Skip to main content
Version: Axidian Privilege 3.2

Configuration

This section contains parameters for configuring PAM.

System Settings​

In this section global system settings are specified. Fine-tuning is performed in the Policies section.

Scheduled jobs​

OptionDescription
Account checking start timeAt this time Axidian Privilege will start checking all active accounts in the Managed state.
Resources and accounts syncing start timeAt this time Axidian Privilege will start resource information syncing and accounts syncing for resources and domains.
Account password reset start timeAt this time Axidian Privilege will generate new passwords for accounts.
Service connection checking start timeAt this time Axidian Privilege will start checking service connection to resources and domains.
Session log rotation start timeAt this time Axidian Privilege will start session log rotation.
Synchronization interval for user groups from the directoryThe PAM system updates the list of members of user groups from the directory at a specified interval.

Video​

OptionDescription
Video recording codec optionsThe libx264 codec is used by default with the following settings: libx264 -preset medium -tune zerolatency.
Video streaming codec optionsThe libx264 codec is used by default with the following settings: libx264 -g 10 -tune zerolatency.
The duration of the recorded video segment, sec.You can set the duration at which the video will be saved as an independent segment, the default is 3600 seconds (1 hour).

Sessions​

OptionDescription
Gateway connection timeout, sec.Time after which connection will be closed if gateway isn't responding. Set the value to 0 if you do not want the connection to be interrupted.
Time to connect, min.Close session on the Gateway if a user did not connect to the resource.
Legal noticeThat text will be shown to user before session. Leave it empty if you don't need it.
Maximum amount of sessions per userLimiting the number of concurrent open sessions per user, 0 is the default with no limit.
Notify user about session terminationThe user will be notified before the session ends.
Notifications thresholdNotification will be shown for the specified time before the session expires.
Notification intervalInterval between notifications about expiring session.

Gateway connections​

OptionDescription
RDCB addressIP address or DNS name of Remote Desktop Connection Broker
RDCB collection nameRemote Desktop Connection Broker collection name for Axidian Privilege Gateway
Use RDGWCheck it for connecting to Axidian Privilege Gateway with Remote Desktop Gateway
RDGW addressRemote Desktop Gateway address for Axidian Privilege Gateway
Gateway RDP file parametersThese parameters will be added to RDP connection settings for Axidian Privilege Gateway. They will replace old ones

RDP Proxy​

The RDP Proxy address parameter specifies an IP address or DNS, and optionally a port.

PostgreSQLProxy​

The PostgreSQLProxy address parameter specifies an IP address or DNS, and optionally a port.

SSH connection settings​

OptionDescription
SSH Proxy addressIP or DNS, port (required)
Default port: 2222
Authentication of resources using SSH server keysSelected SSH server key fingerprint adding type. For more information, see the Types of Adding Fingerprints section.

Syslog​

Option
Description
Syslog serverIP address or DNS name of Syslog server
PortSyslog server port
ProtocolNetwork protocol for connection to Syslog server: TCP, UDP
FormatEvent format used by syslog server: CEF, LEEF
Syslog versionIETF standart of Syslog protocol: RFC3164, RFC5424

User Authentication​

This section specifies the global authentication settings. Fine-tuning authentication is configured in the Policies section.

User Blocking​

If the user enters the wrong password or OTP several times in a row, their account will be blocked for the specified time.

OptionDescription
Number of AttemptsIf this value is exceeded, the user will be temporarily blocked. If the value is 0, the blocking does not apply.
Blocking TimeDefines the period of time after which the user will be unlocked and will be able to enter the password or OTP again.

Password Requirements for Internal Users​

OptionDescription
Password Validity PeriodMinimum value: 0—no restrictions.
Default value: 45 days.
Maximum value: 999 days.
Minimum password lengthMinimum value: 4 characters.
Default value: 8 characters.
Maximum value: 255 characters.
Lowercase lettersIf the option is enabled, the password must contain at least one lowercase Latin letter.
Uppercase lettersIf the option is enabled, the password must contain at least one Latin capital letter.
DigitsIf the option is enabled, the password must contain at least one digit 0–9.
Special charactersIf the option is enabled, the password must contain at least one special character from the list: ~!@#$%^&*()_-+={}|[] \:;"'<>,.?/

SSH Key Authentication​

If the Allow users to connect to SSH Proxy using SSH keys option is enabled, users can connect to SSH Proxy without passwords using SSH keys added to Axidian PAM. The requirement to enter OTP remains. If this option is disabled, users can only authenticate using a password.

User Connection​

caution

Manage User Connections privileges are required to work with user connections. The following privileges are required:

  • UserConnectionType.Create
  • UserConnectionType.Read
  • UserConnectionType.Update
  • UserConnectionType.Delete

Axidian Privilege has the following built-in user connection types:

  • RDP
  • SSH
  • Telnet
  • PostgreSQL

Built-in types cannot be changed or deleted.

It is also possible to add custom user connection types.

Adding Custom User Connection Types​

To add a new connection type, you need to research the client application and develop a template for Axidian Privilege ESSO Agent. The new connection type is unique for each application, for development please contact Technical Support.

