This week’s blog links in with the theme of controls around accessing credentials, or Password Records in Passwordstate. It follows on from the recent blog posts of Reporting Access To Sensitive Credentials and Getting Started With 2FA.
The Check Out/Check In capability operates at the Password Record level. It enables users to manage access to the Password Record in collaborative environments where Password Records are shared. When a Password Record is checked out, it becomes unavailable for others to use until it’s checked back in. This prevents conflicts and ensures that only one person is accessing that system or account during the period it is checked out. Auditing occurs as normal for any Password Record.
An example being, your organization keeps unique Account and Password combinations for all network switches. You only have a small support team with access to the Password Records and are updating configurations or firmware on each switch. You use the check-out/check-in capability to ensure only one support staff member can log into the switch being worked on. If a second support staff member tries to access the password record they can’t.
Check Out and Check In Action
The below image is provided to show what the UI looks like when checking out a Password Record (image on the left) and again, when checking in the Password Record (image on the right). Users trying to access the Password Record are provided the message Checked Out.
If a user hovers over the Information symbol, they can view the UserID and Name of the person who has checked out the Password Record and any Auto Check-In Time that has been set.
Enable Check Out / Check In
The following applies to existing Password Lists and Password Records that you want to apply the Check Out/Check In capability to. Select the Password List and navigate to the Password Record you want to apply the capability to. From here, open the Password Record by clicking on the Title from the display grid. This will open the record as below,
From here, click on the security tab, which will provide access to the Check Out capability. You’ll need to click in the check box as shown below,
Then click Save. On this screen you also have the options below,
Change Password On Check in: This allows you to automatically generate a new random password for the Password Record and apply this during the Check In process.
Check In Automatically After: This allows you to specify a time delay before automatically checking the Password Record back in.
Note, to successfully Change Password On Check In you’ll need to ensure the Password Record has both the Password Requires Check Out as well as the Check In Automatically After selected, and the Enabled for Resets has also been checked.
Failure to do this will result in the Password field not being updated, but auditing will record that the Password Record has been updated with the time and date of the saving of the record, which could be misleading.
Enabling New Password Records for Check Out & Check In
The following applies to creating new Password Records set for the Check Out/Check In capability from an Account Discovery job. For the purpose of this blog post we’re assuming you have an existing Account Discovery job, Host Entries and a relevant Password List.
Firstly, we’ll need to ensure the target Password List has the Enable Password Resets check box ticked. This is set by right clicking on the Password List name and selecting Edit Properties, then clicking on the box as per below,
Next, you can setup the Local Account Discovery job. As per the image below, this discovery job will import all Local Accounts on HP Switches and Routers and add all newly Discovered Accounts to the Password List called Routers and Switches located in the Infrastructure folder, and perform an immediate Password Reset for the account,
Lastly, make sure to check the boxes Password Requires Check Out, and if required Change Password on Check In as per the image below,
