Scenario 1:
Consider a scenario where the administrator has to provide privileged access to a Privileged Account Manager user.
For this scenario, the administrator must perform the following configuration in the command control:
Create an SSH type Credential Vault resource for the Linux or UNIX system and add the respective credentials.
Add the ssh_relay_rule rule with the following field values:
Session Capture: Select On.
Authorize: Select Yes and select Stop if authorized.
Use the drop-down list below to define what happens next:
Blank: Checks the next rule in the hierarchy.
Stop: No more rules are checked for the command.
Return: The next rule to be checked is up one level in the hierarchy.
Stop if authorized: If Authorize is set to Yes, no more rules are checked for the command.
Stop if unauthorized: If Authorize is set to No, no more rules are checked for the command.
Account Domain: <Credential Vault SSH Resource Name>
Credentials: Select a credential from the drop-down list. Run User and Run Host are automatically populated based on the selection.
Drag and drop the preloaded SSH Session command to the ssh_relay_rule rule.
After the administrator configures the authorization rule in Privileged Account Manager, the Privileged Account Manager user can gain privileged session as follows:
Click on home icon on the new Administration console.
Specify the username and password to log in to Privileged Account Manager and click Login.
Click Home > My Access > Predefined Tags > SSH/Telnet and click the launch icon before the appropriate resource name.
You can administer the SSH Relay session as it opens in Home > Active Sessions. The administrator audits the user actions in this privileged session and views these reports in the administration console.
Scenario 2:
Consider a scenario where the administrator has to provide privileged access with X11 application access to a Privileged Account Manager user.
For this scenario, the administrator must perform the following configuration in the command control:
Create a resource for the Linux or UNIX system and add the respective credentials.
Add a rule ssh_relay_rule with the following field values:
Session Capture: Select On.
X11 Enable: Select Yes.
Capture the X11 application videos using the global videos settings.
Authorize: Select Yes and select Stop if authorized.
Use the drop-down list below to define what happens next:
Blank: Checks the next rule in the hierarchy.
Stop: No more rules are checked for the command.
Return: The next rule to be checked is up one level in the hierarchy.
Stop if authorized: If Authorize is set to Yes, no more rules are checked for the command.
Stop if unauthorized: If Authorize is set to No, no more rules are checked for the command.
Account Domain: <Credential Vault SSH Resource Name>
Credentials: Select the required resource from the drop-down list. The Run User is automatically populated with the domain user provided in the resource.
Run Host: <Resource Name>
Drag and drop the preloaded command SSH Session to the rule ssh_relay_rule.
After the administrator configures the authorization rule in Privileged Account Manager, the non-privileged Linux or UNIX user can gain privileged session as follows:
Log in using the Privileged Account Manager user credentials and click Login.
Click Home > My Access > Predefined Tags > SSH/Telnet and click the launch icon before the appropriate resource name.
You can administer the SSH Relay session as it opens in Home > Active Sessions. The administrator audits the user actions in this privileged session and views these reports in the administration console.
Scenario 3:
Consider a scenario where the administrator has to provide access to multiple Privileged Account Manager users with a single command control rule. The framework user gets access to the target resource with the same user account name only if this user account is also available in the target resource.
NOTE:In this case, the user accounts need not be added to the Credential Vault SSH Resource. If there are credentials created in the Credential Vault with the same name as the Privileged Account Manager login user name, login to the target server using these passwords.
For this scenario, the administrator must perform the following configuration in the command control:
Create a resource for the Linux or UNIX system.
Add a rule ssh_relay_rule with the following field values:
Session Capture: Select On.
Authorize: Select Yes and select Stop if authorized.
Use the drop-down list below to define what happens next:
Blank: The next rule in the hierarchy is checked.
Stop: No more rules are checked for the command.
Return: The next rule to be checked is up one level in the hierarchy.
Stop if authorized: If Authorize is set to Yes, no more rules are checked for the command.
Stop if unauthorized: If Authorize is set to No, no more rules are checked for the command.
Run User: Submit User
Run Host: <Credential Vault SSH Resource Name>
Drag and drop the preloaded command SSH Session to the rule ssh_relay_rule.
After the administrator configures the authorization rule in Privileged Account Manager, the Privileged Account Manager user can gain access to the session as follows:
Log in using the Privileged Account Manager user credentials and click Login.
Click Home > My Access > Predefined Tags > SSH/Telnet and click the launch icon before the appropriate resource name.
You can administer the SSH Relay session as it opens in Home > Active Sessions. The administrator audits the user actions in this privileged session and views these reports in the administration console.
Scenario 4:
Consider a scenario where the administrator has to provide access of a specific user to a Privileged Account Manager user.
NOTE:You can specify the Run User as an account name or a Command Control user group containing the list of account names. The Run Host can be a specific target host name or a Command Control Host Group containing the list of target names. The target host names are the SSH type Credential Vault resource names.
For this scenario, the administrator must perform the following configuration in the command control:
Create a resource for the Linux or UNIX system.
Add a rule ssh_relay_rule with the following field values:
Session Capture: Select On.
Authorize: Select Yes and select Stop if authorized.
Use the drop-down list below to define what happens next:
Blank: The next rule in the hierarchy is checked.
Stop: No more rules are checked for the command.
Return: The next rule to be checked is up one level in the hierarchy.
Stop if authorized: If Authorize is set to Yes, no more rules are checked for the command.
Stop if unauthorized: If Authorize is set to No, no more rules are checked for the command.
Run User: <Credential name from SSH Resource>/<Command Control User Group containing list of credential name>
Run Host: <Credential Vault SSH Resource Name/Host Groups>
Drag and drop the preloaded command SSH Session to the rule ssh_relay_rule.
After the administrator configures the authorization rule, the Privileged Account Manager user can gain access to the session as follows:
Log in using the Privileged Account Manager user credentials and click Login.
Click Home > My Access > Predefined Tags > SSH/Telnet and click the launch icon before the appropriate resource name.
You can administer the live Remote Desktop Protocol Web Relay session as it opens in Home > Active Sessions. The administrator audits the user actions in this privileged session and views these reports in the administration console.