topic Re: Block Rclone executable in Firewall and Security Management

Block Rclone executable

kamaladmire1 — Thu, 19 Oct 2023 11:17:51 GMT

Hi All,

I have a question below if someone can answer,

how to block Rclone (software) executable in checkpoint?

customer having issues with Rclone and wanted to block however the problem is Rclone is command line executable and not an application that can simply block within application control? here is the link if the web https://rclone.org/

is there a way to create an email alert if service on AD is down so the admin can receive when AD is disconnected? customer using Identity Collector.

Can access role have both username and machines identity for ID-Awareness and if username not work (AD being disconnected or down) will machine Identity still works?

Thansk

Re: Block Rclone executable

_Val_ — Thu, 19 Oct 2023 11:34:28 GMT

When you say "Block Rclone executable", do you mean on an endpoint? Or do you want to block access to the website?

Re: Block Rclone executable

kamaladmire1 — Thu, 19 Oct 2023 13:23:56 GMT

Hi,

want to block this on firewall level, the issue with this particular one is it access Rclone via repository so not easy to block Web site IP.

Re: Block Rclone executable

PhoneBoy — Thu, 19 Oct 2023 21:00:32 GMT

You're asking three different questions, only two of them are related to each other.

Your ability to block rclone on a network device depends entirely on what it accesses.
I would assume the app just calls the various APIs for AWS/Azure directly.
Which means: to block this app, you'd need to block access to these services.
However, that is just a guess and I recommend watching the various logs on the gateway to confirm what it does.

At this point, there is no monitoring mechanism for Identity Collector.
I believe this is planned, but if you have specific requirements, reach out to your local office with an RFE request.

An individual Access Role is an "and" for each of the configurable options (User Group, Machine, Network, RA Client).
You can create another access role that specifies Machine without the User Group.
However, some user must log onto the system for a machine identity to be acquired.