public/Invoke-VPASAuditSafeTest.ps1
|
<#
.Synopsis Run audit safe tests CREATED BY: Vadim Melamed, EMAIL: vpasmodule@gmail.com .DESCRIPTION Use this function to run a safe audit test configured previosuly via Set-VPASAuditSafeTest .LINK https://vpasmodule.com/commands.html#Invoke-VPASAuditSafeTest .NOTES Category: PAM Tag: Safe Audit Since: v12.2.2 Version: 7 SelfHosted: TRUE PrivCloudStandard: TRUE SharedServices: TRUE SRS: TRUE .PARAMETER token HashTable of data containing various pieces of login information (PVWA, LoginToken, HeaderType, etc). If -token is not passed, function will use last known hashtable generated by New-VPASToken .EXAMPLE $RunAuditSafeTests = Invoke-VPASAuditSafeTest .OUTPUTS $true if successful --- $false if failed #> function Invoke-VPASAuditSafeTest{ [OutputType([bool])] [CmdletBinding(DefaultParameterSetName='Set1')] Param( [Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)] [hashtable]$token ) Begin{ $tokenval,$sessionval,$PVWA,$Header,$ISPSS,$IdentityURL,$EnableTextRecorder,$AuditTimeStamp,$NoSSL,$VaultVersion,$HideWarnings,$AuthenticatedAs,$SubDomain,$EnableTroubleshooting,$APICounter,$Creds,$AuthType,$IDPLogin,$SRS = Get-VPASSession -token $token $CommandName = $MyInvocation.MyCommand.Name $log = Write-VPASTextRecorder -inputval $CommandName -token $token -LogType COMMAND } Process{ $OutputResultsToFile = $true $ErrorInAudit = $false $AuditFailCount = 0 $curUser = $env:UserName $ConfigFilePath = "C:\Users\$curUser\AppData\Local\VPASModuleOutputs\Audits" $ConfigFile = "C:\Users\$curUser\AppData\Local\VPASModuleOutputs\Audits\AuditSafeTestConfigs.txt" if($OutputResultsToFile){ $OutputFile = "C:\Users\$curUser\AppData\Local\VPASModuleOutputs\Audits\AuditSafesResults.txt" $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : BEGINNING AUDIT TEST" | Set-Content $OutputFile } Write-Verbose "CONSTRUCTING FILEPATHS FOR AuditSafeTestConfigs" #FILE CREATION try{ if(Test-Path -Path $ConfigFilePath){ #DO NOTHING Write-Verbose "AuditSafeTestConfigs DIRECTORY EXISTS" if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : SAFE AUDIT PRECHECK 1 PASSED" | Add-Content $OutputFile } } else{ Write-Verbose "AuditSafeTestConfigs DIRECTORY DOES NOT EXIST...PLEASE RUN Set-VPASAuditSafeTest COMMAND TO INITIATE TEST CASES" Write-Verbose "Returning False" Write-VPASOutput -str "AuditSafeTestConfigs DIRECTORY DOES NOT EXIST...PLEASE RUN Set-VPASAuditSafeTes COMMAND TO INITIATE TEST CASES" -type E Write-VPASOutput -str "EXITING UTILITY" -type E if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : FAILED TO RUN SAFE AUDIT TEST" | Add-Content $OutputFile } return $false } if(Test-Path -Path $ConfigFile){ if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : SAFE AUDIT PRECHECK 2 PASSED" | Add-Content $OutputFile } #START PARSING FILE HERE $AllLines = Get-Content -Path $ConfigFile $AuditSafeNameConvention = "" $AuditNumberOfSafeMembers = 0 $AuditSafeMembers = @{} $AuditSafeMember = "" $AuditPermissions = @() $AuditCPMName = "" $AuditIgnoreSafes = @() foreach($line in $AllLines){ #SafeNamingConvention if($line -match "SafeNamingConvention="){ $tempVal = $line $tempValSplit = $tempVal -split "=" $AuditSafeNameConvention = $tempValSplit[1] Write-Verbose "SafeNamingConvention = $AuditSafeNameConvention" } #NumberOfSafeMembers if($line -match "NumberOfSafeMembers="){ $tempVal = $line $tempValSplit = $tempVal -split "=" $AuditNumberOfSafeMembers = [int]$tempValSplit[1] Write-Verbose "NumberOfSafeMembers = $AuditNumberOfSafeMembers" } #SafeMember if($line -match "SafeMember="){ $tempVal = $line $tempValSplit = $tempVal -split "=" $AuditSafeMember = $tempValSplit[1] Write-Verbose "SafeMember = $AuditSafeMember" } #Permissions if($line -match "Permissions="){ $tempVal = $line $tempValSplit = $tempVal -split "=" $AuditPermissionsTemp = $tempValSplit[1] Write-Verbose "Permissions = $AuditPermissionsTemp" $pUseAccounts = $false $pRetrieveAccounts = $false $pListAccounts = $false $pAddAccounts = $false $pUpdateAccountContent = $false $pUpdateAccountProperties = $false $pInitiateCPMAccountManagementOperations = $false $pSpecifyNextAccountContent = $false $pRenameAccounts = $false $pDeleteAccounts = $false $pUnlockAccounts = $false $pManageSafe = $false $pManageSafeMembers = $false $pBackupSafe = $false $pViewAuditLog = $false $pViewSafeMembers = $false $pAccessWithoutConfirmation = $false $pCreateFolders = $false $pDeleteFolders = $false $pMoveAccountsAndFolders = $false $pRequestsAuthorizationLevel1 = $false $pRequestsAuthorizationLevel2 = $false $AuditPermissions = $AuditPermissionsTemp -split ";" foreach($perm in $AuditPermissions){ if($perm -eq "UseAccounts"){ $pUseAccounts = $true } if($perm -eq "RetrieveAccounts"){ $pRetrieveAccounts = $true } if($perm -eq "ListAccounts"){ $pListAccounts = $true } if($perm -eq "AddAccounts"){ $pAddAccounts = $true } if($perm -eq "UpdateAccountContent"){ $pUpdateAccountContent = $true } if($perm -eq "UpdateAccountProperties"){ $pUpdateAccountProperties = $true } if($perm -eq "InitiateCPMAccountManagementOperations"){ $pInitiateCPMAccountManagementOperations = $true } if($perm -eq "SpecifyNextAccountContent"){ $pSpecifyNextAccountContent = $true } if($perm -eq "RenameAccounts"){ $pRenameAccounts = $true } if($perm -eq "DeleteAccounts"){ $pDeleteAccounts = $true } if($perm -eq "UnlockAccounts"){ $pUnlockAccounts = $true } if($perm -eq "ManageSafe"){ $pManageSafe = $true } if($perm -eq "ManageSafeMembers"){ $pManageSafeMembers = $true } if($perm -eq "BackupSafe"){ $pBackupSafe = $true } if($perm -eq "ViewAuditLog"){ $pViewAuditLog = $true } if($perm -eq "ViewSafeMembers"){ $pViewSafeMembers = $true } if($perm -eq "AccessWithoutConfirmation"){ $pAccessWithoutConfirmation = $true } if($perm -eq "CreateFolders"){ $pCreateFolders = $true } if($perm -eq "DeleteFolders"){ $pDeleteFolders = $true } if($perm -eq "MoveAccountsAndFolders"){ $pMoveAccountsAndFolders = $true } if($perm -eq "RequestsAuthorizationLevel1"){ $pRequestsAuthorizationLevel1 = $true } if($perm -eq "RequestsAuthorizationLevel2"){ $pRequestsAuthorizationLevel2 = $true } } $Perms = @{ UseAccounts = $pUseAccounts RetrieveAccounts = $pRetrieveAccounts ListAccounts = $pListAccounts AddAccounts = $pAddAccounts UpdateAccountContent = $pUpdateAccountContent UpdateAccountProperties = $pUpdateAccountProperties InitiateCPMAccountManagementOperations = $pInitiateCPMAccountManagementOperations SpecifyNextAccountContent = $pSpecifyNextAccountContent RenameAccounts = $pRenameAccounts DeleteAccounts = $pDeleteAccounts UnlockAccounts = $pUnlockAccounts ManageSafe = $pManageSafe ManageSafeMembers = $pManageSafeMembers BackupSafe = $pBackupSafe ViewAuditLog = $pViewAuditLog ViewSafeMembers = $pViewSafeMembers AccessWithoutConfirmation = $pAccessWithoutConfirmation CreateFolders = $pCreateFolders DeleteFolders = $pDeleteFolders MoveAccountsAndFolders = $pMoveAccountsAndFolders RequestsAuthorizationLevel1 = $pRequestsAuthorizationLevel1 RequestsAuthorizationLevel2 = $pRequestsAuthorizationLevel2 } $AuditSafeMembers += @{ $AuditSafeMember = $Perms } $AuditSafeMember = "" $AuditPermissions = @() } #CPMName if($line -match "CPMName="){ $tempVal = $line $tempValSplit = $tempVal -split "=" $AuditCPMName = $tempValSplit[1] Write-Verbose "CPMName = $AuditCPMName" } #IgnoreSafes if($line -match "IgnoreSafes="){ $tempVal = $line $tempValSplit = $tempVal -split "=" $AuditIgnoreSafesTemp = $tempValSplit[1] Write-Verbose "IgnoreSafes = $AuditIgnoreSafesTemp" $AuditIgnoreSafes = $AuditIgnoreSafesTemp -split ";" } } } else{ Write-Verbose "AuditSafeTestConfigs.txt DOES NOT EXIST...PLEASE RUN Set-VPASAuditSafeTes COMMAND TO INITIATE TEST CASES" Write-Verbose "Returning False" Write-VPASOutput -str "AuditSafeTestConfigs.txt DOES NOT EXIST...PLEASE RUN Set-VPASAuditSafeTes COMMAND TO INITIATE TEST CASES" -type E Write-VPASOutput -str "EXITING UTILITY" -type E if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : FAILED TO RUN SAFE AUDIT TEST" | Add-Content $OutputFile } return $false } }catch{ Write-VPASOutput -str "ERROR READING AuditSafeTestConfigs FILE" -type E Write-VPASOutput -str $_ -type E if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : FAILED TO RUN SAFE AUDIT TEST" | Add-Content $OutputFile write-output "$_" | Add-Content $OutputFile } return $false } if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDITING SAFES AGAINST THE FOLLOWING PARAMETERS:" | Add-Content $OutputFile write-output "$timestamp : `tSafeNameConvention = $AuditSafeNameConvention" | Add-Content $OutputFile write-output "$timestamp : `tCPMName = $AuditCPMName" | Add-Content $OutputFile write-output "$timestamp : `tIgnoreSafes = $AuditIgnoreSafes" | Add-Content $OutputFile write-output "$timestamp : `tNumberOfSafeMembers = $AuditNumberOfSafeMembers" | Add-Content $OutputFile $AllKeys = $AuditSafeMembers.Keys $targetMembers = @() $MemberCheckArr = @{} foreach($rec in $AllKeys){ $targetUser = $rec $str = "" $pUseAccounts = $AuditSafeMembers.$rec.UseAccounts $pRetrieveAccounts = $AuditSafeMembers.$rec.RetrieveAccounts $pListAccounts = $AuditSafeMembers.$rec.ListAccounts $pAddAccounts = $AuditSafeMembers.$rec.AddAccounts $pUpdateAccountContent = $AuditSafeMembers.$rec.UpdateAccountContent $pUpdateAccountProperties = $AuditSafeMembers.$rec.UpdateAccountProperties $pInitiateCPMAccountManagementOperations = $AuditSafeMembers.$rec.InitiateCPMAccountManagementOperations $pSpecifyNextAccountContent = $AuditSafeMembers.$rec.SpecifyNextAccountContent $pRenameAccounts = $AuditSafeMembers.$rec.RenameAccounts $pDeleteAccounts = $AuditSafeMembers.$rec.DeleteAccounts $pUnlockAccounts = $AuditSafeMembers.$rec.UnlockAccounts $pManageSafe = $AuditSafeMembers.$rec.ManageSafe $pManageSafeMembers = $AuditSafeMembers.$rec.ManageSafeMembers $pBackupSafe = $AuditSafeMembers.$rec.BackupSafe $pViewAuditLog = $AuditSafeMembers.$rec.ViewAuditLog $pViewSafeMembers = $AuditSafeMembers.$rec.ViewSafeMembers $pAccessWithoutConfirmation = $AuditSafeMembers.$rec.AccessWithoutConfirmation $pCreateFolders = $AuditSafeMembers.$rec.CreateFolders $pDeleteFolders = $AuditSafeMembers.$rec.DeleteFolders $pMoveAccountsAndFolders = $AuditSafeMembers.$rec.MoveAccountsAndFolders $pRequestsAuthorizationLevel1 = $AuditSafeMembers.$rec.RequestsAuthorizationLevel1 $pRequestsAuthorizationLevel2 = $AuditSafeMembers.