Discover servers are passing passwords over command line during scanning.

Products

• Data Loss Prevention Network Discover

Issue/Introduction

Your organization's security policy disallows the storage of credentials locally

Using the native mounter, we don't see a way around this security concern. 

 

 

Environment

16.x

25.x

26.x

Windows Detection servers. 

Cause

Discover 1g using the native OS mounter requires credentials to be passed via command line to mount a share on windows. 

Resolution

• Solution 1: Use High speed discover
  • Convert your legacy single server or grid scans to utilize High Speed Discover(Discover 2g)
  • Discover 2G uses library APIs to scan shares (smbj for SMB/DFS, libNFS for NFS). Therefore, credentials are not passed to the command line/mounter for HSD.

 

• Solution 2: Use Jcifs
  • On the Discover server browse to <drive>:\Program Files\Symantec\DataLossPrevention\DetectionServer\<version>\Protect\config
  • edit Crawler.properties
  • change filesystemcrawler.use.jcifs = false to filesystemcrawler.use.jcifs = true
    This will run the entire mount process inside java rather than using the native system mount