topic Re: Checkpoint Identity awareness: idc_servacc.db Meaning of "exceptions" in Firewall and Security Management

Checkpoint Identity awareness: idc_servacc.db Meaning of "exceptions"

StefanSchmidt — Thu, 24 Oct 2024 11:32:19 GMT

Hello,

I need to exclude certain service accounts from being monitored by CP Identity Awareness.

I have found an article https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_IdentityAwareness_AdminGuide/Content/Topics-IDAG/Identity-Collector-Service-Account-Exclusion.htm

(and similar information in the CP Identity Awareness documentation) that there is a file

$FWDIR/conf/idc_servacc.db

"Identity Awareness Gateway saves the session identifier and username c associated with an identified Service Account in the $FWDIR/conf/idc_servacc.db "

There are two sections in this file:

:serviceAccounts (
:exceptions (

Where should I insert the service accounts that I do not want be monitored? Under serviceAccounts or under exceptions?

Thank you

regards

Stefan

Re: Checkpoint Identity awareness: idc_servacc.db Meaning of "exceptions"

PhoneBoy — Fri, 25 Oct 2024 19:31:31 GMT

Rather than modify that file directly, you should use pdp idc service_accounts mark username

Re: Checkpoint Identity awareness: idc_servacc.db Meaning of "exceptions"

StefanSchmidt — Wed, 06 Nov 2024 11:46:12 GMT

So the command pdp idc service_accounts mark username will create an entry in the file $FWDIR/conf/idc_servacc.db ?

Or what does the command do?

What do the sections

:serviceAccounts (
:exceptions (

in the file $FWDIR/conf/idc_servacc.db mean?

Does the ":exceptions ( " line define which accounts should never be detected as service accounts or does it define that those accounts acutally ARE service accounts? If both is incorrect: what does the ":exceptions ( " line do for accounts that are dinfend under this line?

Thank you

regards

Stefan

Re: Checkpoint Identity awareness: idc_servacc.db Meaning of "exceptions"

PhoneBoy — Wed, 06 Nov 2024 15:20:55 GMT

I assume this is what the command will do.
Rather than manipulate this file directly, you should use the relevant pdp idc service_accounts commands per the documentation.
That documentation suggests that "exceptions" in this case are to override the detection of service accounts for specific users (e.g. always enforce identity for these users).

Re: Checkpoint Identity awareness: idc_servacc.db Meaning of "exceptions"

StefanSchmidt — Thu, 07 Nov 2024 07:40:04 GMT

Thanks a lot for the clarification