Skip to main content

Who is this article for?

Incydr
Code42 for Enterprise
CrashPlan for Enterprise
CrashPlan for Small Business

Incydr, yes.

CrashPlan for Enterprise, yes.

Code42 for Enterprise, yes.

CrashPlan for Small Business, no.

This article applies to Code42 cloud environments.

HOME
GETTING STARTED
RELEASE NOTES
FAQs
APIs
SYSTEM STATUS
Code42 Support

Code42 User Directory Sync server hardening

Overview

To integrate your Code42 cloud environment with a directory service, you must configure User Directory Sync. This means installing the User Directory Sync tool to a dedicated server within your organization's environment as well as configuring the Code42 console. For directions, see Configure Code42 User Directory Sync.

The steps below provide best practices for implementing additional layers of security when deploying this tool in your environment. 

Considerations

  • To successfully run the User Directory Sync on a dedicated host, the computer must meet system requirements
  • Ensure your User Directory Sync installation is upgraded to the latest version.
  • For help with User Directory Sync, contact your Customer Success Manager (CSM) to engage the Professional Services team.

Deployment options

Virtual server

Code42 recommends deploying the Code42 User Directory Sync tool to a virtual server. Not only will this reduce your resources requirements, but then the tool is also abstracted from a physical machine. The virtualization hypervisor can be from any vendor so long as it supports:

  • Network-based communication
  • Java runtime
  • 64-bit execution environment

Physical server

Alternatively, the Code42 User Directory Sync tool can be deployed to a stand-alone, dedicated, minimal-resource server. We strongly recommend that the Code42 User Directory Sync tool is deployed to a different server than your Active Directory or LDAP server. 

Networking

Inbound connections

This tool does not need to receive inbound connections from any service in order to run. As a result, inbound connections that are not necessary for management should be blocked using the operating system's firewall or a third party networking tool.

Outbound connections

The UDS tool will need to make outbound connections to Code42 and your directory server. We recommend using encrypted ports whenever setting up these connections. The tool requires the following outbound connections are open: 

Port

Destination

443 (HTTPS)

Code42 cloud
636 (LDAPS) Your directory server

Permissions

For any permission controls, we recommend following the security principle of least privilege. This means that a person or process is given only the minimum level of access rights to complete an assigned operation. 

LDAP bind user

We recommend the directory bind user has read-only permissions to your directory, specifically within the search base for your target set of users.

OS service user

The operating system user account that will run the Code42 User Directory Sync tool should be given lowest-level permissions possible. The tool does not require administrative privileges to run.

Remote access user

It is recommended that no other users are able to remotely access this server (SSH or RDP) other than an admin if required.

  • Was this article helpful?