Frequently Asked Questions

Yes, you can change the default port as explained below:

• Login to Password Manager Pro as an Administrator. Navigate to Admin >> Configuration >> Password Manager Pro Server.
• Enter the required port beside the Server Port field, and click Save.
• Restart Password Manager Pro for this configuration to take effect.

Password Manager Pro comes bundled with a tailored version of TomCat webserver which allows users to access the webpage and also the JVM which performs the product operations. You can use the below steps to configure the Bind IP address for both these components.

Steps for changing webserver bind IP

• Stop the Password Manager Pro service.
• Navigate to <PMP installation folder>/conf directory and take a backup of the file named server.xml.
• Open Wordpad as an administrator and open server.xml under <PMP installation folder>/conf directory.
• • Look for the port="7272" and add the entry address="<IP addresses of the application server>" next to it.
  • Save the file.
• Start the Password Manager Pro service. This time the Tomcat webserver will start using the bind IP that you have specified.

Steps for changing JVM bind IP

• Stop the Password Manager Pro service.
• Navigate to <PMP installation folder>/conf directory and take a backup of the file named wrapper.conf.
• Open Wordpad as an administrator and open wrapper.conf under <PMP installation folder>/conf directory.
• • Look for the word wrapper.app.parameter.1 and add the following line below wrapper.app.parameter.1.
  • • wrapper.app.parameter.2=-Dspecific.bind.address=<IP addresses of the application server>
  • Save the file.
• Now, rename <PMP installation folder>/logs folder to logs_older and start the Password Manager Pro service.
• Connect to the login page and try using the product features such as Password reset. The source IP for these operations will be the IP Address that you have configured.

In general, users are notified of their Password Manager Pro accounts only through emails. If a user does not get the notification emails, verify:

• if you have configured the mail server settings properly, with the details of the SMTP server in your environment.
• if you have provided valid credentials as a part of mail server settings, as some mail servers require the same for mails to be received.
• if the 'Sender E-Mail ID' is properly configured, as some mail servers reject emails sent without the From address or mails originating from unknown domains.

You can use one of the following three authentication mechanisms out of Password Manager Pro:

• Active Directory: When enabled, the authentication request is forwarded to the configured domain controller and based on the result, the user is allowed or denied access into Password Manager Pro. The user name, password and the domain are supplied in the Password Manager Pro login screen. This scheme works only for users whose details have been imported previously from AD, and is available only when the Password Manager Pro server is installed on a Windows system.
• LDAP Directory: When enabled, the authentication request is forwarded to the configured LDAP directory server and based on the result, the user is allowed or denied access into Password Manager Pro. The username, password and the option to use LDAP authentication are supplied in the Password Manager Pro login screen. This scheme works only for users whose details have been imported previously from the LDAP directory.
• Password Manager Pro Local Authentication: The authentication is done locally by the Password Manager Pro server. Irrespective of AD or LDAP authentication being enabled, this scheme is always available for the users to choose in the login page. This scheme has a separate password for users and the AD or LDAP passwords are never stored in the Password Manager Pro database. However, for security reasons, we recommend that you disable the local authentication for users after enabling AD/LDAP authentication. For more information on this, refer to the 'User on-boarding and management' section in our best practices guide.
• Azure AD: Once you integrate Password Manager Pro with Azure Active Directory (Azure AD) in your environment, you can allow users to use their Azure AD credentials to log in to Password Manager Pro in both Windows and Linux platforms. To use this authentication, Password Manager Pro should first be added as a native client application in your Azure AD portal.
• Smartcard Authentication: Enabling this feature will mandate users to possess a smartcard, and also know their Personal Identification Number (PIN). Note that smartcard authentication will bypass other first factor authentication methods like AD, LDAP or Local Authentication.
• RADIUS Authentication: You can integrate Password Manager Pro with RADIUS server in your environment and use RADIUS authentication to replace the local authentication provided by Password Manager Pro. The users who will be accessing Password Manager Pro using their RADIUS server credentials will have to be added as users in Password Manager Pro first. When you do so, you need to ensure that the "username" in Password Manager Pro is the same as the username used for accessing the RADIUS server.
• SAML SSO: Password Manager Pro acts as the Service Provider (SP) and it integrates with Identity Providers (IdP) using SAML 2.0. The integration basically involves supplying details about SP to IdP and vice-versa. Once you integrate Password Manager Pro with an IdP, the users have to just login to the IdP and then, they can automatically login to Password Manager Pro from the respective IdP's GUI without having to provide the credentials again. Password Manager Pro supports integration with Okta, AD FS, OneLogin, and Azure AD SSO.

