PAM › Admin Guide

Overview

Verify and rotate credentials stored in the GAccess vault against their target systems

Target Account Management

Overview

GAccess can actively manage the credentials stored in its vault by verifying them against their target systems and rotating them on a schedule or on demand. These two operations — verification and rotation — work together to ensure that every credential in the vault is accurate, up to date, and not a source of unexpected access failures. Allowing administrators to spot deviations and unsynchronized credentials.

  • Verification confirms that a stored credential still matches the actual configuration on the target system, without making any changes.
  • Rotation generates a new credential, applies it to the target system, and updates the vault — all in a single atomic operation.

Both operations are executed by the Gateway — within a lightweight service deployed inside your network that handles all communication with target systems. GAccess management console will never connects to target systems directly.

Supported credential types

Credential Type Target OS Protocol Port Notes
Local (password) Windows SMB 445 Authenticates using the stored credential
Domain Windows / Linux LDAPS (fallback LDAP) 636 (fallback 389) NTLM
Local (password) Linux SSH 22 (configurable) Password-based authentication
Private Key Linux SSH 22 (configurable) Key-based authentication
Note: Application credentials do not yet support verification or rotation and are always skipped.

Prerequisites

Before using verification or rotation, confirm the following are in place.

Permissions

  • You must have the manage permission on the credential to attach policies.

Credential requirements

  • For Local and Private Key credentials, exactly one server must be associated. Credentials with zero or more than one server are skipped.
  • The credential must not be in a paused state. If paused, new jobs are blocked until the pause expires or an administrator clears it.
  • For Active Directory credentials the gateway will try to discover the domain controller based on DNS settings of the host or by using the variable defined at /opt/gaccess/config/gaccess.conf

Gateway requirements

  • At least one Gateway must be online and reachable by GAccess.
  • Domain credentials — a Gateway with the Account Discovery module enabled.
  • Local and Private Key credentials — a Gateway whose CIDR routes cover the target server's IP address.
  • Domain rotation — the Gateway must have a reconcile account configured. This is the privileged account GAccess uses to connect to the domain controller and apply credential changes on behalf of the target user.

Connectivity requirements

  • Gateway should be able to communicate with target systems using the ports previously described. Make sure to design your architecture and set firewall rules accordingly.