You can configure Safeguard for Privileged Passwords to authenticate to a managed system using an SSH authentication key. Safeguard for Privileged Passwords will not rotate SSH Keys unless you select the Manage SSH Key option in the asset's profile change schedule. For more information, see Adding change password settings.
Note: This option is not available for all operating systems. But if a Safeguard for Privileged Passwords asset requires an SSH host key and does not have one, Check Password, Change Password, and Test Connection will fail. For more information, see Connectivity failures.
| Property | Description |
|---|---|
| Automatically Generate the SSH Key |
Select this option to have Safeguard for Privileged Passwords generate the SSH authentication key. |
| Manually Deploy the SSH Key |
When you select Automatically Generate the SSH Key, Safeguard for Privileged Passwords allows you to select this option so that you can manually append this public key to the authorized keys file on the managed system for the service account. For more information, see Downloading a public SSH key. The SSH authentication key becomes available after Safeguard for Privileged Passwords creates the asset. Important: If you do not select this option, Safeguard for Privileged Passwords automatically installs the SSH authentication key. If you do select this option, Safeguard for Privileged Passwords creates the key and associates it with the Safeguard for Privileged Passwords asset you are creating, but it does not install it on the managed system for you. |
| Import and Manually Deploy the SSH Key |
Select this option, then Browse to import an SSH authentication key. For more information, see Importing an SSH key. |
| Key Comment |
(Optional) Enter a description of this SSH key. |
| Service Account Name |
Enter the service account name that Safeguard for Privileged Passwords is to use for management tasks. This is the account Safeguard for Privileged Passwords uses to install the SSH authentication key on the asset. For more information, see About service accounts. |
| Service Account Password |
If not importing the SSH authentication key, then you must enter the service account password Safeguard for Privileged Passwords needs to authenticate to this managed system. Limit: 255 characters |
| Privilege Elevation Command |
If required, enter a privilege elevation command (such as sudo). This is used as a prefix for commands that require privileged access on the system and to manage accounts on Unix-based systems; that is, to check and change passwords and to discover accounts. When adding an asset, Safeguard for Privileged Passwords uses this command to perform Test Connection. For more information, see About Test Connection. To enable Safeguard for Privileged Passwords to elevate the privileges of the service account, assign the asset to the scope of a partition profile that has the privilege elevation command defined. For more information, see Creating a profile. The privilege elevation command must run non-interactively, that is, without prompting for a password. For more information, see Preparing Unix-based systems. Limit: 255 characters |
| Test Connection |
Click this button to verify that Safeguard for Privileged Passwords can log in to this asset using the service account credentials you have provided. For more information, see About Test Connection. |
|
Service Account Profile |
Click  Edit to add the profile or — Remove to delete the assigned profile. Available profiles are based on the partition selected on the General tab (asset discovery). To update the profile later, go to the service account and update the Profile. For more information, see General tab (account). |
| Auto Accept SSH Host Key |
Select this option to have Safeguard for Privileged Passwords automatically accept the SSH host key when it creates the Safeguard for Privileged Passwords asset. When this option is selected, Safeguard for Privileged Passwords displays the thumbprint of the SSH host key that was discovered. When a managed system requiring an SSH host key does not have one, Check Password will fail. For more information, see Connectivity failures. |
| Port |
Enter the port number used by SSH to log in to the managed system. Required |
| Connection Timeout |
Enter the command timeout period. This option applies only to platforms that use telnet or SSH. Default: 20 seconds |
Add Asset from the toolbar to add an asset.
Import an SSH Key.