Password Manager Pro comes with five pre-defined roles:

• Privileged Administrator
• Administrators
• Password Administrator
• Password Auditor
• Password User

Apart from these default roles, any administrator can be promoted as a "Super Administrator" with the privilege to view and manage all the resources. Click here for details on the access levels of the default roles.

If you were already given a valid Password Manager Pro account, you can use the 'Forgot Password?' link available in the login page to reset your password. The username/email ID pair supplied should match the one already configured for the user. The password will be reset for that user and the new password will be sent to the respective email address. However, you wouldn't need this option if AD/LDAP authentication is enabled.

The Password Manager Pro web console always uses the HTTPS protocol to communicate with the Password Manager Pro server.The Password Manager Pro server comes with a default self-signed SSL certificate, which the standard web browsers will not recognize, thereby issuing a warning. You can ignore this warning while you're testing or evaluating the product. However, if you're rolling it out in production, we recommend that you install an SSL certificate bought from an authorized Certificate Authority (CA) that is recognized by all standard web browsers. Know More

Ensuring secure storage of passwords and offering solid defense against intrusion are the top priorities of Password Manager Pro. The following measures ensure high level security for your passwords:

• Passwords are encrypted using Advanced Encryption Standard (AES), and stored in the database. AES is currently the strongest encryption algorithm known, and has been adopted as an encryption standard by the U.S. Government.
• The database which stores all the passwords accepts connections only from the host that it is running on, and is not visible externally.
• Role-based, fine-grained user access control mechanism ensures that users can view and access passwords only based on the permissions granted to them.
• All transactions between the Password Manager Pro console and the server take place through HTTPS.
• Password Manager Pro's in-built password generator helps you generate strong passwords.

For detailed information, refer to our Security Specifications document.

Password Manager Pro offers RESTful APIs and SSH-based CLI APIs that can be used for Application-to-Application/Database password management. The applications connect and interact with Password Manager Pro through HTTPS. An application's identity is verified first by verifying the validity of its SSL certificate, and then by verifying the source IP/hostname in which it resides. Each application/database must be registered as an API User in Password Manager Pro. During this registration, the hostname/IP of the application server has to be supplied and a unique authentication token that uses the REST API will be generated. This token needs to be sent along with the API requests for authentication. In addition to these security checks, each application/database can only access the information that are explicitly delegated to them by an administrative user. Refer to this document to know more about sharing/delegating passwords.

Yes, you can install your own SSL certificates. Follow the steps below:

Note: The below steps are applicable for builds 9700 and above only.

• Navigate to "Admin >> Configuration >> Password Manager Pro Server".
• Choose the Keystore Type as "JKS" or "PKCS12", whichever you chose while generating the CSR.
• Browse and upload the Keystore File.
• Enter the same Keystore Password, you entered while generating the CSR.
• Modify the Server Port, if required.
• Hit Save. Restart the Password Manager Pro service once, for the certificate change to take effect.

Password Manager Pro runs as a HTTPS service. It requires a valid CA-signed SSL certificate with the principal name as the name of the host on which it runs. By default, on first time startup, it creates a self-signed certificate, which will not be trusted by the user browsers. Thus, while connecting to Password Manager Pro, you need to manually verify the certificate information and the host name of Password Manager Pro server carefully and should force the browser to accept the certificate.

