • Microsoft® Hyper-V: Support for Windows Server 2019, Windows Server 2016, Windows Server 2012, and Windows 10 (OVA to VHD conversion), virtual machines in VHD/VHDx format can be used. Azure: Virtual machines in VHD format can be used. AWS: VM in OVA or VMDK structure.
  • Microsoft® Azure (OVA to VHD conversion).
  • Linux KVM(QCOW2).
  • Amazon (Amazon Web Services - AWS) (AMI deployment) (enter account ID and region).
  • Google® Cloud Platform (GCP) (OVA deployment).
  • Openstack: virtual machines in RAW format can be used.
  • ISO installation media.

Hardware requirements

These requirements depend on the maximum number of simultaneous sessions handled by the solution and the recording retention time given by each scenario in the different environments, which are defined according to the following information:

  • RDP/SSH: When the access is done by the Terminal Proxy.
  • Web: When the access is done through the browser.

The access structure is as follows:

NOVPN Architecture (Optional)

Consumption per connection

HardwareUseRDP/SSHWeb
CPU: Number of Concurrent Connections per core (con./core)Moderate30030
RAM: Amount of memory used per connection (MB/con.)Moderate2040
HDD: Disk space by time per connection (kB/s/con.)Moderate34
NET: Network traffic per connection(Server Side RX / TX)(kbps / con.)
Moderate1/345/5
NET: Network traffic per connection(Client Side RX / TX)(kbps / con.)
Moderate0.2/1.010/80

For customer deployment, the following features are available for the HA (Two Equal Appliances in Cluster) scheme in the Credit Bureau Datacenter:

  • Up to xxx simultaneous connections
  • Users: xxx
  • Managed Systems: xx
  • Hours of use per day: xx hours
  • Days of use per week: x Days
  • Retention months: x months

The minimum hardware requirements would be as follows:

  • x minimum vCPU (2.0 GHz) (not shared).
  • Minimum RAM x GB (not shared).
  • Minimum DD x TB (Not shared, this requirement directly depends on the required retention).
  • Minimum 1 network port (1 GbE) (not shared).
info

For a High Availability (Active-Passive) architecture with two members in a cluster, two machines with the exact Hardware requirements are needed. For an (Active-Active) model, a balancer must be added, which is not included.

For deployment as disaster recovery, you have the following capabilities for a single device:

  • Up to x simultaneous connections
  • Users: x
  • Managed Systems: x
  • Hours of use per day: x hours
  • Days of use per week: x Days
  • Retention months: x months

The minimum hardware requirements would be as follows:

  • Minimum vCPU x CPU (2.0 GHz) (Not shared).
  • Minimum RAM x GB (not shared).
  • Minimum DD x TB (Not shared, this requirement directly depends on the required retention).
  • Minimum 1 network port (1 GbE) (not shared).