Dual control in privileged access

With dual control, sensitive privileged access changes wait for a second administrator's approval. No administrator alone changes who can reach critical accounts.

Which changes wait?

Creating, changing and deleting access profiles; changing an account's profile; rotating a credential now; deleting a target; changing the PAM settings; releasing a recording's legal hold; setting the break-glass group; registering the escrow key; and turning dual control itself off. The last three are always four-eyes.

How do I turn it on?

1. Open «PAM» › «Dual control».
2. Tick «Require a second administrator». There must be at least two active administrators.
3. The console shows «Dual control is on.»

How does a request work?

1. The first administrator makes the change. The console says it was sent for approval and that a second administrator must approve it under PAM › Dual control.
2. The change appears in the list with its «Change», «Command digest» and request time, in the «Waiting for a second administrator» state.
3. Another administrator chooses «Approve and apply» (or «Deny») with a recent confirmation. The requester can «Cancel».
4. Final states: «Applied», «Denied», «Cancelled», «Expired» (24 hours), «Not applied».

The requester can never approve their own change.

Turning it off

Turning it off also waits for a second administrator.