Royal Apps

I have a feature request regarding the logging.

It would be nice if further logging was available with the Royal TS server, so that you for example can use it as a logging aggregator for all clients.

This logging would help greatly with GDPR requirements as we need central logging which cannot be tampered with (unless access to the Royal TS server).

The logging should then include which user accessed which connection at what time so that tracabillity is good, for example "user dialect\tejo connected to server BananaServer via RDP at 14:00:00 16-03-2018"

Moreover if someone edits/unlocks the document this should also be logged into the Royal TS server.

Best regards

Ted

Hey!

What i am looking for exactly is a way to send all the loggs from the clients to the royal TS server for easy aggregation off all logs so that you can see who has done what.

For example who edited a connection at what time, and which person connected to a server at a specific time. This should work when working towards a document centrally stored on the Royal TS server.

Example of proposed output from connection to server:

"user dialect\tejo connected to server BananaServer via RDP at 14:00:00 16-03-2018"

Example of proposed output from editing a connection:

"user dialect\tejo edited the password of Bri_adsrv01 at 14:00:00 16-03-2018"

The above mentioned should also logg when changing the password on a folder

The information that is logged to file is enough :)

We would also like to have this feature implemented in Royal Server for the same reasons. +1 vote!

Hey Michael

Is something like this already implemented? Especially the part "user dialect\tejo connected to server BananaServer via RDP at 14:00:00 16-03-2018" stated from Dialect_Skove.

I thought this was logged out of the box, but I could not find it at all. Not in logs, request/reponse logs and event viewer.

Kind regards

Jeffrey

Hi Michael,

the information shown and logged from Royal TS to Event Log is enough for our needs.

Hi everyone and Michael !

I know that this topic is 5 years old but I also would like to see such auditing features !

At least some basics as it can be requested by cyber insurances nowadays to be covered in case of an attack.

From the server/gateway POV, what would be interesting:

• Beeing able to get records of the which user logged in (with at leaste timestamp, source IP)
• Details of failed authentications attempts (known/unknown user, reason of failure like wrong password or MFA/timeout, ...)
• Which document(s) has been opened by whom and which rights were applyed and when
• Which tunnels were opened for an user and to which internal server, ...

From the RoyalTS/X clients POV, when interacting with RoyalServer's document from the store:

• Is the document was unlocked for modification
• What have been modified or revealed, ...
• If those records can be sent back to the server for central logging it would be nice too !

We already have a SOC that is monitoring accesses to our infrastructure to identify potential intrusions or account misuse (e.g. logged in from an unusual country) from the WAN side.

If all those informations can be send to a log file or event the Windows Eventlog of the RoyalServer, it can be grabbed by some agents (Winlogbeat, Wazuh, Splunk, ...) and alerting rule in near-realtime can be raised !

I also noticed that RoyalTS for Windows use Serilog and is already bundled with Splunk/ElasticSearch/ Syslog sinks, so adding the ability to directly send logs to such logging plateforms could be achieved without too much headache ;-)

Hope this will help !

As always, feel free to ask if you want more inputs on the topic :)

Best Regads,

Nicolas.

Hi Mickael !

Thank you for the detailed explanation ! It will be very useful :)

Maybe a KB article or tutorial would help other with similar needs as a starting point !

After posting my message I realized that Serilog was also used like RoyalTS. Also I didn't spotted those messages the first time as RoyalServer log a lot of performance metrics by default and what I looking for was lost in all of these ;-)

Regarding what is revealed or unlocked, 

• For document without lockdown-mode enabled, users can freely reveal password, sometime you need to let this ability to users (eg auto-fill does not work on some pages) and using security policy or lockdown-mode is not a choice : logging when a user reveal the password on an object (credential, connection, ...) can be useful.
• When lockdown-mode is enabled on the document, no reveal is possible unless you know the lockdown-password to unlock the document: being able to know who unlocked the document may help spot unauthorized access, added to password reveal logs you can know in such cases if there is a compromize

Personnaly I use Winlogbeat to send logs to an Elastic Stack through Logstash. Winlogbeat can easily read a flat log file with single or multilines log entries or directly from Windows Eventlogs, and Logstash can act as a syslog receiver, so I think that would be enough for a start!

You seems to use a lot of custom EventIDs (435 for service start, 5096 for perf, 26865 for starting config tool, etc ...), I'll try to filter the list and identify the more interesting ones but if you have a list of IDs used and their meaning, that can definitely help filter the output and collect only what matter for auditing :p

I'll try to setup a PoC with all those details and see how it goes ;-)

I'm going to fill a new feature request for RoyalTS/X logging to RoyalServer and let see what other users have in mind too !

Best Regards,

Nicolas.