Antonio Braccolino, Identity & Access, home

Lab · 13 / 16

Admin for one hour.

An engineer needs root on a production database to fix an incident. With PAM nobody holds that power permanently: it is granted for one task, watched, and taken back.

You completed every lab

All 16 labs, from the map of IAM to the reference architectures. Identity has no secrets left for you.

See your achievements

Share your badge

LinkedInXFacebookWhatsApp

Instagram: download the image and post it as a post or story. LinkedIn: the text is copied when you open it, paste it and attach the image.

PAM · JIT · Session recording · Advanced · 6 steps

What you will learn

  • Why standing admin rights are the real risk
  • Vaulted accounts versus just-in-time accounts
  • What session recording and rotation give you
Kind of privileged access

A shared admin account lives in the vault: you check it out and the password is rotated afterwards.No standing account: a personal one is created for the task and removed when it ends.

Admin
an engineer with a personal account
PAM
vault, broker and recorder
Approver
a second person who okays the task
Server
a production database server
  1. sign in + MFA

    Step 1 of 6

    A normal account, a strong login

    In plain words You enter the vault room with your own badge and a second proof. Your badge alone opens nothing important.

    The engineer signs in to PAM with a personal account through the IdP, with phishing-resistant MFA. That account has no admin rights of its own.

  2. request: root · db-prod-01 · 60 min

    Step 2 of 6

    Asking for access to one target

    In plain words You say exactly which door, for how long and why, with the incident number.

    The request names the target, the duration and a ticket. PAM can check the ticket in the ITSM tool and apply policies: which teams may ask for which servers, and at what times.

    target:   db-prod-01 (root)
duration: 60 min
reason:   INC-48213 · replication stuck
mode:     SSH via PAM proxy, recorded
  3. approve?

    Step 3 of 6

    Four eyes

    In plain words A second person looks at the request before the key leaves the safe.

    Production access needs an approver who is not the requester. For emergencies there is a break-glass path: immediate access, reviewed afterwards.

  4. approved · 60 min

    Step 4 of 6

    Access granted, with a timer

    In plain words The yes comes with an expiry: after one hour the door closes on its own.

    The approval is time-boxed and tied to the ticket. Nothing has changed on the server yet.

  5. session · credential injected

    Step 5 of 6

    The vault opens a session for youAn account is created just for this task

    In plain words Someone opens the door for you with the master key, and you never touch the key.A key is cut for you, works only on this door, and melts after an hour.

    PAM takes the root password from the vault and injects it into the SSH session through its proxy. The engineer never sees it. Every keystroke and command is recorded, and risky commands can be blocked.PAM creates a temporary account or adds the person to an admin group only for this window: zero standing privileges. The session still goes through the proxy and is recorded.

    $ ssh ada@pam-proxy.example.com -t db-prod-01
[PAM] session 7f3a recorded · ends 09:47
root@db-prod-01:~# systemctl restart replication
  6. end · rotate / remove

    Step 6 of 6

    The password is rotatedThe temporary account is removed

    In plain words When you hand the key back, the lock is changed, so a copy would be useless.When the hour ends, the key is gone and there is nothing left to steal.

    After check-in PAM sets a new random root password. The recording and the command log go to the SIEM, linked to the ticket and the approver.PAM deletes the account or removes the group membership. The recording and the command log go to the SIEM, linked to the ticket and the approver.

Example domains and values. Nothing leaves your browser.