Service Connection​

caution

Manage Service Connection Types privileges are required to work with service connections. The following privileges are required:

  • ServiceConnectionType.Create
  • ServiceConnectionType.Read
  • ServiceConnectionType.Update
  • ServiceConnectionType.Delete

Axidian Privilege has the following built-in service connection types:

  • Windows
  • SSH
  • Microsoft SQL Server
  • MySQL
  • PostgreSQL
  • Oracle Database
  • Cisco IOS
  • Inspur BMC

Built-in types cannot be changed or deleted.

It is also possible to add custom service connection types.

Adding Custom Service Connection Types​

caution

If your PAM installation's management server is installed on a Windows host, you can only add connectors with a powershell template.

If your PAM installation's management server is installed on a Linux host, you can only add connectors with a bash template.

  1. Open the Configuration → Service Connection section.
  2. Click Add Service Connection Type.
  3. In the window that opens, upload the ZIP archive with the connector file.
  4. Specify the Name of the service connection or use the value loaded from the metadata.
  5. Enter the Description of the service connection. Optional.
  6. Finish operation by clicking Add.

Connectors preparation​

To prepare a ZIP archive with the connector file, use the Connector Creation Tool.

Editing Custom Service Connection Types​

  1. Open the Configuration → Service Connection section.
  2. Click Edit next to the desired service connection type.
  3. Click Download archive and select a folder on your computer to save the current ZIP archive with the connector file. This archive will be needed to restore the previous state of the service connection if an error occurs when loading a new archive.
  4. Upload a new ZIP archive with connector file.
  5. If necessary, edit Name and/or Description.
  6. Finish editing by clicking Save.

Connector Script Code Viewing​

  1. Open the Configuration → Service Connection section.
  2. Click Show script code next to the desired service connection type.

Custom Connection Types Deleting​

  1. Open the Configuration → Service Connection section.
  2. Click Delete next to the desired service connection type.
info

A service connection type cannot be deleted if a resource with that type exists.

Uploading the SSH Connector Template​

The service operations template is unique for each *nix distribution. The PAM distribution includes templates for the *nix distributions listed below. Path to the templates in the PAM distribution: AxidianPAM_3.2\axidian-pam-tools\ssh-templates\.

SSH connector templates included in Axidian Privilege distribution
  • Alt
  • Astra
  • CentOS
  • Debian
  • FreeBSD
  • Gentoo
  • Oracle
  • RedOS
  • RHEL
  • Rocky
  • SLES
  • Ubuntu

To add a template to Axidian Privilege:

  1. Open the Configuration → Service Connection section.
  2. Inside the SSH block, click Add.
  3. Select the file with the SSH connector template you need from the distribution by path AxidianPAM_3.2\axidian-pam-tools\ssh-templates\.

If you need help with development of the new template, please contact Technical Support.

Network Location​

The section contains information about adding network locations to limit the use of resources issued by addresses.

To add a network location:

  1. Click Add.
  2. Enter a Name.
  3. Add the Network addresses of the resources to which you want to issue a limited connection.

Tags​

This section displays all the tags that have been created. By default, tags are sorted alphabetically in direct order. To sort them in reverse order, click on the table header, the Tags column.

To create a tag:

  1. Click Create.
  2. Enter tag Name. It can contain from 2 to 50 characters and can consist only of Latin and Cyrillic letters, numbers and special characters. The tag name must be unique regardless of case. For example, if you already have an "important" tag, you won't be able to create an "IMPORTANT" tag.
  3. Select a color.
  4. Leave the Display tag in user console (UC) option enabled. If you disable this option, only PAM administrators will be able to use the tag in management console.
  5. Finish adding by clicking Save.

To find the tag:

  1. Specify the tag name in the search bar in whole or in part.
    In PAM installations with PostgreSQL database, the search is case-sensitive. For example, if you have an "important" tag, it won't appear when you type "IMPORTANT". In PAM installations with Microsoft SQL database, the search is case-insensitive, that is, the tag will be displayed when you enter its name with both uppercase and lowercase letters.
  2. Press ENTER or magnifying-glass-search-icon.

To edit the tag:

  1. Select the tag from the list.
  2. Click Edit.
  3. Make the changes. It is possible to change the tag name, color and visibility of the tag in the user console.
  4. Finish editing by clicking Save.

To remove one or more tags:

  1. Select one or more tags from the list.
  2. Click Remove.
  3. In the pop-up window, click Remove.
info

When tag is removed from PAM, the tag will be removed from all the resources to which it was applied.

Monitoring​

Axidian Privilege automatically detects unused permissions. Administrator can revoke such permissions to minimize redundant privileges.

Parameter Consider permission unused if it has not been used for more than sets the number of days of inactivity on the permission, beyond which the permission is considered unused.

The following actions are considered to be the use of the permission:

  • successful start of the session;
  • viewing or changing credentials;
  • checking the permission to use pamsu.

Licenses​

Getting​

  1. Copy the value from the Installation ID field.
  2. Send this value to technical support and ask them to generate a license file.
  3. Wait for a response from technical support with a license file in the PAM_yyyy.mm.dd.lic format.

Adding​

Click Add and select a license file.

Removing​

Select one or more licenses and click Remove.