Common Configuration

Prerequisites

To facilitate server configuration please gather the following information before starting.

For General Settings

• public IP address or DNS name for the Mamori server

Enter these later under Properties.

For SMTP Server Integration (required for email alerts & account notifications)

• SMTP server IP address, port, username, password
• Logo File

For AD Integration

• IP Address, OU(s), AD Login users with Bind permission

For Adding Resources

• Have connection details for the resources you would like to access via Mamori (RDP, VDI, SSH, HTTP/S & DB)

For Mobile 2FA configuration

• Install the Mamori 2FA mobile app from the respective app store.

Configuration Steps

Prerequisites

Confirm General Server Settings

Or configure public IP / Web Server URL under Properties

Step 1 - Integrate your email server (optional) — install notes: SMTP server

Step 2 - Configure 2FA Providers — portal: Authentication Providers

Step 3 - Setup Directory Integration (optional)

Step 4 - Review Default Alerts

Step 5 - Review Default Roles

Step 6 - Review Default Resource Policies

Step 7 - Server SSL Certificates (portal) — AIO/HA and manual: Server SSL Certificate

Step 8 - Hardening Check List

SMTP server

Integrating an email server enables:

• Email alerts
• User login account emails
• User remote access key emails

Configure SMTP in the portal under Server Settings:

See SMTP Settings

2FA Providers

Mamori works with both built-in and supported external 2FA providers. Manage providers in the portal under Authentication Providers.

Built-in Providers

Mamori server has 2 built-in 2FA providers

• pushmobile - Uses the Mamori mobile app and Google FCM to send Apple/Android notifications. This requires the Mamori server to access both https://oauth2.googleapis.com/token and https://fcm.googleapis.com/fcm/send

• pushtotp - Uses a web browser, one time tokens and works without internet access. Ideal for Air Gap environments

To enable the providers ensure their Service URL property is set to the Mamori url that will be accessible from the mobile device.

Supported External Providers

• Azure 2FA

• Okta

• Duo

• PingId

• Yubi Key

• SASSPASS

Push Mobile

Open Authentication Providers, then edit the pushmobile provider.

Click Update Provider.

Push TOTP

Open Authentication Providers, then edit the pushtotp provider.

Click Update Provider.

External Provider

Add external 2FA providers from Authentication Providers: create a provider, choose the external type, fill in the vendor fields, then save.

For directory and identity setup, see Active Directory, Azure AD, and Identity Management Overview.

Alert channels

Mamori deploys with a commonly used set of alerts that will notify users via emails and the mobile app.

Pre-configured Alerts:

• default_intrusion
• default_policy_denied
• default_policy_endorsemet
• default_policy_request
• default_row_limit_violation
• default_error_alert

Alert Types

Alert action types (Email, Email Role, Notification, HTTP, Event) are documented under Alert Channels.

Intrusion

Configure this alert if you will be configuring WireGuard. This alert will be triggered when Mamori detects an unauthorized scan of the network.

Click Server Settings > Alerts

Find default_intrusion & Double-click to edit

Next, enter the details

Field	Description
Alert Name	intrusion
Alert Type	email
Email address	enter a comma separated list of email addresses
Email Subject	Mamori Alert! Device Blocked {{username}}
Email Body	user : {{username}} client ip: {{source}} device name : {{device}}

Click to add another alert in the channel

Click Create to save the channel

Policy Request

Configure this alert channel if you will be using on-demand access policies. This alert will be triggered when a user makes a policy requests. Alerting all relevant endorsers of the new request.

Click Server Settings > Alerts

Find default_policy_request & Double-click to edit

Next, enter the details

Field	Description
Alert Name	policy_request
Alert Type	email_role
Email address	enter {{endorsing_role} }
Email Subject	Access Request from {{applicant}} for {{procedure}}
Email Body	applicant : {{applicant}} message: {{applicant_message}} policy: {{procedure}} status: {{status}}

Click to add another alert in the channel

Click Create to save the channel

Policy Endorsement

Configure this alert channel if you will be using on-demand access policies. This alert will be triggered when a request is approved or denied. Alerting the applicant of the outcome.

Click Server Settings > Alerts

Find default_policy_endorsement & Double-click to edit

Next, enter the details

Field	Description
Alert Name	policy_endorsement_or_deny
Alert Type	email
Email address	enter {{applicant_email} }
Email Subject	Access Request for {{procedure}} {{status}}
Email Body	Status:{{status}} Policy : {{procedure}} comment: {{applicant_message}} Endorser: {{agent}} Endorser comment: {{agent_message}}

Click to add another alert in the channel

Click Create to save the channel

Alert Mobile, Slack & Line

Review commonly used roles

Mamori deploys with a commonly used set of roles.

