Downloading files from web targets

• Back to the web applications page

A web application often produces files: a report, an export, an invoice.
With this right, the user downloads the file in the web session and pastes it on the workstation.
The file is checked on the bastion, written in the events and kept with the session recording.

How it works

The browser of a web session runs on the bastion.
A downloaded file therefore lands on the bastion, never on the workstation.
The bastion checks it, then hands it to the workstation through the Remote Desktop clipboard.

flowchart LR
    A[User clicks Export<br>in the application] --> B[Browser on the bastion<br>downloads the file]
    B --> C{Checks:<br>size, type, session limits,<br>antivirus}
    C -- refused --> D[Message in the session<br>event web_file_failed]
    C -- accepted --> E[Message: file ready<br>event web_file_down]
    E --> F[Ctrl+Alt+F<br>list of ready files]
    F --> G[Copy, then paste<br>in File Explorer]
    G --> H[Delivery logged<br>status delivered]

1. The user clicks a download link in the application.
2. The browser writes the file in a folder of the session, on the bastion.
3. The bastion checks the file, in this order:
   • the name is cleaned: no path, no control or invisible character, 255 bytes at most.
   • the size must not exceed the maximum of the policy.
     A file that grows beyond it is cancelled during the download.
   • the extension must be in the allowed types of the policy.
   • the session must stay under 100 files and 2 GB in total.
   • when ClamAV runs on the appliance, the file is scanned.
4. Accepted file: a line at the bottom of the session says rapport.pdf ready: press Ctrl+Alt+F to get it.
   Refused file: the same line gives the reason, for example setup.exe: file type not allowed.
5. The user presses Ctrl+Alt+F.
   The Downloaded files list shows the ready files with their size.
6. The user selects a file and presses Enter or C.
   The file goes to the clipboard of the Remote Desktop client.
7. The user pastes it in File Explorer.
   When the workstation has read the whole file, the delivery is written in the events.

The workstation never sees the file system of the bastion, and the bastion never mounts a drive of the workstation.
The copy that is checked and handed over sits in a folder the browser cannot reach.

Benefits

• Downloads are closed by default.
  No policy allows them until an administrator ticks the box.
• Size and file types are set per policy.
  A policy for accountants can allow xlsx, another one only pdf.
• When ClamAV runs on the appliance, an infected file is never handed over.
• A copy of each file stays with the session recording and follows its retention.
• Each file gives an access event and a SIEM event with its name, size and SHA-256.
• The workstation needs only its usual Remote Desktop client, with clipboard redirection.

Allow downloads on a policy

1. Open RDS Proxy » Policies and edit the policy.
2. In the section Web applications: file downloads, tick Allow file downloads.
3. Set Maximum file size (MB): from 1 to 1024.
   The default is 50.
4. Set Allowed file types: extensions separated by commas, without the dot.
   The default is pdf,csv,xlsx,xls,docx,txt.
   Up to 50 extensions of 1 to 10 letters or digits.
   An empty list refuses every file.
5. Save.

The right applies to the web targets of the policy only.
It does not depend on the copy and paste rights of the policy.
When a user matches several policies, every one of them must allow downloads.
The smallest maximum size and the common file types then apply.

Sessions with this right are always recorded, even when the policy does not ask for it.
The copy of each file lives in the recording.

The policy window warns when:

• a component is too old for downloads.
  The window names it: engine, bridge or authenticator.
• ClamAV is not installed or not enabled: files are not scanned.
• ClamAV is active: its scan limit caps the size of a file.
  The window shows the cap.

The same three settings exist in the RDS Proxy policy of Artica Meta, on each access rule.
A list of types left empty in Meta stays empty on the node: every file is refused.

What the user sees

The texts are in French when the Remote Desktop client is in French.

In the Downloaded files list:

• Up and Down choose a file.
• Enter or C copies it to the clipboard.
• Esc closes the list.

A file can be copied again later in the same session.
Each delivery is written in the events.

Clipboard redirection must be on in the Remote Desktop client.
In mstsc: Local Resources > Clipboard.
Without it, the file is ready but cannot reach the workstation.

Antivirus

When ClamAV is installed and enabled on the appliance, every file is scanned before it is offered.

• Clean: the file is offered.
• Threat found: the file is refused with threat detected.
  The signature is written in the session file journal and in the events.
  The file is kept in the recording as evidence, but the console never serves it.
  A FILE THREAT line also goes to syslog.
• ClamAV does not answer (stopped, socket missing, timeout after 60 seconds): the file is refused with antivirus scan impossible.

ClamAV stops scanning beyond its own limits and then answers "clean" without reading the rest.
Artica therefore caps the maximum size of a file at the smallest of these ClamAV limits:

• StreamMaxLength (default 12 MB),
• MaxFileSize (default 20 MB),
• MaxScanSize (default 15 MB).

With the defaults, a file above 12 MB is refused with file too large, whatever the policy says.
To allow larger files, raise these limits in the ClamAV settings.

When ClamAV is not installed or not enabled, files are not scanned.
The journal then shows skipped for the antivirus.

Find the files of a session

Session recordings

Open RDS Proxy » Videos.
A session with downloads shows a Downloaded files chip and a Downloaded files button.
The button opens the list:

A delivered or ready file can be downloaded from this list.
A file marked infected, or whose scan failed, is never served by the console.
A file larger than 1 GB is not served here: download the recording archive instead.

The list appears once the recording is packaged, a few minutes after the end of the session.

Access events

Open RDS Proxy » Events.
Each file gives one or two lines:

The subject reads <target> | <name> | <size> | <SHA-256> | <status>[ | <reason>].
For example: Accounting | report.pdf | 204800 | ccfcbc56… | delivered.

SIEM

When the bastion is connected to Artica SIEM, each file also sends a file_transfer event in the rdp-v1 format.
The event carries the direction down and the channel web.

Requirements

All three are needed.
While one of them is older, no session gets downloads, even on a policy that allows them.
The policy window and the WebView tab say which component is missing.

The bastion keeps files in /var/rdpproxy/web-dl during the session.
A download is refused when the free space of /var/rdpproxy is below twice the maximum size plus 1 GB.
Artica cleans the folders of sessions that ended abruptly at startup and every hour.
Their files join the recording of the session.

Limits

• Downloads only: the user cannot send a file to the application.
• No printing, no drag and drop.
• 100 files and 2 GB per session.
• The file reaches the workstation through the clipboard only.
  A Remote Desktop client without file clipboard support cannot fetch it.
• The copy of each file follows the retention of the recordings.
  It disappears with the recording.

Troubleshooting