Skip to main content
Version: Axidian Privilege 3.5

Account Operations

Account Editing​

The function allows you to change the Account Name, Description or Policy

  • Click  in the account profile to the right of the desired option

Account Confirmation​

Resource or Domain Synchronization function allows you to get local or domain accounts in automatic mode, but confirmation is required to work with the received accounts, since Axidian Privilege does not get their passwords.

  • Click Make managed in the account page

Create Permission​

Permissions allow users to connect to resources.

To create a permission:

  1. Open the account page and click Create permission.

  2. Select one or several user connections and click Select.

  3. Define the permission composition. If necessary, modify the preset parameters.

    More about permission scope

    1. Select who gets access:

      • Users — the permission is granted to one or several selected users.
      • User group — the permission is granted to one selected user group.

    2. Select what to get access to:

      • Resources — the permission is granted to one or several selected resources.

      • Resource groups — the permission is granted to one selected resource group.

      • Ad hoc connections — the permission is granted to Ad hoc resources with the selected connection type, including resources not registered in PAM. One shared account is used for all connection types.

        License required

        A special license is required to work with Ad hoc resources.

        A special license is required to create a permission for PostgreSQL or MSSQL. Before creating the permission, add an account from the DBMS to PAM. You need to specify it in the permission.

    3. Click Next.

    4. Select the account under which the user will open a session on the resource:

      • Select account in PAM — the permission is granted to an account added to Axidian Privilege.
      • Use user account — the permission is granted to an arbitrary account.
        The user needs to enter the login and password of the account on the resource. In RDP and SSH sessions, it is possible to log in using the current Axidian Privilege user credentials.

  4. (Optional) Configure access to credentials.

    More about access settings

    You can grant access to credentials only at the permission creation step.

    The following settings are available:

    • Credentials — the option defines actions with credentials:
      • Allow view account credentials — users can view passwords of the accounts from this permission.
      • Allow change account credentials — users can change passwords of the accounts from this permission.
    • Allow running pamsu in SSH sessions — the setting defines access to PamSU when connecting via SSH Proxy:
      • Managed by policies — access to PamSU is determined by the policy of the resource for which the permission is granted.
      • Allowed — the user can use PamSU regardless of policy settings.
      • Denied — the user is not allowed to use PamSU regardless of policy settings.

  5. (Optional) Fill in the Description field.

  6. (Optional) Configure time restrictions.

    More about time restrictions

    You can set a schedule according to which users are allowed to open sessions or change credentials. For example, you can grant permission to work only on weekdays from 8:00 to 17:00.

    The following settings are available:

    • Validity period — the time period during which the permission is valid. For example, you can grant permission for one day or month.

      • Begin — set the date and time when the permission becomes active.
        If only Begin is set, the permission will become active on the selected date, and its validity period will be unlimited.

      • End — set the date and time when the permission becomes inactive.
        If only End is set, the permission will become active at the moment of creation, but will be suspended on the specified date.

        info

        If the Begin and End parameters are not set, the permission will be valid indefinitely.

    • Access schedule — restrictions by days of the week taking into account the specified schedule.

      • Allow access only on selected days — select the days of the week when the permission will be active.

      • Allow access only during selected hours — select the time when the permission will be active.

        info

        Access by days of week is granted according to the management server time zone.

    After the validity period expires, the permission will transition to the Restricted/Inactive state, and the user session will be terminated.

  7. In the Connection source setting, select the network address from which sessions to the resource are allowed to be opened. If no network locations are added to PAM, the value is set to No restrictions — the permission can be used from any device on the network.

  8. Check the data and click Create permission.

Password and SSH Key​

If a service connection of the SSH type is configured for the resource from which the account was added, then it will be possible to generate or manually add not only a password, but also an SSH key. Also, for such accounts it is possible not to set a password: the setup wizard will display an additional item when setting a password — Not set. Below we will consider an example of confirming an *nix account. When confirming Windows OS accounts, DBMS or domain accounts, the Not set item will be missing, and there will be no page for generating or manually setting an SSH Key.

Password Settings​

  1. Select one of the options:
    • Generate — the password is created automatically and synchronized with the resource or domain.
    • Set password manually — the password is set manually.
      Enter the password and confirm it.
      To change the account password not only in PAM, but also on the resource or domain, enable the option Change password on resource or Change password on domain.
    • Not set — the account is created without a password, which can be set later during editing.
  2. Click Next.

SSH Key Settings​

  1. Select one of the options:

    • Generate new SSH key — the key is created automatically and synchronized with the resource or domain. Choose a cryptographic algorithm to generate the key: Ed25519 or RSA.

