Password fails for Unix host
Some Unix systems silently truncate passwords to their maximum allowed length. For example, Macintosh OS X only allows a password of 128 characters. If an Asset Administrator creates a profile with an Account Password Rule that sets the password length to 136 characters, when Safeguard for Privileged Passwords changes the password for an account governed by that profile, the asset's operating system truncates the new password to the allowable length and does not return an error; however, the full 136-character password is stored in Safeguard for Privileged Passwords. This causes the following issues:
Password or SSH key is pending review
Safeguard for Privileged Passwords can resolve a situation when a user needs to request an account password or SSH key but cannot because there is a previous release request still in the Pending Review state and the designated reviewer is not available. If the request is left in this state, Safeguard for Privileged Passwords prevents users from checking out the account password or SSH key. In such a situation, the Security Policy Administrator can close the request without review.
You can also set up requests so that pending reviews do not block access. For more information, see Reviewer tab.
To close a password without review
- Log in as a user with Security Policy Administrator permissions.
- On the Home page, click Refresh.
- Open Administrator to review the pending request.
- Select Close Request.
- Type an explanation in the Comment box of up to 255 characters (required).
- Select Close Request.
You can query and view all requests closed without review in the Activity Center. Filter the events by Password Request Closed, then export the search results to see the old state and new state.
Password or SSH key is pending a reset
If a user receives a persistent message that states either of the following types of messages, the account password or SSH key is stuck in a pending password/SSH key change state:
- You cannot checkout the password or SSH key for this account while another request is pending password or SSH key reset
- This account has password or SSH key requests which have not yet expired or have to be reviewed. It cannot be deleted now"
- Ensure that the service account for the asset associated with this account is working. Then manually change the account password or SSH key . See: Checking, changing, or setting an account password and Checking, changing, or setting an SSH key.
- Or, if the service account for the asset is working properly and the policy governing the account allows emergency access and has enabled multiple users simultaneous access, you can instruct the user to request the password or SSH key using Emergency Access.
You can allow new access requests whether a prior request is approved or not approved. In other words, no requests will be blocked based on the approval status of a prior request. Setting the Pending reviews do not block access check box only pertains to future requests. For more information, see Reviewer tab.
Password or SSH key profile did not run
The password and SSH key management settings Settings | Access Request | Enable or Disable Services enable the automatic profile check and change schedules in partitions.
Ensure the password and SSH key management settings are enable for profiles to run on schedule:
- Check Password Management Enabled
- Change Password Management Enabled
- Check SSH Key Management Enabled
- Change SSH Key Management Enabled
For more information, see Enable or disable access request and services.