5.6 Password Management

Using Privileged Account Manager, you can grant privileged access to Privileged Account Manager users either by elevating the user privilege or by providing privileged account credentials for checkout. The resource and credential details required to provide privileged access are stored securely in the Credential Vault, formerly known as Enterprise Credential Vault. The password of these credentials can be rotated periodically based on the compliance rule of the organization.

The credentials that are used to perform SSO by Privileged Account Manager are unknown to any administrator. Hence, these credentials must be rotated automatically by Privileged Account Manager to improve security. Similarly, the credentials used in service accounts are left unchanged, as it is tedious to detect all the service accounts, rotate their password, and restart the services. Using the password management feature of Privileged Account Manager, you can automate periodic rotation of service account password.

Password rotation is the process of regularly changing or resetting passwords (s). By reducing the amount of time a stolen password might be used, limiting the lifespan of a password lowers the danger from and efficacy of password-based attacks and exploits.The solution supports password updates for a wide range of platforms, including databases, routers, switches, operating systems (Windows and Unix), routers, and firewalls.

5.6.1 Understanding Password Management for Windows, Active Directory, Linux, and Network Devices

For changing these resource passwords, Privileged Account Manager uses tasks. Tasks contains the script that must be executed for password change and the scheduling option required to execute the script. The tasks are associated to a vault. For more information about vaults, see Contextual Help. By default, every vault will have a password change task associated with it. This task is executed for the credentials in the vault, which has the Change Password Policy option enabled.

In addition, if you want to perform any automated task after a password change, it can be added as a service task. For example, if you want to perform backup after changing the account password, it can be defined as a service task. These service tasks are custom tasks for creating a custom script and adding it to the task. For more information about the template for creating a custom script, contact Customer Support.

For Windows and Active Directory:

Privileged Account Manager provides out-of-the-box scripts to the change password of Windows local machine and Active Directory.

In addition to windows account password change, Privileged Account Manager also offers the capability to change the password of service accounts. Privileged Account Manager provides out-of-the-box scripts to change the password of service accounts, such as such as Windows Services, COM+, Task Scheduler, and IIS Pool. You can define a custom script for password change for other service accounts and associate it to a service task.

These service account tasks are executed only for those credential with the appropriate service account associated with it. This association can be defined when adding a credential. When you are adding a credential for an active directory, Privileged Account Manager provides a capability for you to define the machines where the credential is used for service accounts. This will help in end to end password change of the Active Directory accounts.
For Linux and Network Devices:

Privileged Account Manager provides out-of-the-box script to change password of Linux and Network devices that can be connected using SSH protocol. Privileged Account Manager can rotate both the password or the SSH key that is configured for a credential.

If you want to change the password of associated service accounts, you can define a custom script for service account password change and associate it to a service task.

For more information about configuring tasks and scripts, see Contextual Help.

Resource	Password Management	Schedule Password Change	Change Password in Associated Services	Custom Task Execution after Password change
Windows	Yes	Yes	Yes	Yes
UNIX, Linux and Network Device
Linux and Network Devices using SSH connection	Yes	Yes	No	Yes
Telnet (Linux and Network Devices using Telnet connection)	No	No	No	No
UNIX	No	No	No	No
LDAP
Windows Active Directory	Yes	Yes	Yes	Yes
NetIQ eDirectory	No	No	No	No
OpenLDAP	No	No	No	No
Database	Yes	No You can only enable the password to be changed immediately after credential check-in.	No	No
Application
Application Credential Checkout	Yes	No You can only enable the password to be changed immediately after credential check-in.	No	No
Application SSO	No	No	No	No
Key	No These are static keys that cannot be rotated.	No	No	No

5.6.2 Prerequisites for Configuring Password Management

Ensure that the Task Manager module is installed.
- The task manager component of Privileged Account Manager (taskmanager) is supported only on Windows, SLES 12 (64-bit), SLES 15 (64-bit), RHEL 7.5 (64-bit), or RHEL 8(64-bit).
  - For RHEL 8 (64-bit) and RHEL 7 (64 bit), install the redhat-lsb-core package.
  - For SLES 12 (64-bit) and SLES 15 (64-bit), install the lsb-release package.
- If you want to configure task manager on a separate agent, you must first install Privileged Credential Manager package (prvcrdvlt) and Access Manager package (auth), and then install Task Manager (taskmanager) module in the agent.
- If you have multiple host domains in Privileged Account Manager, you must have Task Manager module installed on every host domain.
  