To make the Password Manager Pro server trusted by web browsers and users:

• Obtain a new signed certificate from a CA for the Password Manager Pro host. [OR]
• Configure an existing certificate obtained from a CA with wild-card principal support for the Password Manager Pro host.

There are different ways to generate the signed SSL certificates:

• By using the "Certificate Management" module of Password Manager Pro.
• By using the OpenSSL or Keytool (bundled with Java) to create your certificates, get them signed by a CA and use them with Password Manager Pro.
• By installing a wild card certificate.

You can decide the mode of generating the signed SSL certificates based on what your security administrators recommend. The detailed steps for using each of the above methods are provided under the links below.

Note: If you already have a certificate signed by a CA, then we recommend using OpenSSL to create the keystore and configure it in Password Manager Pro (steps 4 and 5 in the instructions below).

• Generating Signed SSL certificates using the Certificate Management module of Password Manager Pro
• Generating Signed SSL certificates using OpenSSL
• Generating Signed SSL certificates using Keytool
• Generating Signed SSL certificates by installing a wild card certificate

Follow the steps below to generate SSL certificate for MySQL Server. (If you want to have a self-signed key, follow all the steps. If you are using a CA signed certificate, skip steps 1, 2 and 5.)

Step 1 Create certificate authority key

• Open a command prompt
• Execute the command openssl genrsa -out ca.key 1024
• This will create a key named ca.key

 

Step 2 Create a self-signed certificate authority certificate

• Execute the command openssl req -new -x509 -days 365 -key ca.key -out CAcert.pem
• Here ca.key is the file you created in step 1
• This will create a file named CAcert.pem

 

Step 3 Generate private key

• Open a command prompt
• Execute the command openssl genrsa -out ServerKey.key 1024
• This will create a file named ServerKey.key

 

Step 4 Generate a certificate request

• Execute the command openssl req -new -key ServerKey.key -out server.csr
• Here, ServerKey.key is the file you created in step 3
• This will create a file named server.csr

 

Step 5 Create a Certificate Signing Request (CSR) for submission to a certificate authority (perform this step only if you are using a self-signed certificate. Otherwise, proceed to step 6)

• Execute the command openssl x509 -req -days 365 -in server.csr -CA CAcert.pem -CAkey ca.key -set_serial 01 -out ServerCer.cer
• Here, server.csr is the file you created in Step 4; CAcert.pem is the file created in Step 2; ca.key is the file created in Step 2
• This will create a file named ServerCer.cer

 

Step 6 Generate .p12 file

• Execute the command openssl pkcs12 -export -in ServerCer.cer -inkey ServerKey.key -out PMPKeyStore.p12 -name pmp -CAfile CAcert.pem -caname pmp -chain
• Here, ServerCer.cer is the file you created in Step 5. If you are using a CA signed certificate, enter the signed SSL certificate with .cer extension; ServerKey.key is the one you created in Step 3; CAcert.pem is the file created in Step 2
• This will create a file named PMPKeyStore.p12
• Here, you will be prompted to enter 'Export Password'. The password specified here has to be entered in PMP configuration file in wrapper (in Windows installation) and wrapper_lin.conf (in Linux installation) as explained below.

• Open wrapper (in Windows installation) and wrapper_lin.conf (in Linux installation) and search for the following line:

  wrapper.java.additional.22=-Djavax.net.ssl.keyStorePassword=passtrix

  In the above, replace passtrix with the password you have entered above.