$rec.RequestsAuthorizationLevel2 if($pUseAccounts){ $str += "UseAccounts;" } if($pRetrieveAccounts){ $str += "RetrieveAccounts;" } if($pListAccounts){ $str += "ListAccounts;" } if($pAddAccounts){ $str += "AddAccounts;" } if($pUpdateAccountContent){ $str += "UpdateAccountContent;" } if($pUpdateAccountProperties){ $str += "UpdateAccountProperties;" } if($pInitiateCPMAccountManagementOperations){ $str += "InitiateCPMAccountManagementOperations;" } if($pSpecifyNextAccountContent){ $str += "SpecifyNextAccountContent;" } if($pRenameAccounts){ $str += "RenameAccounts;" } if($pDeleteAccounts){ $str += "DeleteAccounts;" } if($pUnlockAccounts){ $str += "UnlockAccounts;" } if($pManageSafe){ $str += "ManageSafe;" } if($pManageSafeMembers){ $str += "ManageSafeMembers;" } if($pBackupSafe){ $str += "BackupSafe;" } if($pViewAuditLog){ $str += "ViewAuditLog;" } if($pViewSafeMembers){ $str += "ViewSafeMembers;" } if($pAccessWithoutConfirmation){ $str += "AccessWithoutConfirmation;" } if($pCreateFolders){ $str += "CreateFolders;" } if($pDeleteFolders){ $str += "DeleteFolders;" } if($pMoveAccountsAndFolders){ $str += "MoveAccountsAndFolders;" } if($pRequestsAuthorizationLevel1){ $str += "RequestsAuthorizationLevel1;" } if($pRequestsAuthorizationLevel2){ $str += "RequestsAuthorizationLevel2;" } $targetPermissions = $AuditSafeMembers.$rec write-output "$timestamp : `tTargetSafeMember = $targetUser" | Add-Content $OutputFile write-output "$timestamp : `tTargetPermissions = $str" | Add-Content $OutputFile $targetMembers += $targetUser.ToLower() $MemberCheckArr += @{ $targetUser = $false } } } $AllSafes = Get-VPASSafes -token $token -searchQuery "$AuditSafeNameConvention" if($AllSafes){ #WE HAVE A BUNCH OF SAFES NOW $counter = $AllSafes.count if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : $counter SAFES FOUND CONTAINING *$AuditSafeNameConvention* " | Add-Content $OutputFile Write-Verbose "FOUND $counter SAFES CONTAINING *$AuditSafeNameConvention* " } foreach($saferes in $AllSafes.value){ $safe = $saferes.safename $CPM = $saferes.managingCPM write-verbose "ANALYZING SAFE: $safe" if($AuditIgnoreSafes.Contains($safe)){ #DO NOTHING...SKIPPING SAFE Write-Verbose "SKIPPING $safe...PART OF IGNORE SAFE SET" } else{ #CONTINUE QUERYING IDIRA (formerly CyberArk) FOR MEMBERS AND OTHER CHECKS if($AuditCPMName -eq "NULL"){ #SKIPPING CPM AUDIT } else{ if($CPM -ne $AuditCPMName){ if([String]::IsNullOrEmpty($CPM)){ $CPM = "None" } if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (CPM) - $safe - CURRENT CPM ASSIGNED $CPM...SHOULD BE $AuditCPMName" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 Write-Verbose "CPM USER IS INCORRECT ON SAFE: $safe" } } } if($AuditNumberOfSafeMembers -eq "0"){ #SKIPPING SAFE MEMBERS CHECK } else{ $AllSafemembers = Get-VPASSafeMembers -token $token -safe $safe -IncludePredefinedMembers foreach($foundMember in $AllSafemembers.value){ $MemberName = $foundMember.memberName $permissions = $foundMember.permissions Write-Verbose "ANALYZING SAFE MEMBER: $MemberName ON SAFE: $safe" $MemberName = $MemberName.ToLower() if($targetMembers.Contains($MemberName)){ #FOUND TARGET MEMBER $MemberCheckArr.$MemberName = $true Write-Verbose "FOUND TARGET MEMBER: $MemberName ON SAFE: $safe" #CURRENT PERMS $pUseAccounts = $permissions.UseAccounts $pRetrieveAccounts = $permissions.RetrieveAccounts $pListAccounts = $permissions.ListAccounts $pAddAccounts = $permissions.AddAccounts $pUpdateAccountContent = $permissions.UpdateAccountContent $pUpdateAccountProperties = $permissions.UpdateAccountProperties $pInitiateCPMAccountManagementOperations = $permissions.InitiateCPMAccountManagementOperations $pSpecifyNextAccountContent = $permissions.SpecifyNextAccountContent $pRenameAccounts = $permissions.RenameAccounts $pDeleteAccounts = $permissions.DeleteAccounts $pUnlockAccounts = $permissions.UnlockAccounts $pManageSafe = $permissions.ManageSafe $pManageSafeMembers = $permissions.ManageSafeMembers $pBackupSafe = $permissions.BackupSafe $pViewAuditLog = $permissions.ViewAuditLog $pViewSafeMembers = $permissions.ViewSafeMembers $pAccessWithoutConfirmation = $permissions.AccessWithoutConfirmation $pCreateFolders = $permissions.CreateFolders $pDeleteFolders = $permissions.DeleteFolders $pMoveAccountsAndFolders = $permissions.MoveAccountsAndFolders $pRequestsAuthorizationLevel1 = $permissions.RequestsAuthorizationLevel1 $pRequestsAuthorizationLevel2 = $permissions.RequestsAuthorizationLevel2 #AUDIT PERMS $cUseAccounts = $AuditSafeMembers.$MemberName.UseAccounts $cRetrieveAccounts = $AuditSafeMembers.$MemberName.RetrieveAccounts $cListAccounts = $AuditSafeMembers.$MemberName.ListAccounts $cAddAccounts = $AuditSafeMembers.$MemberName.AddAccounts $cUpdateAccountContent = $AuditSafeMembers.$MemberName.UpdateAccountContent $cUpdateAccountProperties = $AuditSafeMembers.$MemberName.UpdateAccountProperties $cInitiateCPMAccountManagementOperations = $AuditSafeMembers.$MemberName.InitiateCPMAccountManagementOperations $cSpecifyNextAccountContent = $AuditSafeMembers.$MemberName.SpecifyNextAccountContent $cRenameAccounts = $AuditSafeMembers.$MemberName.RenameAccounts $cDeleteAccounts = $AuditSafeMembers.$MemberName.DeleteAccounts $cUnlockAccounts = $AuditSafeMembers.$MemberName.UnlockAccounts $cManageSafe = $AuditSafeMembers.