Installation
You will receive the RealVNC Client PSM Connection Component from your CyberArk representative. The following instructions show you how to install it.
The RealVNC Client PSM Connector now supports the following Auth Types:
Single sign-on (SSO)
- Windows Domain accounts (RunAs)
- Requires adding additional settings to the connector defaults.
- Carefully read the instructions below. **
Windows Password (win)
- Windows user accounts on the target RealVNC server
- (Local accounts on the target VNC host)
- Requires adding additional settings to the connector defaults.
- Carefully read the instructions below. **
VNC Password (password) = RealVNC Password Authentication; Supported password types include:
- VNC Password (User)
- AdminPassword (Admin)
- ViewOnlyPassword (ViewOnly)
- Legacy Password (not secure, not recommended)
On the target VNC server (Target host), verify the server authentication setting:
If the target RealVNC Server authentication type is SSO or Windows, the RealVNC Client PSM Connection Component can be added to the corresponding Windows Desktop Local (AuthType:win) or Windows Domain (AuthType:SSO) Platforms.
If using AuthType win or SSO carefully read the instructions below. **
Configuration
AppLocker Settings
The PSM installation includes an AppLocker script which enables PSM users to invoke internal PSM applications, mandatory Windows applications, and 3rd party external applications that are used as clients in the PSM.
All AppLocker rules are defined in the PSMConfigureAppLocker.xml file in the PSM installation folder à Hardening.
- If your environment includes executables that must be allowed, in addition to those that are built-in to the PSM installation, such as PSM Universal Connectors executables, you must edit this file to add rules that will allow these executables.
- If you have connectors deployed using shared universal connector deployment on multiple PSM servers they will be updated automatically in the AppLocker rules. For details, see Deploy Universal Connectors on multiple PSM servers. Associated executables are automatically updated in the AppLocker rules, but DLL dependencies must be added manually.
- Beginning in version 12.2.4, DLL files are allowed only when located with the allowed executables. If your environment includes DLL files that are not located with the allowed executables, you must add them to the xmlfile.
If your PSM server is hardened, you will need to make the following configurations in order for AutoIt and additional executables to be excluded from the Applocker rules.
Open PowerShell as Administrator from:
C:\Program Files (x86)\Cyberark\PSM\Hardening
Run: notepad PSMConfigureAppLocker.xml
At the end of the PSMConfigureAppLocker.xml file, preceding the </AllowedApplications> tag, add the following lines:
<Application Name="AutoIt" Type="Exe" Path="C:\Program Files (x86)\AutoIt3\ AutoIt3.exe" Method="Hash" />
<Application Name="PSM-RealVNC762Dispatcher" Type="Exe" Path="C:\Program Files (x86)\CyberArk\PSM\Components\RealVNCClientDispatcher.exe" Method="Hash" />
Note: You may need to change the path(s) listed above to match your environment.
In the same PowerShell window run: PSMConfigureAppLocker.ps1
Following a successful completion of the script, reboot the PSM server to apply the AppLocker changes.
Connection Component Settings
Specify the following parameters at the connection component level:
Connection Component Root Level Parameters
Parameters that define generic settings of the PSM connection component.
| Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| DisableRemoteApp | Enable / Disable RDS RemoteApp Experience remote applications with the same look and feel as local applications. Reference | Yes/No | No |
| authentication level:i | Defines the server authentication level settings in the RDP file.
Note: Some PSM server environments require this to be set to 1 or 2. If this is not required, it is safe to delete this parameter. | 1,2,3 | 3 |
| ID | A unique ID that identifies the connection component Reference | String | PSM-RealVNC762 |
| DisplayName | Enable / Disable RDS RemoteApp Experience remote applications with the same look and feel as local applications. Reference | String | RealVNC Client v7.6.2 |
Component Parameters section
Parameters that define the PSM connection and how it will be performed. These parameters can be overridden at platform or account level.
| Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| ClientDispatcher | Defines the internal client that will open the target connection. | Command Path with Arguments | "{PSMComponentsFolder}\PSMRealVNCClientDispatcher.exe" "{PSMComponentsFolder}" |
| ConnectionComponentInitTimeout | The time allowed for the connection component to initialize, in milliseconds. | ms | 60000 |
User Parameters section
Parameters that determine the information that users will be required to supply while initiating the PSM connection. These parameters can be overridden at platform or account level.
| Parameter Name | Description | Acceptable Values | Default Value | Visible | Required | Type |
|---|---|---|---|---|---|---|
| AllowMappingLocalDrives | Whether users can redirect their local hard drives to the remote server. | Yes, No | Yes | Yes | Yes | CyberArk.TransparentConnection.BooleanUserParameter, CyberArk.PasswordVault.TransparentConnection |
| PSMRemoteMachine* | Target RealVNC Server Address | Host Address | Yes | No* | CyberArk.PasswordVault.Web.TransparentConnection.RemoteMachineUserParameter, CyberArk.PasswordVault.Web | |
* Only valid if AuthType = 'sso' | ||||||
Target Settings section
Parameters that define specific target machines settings. These parameters can be overridden at platform or account level.
| Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| ExeFullPath | The full path of the target application exe file located on the PSM Server. | Path Placeholders are acceptable | C:\Program Files\RealVNC\VNC Viewer\vncviewer.exe |
| AuthType | Target RealVNC Server authentication type ** If using 'win' or 'sso' see details below | password, win, sso | password |
| WaitBeforeCmdlineParmsHide | Time, in milliseconds, to wait before hiding the parameters in the command line. | <ms> | 2000 |
| CmdLineParmsHideTimeout | The time, in milliseconds, that PSM waits for the command line parameters hiding process to finish its operation. | <ms> | 2000 |
| EnableTrace | Show Connection process following 'Click to Connect' | Yes, No | No |
** If AuthType is 'SSO' also add the following:
User Parameter: PSMRemoteMachine
Set the following properties:
Type: CyberArk.PasswordVault.Web.TransparentConnection.RemoteMachineUserParameter, CyberArk.PasswordVault.Web
Known Issues
Please note: The legacy RealVNC CPM platform in incompatible with this connector.
If the target credential is a VNC password (not Windows local or domain), use the 7.6.1+ version of the RealVNC CPM plugin located here: https://community.cyberark.com/marketplace/s/#a35Ht0000013FdrIAE-a39Ht000003ATcKIAW
RealVNC Server can be run as a Windows Service (service or legacy -service), or under a specific user session (user or legacy -user). For more information click here.
Using RealVNCMode: 'user', 'legacy -user' or 'legacy -service' is not recommended.
Legacy uses an outdated and unsecure password schema.
Most environments will use service mode only.
Using Username (a.k.a Real VNC Type) 'GuestPassword' is not supported
RealVNC Server by default disables and discourages the use of the 'GuestPassword'
The RealVNC Client connector does not support the use of any of the following:
- Multi-Window Mode / Multi-Monitor Support
- RealVNC 'virtual mode' credentials
- RealVNC SmartCard Authentication
- RealVNC with Radius or MFA Authentication
- GuestPassword
- Weakpwd
If the target RealVNC Server authentication type is SSO or Windows, this PSM connector can be added to a compatible Windows Desktop Local or Windows Domain Platform.
This PSM Connector for RealVNC Client (v7.6.1+) supports the following Authentication Types:
Single sign-on (SSO) = Windows domain user
Windows (Win) = Local Windows User (Local users on the target RealVNC server)
Password = RealVNC Password Authentication;
Supported password types include:
- VNC Password (User)
- AdminPassword (Admin)
- ViewOnlyPassword (ViewOnly)
- Legacy Password (not secure, not recommended)
Legacy VNC server targets:
If the target (Non-RealVNC) VNC Server uses the legacy the VNC protocol and password, this PSM connector can be used with the corresponding RealVNC Platform as long as the target VNC account object is unmanaged.
Passwords for Non-RealVNC hosts cannot be managed by the CyberArk Marketplace "RealVNC Server Local Passwords" CPM plugin; However, this platform provides the parameters / File Categories required by this PSM connection component.
The connector will continue after displaying the Unencrypted connection warning message when connecting to legacy targets.