Securing GAM

[jthompson]

Hi all

 

I'm looking at how best to set up GAM. It's a really useful tool, but I'm just thinking about how to keep it nice and secure. Using a standard installation of it, with OAuth files stored alongside the exe, feels a bit like leaving the superadmin keys in the ignition. A malicious user on a client or server with GAM isntalled could do a lot of damage to a Google domain.

 

Does anyone know of any ways of adding some extra layers of security to GAM?

[aicrd]

Could use software like VeraCrypt to create a virtual encrypted volume and then store the files on that. Then you just mount / dismount with a passphrase whenever you want to run GAM.

[paulkerton]

Well, I would only have GAM installed on a client machine in an office where staff expected to use it, can use it.

Where are you looking to put it?!

[localzuk]

The permissions to the GAM folder should be restricted to only those people who are able to use it.

 

Oh, also, if you have some staff that only need a subset of permissions, generate an OAuth token for them with only those permissions. Eg. My technician has a subset of capabilities within GAM available to them. It means you have to have more than 1 install of GAM on your machine if you use a shared environment, but it is more secure than giving all your technicians Super-admin rights.

Edited May 4, 2021 by localzuk

[jthompson]

Well, I would only have GAM installed on a client machine in an office where staff expected to use it, can use it.

Where are you looking to put it?!

 

Well, I'm thinking that, too, but if those client machines were to get compromised, it would place the entire Google domain at risk. An attacker would only need to pinch a few text files and they could trash the Google domain.

[jthompson]

Could use software like VeraCrypt to create a virtual encrypted volume and then store the files on that. Then you just mount / dismount with a passphrase whenever you want to run GAM.

 

I had wondered whether I could symlink the OAuth files to ones stored on a BitLockered USB drive, but I guess the entire app could possibly be installed into an encrypted volume and run from there, as you say.

[paulkerton]

Well, I'm thinking that, too, but if those client machines were to get compromised, it would place the entire Google domain at risk. An attacker would only need to pinch a few text files and they could trash the Google domain.

Run it on a Chromebook. Not so easy to attack those!

or run it via Google Cloud Shell, behind your login and 2FA.

Edited May 4, 2021 by paulkerton

[jthompson]

Run it on a Chromebook. Not so easy to attack those!

or run it via Google Cloud Shell, behind your login and 2FA.

 

Good shout!

[SpaceInvader83]

Google Cloud Shell... https://sites.google.com/jis.edu.bn/gam-commands/home

[jthompson]

Awesome, thanks folks. I've now got GAMADV-XTD3 running in Google Cloud Shell.

[mrstrong]

I have basic gam set up (did via instructions here: https://github.com/jay0lee/GAM/wiki) on a PC

To use advanced gam in cloud shell which instructions did you follow ?

e.g. https://github.com/taers232c/GAMADV-XTD3/wiki/How-to-Install-Advanced-GAM

is there a need to uninstall version on PC first ?

[ITGuyNW]

Just setup Google GAM in Cloud shell, thanks all!

[paulkerton]

I have basic gam set up (did via instructions here: https://github.com/jay0lee/GAM/wiki) on a PC

To use advanced gam in cloud shell which instructions did you follow ?

e.g. https://github.com/taers232c/GAMADV-XTD3/wiki/How-to-Install-Advanced-GAM

is there a need to uninstall version on PC first ?

https://basuta.com/posts/installing-google-apps-manager-gam-on-google-cloud-shell/

 

These instructions are excellent.

[caffrey]

Yep +1 for those instructions, just set mine up in 5 mins

[paulkerton]

So depending on which version of GAM you want, you need to change the URL on the following command

 

GAM : bash <(curl -s -S -L https://git.io/install-gam)

GAMADV-XTD3 : bash <(curl -s -S -L https://git.io/fhZWP)

 

If you want to do an upgrade, its the same command but with the flag -l

 

So if it tells you there is an upgrade to do when you run a GAM command, let it do what you've asked and then run the bash command with -l

 

I just use everyday GAM myself. Haven't bumped into a reason to use Advanced yet.

[jthompson]

I have basic gam set up (did via instructions here: https://github.com/jay0lee/GAM/wiki) on a PC

To use advanced gam in cloud shell which instructions did you follow ?

e.g. https://github.com/taers232c/GAMADV-XTD3/wiki/How-to-Install-Advanced-GAM

is there a need to uninstall version on PC first ?

 

No, you don't need to uninstall it from your PC in order for it to work from Cloud Shell (although it makes sense to, since one of the main reasons for installing in the cloud in the first place is to avoid needing to have it on a Windows system).

 

Once you've got one instance of GAM set up, you can reuse the following files in further instances, without having to go through the whole setup process again.

client_secrets.json

oauth2.txt

oauth2service.json

 

It's having those files just sitting in a folder in Windows that made me nervous about it. If someone has those, they basically have your Google Workspace domain.

[ITGuyNW]

What do you do if you need to use a csv in GAM in the cloud?

[paulkerton]

What do you do if you need to use a csv in GAM in the cloud?

You can upload it into your workspace.

[jthompson]

Your UI appears different from the one I get. It's in the three pips menu on mine.

 

[paulkerton]

Your UI appears different from the one I get. It's in the three pips menu on mine.

 

[ATTACH=CONFIG]62529[/ATTACH]

 

Tap the pencil icon and show the editor.

[junz]

The permissions to the GAM folder should be restricted to only those people who are able to use it.

 

Oh, also, if you have some staff that only need a subset of permissions, generate an OAuth token for them with only those permissions. Eg. My technician has a subset of capabilities within GAM available to them. It means you have to have more than 1 install of GAM on your machine if you use a shared environment, but it is more secure than giving all your technicians Super-admin rights.

 

I am looking to create an Ouath token with permissions to manage Chrome devices and Google Classroom guardians and was wondering how you went about creating aOuath token? Did you have to create a new project with new API permissions or would you able to create a new Ouath token form the same project?