- What options does skyline provide to reduce the privileges of the used system account?
We would like to run this account without users having admin rights.
It also would be helpful to have this as an feature in a newer release.
2. When DataMiner creates a user it is not part of any groups on the OS level. On the DataMiner level it will add the user to:
- C:\Skyline DataMiner\Security.xml
- C:\Skyline DataMiner\Files\SyncInfo\{DO_NOT_REMOVE_XYZ}.xml
- C:\Skyline DataMiner\Files\SyncInfo\{DO_NOT_REMOVE_XYZ}.xml
- This file is signed and cannot be altered, during startup this file is used to re-create/delete users that were added/removed from Security.xml
Can this files be altered?
What additional security measurements can be implanted here?
A user with Administrator privileges is required to run the DataMiner installer. During installation, DataMiner will create a number of services in Windows that will run as SYSTEM. There is currently no way to run the DataMiner services under a different user. We are aware that all of our services running as SYSTEM is not recommended, and are working on removing this limitation in the future.
Do note that once the installation is finished, DataMiner operators no longer require Administrator permissions on the server where DataMiner is hosted. You can even disable the built-in Windows Administrator.
You can alter the Security.xml manually, but after the next DataMiner restart any changes will be overwritten by the information in the SyncInfo\* files. These files are signed, meaning they cannot be altered. This is a security measure to prevent tampering and is by design.
Some additional security tips can be found in this article about securing DataMiner (more tips will follow soon).
Other than this I recommend applying the principle of least privilege for your DataMiner users. Meaning if a user doesn't require specific permissions, they should not be granted. Be especially careful when granting the DataMiner permissions regarding Security, Automation Script creation, and Protocol upload.
Please let me know if you have any further questions, I'm happy to assist where needed.