$MemberName.ManageSafe $cManageSafeMembers = $AuditSafeMembers.$MemberName.ManageSafeMembers $cBackupSafe = $AuditSafeMembers.$MemberName.BackupSafe $cViewAuditLog = $AuditSafeMembers.$MemberName.ViewAuditLog $cViewSafeMembers = $AuditSafeMembers.$MemberName.ViewSafeMembers $cAccessWithoutConfirmation = $AuditSafeMembers.$MemberName.AccessWithoutConfirmation $cCreateFolders = $AuditSafeMembers.$MemberName.CreateFolders $cDeleteFolders = $AuditSafeMembers.$MemberName.DeleteFolders $cMoveAccountsAndFolders = $AuditSafeMembers.$MemberName.MoveAccountsAndFolders $cRequestsAuthorizationLevel1 = $AuditSafeMembers.$MemberName.RequestsAuthorizationLevel1 $cRequestsAuthorizationLevel2 = $AuditSafeMembers.$MemberName.RequestsAuthorizationLevel2 if($pUseAccounts -ne $cUseAccounts){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName UseAccounts IS SET TO $pUseAccounts...SHOULD BE SET TO $cUseAccounts" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "UseAccounts PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pRetrieveAccounts -ne $cRetrieveAccounts){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName RetrieveAccounts IS SET TO $pRetrieveAccounts...SHOULD BE SET TO $cRetrieveAccounts" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "RetrieveAccounts PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pListAccounts -ne $cListAccounts){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName ListAccounts IS SET TO $pListAccounts...SHOULD BE SET TO $cListAccounts" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "ListAccounts PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pAddAccounts -ne $cAddAccounts){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName AddAccounts IS SET TO $pAddAccounts...SHOULD BE SET TO $cAddAccounts" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "AddAccounts PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pUpdateAccountContent -ne $cUpdateAccountContent){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName UpdateAccountContent IS SET TO $pUpdateAccountContent...SHOULD BE SET TO $cUpdateAccountContent" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "UpdateAccountContent PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pUpdateAccountProperties -ne $cUpdateAccountProperties){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName UpdateAccountProperties IS SET TO $pUpdateAccountProperties...SHOULD BE SET TO $cUpdateAccountProperties" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "UpdateAccountProperties PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pInitiateCPMAccountManagementOperations -ne $cInitiateCPMAccountManagementOperations){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName InitiateCPMAccountManagementOperations IS SET TO $pInitiateCPMAccountManagementOperations...SHOULD BE SET TO $cInitiateCPMAccountManagementOperations" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "InitiateCPMAccountManagementOperations PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pSpecifyNextAccountContent -ne $cSpecifyNextAccountContent){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName SpecifyNextAccountContent IS SET TO $pSpecifyNextAccountContent...SHOULD BE SET TO $cSpecifyNextAccountContent" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "SpecifyNextAccountContent PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pRenameAccounts -ne $cRenameAccounts){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName RenameAccounts IS SET TO $pRenameAccounts...SHOULD BE SET TO $cRenameAccounts" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "RenameAccounts PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pDeleteAccounts -ne $cDeleteAccounts){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName DeleteAccounts IS SET TO $pDeleteAccounts...SHOULD BE SET TO $cDeleteAccounts" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "DeleteAccounts PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pUnlockAccounts -ne $cUnlockAccounts){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName UnlockAccounts IS SET TO $pUnlockAccounts...SHOULD BE SET TO $cUnlockAccounts" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "UnlockAccounts PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pManageSafe -ne $cManageSafe){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName ManageSafe IS SET TO $pManageSafe...SHOULD BE SET TO $cManageSafe" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "ManageSafe PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pManageSafeMembers -ne $cManageSafeMembers){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName ManageSafeMembers IS SET TO $pManageSafeMembers...SHOULD BE SET TO $cManageSafeMembers" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "ManageSafeMembers PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pBackupSafe -ne $cBackupSafe){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName BackupSafe IS SET TO $pBackupSafe...SHOULD BE SET TO $cBackupSafe" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "BackupSafe PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pViewAuditLog -ne $cViewAuditLog){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName ViewAuditLog IS SET TO $pViewAuditLog...SHOULD BE SET TO $cViewAuditLog" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "ViewAuditLog PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pViewSafeMembers -ne $cViewSafeMembers){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName ViewSafeMembers IS SET TO $pViewSafeMembers...SHOULD BE SET TO $cViewSafeMembers" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "ViewSafeMembers PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pAccessWithoutConfirmation -ne $cAccessWithoutConfirmation){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName AccessWithoutConfirmation IS SET TO $pAccessWithoutConfirmation...SHOULD BE SET TO $cAccessWithoutConfirmation" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "AccessWithoutConfirmation PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pCreateFolders -ne $cCreateFolders){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName CreateFolders IS SET TO $pCreateFolders...SHOULD BE SET TO $cCreateFolders" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "CreateFolders PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pDeleteFolders -ne $cDeleteFolders){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName DeleteFolders IS SET TO $pDeleteFolders...SHOULD BE SET TO $cDeleteFolders" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "DeleteFolders PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pMoveAccountsAndFolders -ne $cMoveAccountsAndFolders){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName MoveAccountsAndFolders IS SET TO $pMoveAccountsAndFolders...SHOULD BE SET TO $cMoveAccountsAndFolders" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "MoveAccountsAndFolders PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pRequestsAuthorizationLevel1 -ne $cRequestsAuthorizationLevel1){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName RequestsAuthorizationLevel1 IS SET TO $pRequestsAuthorizationLevel1...SHOULD BE SET TO $cRequestsAuthorizationLevel1" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "RequestsAuthorizationLevel1 PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } if($pRequestsAuthorizationLevel2 -ne $cRequestsAuthorizationLevel2){ $ErrorInAudit = $true if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER PERMISSION) - $safe - $MemberName RequestsAuthorizationLevel2 IS SET TO $pRequestsAuthorizationLevel2...SHOULD BE SET TO $cRequestsAuthorizationLevel2" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } Write-Verbose "RequestsAuthorizationLevel2 PERMISSION FOR $MemberName ON SAFE: $safe IS INCORRECT" } } } $AllCheckKeys = $MemberCheckArr.Keys foreach($CheckKey in $AllCheckKeys){ if($MemberCheckArr.$CheckKey -eq $false){ if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : AUDIT FAIL (SAFE MEMBER) - $safe - MISSING SAFE MEMBER: $CheckKey" | Add-Content $OutputFile $ErrorInAudit = $true $AuditFailCount += 1 } } } } } } } else{ Write-Verbose "FAILED TO QUERY IDIRA (formerly CyberArk) FOR SAFES" Write-Verbose "Returning False" Write-VPASOutput -str "FAILED TO QUERY IDIRA (formerly CyberArk) FOR SAFES" -type E Write-VPASOutput -str "EXITING UTILITY" -type E if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : FAILED TO RUN SAFE AUDIT TEST" | Add-Content $OutputFile } return $false } if($OutputResultsToFile){ $timestamp = Get-Date -Format "(MM-dd-yyyy HH:mm:ss)" write-output "$timestamp : $AuditFailCount FAILED AUDIT TESTS" | Add-Content $OutputFile } if($ErrorInAudit){ Write-Verbose "SOME AUDIT CHECKS FAILED...RETURNING FALSE" Write-VPASOutput -str "AuditSafeTest RAN SUCCESSFULLY, BUT SOME ERRORS WERE DISCOVERED" -type M Write-VPASOutput -str "VIEW AUDIT LOG LOCATED HERE TO VIEW MORE DETAILS: $OutputFile" -type M return $false } else{ Write-Verbose "ALL AUDIT CHECKS PASSED...RETURNING TRUE" Write-VPASOutput -str "ALL AUDIT CHECKS PASSED!!!" -type G return $true } } End{ $log = Write-VPASTextRecorder -inputval $CommandName -token $token -LogType DIVIDER $token = Update-VPASSession -AddCounter $APICounter -InputToken $token } } # SIG # Begin signature block # MIIsuQYJKoZIhvcNAQcCoIIsqjCCLKYCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB # gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR # AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUNgv0sWUQm2BZhi8XdiSZikxb # KCyggiXzMIIFbzCCBFegAwIBAgIQSPyTtGBVlI02p8mKidaUFjANBgkqhkiG9w0B # AQwFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVy # MRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEh # MB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIxMDUyNTAwMDAw # MFoXDTI4MTIzMTIzNTk1OVowVjELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3Rp # Z28gTGltaXRlZDEtMCsGA1UEAxMkU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5n # IFJvb3QgUjQ2MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjeeUEiIE # JHQu/xYjApKKtq42haxH1CORKz7cfeIxoFFvrISR41KKteKW3tCHYySJiv/vEpM7 # fbu2ir29BX8nm2tl06UMabG8STma8W1uquSggyfamg0rUOlLW7O4ZDakfko9qXGr # YbNzszwLDO/bM1flvjQ345cbXf0fEj2CA3bm+z9m0pQxafptszSswXp43JJQ8mTH # qi0Eq8Nq6uAvp6fcbtfo/9ohq0C/ue4NnsbZnpnvxt4fqQx2sycgoda6/YDnAdLv # 