Password Safe - Dedicated Admin Accounts and other Functions

Dedicated Admin Accounts

  • Enable users to log in with standard AD account and link to a managed account.
  • Facilitates one-to-one mapping between requester and managed account.
  • Account name is a variation of the standard user account name (e.g., adding a prefix or suffix like "-adm" or ".adm").
  • Can also be matched using other AD attributes (employee ID, email address).
  • Before mapping, users need passwords for both end-user and admin accounts.
  • Password Safe manages the admin account's password.
  • Enhances security and allows tracking of user changes.
  • Provides centralized reporting and audit logs.

Mapping Process

  1. Create an access security group in Active Directory containing everyday user accounts.
  2. Create two smart roles:
    • One to onboard and manage admin accounts, linking them to target systems.
    • Another to map admin accounts to standard accounts.
    • The second smart rule requires an account-based smart group for role-based access to the requester group.

Step-by-Step Mapping

  1. Create Security Group in AD:

    • Access Active Directory Users and Computers.
    • Create a new group (e.g., "PS Dedicated Admin Requesters").
    • Add standard end-user accounts to this group.

  2. Add Requester Group to User Management in Beyond Insight:

    • Navigate to Configuration > Role Based Access > User Management.
    • Create a new group and add the AD group.
    • Include a relevant credential for the bind account.
    • Search Active Directory to locate the group.

  3. Create Directory Query:

    • Note the format of the user account (e.g., "-ADM" suffix).
    • Go to Configuration > Role Based Access > Directory Query.
    • Create a new query that locates the correct OU in AD.
    • Filter users with a name ending in "-ADM".
    • Test the query to confirm it reaches the targeted accounts.
    • Example filter: name ending in -ADM
    • LDAP queries can be used for different matching attributes.

  4. Create Smart Rule to Onboard Admin Accounts:

    • Create a managed account-based smart rule using the directory query as selection criteria.
    • Include three actions:
      • Manage Account Settings: Onboard admin accounts to Password Safe.
      • Link Domain Accounts to Manage Systems: Link onboarded accounts with the correct smart group.
      • Show Managed Account as Smart Group.
    • Active Directory accounts can be onboarded using the disabled at rest action if required.

  5. Verify Onboarding and Grouping:

    • View results to double-check accounts have been onboarded and grouped correctly.
    • Navigate to the managed system and select go to advanced details.
    • Under linked accounts, the accounts ending in -ADM should be visible.
    • Filter by account name -ADM to make the search easier.

  6. Create Smart Rule to Map Admin Accounts to Requester Group:

    • Create a new managed account-based smart rule.
    • Use selection criteria to search for onboarded admin accounts (e.g., accounts ending in "-ADM" on a specific domain).
    • Actions:
      • Map Dedicated Accounts to the Target User Group.
      • Show Managed Account as Smart Group.

  7. Verify the Mapping

    • From the manage accounts page result, select the column chooser and then select map to user.
    • Drag this new column next to the account column to easily check that each admin account is now mapped to the correct user account.

  8. Provision the Mapped Group

    • Navigate to Configuration > Role Based Access > User Management.
    • Locate the initial requester group and select view group details.
    • Go to the smart groups tab and make sure the drop down says all smart groups instead of enabled smart groups.
    • Select the newly created smart group and then under assign permissions, choose assign permissions read only.
    • Change the drop down back to enabled smart groups.
    • Select the ellipsis button next to the smart group, and then select edit password safe roles.
    • Choose the requester option and select an access policy.
    • Select save roles.

  9. Verify Account Setup by Logging In:

    • Log in to the web portal as one of the new end-users.
    • On the account page, under the directory linked accounts tab, the admin account should be available.
    • The end user can request either a password or proxied session depending on the applied access policy.

Accessing Managed Systems

  1. Open a browser and navigate to the Password Safe web console.
  2. Log in to the end user account with username, password, and domain.
  3. On the accounts page, click the directory linked accounts tab.
  4. Click the link to display the list of accessible systems.
  5. Click the access key to request a password or session.

Service Account Management for Windows Services

  • Windows service accounts store startup credentials in the registry.
  • Changing the password in Active Directory does not automatically update the registry.
  • Password Safe automates this by using asset discovery scans with WMI scanning.
Requirements for Password Change:
  • Password Safe needs WMI network access and remote registry access.
Options Available:
  1. Change the password for Windows services started by this account.
  2. Change the password and restart those services.
  3. Change the password for Windows scheduled tasks.
Process:
  1. Password change in Active Directory.
  2. Password Safe checks the asset database and queries for systems with services run by the account.
  3. Remote registry call to update credentials on port 445 or 139.
  4. Optional WMI call on port 135 to restart the service.
Network Access:
  • Requires network access for systems.
  • Ports must be open between Password Safe and the managed system.
  • No agent required on the Windows system.
Firewall Configuration:
  • ACLs needed between Beyond Insight infrastructure and managed Windows systems.
Local Service Accounts:
  • Password change is made locally; registry calls are made.

Detailed Discovery Scans:

  • Required to manage service accounts.
  • Performs a local scan using a dissolvable agent that is removed after the scan.
  • Transfers scan data to Beyond Insight to enumerate assets and services.

