Local Account for SSH

Privilege Secure Privilege Secure Ideas
, , ,
1

Which version of Privilege Secure do you have?

Privilege Secure AM

What is a one sentence summary of your feature request?

Add local account authentication for SSH connections

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

Hello,

We have a lot of equipment that can only be managed via SSH.
Some of this equipment is not compatible with TACACS or cannot authenticate using an LDAP account.

I have to use a local account. However, NPS does not offer this option.

Will this feature be added in future updates?

Best regards,

How do you currently solve the challenges you have by not having this feature?

Right now, I’m having trouble with some very specific servers.
For example: Following Broadcom’s acquisition of VMware, we migrated to XEN Server (VATES XCP NG).
We can log in via the web interface, but the XEN operating system is only accessible with the “root” account.
Netwrix won’t let me do this via SSH.

Recorded SSH sessions to devices that only accept a local account (root, appliance accounts) using Secret Vault + BYOV
2

I second this! We have a lot of appliances that we would love to proxy the SSH session and record the actions but the appliance only has one stripped down account. There should be a way to do this!

1 Like
3

Hi @nresssym and @DavidHenry,

This can be done today in NPS-AM by keeping the local account in an NPS Secret Vault and using NPS itself as a Bring Your Own Vault (BYOV) connector. The activity uses the Vault login account type, so the credential is injected into the session and the user never sees it. The session goes through the NPS SSH proxy, so it is recorded, can be watched live, and can sit behind an approval workflow.

In short:

  1. Onboard the device as a Linux resource by IP, with no service account management
  2. Store the local credential (for example root) in a Secret Vault
  3. Create a BYOV connector pointing to NPS itself
  4. Create an activity with Login Account = Vault and that connector
  5. Add a pre-session script that strips the domain\ or resource\ prefix from the username
  6. Create the access policy with session recording enabled
  7. Launch the session

Full step-by-step guide with screenshots, scripts and doc links:

One limitation to note: NPS won’t rotate the password on these devices automatically, so update the vaulted password when it changes (or script rotation in the BYOV check-in block if the device supports it).

2 Likes
4

Oh I never even thought to leverage the BYOV connector for this. I appreciate the information! It’ll help us greatly with controlled access to some platforms!

1 Like