 

Step 7 Configure the PMP server to use the keystore with your SSL certificate

• By executing the above steps, you would have got four files namely CAcert.pem, ServerKey.key, ServerCer.cer and PMPKeyStore.p12. You need to copy and paste these files into <PMP-Installation-Folder>/conf directory

 

Step 8 Import CAcert.pem into PMP

• Navigate to <PMP-Installation-Folder>/bin directory and execute the following command:

In Windows: importcert.bat <absolute path of the CAcert.pem file created in step 2>
In Linux: sh importcert.sh\bat <absolute path of the CAcert.pem file created in step 2>

 

Step 9 Put these files into MySQL

• You need to copy the following three files created after Step 6 and rename them as below:

CAcert.pem to be renamed as ca-cert.pem
ServerKey.key to be renamed as server-key.pem
ServerCer.cer to be renamed as server-cert.pem

• Then, put the renamed files into <PMP-Installation-Folder>/mysql/data directory

Important Note: If you are having High Availability setup, execute the steps 7, 8 and 9 in PMP secondary installation also.

Yes, you can create a certificate using SAN with an alias name and apply it in Password Manager Pro. Follow the below steps:

Yes. Password Manager Pro can remotely reset the passwords of various end points. Password Manager Pro supports both agent-based and agent-less modes of changing passwords. Refer this document for more information.

Let us first look at the requisites for both the modes:

• The agent mode requires the agent to be installed as a service in each end point and run with administrative privileges to perform password reset operations. The agent uses one-way communication using outbound traffic to reach the Password Manager Pro server.
• For the agent less mode, you must supply administrative credentials to perform the password changes. For Linux, you must specify two accounts- one with root privileges and the other with normal user privileges that can be used to login remotely. Telnet or SSH service must be running on the resources. For Windows domain, you must supply the domain administrator's credentials. For Windows and Windows Domain, Password Manager Pro uses remote calls, so relevant ports must be open on the resource.

Based on this, you can choose which mode you want for your environment, indicated by the following tips:

Choose the agent mode when:

• You do not have administrative credentials stored for a particular resource in Password Manager Pro,
• You do not have the required services running on the resource (Telnet / SSH for Linux, RPC for Windows),
• You run Password Manager Pro in Linux and want to make password changes to a Windows resource.

Choose agent less mode in all other cases as it is a more convenient and reliable way of doing password changes.

Yes, you can. As long as your resource type label contains the string 'Linux' or 'Windows', you can still configure agent less password reset for those resources.

Example of valid resource type labels to enable password reset:

Debian Linux, Linux - Cent OS, SuSE Linux, Windows XP Workstation, Windows 2003 Server

Password Manager Pro supports remote password reset for custom resource types through SSH command sets, password reset plugins, and password reset listeners.

• SSH Command Sets: For SSH-based devices, you can build command-based executables directly from Password Manager Pro using a set of default or customized SSH commands. These command sets can then be associated with the respective SSH device accounts that do not come out of the box with Password Manager Pro to perform their password resets without the need for a CLI.
• Password Reset Plugin: You can build your own implementation class and run it via Password Manager Pro to enforce automatic password resets of custom resource types. With the plugin, you can also leverage access control for legacy accounts and automatically reset passwords instantly upon usage. This way, the passwords of these accounts will serve as one-time passwords that are reset after every use via the associated plugin.
• Password Reset Listeners: Listeners are custom scripts or executables that can be invoked for local password changes, as well as to reset the passwords of custom resource types for which remote password reset is not supported out-of-the-box by Password Manager Pro. You can configure listener scripts individually for each resource type including the custom ones.

In the agent mode:

• Check if the agent is running by looking at the Windows active process list for the entry 'Password Manager ProAgent.exe' or the presence of a process named 'Password Manager ProAgent' in Linux.
• Check if the account in which the agent is installed has sufficient privileges to make password changes.

In the agent less mode:

• Check if the right set of administrative credentials have been provided and the remote synchronization option is enabled.
• Check if the necessary services are running on the resource (Telnet / SSH for Linux, RPC for Windows).
• Check if the resource is reachable from the Password Manager Pro server using the DNS name provided.

