Privileged access (PAM)

In this tutorial, we set up privileged access: server administration accounts live in a vault, are only used by whoever requested and was approved, for the time requested, and every session is recorded. Before you start, you need an Edge appliance installed on your network, with the privileged access module turned on, and an approvers group, created under Manage, Groups.

First, the access profile. Under PAM, Access profiles, choose Add profile. Give it a name, set how many approvals are required and which groups approve, and set the default and maximum duration. Turn on recorded sessions and save. In the same profile, you can write alert rules: a command that raises an alert, or one that ends the session. Use Test rules to see what each command line triggers.

Now the target. Under PAM, Targets, choose Add target. Enter the name, the type, the host and port, and the level: normal or critical. A critical target is flagged on the approver's phone. Attach the Edge appliance that reaches the server, and choose Read host key. Compare the fingerprint with the server's own and, if it matches, confirm. From then on, the appliance trusts only that key.

On the target, add the privileged account: the username, the mode, in the vault, the credential and the connector. Assign it the access profile. Without a profile, nobody can request it. Finally, publish a rule in the access policy that allows these requests. Everything is ready. Let's see it from the side of whoever needs access. Under Access, My access, the technician chooses Request on the account, picks Recorded session, the duration, writes the justification and the support ticket number, and sends it.

The approving colleague receives the request on her phone: who is asking, the target, the account, the duration and the justification. She compares the code with the requester's, approves, and confirms with her PIN or fingerprint. Nobody approves their own requests. With the request approved, the technician chooses Activate, confirms with his passkey, and opens the web terminal.

The session opens already authenticated: the appliance injects the credentials, and he never sees the password. When he's done, he chooses Release. Under PAM, Sessions, administrators see the sessions in progress and the recordings. Before playback, the service checks the recording: verified and anchored in the audit chain. The command index takes you straight to each command.

For extra protection, turn on dual control for sensitive changes, create an emergency access group with at least two people, and keep the vault's custody key offline. And that's it: credentials in the vault, access approved and time-limited, and every session recorded and sealed. In the next tutorial, we'll connect the VPN and Wi-Fi through RADIUS.