Terminator setup
Terminators are to be set up on destination host machines (see Overview). Currently terminators for Windows Remote Desktop and Linux (SSH) are available.
Please note that administrative privileges are required for the installation.
The following parameters are required during setup. The necessary values can be found on the Installers page in the admin panel:
- Organization - The unique URL associated with your organization's tenant.
- Token - An installation token used to authorize the client installation.
Windows Remote Desktop
Download KeystrikeTerminator.msi, a Microsoft Installer, from the admin panel, and install using one of the following methods:
Run the installer
- You can run the installer directly by double-clicking it in File Explorer.
- Enter the required parameters during installation.
Install with msiexec
To install the terminator with msiexec:
- Open a command prompt with administrator privileges.
- Run the following command:
msiexec /i <path_to_.msi> ORG="<organization_domain>" TOKEN="<install-token>"/qb
The exact command, pre-filled with the required parameters, can be copied from the admin panel.
VM Base image install
To install a non-initialized terminator to a VM base image (golden image) and then perform the initialization after VMs are created from the image
- Install the terminator on the base image without the parameters
msiexec /i <path_to_.msi> /qb
- During the initialization of each copy, feed the parameters to this copy of the terminator
sc.exe stop KeystrikeTerminatorService
sc.exe start KeystrikeTerminatorService configure <organization_domain> <install-token>
Proxy
If the device can only connect to dispatch through an explicit proxy, an optional proxy parameter can be passed to the installer in the format PROXY="FQDN:port" .
msiexec /i <path_to_.msi> ORG="<organization_domain>" TOKEN="<install-token>" PROXY="FQDN:port" /qb
Transparent proxys are common, in that case this parameter is not needed.
Post install
The installation will create three files in the %PROGRAMFILES%\Keystrike\Terminator folder:
- KeystrikeTerminatorService.exe - runs as a Windows Service, running in the context of the local system account (SYSTEM), ensuring that a terminator worker is running for every user.
- KeystrikeTerminatorWorker.exe - is started by the service for each user upon successful login of the user. The worker runs as SYSTEM and captures all incoming keystrokes and mouse clicks and verifies that attestations match.
- terminator.toml - a config file. This file requires no manual modification.
The terminator service runs automatically as soon as the install completes.
For troubleshooting, the terminator’s log files can be found at:
Linux (SSH)
Download tarball or RPM package from the admin panel.
The exact commands, shown below, pre-filled with the required parameters, can be copied from the admin panel.
Installation
1. In the download directory on the host, run the following:
For tarball
tar -xzf keystrike-ssh-terminator-<version> && cd keystrike-ssh-terminator && sudo ./install.sh
For RPM
sudo dnf install ./keystrike-ssh-terminator-<version>.rpm
This will create the user and group keystrike and install the executable as /usr/sbin/keystrike-ssh-terminator with the necessary permissions.
2. Connect the host to your organization
Run the config script as root
sudo keystrike-ssh-terminator configure <organization_domain> <install-token>
This will create configuration files for the SSH terminator in /etc/keystrike and set permissions. The parameters can be found on the Setup page in the Keystrike admin panel.
3. Turn the terminator on, and optionally the second factor
as described in /usr/share/doc/keystrike-ssh-terminator/CONFIGURATION.md
The configuration.md file describes different setup options for your given version of the Linux terminator.
The terminator will run for new sessions, not this one.
Once Terminator is running
New terminators get added to the default terminator group, which is by default in audit mode, this can be changed by configuring Terminator groups .
Alerts will appear in the admin panel and activity logs can be downloaded from there.