Skip to main content

Creating New Endpoint Users

Endpoint users are the local accounts on your managed endpoints. AuthNull lists them under Targets → Endpoint Users (in the admin console, Switch product → PAM), together with the credentials AuthNull holds for them. Each endpoint is re-scanned daily, so accounts created on the machine itself also appear.

Creating New Endpoint User in Admin Console​

Administrators can add a user to a Linux endpoint that is reached through a gateway:

  1. Go to Targets → Endpoints.

  2. Open the endpoint's ⋯ menu and choose Add user…. (The same option is in the ⋯ menu at the top of the endpoint's own page.)

  3. Enter the Username (lower-case letters, digits, ., _ and -, at most 32 characters).

  4. Choose Log in with:

    • SSH key: uses the key AuthNull holds; nothing to manage.
    • Password: stored in the vault and rotated automatically. Set Rotate every to the number of days between rotations.

  5. Choose Expires: Never (the account stays until you remove it) or On a date and time, when it is removed from the machine.

  6. Optionally add a Note, for example a ticket number, and click Add user. The account shows as active within about a minute.

Note: Adding a user grants nobody access. An Endpoint Policy that names the account does. See Giving a Person Access to an Endpoint User.

Creating New Endpoint User in an Endpoint Directly​

For Creating New endpoint user in AuthNull via an endpoint directly follow the steps given below:

  1. Log into an endpoint using a user with root or sudo privilege.

  2. Use the useradd [OPTIONS] USERNAME command to create a new user. When invoked, useradd creates a new user account according to the options specified on the command line and the default values set in the /etc/default/useradd file.

    • The variables defined in this file differ from distribution to distribution, which causes the useradd command to produce different results on different systems.

    • useradd also reads the content of the /etc/login.defs file. This file contains configuration for the shadow password suite such as password expiration policy, ranges of user IDs used when creating system and regular users, and more.

    • Test the newly created user by logging in, to do that you need to set the user password.

    • Run the passwd command followed by the username:

    sudo passwd username

    You will be prompted to enter and confirm the password. Make sure you use a strong password.

  3. AuthNull picks the user up at the endpoint's next daily scan. To pick it up straight away, go to Targets → Endpoints, open the endpoint's ⋯ menu and choose Scan accounts.

Checking the Users on an Endpoint​

  • On Targets → Endpoints, click the endpoint's name. The endpoint's page lists its Local users.
  • Or go to Targets → Endpoint Users and use the Endpoint filter.

Managing an Endpoint User​

From Targets → Endpoint Users, the ⋯ menu on each row offers:

  • View Session Recordings: the recorded sessions of this account.
  • Password rotation…: turn on rotation for the account on a gateway-managed endpoint.
  • Rotate now: rotate the password straight away (accounts under rotation).
  • Reveal · break-glass: show the stored password once, after a push approval (administrators only). See Passwords.

Giving a Person Access to an Endpoint User​

Endpoint users are no longer assigned to a person directly. Write an Endpoint Policy under Policies that names the person, the endpoint and the account. See Policies.