banshee/active-directory-collection/active-directory/ssh/krbtgt

Age of the krbtgt password, by SSH

Returns the age, in days, of the password of each krbtgt account of the domain of a domain controller: the key that signs every Kerberos ticket of the domain. A ticket forged with a stolen copy of that key stays valid as long as the key is not changed. Two watches are proposed, both checked: a password too old, and the account krbtgt not found.

How it works

The collector runs one PowerShell command that searches the directory over LDAP, on the domain controller itself, for the users whose sAMAccountName starts with krbtgt:

powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $computer = Get-CimInstance Win32_ComputerSystem; $server = $computer.DNSHostName + '.' + $computer.Domain; $rootDSE = [ADSI]('LDAP://' + $server + '/RootDSE'); $domain = [ADSI]('LDAP://' + $server + '/' + $rootDSE.Properties['defaultNamingContext'][0]); $searcher = New-Object DirectoryServices.DirectorySearcher($domain, '(&(objectCategory=person)(objectClass=user)(sAMAccountName=krbtgt*))', @('sAMAccountName', 'pwdLastSet')); $now = [DateTime]::UtcNow; $accounts = @($searcher.FindAll() | ForEach-Object { @{name = [string]$_.Properties['samaccountname'][0]; days = [long]($now - [DateTime]::FromFileTimeUtc([long]$_.Properties['pwdlastset'][0])).TotalDays} }); ConvertTo-Json -Compress -Depth 4 -InputObject @{accounts = $accounts}"

The search starts at the domain, defaultNamingContext of the RootDSE of the domain controller, and reads two attributes of the schema of Active Directory: sAMAccountName and pwdLastSet, the time of the last change of the password, in hundreds of nanoseconds since 1 January 1601 UTC. The age is counted in whole days, on the domain controller.
The accounts found are krbtgt, the key of the domain, and krbtgt_<number>, the key of each read-only domain controller; any other account whose name starts with krbtgt is returned too.
No krbtgt account found stops the collector as misconfigured, as does an answer that is not the expected JSON.

Nothing is written to the Windows or to the directory: the command only reads. Changing the krbtgt password is the work of an administrator, twice, a replication apart.

Prerequisites

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later.
The OpenSSH server of Windows, installed and started, its default shell left at cmd.exe, the Windows firewall open to the poller on TCP 22, and the fingerprint of its host key set in protocol:ssh:fingerprint unless the Security settings trust the first SSH fingerprint presented: the steps are those of the windows/ssh/services collector of banshee/windows-collection.
An account of the domain for monitoring, without administrator rights, set in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key. No group is given here (see Limits).

Outputs

Name	Label	Unit	Per instance
`age`	Password age	d	yes, per account

Watches

Name	Title	Kind	Defaults	Checked by default
`old`	krbtgt password old	high threshold, on `age`	warning above 180 d, critical above 365 d	yes
`missing`	krbtgt account missing	expected instances, on `age`	critical when `krbtgt` is not found	yes

Limits

Not yet checked on a real domain controller: the execution; that an account of the domain without administrator rights reads pwdLastSet of the krbtgt accounts. The accounts are protected by AdminSDHolder, whose rights a domain may have narrowed. If it may not, the collector stops as misconfigured, or returns no account; the right to read the attribute is then given to the account on those objects, never by making it an administrator. Which right lets an account that is not an administrator open an SSH session on a domain controller.