AuthGuard Request a demo

Privileged access · PAM

Admin access on request, with an end time.

Admin accounts for servers and databases stop being shared. People request access for a set time, a group approves when the profile requires it, activation is signed with a passkey and the session is recorded. When time is up, access ends on its own.

Talk to us about PAM See how it works
  • Credential vault
  • Group approval
  • Recorded SSH sessions
  • Password rotation
PAM · access requestillustrative example
Account
postgres @ db-prod-01
Kind
Recorded session (SSH)
Duration
30 min
Justification
Fix incident INC-311
Approvals
2 of 2 · DBA group
Recording · 00:12:48
Recording sealedanchored in the audit chain
  1. Request
  2. Approved
  3. Activated with passkey
  4. Recording sealed

Watch

Admin access, asked for and recorded.

Narrated in English, with English and Portuguese subtitles. Real product screens; people, organisations and amounts are fictitious.

How it works

From request to recording.

Sessions run through an Edge appliance installed in your network, which connects people to the servers and records what happens.

  1. 01 · Request

    The right account, for the right time

    The person picks the account, the kind of access, the duration, a justification and, optionally, the related ticket.

  2. 02 · Approval

    A group decides

    The access profile sets who approves, how many approvals are needed, the maximum duration and what is allowed. Nobody approves their own request.

  3. 03 · Activation

    Every step is signed

    Activating access and revealing a credential ask for the passkey, which signs exactly that request. In the console, approvers’ decisions do too.

  4. 04 · Session

    Record, watch, terminate

    Sessions can be watched and terminated, and recordings are sealed and anchored in the audit log. Passwords can rotate automatically.

Illustrative example

An incident at 2 a.m., and nobody shares the root password.

Rui is on call and needs to get into the production database. He requests a 30-minute recorded session and names the incident. Two colleagues in the DBA group check the request’s comparison code with him and approve, in the console or on their phones.

Rui activates the access with his passkey and opens the web terminal. When he is done, he releases it. Some accounts change their password on check-in, and the recording stays available for review.

Control

Fewer shared secrets.

Vault and rotation

Credentials nobody needs to remember

  • Credentials encrypted in the vault and never shown again after registration
  • Automatic password rotation
  • An offline escrow key for the vault
  • A register of servers and their privileged accounts
Rules

Who asks, who approves

  • Profiles with approver groups, quorum and a maximum duration
  • Dual control for sensitive changes
  • A break-glass group with at least two members
  • Policy rules for pam.session, pam.checkout and pam.jit
Evidence

What gets recorded

  • A signed receipt for every decision
  • Sealed recordings anchored in the audit log
  • Configurable retention and legal hold
  • Live sessions you can watch and terminate

Worth knowing

  • Available today: recorded SSH and SFTP sessions, credential checkout and temporary accounts. RDP in the browser and with mstsc, and PostgreSQL sessions, are in final integration: see the PAM pillar.
  • Approval at connection time is not available yet either.
  • Privileged access needs an Edge appliance in your network.
  • By default each organisation can have up to 10 gateways and 500 GiB of recordings; your provider can adjust these limits.

In the help centre

Pilot

Start with one critical server.

One server, its privileged accounts and one approver group. We install the Edge appliance with you and define the first access profile.

geral@authguard.pt