A Windows Domain Controller (DC) authenticates and authorizes users, enforcing security policies for computers within the domain. Through centralized user management and access control, the DC ensures that users can log into computers and access resources like applications and files based on their permissions.

With this integration, Apono enables you to manage access to a Windows Domain Controller with Connect permission or a custom permissions group, so that only specific users or groups can provide remote access to resources in your environment on a temporary, as-needed basis.​

Prerequisites

​

Configure the Windows Domain Controller

Before you begin integrating Windows Domain Controller with Apono, you must allow remote access with the Windows Remote Management (WinRM) service on your Windows machine.

You can allow unencrypted or encrypted communication.

Unencrypted Communication

Follow these steps to configure the Windows Domain Controller:

1. Add the WinRM port 5985 to the allowlist in the server firewall.

2. Turn on the WinRM firewall rule in the Windows server.

3. Analyze and configure the WinRM service to allow remote management on the local machine.

winrm quickconfig

1. Set the WinRM service configuration to allow unencrypted traffic.

winrm set winrm/config/service @{AllowUnencrypted="true"}

1. Enable basic authentication for the WinRM service. Basic authentication transmits credentials in cleartext.

winrm set winrm/config/service/Auth @{Basic="true"}

You can now integrate the Windows Domain Controller.

Encrypted Communication

Follow these steps to configure the Windows Domain Controller:

1. Add the WinRM port 5985 to the allowlist in the server firewall.

2. Turn on the WinRM firewall rule in the Windows server.

3. Analyze and configure the WinRM service to allow remote management on the local machine.

winrm quickconfig

1. Enable basic authentication for the WinRM service. Basic authentication transmits credentials in cleartext.Shell

winrm set winrm/config/service/Auth @{Basic="true"}

1. Configure WinRM HTTPS access on the target machine.

You can now integrate the Windows Domain Controller.

Integrate a Windows Domain Controller

Follow these steps to complete the integration:

1. On the Catalog tab, click Windows Domain Controller. The Connect Integration page appears.

2. Under Discovery, select one or multiple resource types for Apono to discover in all instances of the environment.

3. Click Next. The Apono connector section expands.

4. From the dropdown menu, select a connector.

1. Click Next. The Integration Config page appears.

2. Define the Integration Config settings.
3. Click Next. The Secret Store section expands.

4. Associate the secret or credentials.

5. Click Next. The Get more with Apono section expands.

6. Define the Get more with Apono settings.
7. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your Windows Domain Controller.

Overview

If users need to debug, develop or troubleshoot Azure VM SSH servers, they can request Just-in-Time access to them in Apono!

Admins can create Access Flows with specific VM SSH servers and build approval and access duration flows for different users, groups, and shifts.

Upon an approved request, Apono creates a certificate that grants access to the server and makes the requester a member of the group(s) representing the access they need. Apono may also use the user's default Linux group.

How it works

Prerequisites

• Installed Apono connector with network access to the Azure VM SSH Servers

  • Minimal Apono connector version: 1.4.0 (visit the Connectors Page and update the connector if needed)

• A user with a key pair authentication for Apono to your SSH servers with sudo permissions. Add this line to the sudoers file:

  • apono ALL=(ALL) NOPASSWD:ALL

• Optional: User groups representing access to the servers. The default value is "Default", representing access to the server with the user's default Linux group.

Step-by-step guide

1. In the Apono app, navigate to the Catalog

2. Pick the Azure VM SSH integration:
3. Pick an existing connector or create a new one (see connector prerequisites)

4. In the secret store of your choice, create a secret for Apono with the following params:

   1. Key: base64_private_key

   2. Value: the SSH Server private key in base64 format (see SSH key prerequisites) To find the private key in base64 format, run this command : cat /PATH-TO-KEY/key.pem | base64

5. Fill the config:

   1. Integration name: Give the integration a name of your choice

   2. User: set the name of the user you created in the prerequisites for the Apono connector.

   3. User groups (Optional): The names of groups in the server representing the sudoer role (from a local server, puppet/chef, LDAP server, etc., depending on your network setup)

   4. Secret: according to the Secret Store of your choice, insert the secret you created in step 4.

Results

• You will be redirected to the Connected Integrations tab.

• Make sure you see the Azure VM SSH integration as Active. The # of discovered SSH servers will appear in the table under Resources.

• You can now create Access Flows for Azure VM SSH Servers!

Overview

If users need to debug, develop or troubleshoot AWS EC2 SSH servers, they can request Just-in-Time access to them in Apono!

Admins can create Access Flows with specific EC2 SSH servers and build approval and access duration flows for different users, groups, and shifts.

Upon an approved request, Apono creates a certificate that grants access to the server and makes the requester a member of the group(s) representing the access they need. Apono may also use the user's default Linux group.

How it works

Prerequisites

• Installed Apono connector with network access to the AWS EC2 SSH Servers

  • Minimal Apono connector version: 1.4.0 (visit the Connectors Page and update the connector if needed)

• A user with a key pair authentication for Apono to your SSH servers with sudo permissions. Add this line to the sudoers file:

  • apono ALL=(ALL) NOPASSWD:ALL

• Optional: User groups representing access to the servers. The default value is "Default", representing access to the server with the user's default Linux group.

