Local admin accounts for network devices workflow

A workflow for Password Safe

Local admin accounts on network devices control device configuration, so they are high-value targets. Rotating these passwords on a schedule and controlling who can request access reduces the risk that a stolen or reused credential leads to an unauthorized change on your network. This workflow shows you how to set up that control in Password Safe.

Scope of this guide

This workflow shows you how to add local admin accounts for network devices, such as Cisco switches, to Password Safe management. You set up automatic password rotation for these accounts with SSH session auto-approval, and you grant a specific group of users access to request sessions.

Prerequisites

You have administrator access to the BeyondInsight console.
You created a credential with privileges to run Discovery Scans and pull details from Active Directory or LDAP.
You created a functional account with privileges to manage and change passwords on the network devices.
You created an address group that lists the network devices you want to manage.
You configured an access policy that allows auto-approved SSH sessions.
You identified the user group that needs access to the local admin accounts.

Steps

Step 1: Discover network devices with a Smart Group

In the left menu of the BeyondInsight console, select Smart Rules.
Select Create Smart Rule.
Select a Category, and enter a Name and Description for the Smart Rule.
Set the selection criteria to Address Group, select the address group for your network devices, and enable Use to discover new assets during scans.
Enter the interval, in hours, for how often the query reruns. This captures new devices that join the domain.
Set the action to Show asset as Smart Group with View assets in a standard asset grid.
Select Create Smart Rule.
Run a Discovery Scan against the new Smart Group, using a credential with sufficient privileges to pull local accounts from each device. You can start the scan from the vertical ellipsis menu for the Smart Group on the Smart Rules page, or schedule a recurring scan.

Since an address group is a static list of hosts, this Smart Group only needs to reprocess when you update the address group.

Step 2: Add network devices to Password Safe management

In the left menu, select Smart Rules.
Select Create Smart Rule.
Select a Category, and enter a Name and Description for the Smart Rule.
Set the selection criteria to Operating System, contains, cisco. This criteria queries servers that share the same functional account, and the action associates the functional account with the system.
Set an action of Show asset as Smart Group with View assets in a standard asset grid.
Set a second action of Manage Assets using Password Safe, with Platform set to Cisco, Account Name Format set to SAM, and your Functional Account selected.
Select Create Smart Rule.

To ensure new servers are added to Password Safe management automatically, this Smart Group must reprocess repeatedly, especially after the Discovery Scan completes.

Step 3: Grant system access to user groups

In the left menu, select Smart Rules.
From the Smart Rule Type filter list, select Managed System.
Select Create Smart Rule.
From the Category list, select Managed Systems.
Enter a Name and Description for the Smart Rule.
Set the selection criteria to Platforms, Cisco.
Set the action to Show managed system as Smart Group.
Select Create Smart Rule.

This Smart Group is not always required, but it lets you group systems with specific managed accounts and assign asset-level permissions to user groups.

Step 4: Add local admin accounts to Password Safe management

In the left menu, select Smart Rules.
From the Smart Rule Type filter list, select Managed Account.
Select Create Smart Rule.
From the Category list, select Managed Accounts.
Enter a Name and Description for the Smart Rule.
Set the selection criteria to User Account Attribute, Account Name, equals, and enter the local admin account name. Set Discover Accounts for Password Safe Management to yes, and select where to Discover accounts from.
Set an action of Show managed account as Smart Group.
Set a second action of Manage Account Settings: select a Password Rule, set Enable Automatic Password Management to yes, and enter the Change Password Time and Change Password Frequency.
Select Create Smart Rule.

The Manage Account Settings action onboards the account if the scan results find it on the system. This action also controls whether Password Safe rotates the password immediately.

This Smart Group starts with only the local admin account name. You can add more privileged account names to it later, based on your reporting and review.

Step 5: Assign user group permissions and roles

In the left menu of the BeyondInsight console, select Configuration.
Under Role Based Access, select User Management.
Locate the user group in the grid, and select the More Options (ellipsis) button for that group.
Select View Group Details.
From the Group Details pane, select Smart Groups.
In the Smart Groups Permissions grid, select the Smart Group you created in Step 4, and select Assign Permissions above the grid.
Select Assign Permissions Read Only.
Select the vertical ellipsis button for the Smart Group, and select Edit Password Safe Roles.
Select the Requestor role, and select the Access Policy.
Select Save Roles.

Verify the results

Verify that the network devices appear as managed systems, and that the local admin accounts show as managed accounts with automatic password rotation enabled. Confirm that members of the assigned user group can see the Smart Group and request SSH sessions to the network devices.

Next steps

Review the account's password rotation history to confirm passwords change on schedule.
Add more privileged account names to the managed account Smart Group as your review findings require.

Related resources

Updated about 2 hours ago