18.4.3. Procedure – Configuring password-protected Credential Stores

Purpose: 

To configure a local Credential Store that stores the credentials used to login to the target host, complete the following steps. The Credential Store will be protected by custom passwords. This password must be entered every time PSM is rebooted to make the Credential Store available.

Prerequisites: 

Note

Users accessing connections that use Credential Stores to authenticate on the target server must authenticate on PSM using gateway authentication or an AA plugin. Therefore gateway authentication or an AA plugin must be configured for these connections. For details, see Section 18.2, Configuring gateway authentication and Section 18.5, Integrating external authentication and authorization systems.

Steps: 

  1. Navigate to Policies > Credential Stores.

  2. Click and enter a name for the Credential Store.

  3. Select Local.

  4. Select Encryption key > Password protected.

    Note

    The contents of the Credential Store, as well as the passwords are included in the configuration backups of PSM. Make sure to encrypt the configuration backups.

  5. Select Master passwords and click .

    Figure 18.14. Policies > Credential Stores > Local > Password protected — Set Master Password

    Policies > Credential Stores > Local > Password protected — Set Master Password
    • To protect the Credential Store with a single password, select Single password and enter the password into the Password and Verify password fields. Anyone who knows this password and has the Unlock Credential Store privilege will be able to open the Credential Store. Password-protected Credential Stores must be unlocked on the PSM web interface or console after every PSM reboot.

    • To protect the Credential Store with multiple passwords, select Compound password, click and enter a password. Click to add additional passwords. After finishing listing every password, click Add. All of these passwords will be needed to unlock the Credential Store.

    PSM encrypts the master passwords using an aes-256-cbc cipher, and stores them in a local database.

    Note

    PSM accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

    Figure 18.15. Policies > Credential Stores > Local > Password protected — Configure Credential Store

    Policies > Credential Stores > Local > Password protected — Configure Credential Store
  6. Repeat the previous step to add another single or compound password. That way, different password sets can be defined for the Credential Store. For example, if a single and a compound password is configured, the chief administrator can unlock the Credential Store with a single password, and two of his subordinates can open the Credential Store together if they know one element each of the compound password.

    Tip

    To change the password, just click to delete the old password. Then add new passwords as needed.

  7. Add credentials to the Credential Store.

    1. Click and enter the destination host and the username. For the destination host, you can use hostname, IP address, or subnet as well. To use the same credentials for every destination host, enter the 0.0.0.0/0 subnet. To use the credentials only on the hosts of a specific domain, enter *.domain. Note that:

      • Usernames are case sensitive.

      • To authenticate users of a Windows domain, enter the name of the domain into the Host field.

      Use an IPv4 address.

    2. Set the credentials. PSM will use these credentials to login to the destination host if the credential store is selected in a Connection policy. If more than one credential is specified to a host-username pair, PSM will attempt to use the credentials as the destination host requests it.

      • To add a password, click Passwords > , then enter the password corresponding to the username.

      • To upload a private key, click SSH Keys > > , then paste or upload a private key.

        Note

        If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      • To generate a keypair on PSM click SSH Keys > > , set the length and type of the key, then click Generate. After that, click the fingerprint of the key to download the public part of the keypair. There is no way to download the private key from the PSM web interface.

        Note

        Balabit recommends using 2048-bit RSA keys (or stronger).

      • To upload a certificate and the corresponding private key, click X509 Keys > > , then paste or upload a certificate and the private key.

        Note

        If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      Note

      PSM accepts passwords that are not longer than 150 characters. The following special characters can be used: !"#$%&'()*+,-./:;<=>?@[\]^-`{|}

    3. Repeat the previous step to add further credentials to the username as necessary.

  8. Repeat the previous step to add further hosts or usernames as necessary.

    Note

    Credential Stores can be used together with usermapping policies to simplify the administration of users on the target hosts. For details, see Procedure 18.1, Configuring usermapping policies.

  9. Click .

  10. Navigate to the Connection policy where you want to use the Credential Store (for example, to SSH Control > Connections), select the Credential Store to use in the Credential Store field, then click .

    Figure 18.16. Control > Connections — Select a Credential Store to use

    Control > Connections — Select a Credential Store to use
  11. Navigate to Basic Settings > Alerting & Monitoring > Traffic related traps and enable the Decryption of a credential failed (scbCredStoreDecrpytError) and The requested credential store is closed (scbCredStoreClosed) events. That way PSM sends automatic alerts if a Credential Store needs to be unlocked.

    Warning

    Password-protected Credential Stores must be unlocked every time after PSM is rebooted. Connections using a password-protected Credential Store will automatically fail until the Credential Store is locked.

    To unlock a Credential Store, users must have the Unlock Credential Store privilege, or editing (read and write) privileges to the particular Credential Store.