This happens when Password Manager Pro is run as a Windows service and the 'Log on as" property of the service is set to the local system account. Change it to any domain user account to be able to reset domain passwords. Follow the instructions below to effect that setting:

• Go to the Windows Services Applet (from Control Panel --> Administrative Tools --> Services)
• Select the 'ManageEngine Password Manager Pro' service, right-click --> choose 'Properties'.
• Click the 'Log On' tab and choose 'This Account' radio button and provide the username and password of any domain user - in the format <domainname>\<username>.
• Save the configuration and restart the server.

Before enabling windows service account reset, ensure if the following services are enabled in the servers where the dependent services are running:

• Windows RPC service should have been enabled.
• Windows Management Instrumentation (WMI) service should have been enabled.

The domain Single Sign On (windows integrated authentication) is achieved in the Windows environment by setting non-standard parameters in the HTTP header, which are usually stripped off by devices like firewalls / VPNs. Password Manager Pro is designed for use within the network. So, if you have users connecting from outside the network, you cannot have SSO this enabled.

Yes. you can migrate Password Manager Pro to another server by following the below steps:

• Stop Password Manager Pro service, exit tray icon.
• Make sure that the Postgres process is not running in Task Manager.
• Copy and move entire Password Manager Pro directory to the new server.
• Open command prompt with admin rights and navigate to <Password Manager Pro HOME>\bin directory. Execute the command Password Manager Pro.bat install. (This will install Password Manager Pro service.)
• Move the encryption key(Password Manager Pro_key.key) to the new server and specify the correct location of it in Password Manager Pro/conf/manage_key.conf file. Click here for more information about the encryption key.
• Go to services console, provide a service account and start Password Manager Pro service.
• If you want the tray icon, Go to the <Password Manager Pro HOME>, right click on Password Manager Pro.exe and select "Run as Administrator". Now you should be able to access the Password Manager Pro web page using the new server name in the URL.

Yes, you can. Password Manager Pro can periodically backup the entire contents of the database, which can be configured through the Password Manager Pro console. Refer this document for more details.

All sensitive data in the backup file are stored in encrypted form in a .zip file under <Password Manager Pro_Install_Directory/backUp> directory. It is recommended that you backup this file in your secure, secondary storage for disaster recovery.

There are three editions of Password Manager Pro

Evaluation Edition - Evaluation Edition allows you to have two administrators for 30 days. You can manage unlimited resources and evaluate all features of the Enterprise edition. You can also get free technical assistance during this period.

Free Edition - The download option is always valid for this edition. It can support only one administrator. You can manage a maximum of 10 resources and you can access all the functionalities of the Standard edition.

Registered Version - You need to buy a license based on the number of administrators required and the type of edition- Standard/Premium/Enterprise:

• Standard - If your requirement is to have a secure, password repository to store your passwords and selectively share them among enterprise users, Standard edition would be ideal.
• Premium - Apart from storing and sharing your passwords, if you wish to have enterprise-class password management features such as remote password synchronization, password alerts and notifications, application-to-application password management, reports, high-availability and others, Premium edition would be the best choice.
• Enterprise - If you require more enterprise-class features like auto discovery of privileged accounts, integration with ticketing systems and SIEM solutions, jump server configuration, out-of-the-box compliance reports, and SQL server / cluster as backend database, the Enterprise edition will be ideal for you.

Note: Password Manager Pro comes with five user roles - Administrator, Password Administrator, Privileged Administrator, Password Auditor and Password User. The term 'administrator' denotes Administrators, Password Administrators and Privileged Administrators. So, licensing restricts the number of administrators as a whole, which includes Administrators, Password Administrators and Privileged Administrators. There is no restriction on the number of Password Users and Password Auditors. To get more details on the five user roles, refer this section of our help documentation.

See the below features comparison table for more clarity:

Though Password Manager Pro follows an annual subscription model for pricing, we also provide perpetual licensing option. The perpetual license will cost three times the annual subscription price, with 20% AMS from the second year. Contact sales@manageengine.com and support@passwordmanagerpro.com for more details.

