Passwords
Local passwords on your endpoints are random and rotated automatically. Nobody needs to know them. The gateway logs in for approved sessions.
At Onboarding
When you add an endpoint, every password that exists on the machine is replaced with a random one. The new password is stored in the vault.
After that, each password is rotated every 30 days by default.
The admin (sudo) account you onboarded the endpoint with is never rotated. See Local Users.
Password Rotation
In the Local Users table, open a user's ⋮ menu and choose Password rotation….
| Setting | Effect |
|---|---|
| Rotate this password | Turns rotation on or off |
| Rotate every N days | How often to rotate. 1 to 365 days. Default: 30 |
| Rotate now | Sets a new password straight away. Shown only when rotation is on |
When rotation is off, the last password stays in the vault and can still be revealed.
There are no rotation profiles. Each account has its own setting.
Reveal (Break-Glass)
Use Reveal… only when you must type the password at the machine's console, for example when the network is down.
- Choose Reveal… from the user's ⋮ menu.
- Click Send approval push. The push goes to your own phone.
- Approve the push within 5 minutes.
| Rule | Detail |
|---|---|
| Needs a push | Nothing is shown until you approve. A denied or expired push reveals nothing |
| Shown once | The password is shown once, for 60 seconds |
| Logged | Every reveal is written to the audit log and sent to your SIEM |
| Rotated again | The password is rotated again 60 minutes later by default. This can be set from 5 to 1440 minutes |
Treat a revealed password as spent. It stops working when it is rotated again.
Next Steps
- Add a User: create an account with a rotated password.
- Endpoint Actions: the endpoint's ⋮ menus.