Skip to main content

Privileged Access

PAM: Overview​

Privileged access management (PAM) is the combination of tools and technology used to secure, control and monitor access to an organization's critical information and resources. Subcategories of PAM include shared access password management, privileged session management and application access management.

What is Privileged Access Management?​

Privileged access management (PAM), a subdivision of Identity and Access Management (IAM), is a solution that provides organizations with better control and monitoring capabilities that decide who can have privileged access to critical assets, say, a computer or information system.

The solution should include the following functionalities:

Defining user roles Granting required privileges or access rights for the roles defined Distributing user information and access grants to all devices and systems that enforce access rights in organizations Monitoring privileged user activities and analyzing the same to detect anomalies

how does PAM work?​

PAM primarily works by keeping the credentials of privileged accounts, also known as system administrator accounts, out of users' hands. Access to those accounts is granted by policy, approved with multi-factor authentication, and logged and recorded. The separation is intended to lower the risk of admin credentials being stolen or misused.

In AuthNull, the second factor is a push notification sent through your organisation's MFA provider (Settings → MFA Provider: AuthNull Authenticator, Duo Security or Okta Verify). The PAM screens are under Switch product → PAM.

Endpoint Management​

Endpoint management in AuthNull revolves around ensuring secure access to various endpoints, be it servers, workstations, or other networked resources.

Setting Up Endpoints​

To set up endpoints in AuthNull, go to Targets → Endpoints and click Add endpoint. Follow the instructions given separately for each type:

Gateways (jump servers)​

AuthNull provides a gateway, an SSH jump server that acts as the intermediary for accessing your Linux servers. Operators never connect to critical servers directly: the gateway checks policy, raises a push for approval, reaches the server with a per-session key and records the session.

Linux only - LDAP 2-Factor Authentication​

For those using LDAP (Lightweight Directory Access Protocol), AuthNull supports 2-factor authentication, adding an extra layer of security to the login process.

Linux only - Local 2-Factor Authentication​

AuthNull also supports local 2-factor authentication for both SSH and password-based logins. This ensures that even if credentials are compromised, malicious actors cannot gain access without the second factor.

What happens when endpoints are integrated with AuthNull?​

  1. Endpoint Registration: Before synchronization can occur, the endpoint must be registered within AuthNull. This involves installing the AuthNull agent on the endpoint and ensuring it can communicate with the AuthNull platform.
  2. Initial Synchronization: Once the endpoint is registered, AuthNull retrieves a list of all local users and groups from the endpoint. These users and groups are then imported into AuthNull, preserving their attributes and memberships.
  3. Ongoing Synchronization: After the initial synchronization, the AuthNull agent monitors the endpoint for any changes to local users or groups. Additions, modifications, and deletions are synchronized in real-time or at scheduled intervals, based on the configuration.

Managing Endpoints​

AuthNull provides a comprehensive interface for managing endpoints. Admins can view, modify, and set policies for each endpoint, ensuring that access is always in line with organizational policies.

Endpoint management guide

Credential Rotation​

Security best practices recommend regularly changing credentials. AuthNull supports credential rotation for endpoint accounts, so that passwords are changed regularly. This minimizes the risk associated with compromised credentials. For SSH sessions through a gateway, operators never hold the account's key at all: the gateway uses a key issued for that one session.

Understanding credential rotation