Accenture MDR Quick Start Guide for Centrify® Server Suite

This quick start guide will help Accenture MDR customers configure Centrify® Server Suite to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
LCP	Centrify Server Suite	1433 (TCP )	Default port

Configuring Centrify Server Suite

I. To create read-only user and grant permissions for fetching logs, follow the steps below.

Create a DB read-only user.

From the Windows Start menu, choose Run, and then type the following command: cmd
Navigate to the directory that contains the OSQL.EXE file.
Log in as the database administrator user and type the following command:

sqlcmd -S ip_address_or_host_name -U sa -P sa_user_password

EXEC sp_addlogin '<account_name>','password','<database_name>' USE <database_name>

CREATE USER <account_name> FOR LOGIN <account_name>

EXEC sp_addrolemember 'db_datareader','<account_name>'

GO

4. Grant read permissions to the new user (i.e. <account_name>) on the selected table.

GRANT SELECT ON AuditTrailEvent to <account_name>;

GRANT SELECT ON AuditEventStrings to <account_name>;

GRANT SELECT ON RawData to <account_name>;

GRANT SELECT ON Session to <account_name>;

GO

II To set the SQL Server security mode to mixed authentication, follow the steps below.

Based on the Microsoft SQL server version, do one of the following:

For Microsoft SQL Server 2012, from the Start menu, go to Programs > Microsoft SQL Server 2012 > SQL Server Management Studio.

For Microsoft SQL Server 2008, from the Start menu, go to Programs > Microsoft SQL Server 2008 > SQL Server Management Studio.

For Microsoft SQL Server 2005, from the Start menu, go to Programs > Microsoft SQL Server 2005 > SQL Server Management Studio.

For Microsoft SQL Server 2000, from the Start menu, go to Programs > Microsoft SQL Server 2000 > SQL Enterprise Manager.

2. Login as Administrator.

3. In the left pane, right-click the appropriate server and then click Properties.

4. In the Server Properties window, select Security.

5. In Server Authentication section, click SQL Server and Windows Authentication mode.

6. Click OK and then click Close.

III. To configure the SQL server instance to listen on a non-dynamic port, follow the steps below.

On the Start menu, go to Programs > Microsoft SQL Server > SQL Enterprise Manager > SQL Server Configuration Manager.
Expand SQL Server Network Configuration and select Protocols for <instance_name>.
In the right pane, click TCP/IP.

a. In the TCP/IP properties window, on the IP Address tab, ensure that the Active and Enabled options are set to Yes.

b. Ensure that the TCP Dynamic Ports text box is blank for the IP address to which the LCP connects.

c. In the TCP Port text box, type 1433

IV. To configure the SSL connection for the Microsoft SQL server, follow the steps below.

Based on the Microsoft SQL server version, do one of the following:

For Microsoft SQL Server 2012, from the Start menu, go to Programs > Microsoft SQL Server 2012 > Configuration Tools > SQL Server Configuration.

For Microsoft SQL Server 2008, from the Start menu, go to Programs > Microsoft SQL Server 2008 > Configuration Tools > SQL Server Configuration.

For Microsoft SQL Server 2005, from the Start menu, go to Programs > Microsoft SQL Server 2005 > Configuration Tools > SQL Server Configuration.

For Microsoft SQL Server 2000, from the Start menu, go to Programs > Microsoft SQL Server 2000 > Configuration Tools > SQL Server Configuration.

2. Expand SQL Server Network Configuration, right-click Protocols for the required server and then click Properties.

3. On the Certificate tab, select the required certificate.

Note: Self-signed certificates are supported but not recommended because they do not provide adequate security.

4. On the Flags tab, specify the protocol encryption option.

5. Set the ForceEncryption option to Yes to encrypt all client and server communication. Clients that cannot support encryption are denied access.

6. Click Apply and then click OK.

7. Click SQL Server Services, right-click SQL-SERVER, and then click Restart.

8. Click Apply and then click OK.

LCP Configuration Parameters

Table 1-2: The Centrify Server Suite event collector (Database – 3813) properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Database URL	jdbc:jtds:sqlserver://<server>:1433/ <databasename>	The database URL string that needs to be configured on the collector by MDR. Server - Hostname or IP address of the database. Database name - The name of the database in which the Centrify Server Suit events are stored. 1433 (TCP port) - The default port number for DB connectivity. Note: If the database is configured to use a different port number, please advise the MDR onboarding team.
User Name	Custom Value	The username for the database account mentioned in the Pre-Installation Questionnaire (PIQ).
Password	Custom Value	The password for the database account mentioned in the PIQ.