Skip to main content

How to Give Time-Limited Access to an Endpoint User?

"Checkout User", which sent an endpoint user's credential to a mobile wallet, has been retired. AuthNull now keeps every endpoint user's password or key in its vault and never hands it to the person who connects. Instead:

  • an Endpoint Policy decides who may open which account, and each session is approved with a push;
  • an endpoint user can be added with an expiry date, after which it is removed from the machine;
  • an administrator can reveal a stored password for break-glass use, for 60 seconds, after which the account is rotated again.

All of these screens are in the admin console under Switch product → PAM.

How to Give Someone Access to an Endpoint User​

  1. Go to Policies and click New policy.
  2. Under Who can connect, select the person in Who.
  3. Under Where, choose the Gateway, Hosts and Accounts.
  4. Optionally, under Sudo, grant Full sudo or Specific commands for a Time limit.
  5. Under Action, keep Require approval so that every session needs a push.
  6. Click Save policy.

To take the access away, open the policy's ⋯ menu and choose Suspend or Delete.

Full steps: Giving a Person Access to an Endpoint User.

How to Create an Endpoint User That Expires​

For a vendor or a one-off task, add an account that removes itself:

  1. Go to Targets → Endpoints.
  2. Open the endpoint's ⋯ menu and choose Add user…. This is available to administrators on Linux endpoints reached through a gateway.
  3. Enter the Username and choose Log in with: SSH key, or Password (stored in the vault and rotated every N days).
  4. Under Expires, choose On and pick the date and time. The account is removed from the machine then.
  5. Optionally add a Note, for example a ticket number, and click Add user.

Adding the user grants nobody access. Write an Endpoint Policy that names the account (above).

For access that should last only one session, choose Temporary user (created per session) under Accounts in the policy instead. Each session gets its own account, deleted when the session ends.

How to Connect to an Endpoint Using an Endpoint User​

  1. Go to Targets → Endpoints and click Connect on the endpoint. The button appears only where a policy gives you an account.
  2. Pick the Account, then copy the Connection string or choose Open terminal.
  3. Approve the push on your phone. The session opens and is recorded.

How to Reveal an Endpoint User's Password (Break-Glass)​

When nobody can log in through AuthNull, an administrator can read a stored password and use it at the machine's console:

  1. Go to Targets → Endpoint Users.
  2. Open the account's ⋯ menu and choose Reveal · break-glass. It is shown only for accounts whose password AuthNull holds.
  3. Click Send approval push and approve the push on your own phone within 5 minutes.
  4. The password is shown once, for 60 seconds, with a Copy button. Then it is hidden.

The account is rotated again a set time after the reveal (60 minutes by default, from its rotation profile). Every reveal is recorded in the audit log.

To change the password straight away, use Rotate now in the same menu.