64IplXCN/7sVz/7RDzaiLk8ykHRGa0c1E3cFM09jLrgt4b9lpwRrGNhx+swI8m2J # mRCxrds+LOSqGLDGBwF1Z95t6WNjHjZ/aYm+qkU+blpfj6Fby50whjDoA7NAxg0P # OM1nqFOI+rgwZfpvx+cdsYN0aT6sxGg7seZnM5q2COCABUhA7vaCZEao9XOwBpXy # bGWfv1VbHJxXGsd4RnxwqpQbghesh+m2yQ6BHEDWFhcp/FycGCvqRfXvvdVnTyhe # Be6QTHrnxvTQ/PrNPjJGEyA2igTqt6oHRpwNkzoJZplYXCmjuQymMDg80EY2NXyc # uu7D1fkKdvp+BRtAypI16dV60bV/AK6pkKrFfwGcELEW/MxuGNxvYv6mUKe4e7id # FT/+IAx1yCJaE5UZkADpGtXChvHjjuxf9OUCAwEAAaOCARIwggEOMB8GA1UdIwQY # MBaAFKARCiM+lvEH7OKvKe+CpX/QMKS0MB0GA1UdDgQWBBQy65Ka/zWWSC8oQEJw # IDaRXBeF5jAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zATBgNVHSUE # DDAKBggrBgEFBQcDAzAbBgNVHSAEFDASMAYGBFUdIAAwCAYGZ4EMAQQBMEMGA1Ud # HwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmlj # YXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0 # cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBDAUAA4IBAQASv6Hvi3Sa # mES4aUa1qyQKDKSKZ7g6gb9Fin1SB6iNH04hhTmja14tIIa/ELiueTtTzbT72ES+ # BtlcY2fUQBaHRIZyKtYyFfUSg8L54V0RQGf2QidyxSPiAjgaTCDi2wH3zUZPJqJ8 # ZsBRNraJAlTH/Fj7bADu/pimLpWhDFMpH2/YGaZPnvesCepdgsaLr4CnvYFIUoQx # 2jLsFeSmTD1sOXPUC4U5IOCFGmjhp0g4qdE2JXfBjRkWxYhMZn0vY86Y6GnfrDyo # XZ3JHFuu2PMvdM+4fvbXg50RlmKarkUT2n/cR/vfw1Kf5gZV6Z2M8jpiUbzsJA8p # 1FiAhORFe1rYMIIGGjCCBAKgAwIBAgIQYh1tDFIBnjuQeRUgiSEcCjANBgkqhkiG # 9w0BAQwFADBWMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVk # MS0wKwYDVQQDEyRTZWN0aWdvIFB1YmxpYyBDb2RlIFNpZ25pbmcgUm9vdCBSNDYw # HhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBUMQswCQYDVQQGEwJHQjEY # MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSswKQYDVQQDEyJTZWN0aWdvIFB1Ymxp # YyBDb2RlIFNpZ25pbmcgQ0EgUjM2MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB # igKCAYEAmyudU/o1P45gBkNqwM/1f/bIU1MYyM7TbH78WAeVF3llMwsRHgBGRmxD # eEDIArCS2VCoVk4Y/8j6stIkmYV5Gej4NgNjVQ4BYoDjGMwdjioXan1hlaGFt4Wk # 9vT0k2oWJMJjL9G//N523hAm4jF4UjrW2pvv9+hdPX8tbbAfI3v0VdJiJPFy/7Xw # iunD7mBxNtecM6ytIdUlh08T2z7mJEXZD9OWcJkZk5wDuf2q52PN43jc4T9OkoXZ # 0arWZVeffvMr/iiIROSCzKoDmWABDRzV/UiQ5vqsaeFaqQdzFf4ed8peNWh1OaZX # nYvZQgWx/SXiJDRSAolRzZEZquE6cbcH747FHncs/Kzcn0Ccv2jrOW+LPmnOyB+t # AfiWu01TPhCr9VrkxsHC5qFNxaThTG5j4/Kc+ODD2dX/fmBECELcvzUHf9shoFvr # n35XGf2RPaNTO2uSZ6n9otv7jElspkfK9qEATHZcodp+R4q2OIypxR//YEb3fkDn # 3UayWW9bAgMBAAGjggFkMIIBYDAfBgNVHSMEGDAWgBQy65Ka/zWWSC8oQEJwIDaR # XBeF5jAdBgNVHQ4EFgQUDyrLIIcouOxvSK4rVKYpqhekzQwwDgYDVR0PAQH/BAQD # AgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwGwYD # VR0gBBQwEjAGBgRVHSAAMAgGBmeBDAEEATBLBgNVHR8ERDBCMECgPqA8hjpodHRw # Oi8vY3JsLnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNDb2RlU2lnbmluZ1Jvb3RS # NDYuY3JsMHsGCCsGAQUFBwEBBG8wbTBGBggrBgEFBQcwAoY6aHR0cDovL2NydC5z # ZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdSb290UjQ2LnA3YzAj # BggrBgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wDQYJKoZIhvcNAQEM # BQADggIBAAb/guF3YzZue6EVIJsT/wT+mHVEYcNWlXHRkT+FoetAQLHI1uBy/YXK # ZDk8+Y1LoNqHrp22AKMGxQtgCivnDHFyAQ9GXTmlk7MjcgQbDCx6mn7yIawsppWk # vfPkKaAQsiqaT9DnMWBHVNIabGqgQSGTrQWo43MOfsPynhbz2Hyxf5XWKZpRvr3d # MapandPfYgoZ8iDL2OR3sYztgJrbG6VZ9DoTXFm1g0Rf97Aaen1l4c+w3DC+IkwF # kvjFV3jS49ZSc4lShKK6BrPTJYs4NG1DGzmpToTnwoqZ8fAmi2XlZnuchC4NPSZa # PATHvNIzt+z1PHo35D/f7j2pO1S8BCysQDHCbM5Mnomnq5aYcKCsdbh0czchOm8b # kinLrYrKpii+Tk7pwL7TjRKLXkomm5D1Umds++pip8wH2cQpf93at3VDcOK4N7Ew # oIJB0kak6pSzEu4I64U6gZs7tS/dGNSljf2OSSnRr7KWzq03zl8l75jy+hOds9TW # SenLbjBQUGR96cFr6lEUfAIEHVC1L68Y1GGxx4/eRI82ut83axHMViw1+sVpbPxg # 51Tbnio1lB93079WPFnYaOvfGAA0e0zcfF/M9gXr+korwQTh2Prqooq2bYNMvUoU # KD85gnJ+t0smrWrb8dee2CvYZXD5laGtaAxOfy/VKNmwuWuAh9kcMIIGRzCCBK+g # AwIBAgIQacs5SDkvNuif0aEmZmr03jANBgkqhkiG9w0BAQwFADBUMQswCQYDVQQG # EwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSswKQYDVQQDEyJTZWN0aWdv # IFB1YmxpYyBDb2RlIFNpZ25pbmcgQ0EgUjM2MB4XDTI1MDEyOTAwMDAwMFoXDTI4 # MDEyOTIzNTk1OVowXjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCk5ldyBKZXJzZXkx # HDAaBgNVBAoME0N5YmVyTWVsIENvbnN1bHRpbmcxHDAaBgNVBAMME0N5YmVyTWVs # IENvbnN1bHRpbmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDBQmSv # dfamF8o0CJr4vbHCcJ4rwx6T1HR3d32u4aIf9v9p/GV4nFdG4PP9SMjWw7Nx9CLF # qGPpkw7aDU2IxwpfPYExDzkCj2pgiyeVKlL0itTlPocb6i1cZLe/WHV7aUkGkVlf # vyYIqdJ9uw711dhNWmMhlqo+/qyp+gpKqaiFHm6mWNVg2KLTH5Pu38cBoGhS1tn7 # mlQbtALNjehkpFw2AAntEIBzM3ZEg9WBxQlgYY0yAPkydYbJfTEOEFJqHUPTSV46 # jx22Jb9dl0cEIPsGrCp+Jo5Ugusp9oZECZ8bGt7Vc9jYoIWGpqcRDq1JZFNCSVvN # E4N3ECGjq6W3kYW7ot0CP1DkpJ93a5wrksQ6bvYGUy3lghkMvzjkkq/NVUDEVcdN # R7PsUFf654vSw+iLINZ+9kYg+ZnplfndT/JSMJDAaWkM5oLu6+ao0774QWrsHOtt # z7M8EDU+3PntYHglwWoej6qXIFRurgXdwAXXyXYcSmkOTbPqrjSwsbs8CuSwGqeb # bRSDKfjRzDqQ9D1AZ/JHHaaUkBbAYBsVMrvypDSrP/1o37mt4Zky28BnEp5ztEGp # 0HJ44X4rFVWWz+BfeuZWcVUcGKW2YFHobNwGmJ/OanLvlnmtpZIRLF9ZkbzCHHom # i+RId4g3fc3FsGxKqEW9Vj8PCumwKc6LUwZU4wIDAQABo4IBiTCCAYUwHwYDVR0j # BBgwFoAUDyrLIIcouOxvSK4rVKYpqhekzQwwHQYDVR0OBBYEFCiCHmEfvPkU1uIc # 2sPugFDBq88SMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQM # MAoGCCsGAQUFBwMDMEoGA1UdIARDMEEwNQYMKwYBBAGyMQECAQMCMCUwIwYIKwYB # BQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAEEATBJBgNVHR8E # QjBAMD6gPKA6hjhodHRwOi8vY3JsLnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWND # b2RlU2lnbmluZ0NBUjM2LmNybDB5BggrBgEFBQcBAQRtMGswRAYIKwYBBQUHMAKG # OGh0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5n # Q0FSMzYuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAN # BgkqhkiG9w0BAQwFAAOCAYEAmLUUP/C5nHN/qX27dIrfNezHdUul/uhOA5CwNkD7 # P4pvLJButR/S1OmvozuzJJTce6824IylnXkRwUFj04XLbodkBL7+YwQ5ml7CjdDS # Vo+sI/38jcEQ6FgosV/TTJSiFAgqMNwkx/kSzvQ1/Ufp5YVKggCXGJ4VitIzl5nM # bzzu35G/uy4vmCQfh0KPYUTJYiRsF6Z3XJiIVtYrEwN/ikif/WFGrzsFj1OOWHNn # 5qDOP80xExmRS09z/wdZE9RdjPv5fYLnKWy1+GQ/w1vzg/l2vUXIgBV0MxalUfTP # 4V9Spsodrb+noPXiCy5n+6hy9yCf3EQb3G1n8rT/a454fLSijMm6bhrgBRqhPUUt # n6ZIBdEJzJUI6ftuXrQnB/U7zf32xcTTAW7WPem7DFK/4JrSaxiXcSkxQ4kXJDVo # DPUJdpb0c5XdWVJO0DCkB35ONEIoqT6VjEIjLPSw9UXE420r1OIpV8FRJqrW4Fr5 # RUveEUlyF+FyygVOYZECNsjRMIIGgjCCBGqgAwIBAgIQNsKwvXwbOuejs902y8l1 # aDANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBK # ZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRS # VVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlv # biBBdXRob3JpdHkwHhcNMjEwMzIyMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjBXMQsw # CQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMS4wLAYDVQQDEyVT # ZWN0aWdvIFB1YmxpYyBUaW1lIFN0YW1waW5nIFJvb3QgUjQ2MIICIjANBgkqhkiG # 9w0BAQEFAAOCAg8AMIICCgKCAgEAiJ3YuUVnnR3d6LkmgZpUVMB8SQWbzFoVD9mU # EES0QUCBdxSZqdTkdizICFNeINCSJS+lV1ipnW5ihkQyC0cRLWXUJzodqpnMRs46 # npiJPHrfLBOifjfhpdXJ2aHHsPHggGsCi7uE0awqKggE/LkYw3sqaBia67h/3awo # qNvGqiFRJ+OTWYmUCO2GAXsePHi+/JUNAax3kpqstbl3vcTdOGhtKShvZIvjwulR # H87rbukNyHGWX5tNK/WABKf+Gnoi4cmisS7oSimgHUI0Wn/4elNd40BFdSZ1Ewpu # ddZ+Wr7+Dfo0lcHflm/FDDrOJ3rWqauUP8hsokDoI7D/yUVI9DAE/WK3Jl3C4LKw # Ipn1mNzMyptRwsXKrop06m7NUNHdlTDEMovXAIDGAvYynPt5lutv8lZeI5w3MOlC # ybAZDpK3Dy1MKo+6aEtE9vtiTMzz/o2dYfdP0KWZwZIXbYsTIlg1YIetCpi5s14q # iXOpRsKqFKqav9R1R5vj3NgevsAsvxsAnI8Oa5s2oy25qhsoBIGo/zi6GpxFj+mO # dh35Xn91y72J4RGOJEoqzEIbW3q0b2iPuWLA911cRxgY5SJYubvjay3nSMbBPPFs # yl6mY4/WYucmyS9lo3l7jk27MAe145GWxK4O3m3gEFEIkv7kRmefDR7Oe2T1HxAn # ICQvr9sCAwEAAaOCARYwggESMB8GA1UdIwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKy # A2bLMB0GA1UdDgQWBBT2d2rdP/0BE/8WoWyCAi/QCj0UJTAOBgNVHQ8BAf8EBAMC # AYYwDwYDVR0TAQH/BAUwAwEB/zATBgNVHSUEDDAKBggrBgEFBQcDCDARBgNVHSAE # CjAIMAYGBFUdIAAwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1 # c3QuY29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMDUG # CCsGAQUFBwEBBCkwJzAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0 # LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEADr5lQe1oRLjlocXUEYfktzsljOt+2sgX # ke3Y8UPEooU5y39rAARaAdAxUeiX1ktLJ3+lgxtoLQhn5cFb3GF2SSZRX8ptQ6Iv # uD3wz/LNHKpQ5nX8hjsDLRhsyeIiJsms9yAWnvdYOdEMq1W61KE9JlBkB20XBee6 # JaXx4UBErc+YuoSb1SxVf7nkNtUjPfcxuFtrQdRMRi/fInV/AobE8Gw/8yBMQKKa # Ht5eia8ybT8Y/Ffa6HAJyz9gvEOcF1VWXG8OMeM7Vy7Bs6mSIkYeYtddU1ux1dQL # bEGur18ut97wgGwDiGinCwKPyFO7ApcmVJOtlw9FVJxw/mL1TbyBns4zOgkaXFnn # fzg4qbSvnrwyj1NiurMp4pmAWjR+Pb/SIduPnmFzbSN/G8reZCL4fvGlvPFk4Uab # /JVCSmj59+/mB2Gn6G/UYOy8k60mKcmaAZsEVkhOFuoj4we8CYyaR9vd9PGZKSin # aZIkvVjbH/3nlLb0a7SBIkiRzfPfS9T+JesylbHa1LtRV9U/7m0q7Ma2CQ/t392i # oOssXW7oKLdOmMBl14suVFBmbzrt5V5cQPnwtd3UOTpS9oCG+ZZheiIvPgkDmA8F # zPsnfXW5qHELB43ET7HHFHeRPRYrMBKjkb8/IN7Po0d0hQoF4TeMM+zYAJzoKQnV # KOLg8pZVPT8wgganMIIEj6ADAgECAhEAkKwIciD9xafEa1zHDfc9BjANBgkqhkiG # 9w0BAQwFADBXMQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVk # MS4wLAYDVQQDEyVTZWN0aWdvIFB1YmxpYyBUaW1lIFN0YW1waW5nIFJvb3QgUjQ2 # MB4XDTI2MDMyNTAwMDAwMFoXDTQxMDMyNDIzNTk1OVowVTELMAkGA1UEBhMCR0Ix # GDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDEsMCoGA1UEAxMjU2VjdGlnbyBQdWJs # aWMgVGltZSBTdGFtcGluZyBDQSBSNDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw # ggIKAoICAQCu5EqiAa2CHGL5Zi1bmgPM8NUXwYZJ+BtQqHps43GLTC+sjVLypsBh # +8uv+TLkgtVGD//vSmA0qrzELf9YRCh2MTAA/aGaQZKGg0BRCmziR3pbCnvgWjtG # XBDUyn3j3K2lZAO8KxgFtlxwOYEAkL+CCqK4v9zzTl8ZwzDpPMiDIFa5THk8an1i # eF5I09cXNrPQw+1ER1liThaG0z6FrOpqwxZWmPRZQBw2E32878UB1bL0Zp91vuWZ # gsMpNNiPCoBj0/1F+LE8+NRokfqacFI0F2tftrRB2W7HQClLR9zjxFbWb5be2rce # IfNyHUUfKGIvMI2NzoxSlxXnFqUG887D8W1Cj8DFok688JKxWvHR/9aQykSbd+9V # utj36ij2sgq/125wTpUZ/AgC0ph50bRs7gFrUyaXE9wSsOqMvCCC+sEm7vd/BemS # G0TSHNXSmyCba+FCzekeWX03TRIcF3Laqd0Rw24OH7jpei4zaGhcI7nfdhBA4c8R # ScxNY6jeHLHHmSMMTk9Wqn7H4dLhUBP5YEwbgbN4uv1i9ltTnHli8t1xHV0StX9B # FgrnmunTX19kUXY1H5ORJbRZyZDdvm1oZyteDj0SnMozr+YSmdIleDUTXdfoY7b2 # taz8s2+QbOxLxcahEIYGWzqu6h955tKwcANHcZ4gTmAhT3btuOiQsQIDAQABo4IB # bjCCAWowHwYDVR0jBBgwFoAU9ndq3T/9ARP/FqFsggIv0Ao9FCUwHQYDVR0OBBYE # FDp0pQxnxkJQwv21/Me7KTSC9Hq5MA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8E # CDAGAQH/AgEAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMCMGA1UdIAQcMBowCAYGZ4EM # AQQCMA4GDCsGAQQBsjEBAgEDCDBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3Js # LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNUaW1lU3RhbXBpbmdSb290UjQ2LmNy # bDB8BggrBgEFBQcBAQRwMG4wRwYIKwYBBQUHMAKGO2h0dHA6Ly9jcnQuc2VjdGln # by5jb20vU2VjdGlnb1B1YmxpY1RpbWVTdGFtcGluZ1Jvb3RSNDYucDdjMCMGCCsG # AQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOC # AgEAMt5SR2bxngNm+N8oc6Gq76Gx1c235fkX7jw8Ho9MAkJGADerHE7dhsBXttqm # zgr/7ZZahZSykGRPhPY1crj028kB8KzO0dKC2qQBAwtfgqMLKkkX/6bYq2uT33eD # 6ByAp2/XKD0LcmZh0kKecvSBr6ln9ajX6u1dnx2fA7xEKy1M3qBhfQSUWLtjs2nF # t0ELVLptzTlX9ID0cL+iOPfdboZ3CelT+JXKVKR2Sge0d4YiFAtPZkfSo8z1Z1x7 # y/Z9mwMIlBAnyuWXs4YsNuxdrYIt/QxE31PDOJ9DesS4Bc7H9OTORlEV/AvfiF/V # epKZpira1MzLYuCw+uoLZn/pkpvd+CvNTS+mEHjBJNa6WK1j8qXFu+jIq+sG9QIL # HiyB6p/xpHrkJu8zkw393+VqF9eKlTY2VjRxdycZLrVemZ4Yp3wi33b+W58CllH3 # HqjmowlZ7SOrgmx8YwYOkgrHsXOQHyBp6O4FRb8In0+FzjT7ElGie9V7CfhL3IlV # FZ4zjuKsZtH1iU3fGu4z/JnOGT6sCb0BbTqe/uhvpFCQBdH5xPGIA/LrbQUXjU2t # WJgHhTIqnN/HvHyOHi5tM4zP3nhgh2rJ6Kqq2xsHBeNYs/R18xQ8DeIg+c90Eoae # h0YlN1KU8AyYol3K9M+qY5ez8syd/7ZlrRnoVewgH3P1pcswggbiMIIEyqADAgEC # AhEA507yVbBQT/rbpt/3/IujFTANBgkqhkiG9w0BAQwFADBVMQswCQYDVQQGEwJH # QjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSwwKgYDVQQDEyNTZWN0aWdvIFB1 # YmxpYyBUaW1lIFN0YW1waW5nIENBIFI0MTAeFw0yNjAzMjUwMDAwMDBaFw0zNzA2 # MjQyMzU5NTlaMHIxCzAJBgNVBAYTAkdCMRcwFQYDVQQIEw5HcmVhdGVyIExvbmRv # bjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTAwLgYDVQQDEydTZWN0aWdvIFB1 # YmxpYyBUaW1lIFN0YW1waW5nIFNpZ25lciBSMzcwggIiMA0GCSqGSIb3DQEBAQUA # A4ICDwAwggIKAoICAQCy/8NtS9xQ2UUtBRF32bj7VK3n4m50Uqjk/zTciSziYV40 # H1LKah0/oEklYG42E4VCP3DvsBUB6DmpCkDZ0jCnZBPIEevaH15ZJOQwFWP2ZXr5 # YjlJpb68Nlbs+ElNvKx32/1YHde3qqUSLybjulxPLz6T85+HOIqK7M1Bep8Lspyh # EP/q6nw5kGxTSrGvufmeH+JF8CnVBcVMFA40FlIYh0cDJVFhhfTfdWgLy/vWuLMQ # oKkf3s/FvByf16r0rtbyHm/iemwxSioJL9zyZDDKUNAbHXl0dhXo2VxUV2NcPXWX # uoKsjL+6cfk6Vm2DHnxAlFdFsaBDIF1JOkSnC6PeLlBznZn2buF3vIIYJcq6N/ze # FRCk4/HXDz7zgRsRRMdUB+rhyk5FoZaBjw0nLq3GZ3fClLUx5es5pUAxzNODMBn7 # JkFYip2BAGBPER5eV0ROhk6tGTG+fUiMiV+vgjg1YnP5FvnYWyEtWeQD/B2hp3vz # 0RvtdkM0p3igyadzrfpOBq5ppVk/YsuhTQkP99ivneHAGfi5e7lmxJ+meoBPrRLu # zMmb81rzzbESjJHMsn5RVtc6Ucs7rcMqQC13PUIO7BbGBETV2ufCmV6lPTp3P7XJ # OvmnUCRTPbVvMTpxP/z+SOHg4/OCBhiqs4FA9+4oQvlkk9w32NGASli9GWrm5wID # AQABo4IBjjCCAYowHwYDVR0jBBgwFoAUOnSlDGfGQlDC/bX8x7spNIL0erkwHQYD # VR0OBBYEFGEQ6XoSr1HEhdTyz6R0D1DNIK/4MA4GA1UdDwEB/wQEAwIGwDAMBgNV # HRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMEoGA1UdIARDMEEwCAYG # Z4EMAQQCMDUGDCsGAQQBsjEBAgEDCDAlMCMGCCsGAQUFBwIBFhdodHRwczovL3Nl # Y3RpZ28uY29tL0NQUzBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vY3JsLnNlY3Rp # Z28uY29tL1NlY3RpZ29QdWJsaWNUaW1lU3RhbXBpbmdDQVI0MS5jcmwwegYIKwYB # BQUHAQEEbjBsMEUGCCsGAQUFBzAChjlodHRwOi8vY3J0LnNlY3RpZ28uY29tL1Nl # Y3RpZ29QdWJsaWNUaW1lU3RhbXBpbmdDQVI0MS5jcnQwIwYIKwYBBQUHMAGGF2h0 # dHA6Ly9vY3NwLnNlY3RpZ28uY29tMA0GCSqGSIb3DQEBDAUAA4ICAQAD6j2N0azN # +hl6k6bKB5/U6VuSOs93ZBb3Pczy9VtBIKu4947Z5GwL0aFngIxl+GSuLFrJgPru # BCRvKJEJsm7kv+LQ1COVCEG9tZ+IRtr4ocUoa53lgdFaENlS0N4wgkZkbQEPv+x+ # 1lSjYh+T4JeL9mUznT7Erc6Sp5dWLka5sMP/m3GZi6oJPdPcsCKWagH7m2H2xDGI # yHJC5PdH9phvi/KmhkktiSVTNNqVeV5bWdX2zhRE6UTfz0IcMoCL996lFIydXxOC # E4MNDHDM0as4lnTiT/KHMccO6l8c9TnUVgmpci9ar1IABZ2U1XUkYjGGSn9MC3EH # DP9V39VuBVvZ33/BEV/EWSRrf07T7jFplKX+gQr/UOqPGMlE7ZJ72UaUkNJy7bVl # 3bcLKzdpjIHzLkf/4MVa1V7w8wqCv5W4gOnRGTlud5UMARbRM8BPxR/CXYXoMmIO # D8pmTk2axgRL4LG8XtuchISdCHRmtacAmLGq5XSYSVTHTXADlO48iDKh3HM2r98L # SF6f0sG12d8V9Jn7C3wDUieOxuKj4MdWrW+hiJU2kF87v6eH00HgCFFc2V0+CvfO # CMn7juzS41jLaINcBlKWQ/fKb/uDLfWOW73z1I2lFY7Xj8tQ1XYtK5eREjWItM8j # pl1cbQOc88btR+0XS2TmboE/141+va2PWzGCBjAwggYsAgEBMGgwVDELMAkGA1UE # BhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDErMCkGA1UEAxMiU2VjdGln # byBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNgIQacs5SDkvNuif0aEmZmr03jAJ # BgUrDgMCGgUAoHgwGAYKKwYBBAGCNwIBDDEKMAigAoAAoQKAADAZBgkqhkiG9w0B # CQMxDAYKKwYBBAGCNwIBBDAcBgorBgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAj # BgkqhkiG9w0BCQQxFgQUvHnIsr9KbzMcNplzT81NJ+DiAtkwDQYJKoZIhvcNAQEB # BQAEggIATZ/ogHe9sc9E8l+bcD9fTS2bgkI1/qUVKIWpy1OCzs+ejTULXbQ8pu0+ # ghAge3ARQqfg7NeyfD9Qs0AIF6miJpt5JUff8nR8euOUK+zBRrfj4JXm/WyPTo82 # Idn+SHE1vxrxF96YfKfxU3iziwjK6lC+i27ZmlfI+ziV7LN3cLIHResLcIcHTSmC # B7Xc1/QBZCTEqhbb5XR2kYduMegNKj9XnGLHkIYNkqvBMscjAK4SZgWKDrluxfTP # YeR0a5g3naPK/5RTDt5mY1qsIyQBE8F+rjfTPizjTaw7XaHGTBkVmyLNVf07D8Wr # r451jzNH01vx9xEqK0AI8Pf2rg1fp+VHlfvY6bb42qApwhQpsBhdojtUDpyknSLO # GhhV/W6O9zVT4IfvsMM4QrSmZI1p99LT1pqsPoFFmCMoBGcphsP9Z3I1nG4rnzi5 # OBsstC22Le4+TSh4kQEB+jUBOQGr9jCdpXRitSjXbmAdFV2lIB2ob2eB52A5ol47 # LPcA6scikzFhS82VA9T0/Hz7DzXZJ/DZy/MKvFhi1UklL5L4thEdJuFnrdfi08pE # gCqxxchkMNe3A72ku1EioZGuqyLMAlE1MrE617bLnhK7xQ+D2Ujzu8F0onNn0K/x # T0Eig92ToYNRoryBGEhnhw7lqi+LjzsVlHuGe8NLMiEftW+ifcahggMjMIIDHwYJ # KoZIhvcNAQkGMYIDEDCCAwwCAQEwajBVMQswCQYDVQQGEwJHQjEYMBYGA1UEChMP # U2VjdGlnbyBMaW1pdGVkMSwwKgYDVQQDEyNTZWN0aWdvIFB1YmxpYyBUaW1lIFN0 # YW1waW5nIENBIFI0MQIRAOdO8lWwUE/626bf9/yLoxUwDQYJYIZIAWUDBAICBQCg # eTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yNjEw # MTcwMzA3MTNaMD8GCSqGSIb3DQEJBDEyBDCkExzO5jNeLu3P4coqTUcaaZNr4zWy # oG5Z27W08pza9mKBXzPRgxE8YW9ck8mavqAwDQYJKoZIhvcNAQEBBQAEggIAot+v # jOvhvQCZF0iSYRX0DgbHG8D7ppSdoobxiiDgNpZfKN2Ft7yEirAjmBwhyBNOJMtW # dKMwsZBgRZCzr241L04xZT828y18waHthxasMJwtXhmFCa3Hb43jk3CbDhRj3Jlp # w13qACqRVUkNO0V3LXezk8r+WJ/0tZURFoY5ol/R39Ort6dWFxAhT5IB7QJuX4jf # g9fRsvYDzvqngkcqkZCRsejvEvh7L5a/kNeEWcrYitXDe8aJl1U4iLqaQwXh5l7X # bnbNH2JEG62E49Mg0UxypscZZuuBeRweI0cXFXi46NhfEg1un94uptXdutjc+w62 # dWAWrTY9X8nWjKlsvrUZ4zYg7XmR7Z5yusc2RpH23mWT+8aWG+W1fejrSndD6SHK # HXWfyx7+J/gMdJp595IgQSfCd8KxHM+oIrwUzqWhvqcYxco+xtTPVUpKczeTk2XW # nwsorOfU/P9rJK8jaZszoycESJQBOWToHodKZxfHWDaw0Yz1ux2TFwVctbHOuq3e # 7HxdDAZHCJO9vfdn5CrSf5jHsSESXIN6Fgcd1DLG9kE7Nx8PwiloPlZeP2KgFfo3 # JoHWTOnXHNarNol0XoT82rI8g3OnXGUmK9GDYZtSrxuE/9jqUE3I2INksarvBdjy # KrdUOltS/xhnMIyYvEpqXBc8e69lMoGNZWQiTAw= # SIG # End signature block |