Step-by-step guide

1. In the Apono app, navigate to the Catalog

2. Pick the AWS EC2 SSH integration:
3. Pick an existing connector or create a new one (see connector prerequisites)

4. In the secret store of your choice, create a secret for Apono with the following params:

   1. Key: base64_private_key

   2. Value: the SSH Server private key in base64 format (see SSH key prerequisites) To find the private key in base64 format, run this command : cat /PATH-TO-KEY/key.pem | base64

5. Fill the config:

   1. Integration name: Give the integration a name of your choice

   2. User: set the name of the user you created in the prerequisites for the Apono connector.

   3. User groups (Optional): The names of groups in the server representing the sudoer role (from a local server, puppet/chef, LDAP server, etc., depending on your network setup)

   4. Secret: according to the Secret Store of your choice, insert the secret you created in step 4.

Results

• You will be redirected to the Connected Integrations tab.

• Make sure you see the AWS EC2 SSH integration as Active. The # of discovered SSH servers will appear in the table under Resources.

• You can now create Access Flows for AWS EC2 SSH Servers!

Microsoft Remote Desktop Protocol (RDP) enables users to connect to and control a remote computer or virtual machine over a network. It provides secure and efficient remote access to desktops, servers, and applications, allowing employees to work from anywhere with an internet connection.

With this integration, Apono enables you to manage access to an RDP server with Connect permission or custom permissions group, so that only specific users or groups can provide remote access to resources in your environment on a temporary, as-needed basis.

Prerequisites

Configure the RDP server

Before you begin integrating RDP with Apono, you must configure the Windows Remote Management (WinRM) service on a Windows machine to allow remote access using unencrypted and basic authentication.

You can allow unencrypted or encrypted communication.

Unencrypted Communication

Follow these steps to configure the RDP server:

1. Add the WinRM port 5985 to the allowlist in the server firewall.

2. Turn on the WinRM firewall rule in the Windows server.

3. Analyze and configure the WinRM service to allow remote management on the local machine.

winrm quickconfig

1. Set the WinRM service configuration to allow unencrypted traffic.

winrm set winrm/config/service @{AllowUnencrypted="true"}

1. Enable basic authentication for the WinRM service. Basic authentication transmits credentials in cleartext.Shell

winrm set winrm/config/service/Auth @{Basic="true"}

You can now integrate an RDP server.

Encrypted Communication

Follow these steps to configure the RDP server:

1. Add the WinRM port 5985 to the allowlist in the server firewall.

2. Turn on the WinRM firewall rule in the Windows server.

3. Analyze and configure the WinRM service to allow remote management on the local machine.

winrm quickconfig

1. Enable basic authentication for the WinRM service. Basic authentication transmits credentials in cleartext.

winrm set winrm/config/service/Auth @{Basic="true"}

1. Configure WinRM HTTPS access on the target machine.

You can now integrate an RDP server.

Integrate an RDP server

Follow these steps to complete the integration:

1. On the Catalog tab, click RDP The Connect Integration page appears.

2. Under Discovery, select one or multiple resource types for Apono to discover in all instances of the environment.

3. Click Next. The Apono connector section expands.

4. From the dropdown menu, select a connector.

1. Click Next. The Integration Config page appears.

2. Define the Integration Config settings.
3. Click Next. The Secret Store section expands.

4. Associate the secret or credentials.

5. Click Next. The Get more with Apono section expands.

6. Define the Get more with Apono settings.
7. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your RDP server.

SSH servers are secure, remote access points that allow users to connect to and manage systems over encrypted connections.

Through this integration, Apono enables managing secure Just-in-Time (JIT) access to SSH servers. Admins can create access flows for specific SSH servers and define approval processes and access durations for different users, groups, and shifts.

When a user's access request is approved, Apono creates a certificate that grants access to the server and assigns the requester to the appropriate access group(s). Apono may also use the user's default Linux group.

Prerequisites

Integrate SSH servers

Follow these steps to complete the integration:

1. On the Catalog tab, click SSH. The Connect Integration page appears.

2. Under Discovery, click Next. The Apono connector section expands.

3. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config page appears.

2. Define the Integration Config settings.

1. Click Next. The Secret Store section expands.

2. Associate the secret or credentials.

3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.

1. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your SSH instance.

Step By Step to installing the HTTP proxy

Deploy with Kubernetes

• Set the following env vars:

K8S_NAMESPACE=
KMS_KEY_ID=

KMS_KEY_ID value should be the OidcSignerKey created by Apono-Connector CloudFormation stack:

• Install envoy proxy with helm:

helm install envoy-proxy https://apono-io.github.io/apono-helm-charts/envoy-proxy/envoy-1.0.4.tgz \
    --namespace $K8S_NAMESPACE \
    --set-string jwks=`aws kms get-public-key --key-id $KMS_KEY_ID --output text --query PublicKey | awk '{print "-----BEGIN PUBLIC KEY-----\n"$1"\n-----END PUBLIC KEY-----"}' | docker run -i danedmunds/pem-to-jwk:latest | awk '{print "{\"keys\":["$1"]}"}' | openssl base64 -A` \
    --set-string tls=true \ # if destination is https
    --set-string accessLogs=true \ # if you want access logs to be written
    --create-namespace