  For more information about installing a package in Privileged Account Manager, see Installing Packages on a Host.
- If you have configured a Windows machine as task manager, ensure the following:
  - Powershell 4.0 or later must be installed in the Windows machine where you are installing the Task Manager module.
  - Windows Remote Management (WinRM) service must be running on the Windows machine. To start winrm service, use the command:
    
    Enable-PSRemoting –force
  - Add a target machine, where the password must be changed, to the WinRM trusted host. To add all servers as trusted host, use the command:
    
    winrm set winrm/config/client '@{TrustedHosts="*"}'
  - Set the PowerShell execution policy to Remotesigned using the command:
    
    Set-ExecutionPolicy -ExecutionPolicy RemoteSigned
Ensure the following is done on the target machine where the password must be changed.
- In Windows machine:
  - Powershell 2.0 or later must be installed in all the Windows target machines as Privileged Account Manager uses PowerShell scripts to change password.
  - Windows Remote Management (WinRM) service must be running on the Windows machine. To start WinRM service, use the command:
    
    Enable-PSRemoting –force
  - IP address of the task manager must be added to the trusted host of the target machine. To add trusted host, use the command:
    
    winrm set winrm/config/client '@{TrustedHosts="x.x.x.x"}'
- In AIX machine, configure the following:
  - Specify AcceptEnv LC_ALL in the sshd_config file.
  - Restart sshd service.

Configuring Password Management

Prerequisites

You must install the gssntlmssp package for upgrade and for fresh install of Privileged Account Manager. Download the appropriate versions from gssntlmssp.

Example 5-1 Installing the gssntlmssp Package

>> wget --no-check-certificate https://download.opensuse.org/repositories/openSUSE:/Backports:/SLE-15-SP4:/Update/standard/x86_64/gssntlmssp-1.2.0-bp154.2.3.1.x86_64.rpm
>> rpm -i gssntlmssp-1.2.0-bp154.2.3.1.x86_64.rpm

For RHEL, install using the yum install gssntlmssp command.

Test powershell authentication to AD server using the following command: cd /opt/netiq/npum/service/local/taskmanager/framework/powershellLD_LIBRARY_PATH=/opt/netiq/npum/bin/ ./pwshNew-PSSession -ComputerName <ad_server_ip> -Credential <ad_domain>\administrator -Authentication Negotiate

To configure Privileged Account Manager to change (rotate) the password of any resource, you must enable the Password Change option value in the Credential Vault > Resources > Edit icon Password Management resource configuration and ensure that all the password change tasks are enabled. If the password change option is set to yes in a resource, this configuration will be inherited by all credentials in that resource. However, you can override them in the credential configuration. To modify the password management option of a resource, click Credential VaultPassword Management Vault Nameedit icon next to the required resource.

Configuring Password Management in an Upgraded Setup

After upgrading Privileged Account Manager, if you want to enable password management, perform the following:

	Tasks	Go To
	Review the prerequisites and ensure all the required configurations are complete.	Prerequisites for Configuring Password Management
	Review all password change and service tasks associated with the vault and update when the task must be scheduled for execution.	Credential Vault > Password Management
	(Conditional) By default, the out-of-the-box password policy provided by Privileged Account Manager is associated it with every vault. You can choose to use the default policy or create a new policy and associate with the vault. Ensure not to use '%', percentage character in the special characters list of the password policy.	Credential Vault > Password Policies > Help icon
	Perform the following on all the resources: Edit the resource and enable the Password Change option value in the Credential Vault > Resources > Edit icon Password Management. Also, review and modify all password management options, such as reconcile the account and so on. These password management values will be inherited by all credentials in the resource. (Conditional) If you do not want Privileged Account Manager to change reconcile account password, disable the Password Change option value in the Credential Vault > Resources > Edit icon Password Management in the appropriate resource credential. It is recommended that you disable the Password Change option value in the Credential Vault > Resources > Edit icon Password Management Also, you must have one local administration account, which Privileged Account Manager does not manage to resolve any password change issue. (Conditional) For Windows, if the credential is used as a service account, you must edit the credential and modify the service association. (Conditional) For Active Directory, if the credential is used as a service account in any of the Windows machine, you must add the Windows machine to the credential and update the service association.	Credential Vault > Vault Type > Vault Name > click edit icon of the required resource Credential Vault > Vault Type > Vault Name > Resource Name > click edit icon of the required credential

Disabling Password Management

You can disable password management at task level or resource level.

You can disable password rotation (change) of all credentials or a specific credential in a resource at resource level.

To disable password management of all accounts in a resource, edit the resource configuration and disable the Password Change option value in the Credential Vault > Resources > Edit icon Password Management. Similarly, to disable password management for a credential, edit the credential configuration and set the Password Change to disabled.
At the task level, you can disable the password change task of any vault to stop the execution of the task.

Before you disable any task, review and resolve all the errors related to the task in the failed reports page. As the reports relates to failed reports are not displayed when the task is disabled.