Yes, if you buy a single Premium or Enterprise Edition license, you are entitled to have the High Availability setup. You can apply the same license on the Primary as well as the Secondary servers. Follow the below steps:

• Stop the PMP service in the Primary server.
• Login PMP using the Secondary server URL as an Administrator.
• Tap License under the User menu, at the top right corner of the console.
• Update the same license file which you applied for the Primary server.

Yes, very much. If you want a license with more than 1000 administrator users, please contact sales@manageengine.com and support@passwordmanagerpro.com for more details.

Yes. Fill in the required details in the website and we will send you the license keys.

No. All the features of the Enterprise/Premium edition will automatically get activated when you apply the respective license over your current Password Manager Pro installation.

No. Password Manager Pro adopts the same approach for managing SSH user accounts and SSH service accounts. The only difference is that during resource discovery, if service / root account credentials are provided to establish connection with the resource, you acquire extended privileges to import and manage keys from all user accounts in the resource.

Whereas, when connection to the resource is established using user account credentials, you get key management privileges only for SSH keys present in that particular account.

Yes. We have a dashboard that displays the number of keys that were not rotated for the predefined time period as specified in the notification policy.

Password Manager Pro houses a key vault called "Key Store" which facilitates the storage and management of any type of digital key. However, the option to discover and import is limited to SSH keys and SSL certificates only, and isn't available for other types of digital keys.

No. Password Manager Pro supports all X.509 certificate types.

Yes. You can create scheduled tasks to perform automatic certificate discovery through which you can import and replace old certificates from target systems with their updated versions in Password Manager Pro' certificate repository. Click here for a detailed explanation on creating schedules.

No, it doesn't. The AD User Certificate and MS Certificate Store tabs appear only in the Windows version of Password Manager Pro.

Password Manager Pro differentiates certificates by their common names and records certificates with same common names as a single entry in its certificate repository. We've designed it this way because Password Manager Pro licensing is based on the number of certificates and we don't want customers to spend many license keys for the same certificate.

However, if there's a need to manage both the certificates separately, you can do so by listing them as separate entries in Password Manager Pro' certificate repository. Once listed, the newly added certificate will be counted for licensing.

To add a certificate with the same common name as a separate entry in certificate repository,

• Navigate to the Certificates tab and click Certificates, and click the Certificate History icon beside the certificate.
• Click the 'Certificate Settings' icon beside the required version of the certificate and click on 'Manage Certificate'.
• The selected version is listed as a separate certificate in the certificate repository.
• In case you want to manage only one version of the certificate, click 'Certificate Settings' icon beside the required version and choose 'Set as current certificate' option.

Follow the steps below to import a certificate's private key into Password Manager Pro.

• Navigate to the Certificates tab and click Certificates.
• Select the certificate for which you need to import the private key.
• Click the Import Keys option from the More drop down menu at the top.

Browse for the file that contains the private key, enter the keystore password, and click on 'Import'. The private key will be imported and attached to the selected certificate.

Password Manager Pro facilitates certificate deployment through which you can deploy certificates from its repository to target server's Microsoft Certificate Store.

Click here for step-by-step explanation on certificate deployment.

To map the certificate to its corresponding application, you've to manually restart the server on which the application is running for the change to take effect.

No. Password Manager Pro currently doesn't support subnet based SSL certificate discovery.

No. Currently, Password Manager Pro doesn't support automatic scheduling for certificate discovery from MS Certificate Store.

Email notifications are generated ONLY for certificates listed in Password Manager Pro's certificate repository and NOT for different versions of a certificate displayed in "Certificate History" section.

Yes. All types of SSL certificates, SSH keys and any other digital key being managed using Password Manager Pro are taken into account for licensing. There's a dashboard widget "License Details" that provides insights on the type and number of digital identities being managed using Password Manager Pro that will be taken into account for licensing.