Scan Frequency:

  • Scans need to be run periodically (daily, weekly, or monthly).

Service Restarts:

  • Not all services require restarts.
  • Some services reauthenticate frequently and need to be restarted.
  • Load-balanced systems may require sequenced restarts.

Best Practices:

  • Use a lab environment to research service reauthentication and restart procedures.
  • Match change frequency to meet policy requirements.
  • Check for WMI remote registry connectivity.
  • Pilot changes in a staging environment before production.

Password Safe and Databases

Key capabilities include:

  • Full password management of database accounts.

  • Controlled direct retrieval of password database accounts

  • Controlled session management to manage systems using RDP and SSH

  • Controlled session management through remote application configuration using tools like SQL Server Management Studio and Oracle SQL Developer.

  • Password Safe can manage credentials for almost any organizational resource and provides several methods for managing privileged access to databases.

  • Out-of-the-box connectors include Microsoft SQL Server, Oracle, MySQL, Sybase ASE, Teradata, and MongoDB.

Configuration
  • Before configuring, identify the database and user account.
  • Create a functional account for the database by navigating to Configuration > Privileged Access Management > Functional Accounts.
  • Add the database to Password Safe as a managed system via the Assets page.
  • The underlying operating system platform, whether Linux or Windows, must be a known asset in Beyond Insight before database access can be configured and password safe.
  • Set a database account on the instance to be managed by Password Safe.
Walkthrough
  1. Identify the SQL Server user accounts to be managed and a privileged account for managing managed account passwords.
  2. Open SQL Server Management Studio and authenticate (note databases and existing users).
  3. Create a functional account via Configuration > Privileged Access Management > Functional Accounts.
  4. Add the database as a managed system (Assets > "Go to advanced details" > Databases tab).
  5. Set a database account to be managed (Managed Systems > "Go to advanced details" > Create New Account).
Verification
  • Test the password to verify credentials can be authenticated by the database (Managed Accounts tab > ellipsis > Test Password).
Password Retrieval as Requester
  1. Log in to the Password Safe web console as an Active Directory user.
  2. Find the managed account under the Local Accounts tab.
  3. Request and retrieve the password.
  4. Open SQL Server Management Studio and authenticate with the retrieved password.

Remote Applictions

  • Password embedded within applications pose an often overlooked and undermanaged risk.
  • Password safe lets you take these application passwords under complete management to mitigate those risks.
  • Simplifies usage of remote applications like SQL Server Management Studio or FileZilla by launching them as remote apps via a proxy without exposing passwords.
  • Adds an extra layer of security and removes the need for the user to keep separate passwords for each of their web applications.
  • Password Safe can be used in conjunction with applications to provide controlled session management and leverages Microsoft Remote Desktop Services.
  • password safe can simplify this process even for web interfaces that require scripts used to pass credentials
  • All activity is recorded and can be monitored in real time with the ability to lock and terminate the sessions.
PS Automate Utility
  • PasswordSafe's p s automate utility removes the need to manually enter credentials when launching Windows applications
    *Note, PS Automate is a utility for Windows and is not supported on macOS
  • PS Automate utility removes the need to manually enter credentials when launching Windows applications.
  • It allows you to pass credentials from Password Safe to a remote application and can automate routine tasks.
  • Uses a .INI configuration file to interpret login information.
Configuration Steps
  1. Create, define, and configure the application in Password Safe.
  2. Associate the application with a managed account.
  3. Create a requester group and assign smart group permissions.
  4. Create or amend an access policy to provide application access.
Detailed Instructions

  1. Define Application:

    • Specify the application or command line (PS Automate executable).
    • Define the parameters to be passed (the .INI file).
    • Choose which system to run the application on (the application server).
    • (Optional) Link the application to various systems via a smart group.

  2. Associate Managed Account:

    • Set up a managed system and create managed accounts.
    • Link those managed accounts to the application.
    • Consider using a managed account smart rule to group website accounts.

  3. Create Requester Group:

    • Create an Active Directory group for users.
    • Assign permissions to the group via the previously created website accounts smart group.

  4. Ensure Access Policy Permits Application Access:

    • Application access is a distinct access type.
    • Enable application access in the chosen access policy and assign the policy to the relevant smart group.

    Access to remote applications is confined to the application window and not the entire desktop

Remote Application Example Configuration
  • First, we will add the application server as a managed system.
  • Now we will create a remote app for MS SQL Server Management Studio.
  • Set the application name and optionally specify the version. The value set enables you to have configurations for multiple versions of an application in your enterprise.
  • The proxy passes the application command line, pulling the credentials out of the password safe database and passing the parameters. The proxy then launches SSMS, which will connect the SQL Server on the fourth system, WSQL, the managed account named b t u underscore s a using the credentials that have been retrieved from password safe.
  • After completing a successful request and downloading the RDP file on W client, you open an RDP session on port forty four eighty nine to the proxy, which is on WBI.
    *Select the account, click on the ellipsis, and select edit account. For this example, the BTSA managed account shown here was enabled for the MS SQL database managed system earlier.