Page Comparison

Our Active Directory integration uses a script to pull a CSV containing all of the accounts within the Organizational Units that you will set. To automate this, we This guide outlines how to automate pulling user information from Active Directory. We store the CSV onto an sFTP Server that either Zilla or you can host, and Zilla pulls the information from there. For more general information on this process, please see this documentation. You have the option to do this manually, but the automated approach is recommended.

Prerequisites:

This setup requires the following

1. Ensure that powershell is up to date and installed on your server (odds are it is). For more info, please refer to this documentation

2. That Ensure that you have Admin access to the microsoft servers Microsoft server containing your domain controllerIf you’d like this process to be automated, we , along with admin access to Zilla.

3. We require a service account on AD Active Directory with domain user access that can will be used to export user data from AD.

4. We will also require an SSH Public/Private RSA Key to be made in RSA Format. To do this, do the following:

   1. Run the following command. Do not add a passphrase to the key. This is not supported at this time:

      Code Block
      ssh-keygen -b 2048 -t rsa -f '/home/...'

   2. This will generate a public/private key in the filepath that you defined. Be sure to include the name of the key pair at the end of the filepath. If you didn’t define a path, it will be stored at /home/user_name/.ssh/ with the name id_rsa

   3. If you are using Zilla’s sFTP server, you will need to provide the public key to you Zilla Technical Contact. You can also email support@zillasecurity.com to open a ticket and request an sFTP server. Be sure to include the public key file in the request.

   4. take note of this the filepath for the private key for later configuration.

5. You will

   also need the private key value as well.

6. You will need to add an on-prem AD Application inside of Zilla. To do this, login to Zilla as an admin, select Add Application, then search for On-Prem AD and add it as an app.

...

1. need to request an sFTP server be created by Zilla (recommended) or have your own sFTP server. You can ask your Zilla Technical Resource (Sales Engineer or Customer Success Engineer) or submit a request by emailing support@zillasecurity.com. You must provide us with the public key file for us to create this server.

Configuring Active Directory

Creating a Service Account

We require you to create a domain user account that will be used to run the AD script we use to pull users. This account also requires read/write access to the directory where the Active Directory script is being stored.

For more information on how to create users in Active Directory, please see the video below:

...

Configuring the AD Script

1. Download the script

   View file
   name ADscript_version-R-12.ps1

   onto your domain controller

2. Open the file in an editor like VS Studio, and define what Organizational Units Zilla Will Pull Accounts from. You will do this by editing the below variable:

   1. $DNs = @("DC=yourdomain,DC=com") - this variable is used to define what Organizational Units Zilla Will Pull Accounts from. For example, if my OU is zillasecurity.com, then this line would look like this: $DNs = @("DC=zillasecurity,DC=com"). You can add multiple OUs by comma separating each OU’s domain name. NEED TO FINISH ONCE I GET CLARIFICATION

   If you want to automate this script, you will also need to adjust the following parameters in the file

   1. For example, if I had 2 OUs zillasecurity.com and zsec.io, this parameter would look like this: $DNs = @("DC=zsec,DC=io"), @("DC=zillasecurity,DC=com)

3. There are several parameters affiliated with pushing the generated export to an sFTP server:

   1. $isSftpEnabled = $false - this determines whether the CSV gets sent to an sFTP server. By default, this is turned off, and you will need to set this to $true to automate Active Directory.

   2. $sftpHost = "sftp.zillasecurity.com" - this is the hostname of the sFTP server we are sending the CSV to. If you are sending it to an sFTP server hosted by Zilla, then the default value (sftp.zillasecurity.com) can be left. If you are hosting this on your own sFTP server, then change the value to the hostname on your server.

   3. $sftpUsername = "<your domain.com>" - this is the username of the service account that will need to be created on your sFTP server. If you are using Zilla, the value for this will be the domain that is affiliated with your tenant. You can view this inside of Zilla by logging in as an admin, going to the settings on the left hand side panel, and looking at the first domain inside of your internal domains

      

   4. $applicationId = "<application-id>" - the application ID can be found by navigating to your active directory application inside of Zilla:

      

      and copying the string that appears inside of the URL:

      

   5. $sftpPrivateKeyPath = "<location of your private key>" - this is the full filepath and filename where you have stored your SSH Private Key. Please see the 3rd prerequisite for more details.For example if you stored the private key called private-key.pem in the filepath /Users/mpalella/Desktop, then the value for this parameter will be /Users/mpalella/Desktop/private-key.pem

   6. $Csvfile = "$path\directory.csv" - you can use this setting to change the name of the CSV file that is generated. You can leave this as is

4. Once the script is configured, use task scheduler to automate the running of the above script using the service account you you’ve created in the prerequisites Creating a Service Account step. This guide goes through how to accomplish this.

Setup sFTP Server

For Security reason, Zilla recommends that you have Zilla Support create an sFTP server that will store the generated CSVs. You can also host it on-premise; however, this would require you to create an outbound port 22 rule for Zilla to fetch the CSV. The process is outlined in this documentation.

Zilla Configuration

...

Navigate to the application that you created in step 5 in the prerequisites section.

...

Zilla Configuration

1. add an on-prem AD Application inside of Zilla. To do this, login to Zilla as an admin, select Add Application, then search for On-Prem AD and add it as an app.

...

2. Manually generate a CSV export using the script in Configuring the AD Script.

3. Select Sync Now, and import the CSV one time into Zilla. We have auto-mapped this already so you will just need to select import once uploaded:

Image Added

Image Added

4. Once you’ve successfully imported the CSV, select the gear icon inside of the application:

...

Upload one of the CSV exports that you generated to Zilla. See this guide on uploading a CSV.

3. Enable the Accounts & Permissions CSV File Upload section, then toggle on Use sFTP to automate CSV import.

...

4. Fill out the attributes in the form. Please see this section on guidance for how to fill these out..

   1. If you are using Zilla’s sFTP Server, then the values should be the following:

      1. Host: sftp.zillasecurity.com

      2. Port: 22

      3. Username: your zilla tenant’s domain. You can find this inside of the global settings of your zilla tenant. It will be the first domain listed under Your Domains. In the screenshot below, my sFTP username would be mp.access-ventures.com

         Image Added

      4. File Path: This is the name of the CSV file you are generating. Example would be directory.csv

      5. Password: The Private Key value generated. See step 5 in the requirements section for more information

   2. If you are using your own sFTP Server, then you will need to setup SSH Key-based authentication (see this guide for more info on how to do this) and add the public key you generated to your authorized_keys directory. You will also need to create a service account for zilla to use. Once this is done, the values in Zilla will be:

      1. Host: the hostname of your sFTP server

      2. Port: 22

      3. Username: the username of the service account you created.

      4. File Path: This is the path corresponding to where the CSV file is stored. For example if you stored the file directory.csv in /sftp/zilla on your sFTP server, then the value here would be sftp/zilla/directory.csv

      5. Password: The Private Key value generated. See step 5 in the requirements section for more information

...

5. Select Sync Now to kickoff the automated syncs.

Help:

Having trouble? Please refer to this documentation