    • Set SSH key manually — the key is set manually. Select the SSH key file and enter its password. RSA keys in OpenSSH and PEM formats are supported, as well as Ed25519 keys in OpenSSH format.
      To create an SSH key and write it to a file, use the PuTTYgen program or one of the commands:

      The RSA key in the OpenSSH format
      ssh-keygen -t rsa -b 4096 -f id_rsa_openssh -C "RSA OpenSSH key"
      The RSA key in the PEM format
      ssh-keygen -t rsa -b 4096 -f id_rsa_pem -C "RSA PEM key" -m PEM
      The Ed25519 key in the OpenSSH format
      ssh-keygen -t ed25519 -f id_ed25519_openssh -C "Ed25519 OpenSSH key"

    • Not set — the account is created without an SSH key, it can be set later during editing.

  2. Click Next.

  3. Check the data and click Save.

Rollback Password or SSH Key​

The function allows you to return the saved state of the password or SSH key for the account

  • Click Rollback on your account profile.
  • Select a restore point, provide a reason and complete password recovery

Verification of Password or SSH Key​

Credential verification allows you to compare the password and SSH key for an account as stored in PAM and on the resource, as well as to identify unmanaged SSH keys.

Note

To verify domain or local accounts on Linux resources, no service connection needs to be configured.

To verify an account:

  1. Go to Accounts section and open the account profile.

  2. Click Check.

    Possible verification outcomes

    The following outcomes are possible when verifying an account:

    • The credentials in PAM and on the resource match.

      For the account, the current credentials are verified, as well as any passwords and SSH keys previously stored in the PAM database. If the values from the PAM database match the current account credentials on the resource, the password or SSH key in PAM is updated to the current value.

    • Unmanaged SSH keys have been found on the resource for this account. You can remove these keys from the account profile in PAM.

    • The credentials in PAM and on the resource do not match.

      No matching password or SSH key exists in the PAM database. This can occur if a user has changed the password or SSH key for the account on the resource without updating them in PAM. In this case, the user must update the credentials manually.

To verify credentials for multiple accounts, select the desired accounts in the Accounts section and click Check.

Password Change​

caution

When changing an account password, pay attention to whether there are services associated with the account. When you change the account password, the passwords of the associated services will also change.

The function allows you to change the password to a random value or enter a new password manually.

  • Click Change password in the Account profile
  • Select one of the following options Generate random password or Set password manually
  • Enter the password or continue by selecting Generate random password
  • Fill in the Password change reason and click Save

Scheduled Password Change​

Changing account passwords on a schedule is configured via policies.

  1. Open the Policies section.
  2. Select the policy that controls the account you want to set scheduled password change for.
  3. Open the Accounts section.
  4. Enable the Periodically change the account password and SSH key option.
  5. Specify the number of days in the Password and SSH key change period field. Automatic password or SSH key change will be performed once every specified number of days.

SSH Key Change​

The function allows you to change the key to a random value or upload the new key manually.

  • Click Change SSH key in the account profile
  • Select one of the following options: Generate new SSH key or Set SSH key manually
  • Select the SSH key file and enter its password or continue by selecting Generate new SSH key
  • Fill in the SSH key change reason and click Save

Removing Unmanaged SSH Keys​

If account has an error "Unmanaged SSH keys detected", the Remove unmanaged SSH keys button becomes available. Once clicked, only the unmanaged SSH Axidian Privilege keys will be removed.

Keys that were created or added to Axidian Privilege remain unchanged.

Synchronization​

The function allows you to get the list of groups the account belongs to.

  • Click Sync in the account profile

Blocking​

The function allows you to suspend all permissions in which the account is used.

  • Click Block in the account profile
note

The account will be marked with the  symbol. All permissions in which the account is a member will be marked with the  symbol.

Ignoring​

The function allows you to put an account in a state in which it is stored without a password and cannot be used in permissions.

  • Click Ignore in the account profile
caution

The account will be marked with the  symbol. All permissions with this account will become inactive.

Removing an Account​

  • Click Remove on your account profile
info

When removed, the account will disappear from all services associated with it. There will be a dash in the Account field in the service profile. The services will not be removed.

Rolling Back an Account​

  • Click Extended search in the Accounts section
  • Enter your Account name in whole or in part
  • Set the State field to Removed
  • Select the resource or domain from which the account was added
  • Open your account profile and click Rollback
  • Select a password recovery point for your account
  • Enter the reason for the recovery and click Rollback
info

When you restore an account, any previously existing associations between the account and services are not restored.