Web Console FIPS Compliance Configuration (US9525)

By default, both Windows and SQL authentication requirements must be met for users to log in to the Web Console. To satisfy the FIPS compliance requirement, however, the Web Console needs to be reconfigured so that Windows authentication is the only form of authentication allowed.

To run the Web Console in FIPS compliance mode, you must first create Web Console domain users. Once users become domain users, they need to update the default.json and LogRhythm.Web.Services.ServicesHost.exe files on their Windows devices.

To add a domain user

1. In the SQL Server Management Studio, execute the following script against all LogRhythm databases except for CMDB:

   EXEC sp_addrolemember N'LogRhythmGlobalWebUI', N'DOMAIN\firstname.lastname

2. In the Object Explorer panel of the SQL Server Management Studio, expand the CMBD folder and then do the following:

   1. Expand the Security folder.
   2. Right click the Users folder and select New User.
   3. In the User name field, enter the user name.

   4. For the Login name click the corresponding ellipsis button.

      The Select Login dialog box displays.

   5. Click Browse.
   6. Scroll as needed to locate the user name (domain\firstname.lastname).
   7. Click the corresponding check box for the user name, then click OK.
   8. In the Select Login dialog box, click OK.

   9. In the Database User - New dialog box, click the ellipsis button to the right of the Default schema field.

      The Browse for Objects dialog box displays.

   10. Click the check box for [dbo], then click OK.
   11. In the Select Schema dialog box, click OK.
   12. In the Database role membership scroll box, click the check box for LogRhythmGlobalWebUI.
   13. Click OK to complete the process of adding a domain user.

After users are designated as domain users, they need to make the following configuration changes to their Windows devices.

1. From the Start menu, click Services.
2. In the Services dialog box, right-click LogRhythmServices Host and select Properties, then click the Log On tab.
3. Click the radio button for This Account.
4. Enter your domain user credentials, then click OK.

5. Using Windows Explorer, go to the LogRhythm.Web.Services.ServicesHost.exe.config file on your C drive (Program Files > LogRhythm > LogRhythm Web Console > Service>) and open it in a text editor, then modify the value of the ApplicationAccountType so that it reads as follows:

   <add key="ApplicationAccountType" value="WindowsAccountType" />

6. Save and close the LogRhythm.Web.Services.ServicesHost.exe file.

7. Go to the default.json file (Program Files > LogRhythm Web Console > config) and open it in a text editor, then do the following:

   1. Add parameter: "restrictToWindowsAuth": true,

   2. Delete the value for CaseUsername and leave it blank.

      "CaseUsername": "",

8. Save and close the default.json file.