regular account

Account defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.

When connecting to a server using a forward type account, Wheel Fudo PAM authenticates user against its local database and after successful authentication, it replaces login credentials with values defined in the account. This enables privileged account sharing while preserving full accountability.

Note

In case of Telnet connections, user has to go through authentication process twice. First time to authenticate against Wheel Fudo PAM and then to connect to the target host.

../../_images/accounts_view.png

Defining an account

  1. Select Management > Accounts.
  2. Click Add.
  1. Define object’s name.
  1. Select Blocked option to disable account after it’s created.
  1. Select regular from the Type drop-down list.
  2. Select desired session recording option.
  • all - Wheel Fudo PAM records network traffic allowing for future session playback, using the built in session player, as well as converting session material to a selection of video file formats.
  • raw - Wheel Fudo PAM keeps records of the data exchanged between the user and the monitored server. The raw data can be downloaded later on but the session cannot be played back using the built in session player.
  • none - Wheel Fudo PAM only takes note of the fact that the give session took place but does not record the data exchanged between the user and the server.
  1. Select the OCR sessions option to fully index RDP and VNC sessions contents.
  1. Select language used for processing recorded sessions.
  2. In the Delete session data after field, define the number of days after which the session data will be deleted.
  3. In the Permissions section, add users allowed to manage this object.
  4. In the Server section, assign account to a specific server by selecting it from the Server drop-down list.
  5. In the Credentials section, enter privileged account domain.
  6. Type in login to the privileged account.
  7. From the Replace secret with drop down list, select desired option.

with passwords

  • Provide account password.
  • Repeat account password.

with key

  • Click the key type selection icon and select the key type.
  • Click the upload icon and browse the file system to find the key definition file.
  • Click the i icon and select the key type.
  • Click the i icon and browse the file system to find the key definition file.
  1. Select the defined password changing policy from the Password change policy drop-down list.
  2. In the Password changer section, from the Password changer drop-down list select password changer specific for given account.
  3. Provide privileged user login in the Privileged user field.
  4. Enter priviliged user password.

Note

Privileged user account is used for changing the password when system detects that password has been changed in an unauthorized way.

  1. Click Save.
../../_images/add_account_regular.png

Editing an account

  1. Select Management > Accounts.
  1. Find and click desired object to open its configuration page.
  2. Modify configuration parameters as needed.

Note

Unsaved changes are marked with an icon.

../../_images/unsaved_changes.png
  1. Click Save.

Deleting an account

Warning

Deleting an accout definition will terminate all current connections to servers which use selected account for accessing those servers.

  1. Select Management > Accounts.
  2. Find and select desired objects.
  3. Click Delete.
  4. Confirm deletion of selected objects.

Related topics: