Linux local root accounts workflow

A workflow for Password Safe

Local root accounts on Linux servers grant full control of the system, which makes them high-value targets. Rotating these passwords automatically and limiting who can request access reduces the risk that a compromised or stale root credential leads to a wider breach.

Scope of this guide

This workflow shows you how to set up automatic password rotation for local root accounts on Linux servers in Password Safe, with auto-approval for SSH sessions. You create Smart Rules that discover Linux servers, bring their root accounts under Password Safe management, and grant a specific set of users access to those accounts.

Prerequisites

You have IT administrator access to the BeyondInsight console, including Configuration and Role Based Access.
A credential with privileges to discover services, tasks, systems, devices, users, and databases from Active Directory or LDAP is created for Discovery Scans. Create it under Configuration > Discovery and Vulnerability Management > Credentials.
A functional account for Linux servers is created. Password Safe uses this account to access Linux servers and manage and change root account passwords.
A directory credential for Linux directory accounts is created, if your Discovery Scan pulls details from Active Directory or LDAP.
An address group for Linux servers is configured. The Discovery Scan uses this group to find Linux servers.
An access policy that allows auto-approved SSH sessions is configured.
A user group is created for the users who need Requestor access to Linux root accounts.

Steps

Step 1: Create a Smart Group to discover Linux servers

From the left menu in the BeyondInsight console, select Smart Rules.
Select Create Smart Rule.
Select the Category, and enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to your Linux servers address group, and enable Use to discover new assets during scans. Enter the interval, in hours, to rerun the query so new servers that join the domain are captured automatically.
Set Actions to Show asset as Smart Group and View assets in a standard asset grid.
Select Create Smart Rule.

You can now run a Discovery Scan against this Smart Group. Run the scan with the appropriate credentials to pull details, including local accounts, from each asset into BeyondInsight. Start the scan from the vertical ellipsis menu for the Smart Group on the Smart Rules page. You can also schedule a recurring scan to discover new assets and confirm that local accounts and services have not changed on existing assets — this keeps the onboarding process dynamic.

Because an address group is a static list of hosts, this Smart Group does not need to reprocess often. Reprocess it only when you make known changes to the address group.

Step 2: Create a Smart Group to add Linux servers to Password Safe management

From the left menu in the BeyondInsight console, select Smart Rules.
Select Create Smart Rule.
Select the Category, and enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to Operating System contains linux. This criterion queries servers that share the same functional account, and the related action associates that functional account with the system.
Set Actions to Show asset as Smart Group, View assets in a standard asset grid, and Manage Assets using Password Safe with Platform set to Linux, Account Name Format set to SAM, and the Functional Account you created for Linux servers.
Select Create Smart Rule.

To ensure new servers are added to Password Safe management automatically, reprocess this Smart Group regularly, especially after each scan completes.

Step 3: Create a Smart Group for granting system access to user groups

Creating this managed system Smart Group is not always required, but it helps you group systems that share specific managed accounts and assign asset-level permissions to user groups. As assets are added to Password Safe management, they populate the All Managed Systems Smart Group automatically. This Smart Group looks specifically for Linux servers managed by Password Safe.

From the left menu in the BeyondInsight console, select Smart Rules.
Set the Smart Rule Type filter to Managed System.
Select Create Smart Rule.
Select Managed Systems from the Category list.
Enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to Platforms Linux.
Set Actions to Show managed system as Smart Group.
Select Create Smart Rule.

Step 4: Create a Smart Group to add root accounts to Password Safe management

The initial creation of this Smart Group includes only the root account name. After you research and review reports, you can add other privileged account names to this Smart Group.

From the left menu in the BeyondInsight console, select Smart Rules.
Set the Smart Rule Type filter to Managed Account.
Select Create Smart Rule.
Select Managed Accounts from the Category list.
Enter a meaningful Name and Description for the Smart Rule.
Set Selection Criteria to User Account Attribute Account Name equals root, enable Discover Accounts for Password Safe Management, and select where to discover accounts from.
Set Actions to Show managed account as Smart Group and Manage Account Settings, with a Password Rule, Enable Automatic Password Management set to yes, and a Change Password Time and Change Password Frequency.
Select Create Smart Rule.

The Manage Account Settings action onboards the root account if it's found in the system's scan results, and it determines whether Password Safe rotates the account immediately.

Step 5: Assign user group permissions and roles for account access

Associate a user group with the Smart Group you created in Step 4, and then assign permissions, a role, and an access policy to that group. In this workflow, Password Safe users have the Requestor role with an access policy that allows auto-approved SSH sessions.

From the left navigation in the BeyondInsight console, select Configuration.
Under Role Based Access, select User Management.
Locate the user group in the grid, and select the vertical ellipsis button for that group.
Select View Group Details.
From the Group Details pane, select Smart Groups.
In the Smart Groups Permissions grid, select the Smart Group you created in Step 4, and select Assign Permissions above the grid.
Select Assign Permissions Read Only.
Select the vertical ellipsis button for the Smart Group, and select Edit Password Safe Roles.
Select the Requestor role, and select the Access Policy.
Select Save Roles.

Verify the results

Verify that the Linux servers Smart Group updates automatically as new servers join the domain, that each Linux server's root account appears as a managed account in Password Safe, and that members of the assigned user group can request auto-approved SSH sessions to the Linux servers.

Next steps

Review discovery reports for other privileged local accounts on Linux servers, and add them to the managed account Smart Group.
Adjust the Password Rule and rotation schedule to match your organization's password change requirements.

Updated about 2 hours ago