Pre-configured roles:

• default_api_catalog_access
• default_network_scan_access
• default_wireguard_user
• default_policy_user
• default_policy_endorser
• default_database_credentials
• default_wireguard_user
• default_database_access_ro

Click here for role editor documentation

For Catalog Extracts

A role to access and extract log information via the Mamori API in the clear. By default all string literals in the SQL logs are masked.

Field	Description
Role Id	default_api_catalog_access
Mamori Permissions	VIEW CLEAR SQL LOG, LOG SESSION, VIEW ALL USER

For Database Access

These sets of roles are commonly used to directly grant access databases.They are not required if on-demand data policies are used since the policies will provide the permissions.

To access a database successfully a user needs

• A credential permission
• A session passthrough type permission
• At least SELECT on the database objects

To access the Web SQL console a user additionaly needs

• WEB SQL EDITOR
• WEB EXPORT DATA (Optional)

A role to contain all the target database crentials

Field	Description
Role Id	default_database_credentials
Database & Data > Credentials	Add the desired database credentials

A role that provides read only database access via WebSQL and DB Proxies

Field	Description
Role Id	default_database_access_ro
Mamori Permissions	WEB SQL EDITOR, WEB EXPORT DATA (Optional)
Database & Data > Object Privileges > Datasource	MASKED PASSTHROUGH
Database & Data > Object Privileges > DB Object	SELECT To use DB client tools also provide: CALL, EXECUTE SQL BLOCK, EXECUTE DYNAMIC SQL

For ZTNA Users

A role to identify WireGuard users. Users that login with this role will trigger the automatic device registration process.

Field	Description
Role Id	default_wireguard_user

A role allow network scans. Users with this role will not be blocked by the intrusion detection service.

Field	Description
Role Id	default_network_scan_access
Mamori Permissions	IP SCAN

For On-Demand Policies

A role to assign resource grant permissions. Users with this role be able able to make resource requests.

Field	Description
Role Id	default_policy_user
Mamori Permissions	REQUEST

A role to set as the endorsing role for resource and access policies. Users with this role be able to endorse resource requests.

Field	Description
Role Id	default_policy_endorser
Mamori Permissions	REQUEST

Review default resource polices

The mamori server comes with the following default policies:

default_date_range_resource_policy

For requesting non DB resources based on a date range

default_resource_policy

For requesting non DB resources based on an amount of time

default_role_resource_policy

For requesting Mamori roles based on an amount of time

default_db_resource_policy

For requesting DB resources based on an amount of time

Mamori will preconfigure the resources policies with the following defaults.

Section	Field	New Value
Request	Request Alert	default_policy_request
Endorsement	Endorsement Alert	default_policy_endorsement
Endorsement	Deny Alert	default_policy_deny
Endorsement	Endorsement Role	default_policy_endorser
Endorsement	Allow self endorsement	false

Click here for policy editor documentation

Server SSL Certificate

The Mamori server uses Nginx for SSL termination.

• All-in-one deployment — Set the server certificates via the web portal. See TLS Certificate.

• HA deployment — Manually place the certificate files on each application server node (see Manual below).

Web Portal

For all-in-one installs, install certificates in the portal:

See TLS Certificate

Manual

To setup the certificate for the Mamori server portal and proxies follow the steps below.

Step 1. Copy the key and certificate file on to the mamori server

Step 2. Create the install_certificate.sh script and chmod +x the file

#!/bin/sh

KEY_FILE=$1
CERT_FILE=$2

curl -X POST --data-urlencode name=mamori --data-urlencode "certs[key]"@$KEY_FILE --data-urlencode "certs[crt]"@$CERT_FILE http:// > localhost:4000/api/local/v1/certs

Step 3. Call the script

./install_cert.sh /home/user/myhost.key /home/user/myhost.crt

openssl rsa -outform der -in your-file.pem -out private.key
openssl x509 -outform der -in your-file.pem -out your-file.crt

Hardening Check List

Ensure all items are completed before deploying to production.

Steps

Step 1 - Store the portal root (breakglass) password in an external key store / secrets vault, and change it via Authentication Providers → admin when required

Step 2 - Enable the Mamori server firewall and open only used ports

Step 3 - Enforce 2FA for all logins

Step 4 - Executed the hardening guide for your Mamori server OS.
Click for basic hardening guide