Privileged Account Manager solutions typically take the credentials of privileged accounts – such as, the administrator accounts, and add these credentials inside a secure repository (a vault), isolating the use of privileged accounts to reduce the risk of those credentials being stolen. Once inside the repository, system administrators need to go through the Privileged Account Manager system to access their credentials, at which point they are authenticated and their access is logged. When a credential is checked back in, it is reset to ensure administrators have to go through the Privileged Account Manager system next time they want to use the credential.By centralizing privileged credentials in one place, the Privileged Account Manager system ensures the following activities:
High level of security to the credentials
Control who is accessing the credentials
Control who is accessing the credentials
Monitor for any suspicious activity
Privileged Account Manager supports the following vault types:
Application configuration: Configuration for application credential checkout and application SSO.
Database: Configuration for database credential checkout.
Keys: Configuration for Windows license keys SSH, or host keys.
LDAP/Active Directory Configuration for all the directory servers.
UNIX/LINUX/Network Configuration for Linux, Unix, network device configuration.
Windows: Configuration for a Windows machine that are not part of any directory services.
Click Privileged Account Manager > Credential Vault to view all the vaults configured. Each vault provides a preview of the resources and credentials stored within.
This use case helps you to configure the AWS vault type using the following procedure:
Click Credential Vault > Database > Add New and select Add Resource.
Complete the details.
Name: Specify the name of the database. This name is used along with the Credential to authenticate. If you do not provide the correct domain name, user authentication fails.
Connection Details
Connect String: You can specify the string that will reset the password in the database and check in the password.
Connect As: Select SYSDBA. If you want Privileged Account Manager to perform the password check in process then, to check the connection to the database server, click Test Connection or select Default.
Click Application as vault type.
Change the credentials from the default to the actual administrator credentials using Credential Vault > Manage > Credentials > Edit.
Click Save. This changes the default user credential provided by the template to the actual user credential. The message “Credentials Updated Successfully” is displayed. The Privileged Account Manager user can now access this resource.
Enter Privileged Account Manager user credentials and log into the user interface.
Click home icon on Privileged Account Manager console My Access > Predefined Tags > Cloud Services > Checkout icon against the AWS resource.
A Credential Checkout pop-up page is displayed. Enter Access Duration, Email ID, and Reason for accessing the resource and click Check Out.
Note the credentials provided and open AWS server and enter the same credentials in the Credential Checkout page and click sign in. Now the you are successfully logged into the AWS Database and can proceed with completing the tasks.
You can check-in the credentials after the use of the credentials using the following procedure.
Enter Privileged Account Manager user credentials and log into the user interface.
Click home icon on Privileged Account Manager console My Access > Predefined Tags > Cloud Services > Check-in icon against the AWS resource. The message "Credentials Checked in successfully" is displayed. Now you can verify and note that you can no longer access the AWS database using the earlier credentials.
The administrator can monitor this activity by navigating to Reports > Built-in Reports > Credential Checkouts to access the report using the Privileged Account Manager console.