Enable session recording on a target

Enable session recording on a target

출처: HashiCorp Boundary docs You must enable session recording for any targets that you want to record sessions on. When you create a storage bucket, Boundary provides you with an ID. You use the storage bucket's ID to associate a target with the storage bucket.

Requirements

  • One or more storage buckets to store the recordings.
  • Session recording is supported for SSH and RDP targets.
  • A KMS (Key Management Service) key with the purpose bsr must be added to the controller configuration. The key is used for encrypting data and checking the integrity of recordings. Refer to Create the controller configuration and the bsr KMS key documentation for more information about configuring a KMS block.
  • The targets must be configured with an ingress or egress worker filter that includes a worker with access to the storage bucket you created. Refer to SSH target attributes and RDP target attributes for more information.
  • You must enable injected application credentials on any target that you want to use for session recording. Refer to Configure targets with credential injection for more information about injecting application credentials. Complete the following steps to enable session recording on a target.
  1. Log in to Boundary.
  2. Click Orgs in the navigation pane.
  3. Select the org that contains the target you want to enable for session recording.
  4. Select the project that contains the target you want to enable for session recording.
  5. Select Targets in the navigation pane.
  6. Do one of the following:To create a new target, select New Target.To edit an existing target, select the target, and then select Edit Form.
  7. Select SSH or RDP for the Type, and then configure the target with any relevant attributes.
  8. Click Save.
  9. Click Enable recording.
  10. Enable the Record sessions for this target option.
  11. Select the storage bucket where you want to store recordings from this target.You can also create a new storage bucket.
  12. Click Save. Select the target type you want to enable for session recording:
  13. Log in to Boundary.
  14. Do one of the following:To enable an existing SSH target for session recording, run the following command:$ boundary targets update ssh -id tssh_1234567890 -enable-session-recording true -storage-bucket-id sb_1234567890 Make sure to add the -enable-session-recording true flag to turn on session recording for the target. Add the -storage-bucket-id ID for the storage bucket you want to associate with this target.To create a new SSH target and enable session recording, run the following command:$ boundary targets create ssh -scope-id p_1234567890 -default-port 22 -name test1 -address 99.12.345.67 -enable-session-recording true -storage-bucket-id sb_1234567890 Make sure to add the -enable-session-recording true flag to turn on session recording for the target. Add the -storage-bucket-id ID for the storage bucket you want to associate with this target. You can configure any other target attributes. You can now view the target from the Targets page in the Boundary console.
  15. Log in to Boundary.
  16. Do one of the following:To enable an existing RDP target for session recording, run the following command:$ boundary targets update rdp -id trdp_1234567890 -enable-session-recording true -storage-bucket-id sb_1234567890 Make sure to add the -enable-session-recording true flag to turn on session recording for the target. Add the -storage-bucket-id ID for the storage bucket you want to associate with this target.To create a new RDP target and enable session recording, run the following command:$ boundary targets create rdp -scope-id p_1234567890 -default-port 3389 -name windows-test -address 99.12.345.67 -enable-session-recording true -storage-bucket-id sb_1234567890 Make sure to add the -enable-session-recording true flag to turn on session recording for the target. Add the -storage-bucket-id ID for the storage bucket you want to associate with this target. You can configure any other target attributes. You can now view the target from the Targets page in the Boundary console. Apply the following Terraform policy for an SSH target:
resource
 "boundary_target"
 "ssh_target"
 {

  name         
=
 "ssh_target"

  description  
=
 "SSH target with session recording enabled"

  type         
=
 "ssh"

  default_port 
=
 "22"

  scope_id     
=
 boundary_scope.project.id

  address      
=
 "127.0.0.1"

  # Add the next two lines to an existing target to enable session recording.

  # Modify the value of storage_bucket_id as appropriate.

  enable_session_recording 
=
 true

  storage_bucket_id        
=
 boundary_storage_bucket.aws_example.id

}

Apply the following Terraform policy for an RDP target:

resource
 "boundary_target"
 "rdp_target"
 {

  name         
=
 "rdp_target"

  description  
=
 "RDP target with session recording enabled"

  type         
=
 "rdp"

  default_port 
=
 "3389"

  scope_id     
=
 boundary_scope.project.id

  address      
=
 "127.0.0.1"

  # Add the next two lines to an existing target to enable session recording.

  # Modify the value of storage_bucket_id as appropriate.

  enable_session_recording 
=
 true

  storage_bucket_id        
=
 boundary_storage_bucket.aws_example.id

}

Note RDP session recordings are generated from multiplexed protocol traffic and can contain multiple recorded channels within a single session.

Next steps

After you have enabled session recording, you can:

  • Find and view SSH sessions
  • Export and view RDP sessions You may want to configure storage policies to codify the lifecycle management of your session recordings.