Keycyte PAM 3.2 · Administrator Guide

Configuring Password Policies

Create a password policy for each group of accounts that should share the same password rules, then assign the accounts to it.

Before you begin, make sure that you have the Add permission for Password Policy. To assign accounts, you need the Edit permission.

Creating a Password Policy

To create a password policy:

1. Select Password Policy in the menu.

2. Click Add. The Password Policy dialog opens.

3. Fill in the general fields:

   Field	Description
   Name	Name of the policy. Required.
   Age	Maximum age of a password in days. When Auto Change is selected, a password older than this is changed automatically. A password that was never changed counts as due. 0 turns off scheduled changes.
   Length	Length of generated passwords. Must be greater than 0 for Keycyte PAM to generate passwords.
   Exclude Char	Characters that generated passwords must not contain, for example l1O0 to avoid characters that are easy to confuse, or characters that a target system does not accept.
   Change Method	How the password is changed on the target. See Change Methods. Default: Account itself first, then privileged reset.

4. Under Password Complexity, select the character classes of generated passwords: Upper (A–Z), Lower (a–z), Digits (0–9) and Punctuation. If you select none, letters and digits are used.

5. Under Change and Permission, select the options that you need. See Automatic Change and Connection Operations.

6. Under Period, optionally restrict scheduled changes to a time window. See Change Period.

7. Click Save.

The policy appears in the list, which shows its Age, Length and the selected character classes.

Automatic Change

Automatic changes apply to accounts of the following types only:

Accounts of other types can use a policy for the complexity of generated passwords, but are not changed automatically. Secret types such as certificates and API keys cannot have a policy.

How scheduled changes run:

• Keycyte PAM checks the accounts every minute. In a replicated installation, only the master node changes passwords.
• An account that is used by an active session is skipped and checked again later.
• Every change is verified by logging in to the target with the new password before the vault is updated.
• After a failed attempt, the next attempt for the account waits 5 minutes; the wait doubles after each further failure, up to 6 hours.

The results are recorded in the Password Manager log.

Change Methods

When the account changes its own password, the password rules of Active Directory or Windows apply and no privileged credential is needed. If an account cannot change its own password for a lasting reason, Keycyte PAM resets it with the privileged account for the next 30 days. You can end this early with Retry self change in the account’s action menu on the Password Vault page; see Changing Passwords.

Connection Operations

The following options change the account on Windows hosts or in Active Directory for the duration of a session: the change is made before the user connects and undone after the session ends. Use them to keep privileged group memberships and enabled accounts to a minimum outside sessions.

Operations on a target host use the server’s Manager User. For Windows Domain accounts, the domain operations before the connection are skipped while another session already uses the account.

Change Period

By default, a due password is changed at the next check. To restrict scheduled changes to a time window, select Period and set:

The Verify check box is also in this section.

Assigning Accounts to a Policy

You can assign a policy on the account itself (Policy field; see Adding Accounts) or from the policy list.

To add accounts to a policy:

1. On the Password Policy page, expand the row of the policy. The Accounts list shows the accounts that use the policy.
2. Click Add.
3. Select the accounts. Use Search Keyword to find them.
4. Click Save.

To remove an account from the policy, click the delete icon in its row in the Accounts list and confirm.

Changing Policy Owners

An ADMIN sees only the policies that the ADMIN owns. When an ADMIN creates a policy, the ADMIN is added as an owner. To change the owners, click Owners (users icon) in the row of the policy, select the administrator accounts in Change Owners and click Save.

Deleting a Policy

Before you delete a policy, assign its accounts to another policy or remove them from it. To delete a policy, click Delete in its row and confirm. You need the Delete permission for Password Policy.