Directory admin accounts for Linux Servers workflow

A workflow for Password Safe

Directory admin accounts hold privileged access across every domain-joined server in your environment. If one of these passwords leaks or goes unrotated, an attacker gains broad reach with a single credential. This workflow shows you how to bring those accounts under Password Safe management so their passwords rotate on a schedule and every use is recorded.

Scope of this guide

This workflow covers Active Directory admin accounts that have privileged access to your Linux servers. You set up automatic password rotation for those accounts and turn on auto-approved SSH sessions, so approved users can connect without waiting for a manual approval. It does not cover local root accounts on Linux servers, which follow a separate workflow.

Prerequisites

• You have a BeyondInsight account with permission to create Smart Rules and manage user groups.
• BeyondInsight and Password Safe is installed and licensed.
• You understand these concepts:

• A Discovery Scan credential exists. This credential needs privileges to read details for services, tasks, systems, devices, users, and databases from Active Directory or LDAP. Create it at Configuration > Discovery and Vulnerability Management > Credentials.
• A functional account exists for your Linux servers. This account needs privileges to change passwords on the accounts associated with those servers.
• A directory credential exists. This credential needs privileges to read account details from Active Directory or LDAP.
• A directory query exists for your Linux directory accounts.
• An address group exists that contains your Linux servers.
• An access policy exists that allows auto-approved SSH sessions.
• You have a user group with the Requestor role, or you can assign that role.

✅

Tip

Think of a Smart Rule as the logic engine that answers "How do I select items?" Think of a Smart Group as the bucket that holds the items the Smart Rule selected.

Steps

Step 1: Create an asset Smart Group to discover Linux servers

1. In the left menu of the BeyondInsight console, select Smart Rules.
2. Select Create Smart Rule.
3. Select the Category, then enter a clear Name and Description.
4. Set Selection Criteria to Address Group, select the address group that holds your Linux servers, and enable Use to discover new assets during scans.
5. Enter the number of hours between query runs. This interval controls how often Password Safe picks up new servers that joined the domain.
6. Set Actions to Show asset as Smart Group and View assets in a standard asset grid.
7. Select Create Smart Rule.
8. Run a Discovery Scan against this Smart Group. Select the vertical ellipsis for the Smart Group on the Smart Rules page, then start the scan. Use a credential that can read account and service details from each asset.
9. Schedule the scan to repeat. Recurring scans find new assets and confirm that local accounts and services on existing assets have not changed. This is the core of a dynamic onboarding process.

ℹ️

An address group is a static list of hosts, so this Smart Group does not need to reprocess often — only after you change the address group.

Step 2: Create an asset Smart Group to add Linux servers to Password Safe management

1. In the left menu of the BeyondInsight console, select Smart Rules.
2. Select Create Smart Rule.
3. Select the Category, then enter a clear Name and Description.
4. Set Selection Criteria to Operating System, contains, linux.
5. Set Actions to Show asset as Smart Group and View assets in a standard asset grid.
6. Add a second action: Manage Assets using Password Safe. Set Platform to Linux, set Account Name Format to SAM, and select your Linux Functional Account.
7. Select Create Smart Rule.

ℹ️

• The Operating System criteria groups servers share the same functional account. The Manage Assets using Password Safe action links that functional account to each system.
• Set this Smart Group to reprocess regularly, especially after each scan finishes. Reprocessing is what adds new servers to Password Safe management automatically.

Step 3: Create a managed system Smart Group to grant system access to user groups

This Smart Group is optional, but it helps you group systems that share the same managed accounts and assign asset-level permissions to user groups. Assets added to Password Safe management appear in the All Managed Systems Smart Group on their own. The Smart Group you create here narrows that list to Linux servers that Password Safe manages.

1. In the left menu of the BeyondInsight console, select Smart Rules.
2. Select Managed System from the Smart Rule Type filter list.
3. Select Create Smart Rule.
4. Select Managed Systems from the Category list.
5. Enter a clear Name and Description.
6. Set Selection Criteria to Platforms, Linux.
7. Set Actions to Show managed system as Smart Group.
8. Select Create Smart Rule.

Step 4: Create a managed account Smart Group to add accounts to Password Safe management

When you first create this Smart Group, it holds only the root account name. After you review your account reports, you can add more privileged account names to it.

1. In the left menu of the BeyondInsight console, select Smart Rules.
2. Select Managed Account from the Smart Rule Type filter list.
3. Select Create Smart Rule.
4. Select Managed Accounts from the Category list.
5. Enter a clear Name and Description.
6. Set Selection Criteria to User Account Attribute, Account Name, equals, root. Set Discover Accounts for Password Safe Management to Yes, then select the Smart Group to discover accounts from.
7. Set Actions to Show managed account as Smart Group.
8. Add a second action: Manage Account Settings. Select a Password Rule, set Enable Automatic Password Management to Yes, then set Change Password Time and Change Password Frequency.
9. Select Create Smart Rule.

ℹ️

The Manage Account Settings action adds the account to management when a scan finds it on a system. It also controls whether Password Safe rotates the password right away.

Step 5: Create a managed account Smart Group to add directory accounts and link them to systems

1. In the left menu of the BeyondInsight console, select Smart Rules.
2. Select Managed Account from the Smart Rule Type filter list.
3. Select Create Smart Rule.
4. Select Managed Accounts from the Category list.
5. Enter a clear Name and Description.
6. Set Selection Criteria to Directory Query, Include Accounts from Directory Query, then select your Linux directory account query. Enable Discover Accounts for Password Safe Management.
7. Set Actions to Link domain accounts to Managed Systems, then select the asset or managed system Smart Group you created in Step 3.
8. Add a second action: Manage Account Settings. Select a Password Rule and set Enable Automatic Password Management to No.
9. Add a third action: Show managed account as Smart Group.
10. Select Create Smart Rule.

ℹ️

• If Password Safe already manages these privileged accounts, use Managed Account Fields > Account Name as your criteria instead of a directory query.
• You can split these actions across several managed account Smart Groups. Use Child Smart Rule or other criteria to drive the linking rule separately.

Step 6: Assign user group permissions and roles for account access

Link a user group to the Smart Group you created in Step 5, then assign permissions, a role, and an access policy. In this workflow, your Password Safe users are Requestors with an access policy that auto-approves SSH sessions.

1. In the left navigation of the BeyondInsight console, select Configuration.
2. Under Role Based Access, select User Management.
3. Find your group in the grid, then select the vertical ellipsis for that group.
4. Select View Group Details.
5. In the Group Details pane, select Smart Groups.
6. In the Smart Groups Permissions grid, select the Smart Group you created in Step 5, then select Assign Permissions above the grid.
7. Select Assign Permissions Read Only.
8. Select the vertical ellipsis for the Smart Group, then select Edit Password Safe Roles.
9. Select the Requestor role, then select your Access Policy.
10. Select Save Roles.

Verify the results

Confirm that your Linux servers appear under Password Safe > Managed Systems and that the directory admin accounts appear under Password Safe > Managed Accounts, linked to those systems. Then sign in as a member of the Requestor group and confirm you can request an SSH session and receive auto-approval.

Next steps

• Review your account reports and add more privileged account names to the Smart Group from Step 4.
• Set up a recurring Discovery Scan schedule so new domain-joined servers onboard on their own.
• Turn on session recording so auditors can review SSH sessions.

Related resources

• Add Local Root Accounts for Linux Servers
• Add Directory Admin Accounts for Windows Servers