Keycyte PAM 3.2 · Administrator Guide

Adding Accounts

Add a password vault entry for each privileged account that users connect with, and for each secret that you want to keep in Keycyte PAM.

Before you begin:

• You need the Add permission for Password Vault.
• Add the servers that the account is used on. See Adding Servers.
• If the account should be rotated, create a password policy. See Configuring Password Policies.

Adding an Account

To add an account:

1. Select Password Vault in the menu.

2. Click Add in the toolbar. The Account panel opens.

3. In Type, select the account or secret type. The panel shows the fields of the selected type. For the types, see Account Types.

4. Fill in the fields:

   Field	Shown for	Description
   Type	All	Type of the entry. Default: Other.
   Name	All	Display name of the entry. Required.
   Main Account	Windows Service	The account whose password the service uses. See Windows Service Accounts.
   Service Name	Windows Service	Name of the Windows service.
   Policy	Account types except Windows Service	Password policy of the account. The policy defines the complexity of generated passwords and whether the password is changed automatically.
   Domain	Windows Domain	Domain of the account, for example example.com.
   Username	All	User name of the account.
   Password	All types except Certificate and PFX Bundle	Current password of the account. For Secure Note this field is Note Body. Shown only when you create the entry; afterwards the password is changed with the password change actions.
   Private Key	Linux, SSH Key (Standalone)	Private key for key-based SSH login. Shown only when you create the entry.
   Passphrase	Linux, Certificate, SSH Key (Standalone), PFX Bundle	Passphrase of the private key or bundle. Shown only when you create the entry.
   Tags	All	Descriptive labels for grouping and filtering.
   Roles	All types except Windows Service	Password roles that the entry is added to.
   Servers	Account types except Windows Service	Servers that the account can be used on. See Linking an Account to Servers.
   Server	Windows Service	The Windows server on which the service runs.
   Description	All	Free-text note.

   Secret types have additional fields, such as Valid Until for a certificate. See Account Types.

5. For a Linux account, optionally configure Su/Sudo escalation. See Su/Sudo Escalation.

6. Click Save.

The entry appears in the list. Its password is shown masked; nobody can read it from the list.

Linking an Account to Servers

An account can be used for a connection only on the servers it is linked to. Select the servers in Servers. The list also offers shortcuts:

• All protocol servers, for example All RDP servers, adds every server of that protocol that you can see.
• A server role (marked Role) adds every server of the role that you can see.

Shortcuts add the servers as they are at that moment. Servers added to the protocol or role later are not linked automatically. Select All adds every server that matches the current search text; Clear removes them.

To connect with the account, a user also needs a password role that contains the account and a server role that contains the server. See Password Roles and Server Roles.

Windows Service Accounts

A Windows Service entry represents the logon account of one Windows service on one server. It is not used for connections; it keeps the service working when a password changes.

To add a Windows service account:

1. Add the account that the service runs as (the main account) as a Windows, Windows Domain or Linux entry.
2. Add a new entry with Type set to Windows Service.
3. In Main Account, select the main account.
4. In Service Name, enter the name of the Windows service.
5. In Server, select the Windows server on which the service runs.
6. Click Save.

When the password of the main account is changed on the target, Keycyte PAM also changes the logon password of the service on the selected server, and records the result in the service entry. If that update fails, the service entry keeps its previous password and its status shows the error.

Su/Sudo Escalation

A Linux account can switch to a root account automatically after it logs in. Use this when users must log in with a personal or non-privileged account but need root privileges on the target.

To configure escalation, in the Su/Sudo section of a Linux entry:

1. Turn on the Su/Sudo switch.

2. In Escalation Method, select how to switch: sudo su -, su -, sudo su, su, enable (Cisco), super (Huawei) or super level-15 (H3C). If no method is selected, sudo su - is used.

3. In Root Account, select the vault entry of the root account. Only other Linux entries are listed.

4. Click Save.

The SSH proxy switches to the root account with the selected method after the login, using the password of the root account.

Account Owners and Permission Levels

Owners are the administrator accounts that manage an entry. An ADMIN sees only the entries that the ADMIN owns, and each owner has a permission level on the entry:

A MASTER always has full access. The actions also require the matching permission profile flag, for example Edit for Password Vault to change a password.

To change the owners of an entry:

1. Click the action menu (…) in the row of the entry and select Owners.
2. In the Change Owners dialog, select the administrator accounts that should own the entry and set the Permission level of each.
3. Click Save.

To set owners on several entries, select them and click Password Owners (users icon) in the toolbar.