Least Privileged User: SysMon, Linux, Unix

Purpose

Although similar in function to the Windows Agent, the *nix Agents require different permissions because of the differences in operating systems. All *nix Agents share the same privilege footprint.

UNIX Agents can run under any user context unless syslog monitoring is enabled. Syslog on UNIX defaults to port 514, which requires root access.

Shared Resource

All *nix Agents require full control of their own installation directories.

Registry Access

N/A

Database Access

No Agent communicates directly with a LogRhythm database.

Ports

*nix Agents communicate on the same ports as Windows Agents. However, syslog data collection requires access to port 514.

Other Resources

*nix Agents have a different set of third-party integrations than normal Windows Agents.

Log Collection Interface	Permissions
Flat File Log Collection	Read permissions to target directories/files
Integrated UDP Syslog Server	Port only
Integrated TCP Syslog Server	Port only
System Performance Monitoring	Local system access
File Integrity Monitoring	Read permissions to target directories/files
Realtime File Integrity Monitoring	Read permissions to target directories/files
Process Monitor	Local system access
Network Connection Monitor	Local system access

If Registry Integrity Monitoring is enabled, additional permissions will be required (see the Other Resources item later in this section).

Database Access

An Agent does not require any access to any LogRhythm database. All database communications are handled by the associated Data Processor Mediator service.

Ports

Windows Agent ports can be configured in the Deployment Manager.

Click the System Monitors tab.
Select and right-click the specific Agent, and then click Properties.

Ports can be found in the Advanced settings, the Data Processor Settings, or the SNMP Trap Receiver tabs.

Port	Default Port	Inbound/Outbound	Purpose
Agent Port	3333	Outbound to Mediator	Port used to send logs to Mediator
MediatorPort*	40000	Outbound to Mediator	Data Processor communication port in unidirectional mode (if configured)
NetflowServerPort*	5500	Inbound from IPFIX/NetFlow/J-Flow	Inbound from IPFIX/NetFlow/J-Flow
SFlowServerUDPPort	6343	Inbound	Receiver for NetFlow UDB packets (if configured)
SecureSyslogPort*	6514	Inbound from remote sources	Receiver for secure syslog TCP communications (if configured)
SyslogTCPPort*	514	Inbound	Receiver for non-secure syslog TCP packets (if configured)
SyslogUDPPort*	514	Inbound	Receiver for non-secure syslog UDP packets (if configured)
SNMP Trap*	161	Inbound	Receiver for SNMP logs (if configured)
Remote Windows Events*	135,137, 138, 139, 445	Bidirectional	Remote Windows Host Event Log collection (if configured)
UDLA*	Varies by vendor (1433 for SQL Server)	Bidirectional	Database query port (varies by database type)
Check Point Firewall*	18184	Bidirectional	Log collection from Check Point firewalls
Cisco IDS*	443	Bidirectional	Log collection from Cisco IDS
Nessus*	8843	Bidirectional	Log collection from Nessus servers
Qualys*	443	Bidirectional	Log collection from Qualys servers
Metasploit*	3790	Bidirectional	Log collection from Metasploit
Nexpose*	3780	Bidirectional	Log collection from NeXpose
Retina*	1433	Bidirectional	Log collection from Retina
eStreamer*	4444	Bidirectional	Log collection from eStreamer
IP360	443	Bidirectional	Log collection from IP360

^{* If port is configured}

Other Resources

The Agents can connect to and/or read from a variety of third-party log sources. Depending on the log source, additional security permissions may be required for the Agent’s user context, or on the third-party system.

Log Collection Interface	Permissions
Flat File Log Collection	Read permissions to target directories/files
Windows Event Log Collection	Agent account must be a member of Event Log Readers on target system AND Windows Firewall rules must be enabled for: Remote Event Log Management (NP-In) Remote Event Log Management (RPC) Remote Event Log Management (RPC-EPMAP)
Remote Windows Event Log Collection	Same as above, only on target remote machine
Integrated UDP Syslog Server	Port only
Integrated TCP Syslog Server	Port only
Integrated Secure Syslog Server	Port only
Integrated NetFlow/J-Flow Server	Port only
Integrated IPFIX Server	Port only
Integrated sFlow Server	Port only
Integrated SNMP Trap Receiver	Port only
Remote Checkpoint Firewall Log Collection (via LEA)	Checkpoint API permissions
Remote Cisco IDS Log Collection (via SDEE)	SDEE API permissions
Remote Database Log Collection (UDLA)	A database account with read permissions to target tables
System Performance Monitoring	Account must be member of Performance Log users, Performance Monitor Users, and Event Log Readers groups
Data Loss Defender	Agent account needs device control (ioctl) on local system
File Integrity Monitoring	Read permissions to target directories/files
Real Time File Integrity Monitoring	Read permissions to target directories/files
Realtime Registry Integrity Monitoring	Read permissions for target registry keys
User Activity Monitoring	Read permissions for registry keys related to users
Process Monitor	Local system access
Network Connection Monitor	Local system access
Qualys Integration	Qualys API permissions
Nessus Integration	Nessus API permissions
NeXpose Integration	NeXpose API permissions
Metasploit Integration	Metasploit API permissions
Retina Integration	Retina API permissions
eStreamer Integration	eStreamer API permissions
IP360	IP360 API permissions

SmartResponse plug-ins are executed from either the ARM or the Windows Agent. In both cases, the SmartResponse runs under the context of the ARM service account. These plug-ins may include privilege escalation, impersonation, or alternate logins. Carefully review the SmartResponse actions you use to determine if any extra privileges are require—or exposed—by the SmartResponse.