Remote Password Reset Using SSH Command Sets

  1. Overview
  2. How SSH Command Sets work in PAM360
  3. Supported resource types
  4. Steps to configure SSH Command Sets for custom resource types

    4.1 Adding custom commands

    4.2 Creating a Command Set

  5. Adding a custom resource type and mapping Command Sets to it
  6. Adding a new resource and mapping it to the resource type
  7. Adding accounts to the resource
  8. Configuring remote password reset
  9. Applying Command Sets to accounts in bulk

1. Overview

PAM360 supports automatic remote password reset for a wide range of commonly-used resource types such as Windows local accounts, Windows domain accounts, Linux root accounts, etc. For custom devices that allow SSH connections, PAM360 provides SSH command sets option through which you can add the password reset commands used in the command-line interface of your resource type directly to the PAM360 web interface, without the need for a CLI terminal.

PAM360 offers a default set of basic commands that you can use right away; alternatively, you can add your own commands, arrange them in the order of execution, and combine them into a new command set. This way, you'll be able to add accounts that have varying password authentication methods but fall under a single custom resource type. For example, Linux resources have different password authentication flows for root passwords and regular user passwords; similarly, Cisco devices support five different types of users. In such cases, you will be able to add any number of custom commands and specify the order in which they are to be executed.

Note: While all Administrators can view the SSH command sets, only the Privileged Administrators will be able to add, edit, modify, and delete the commands and the command sets.

2. How SSH Command Sets Work in PAM360

To create your own set of commands in PAM360 and ensure they work as expected, you must follow the flow given below:

  1. Create one or more command sets

    1.1 Choose from the existing commands or add your custom commands.

    1.2 Combine commands in the correct sequence of execution and create a command set.

  2. Add a custom resource type in PAM360 in case of devices that are not supported by PAM360.
  3. Map one or more command sets to the custom resource type.
  4. Add a new resource and map it to the custom resource type.
  5. Create accounts in the new resource and map an individual command set to each account.

3. Supported Resource Types

You can configure remote password reset for the following SSH-based resource types using SSH Command Sets. In addition, you can also add custom commands and configure remote password reset for other SSH-based devices that are not included in this list.

  1. Aruba ATP
  2. ASA Firewall
  3. Audiocode
  4. AVAYA-GW
  5. Brocade
  6. Brocade VDX
  7. Brocade SAN Switch
  8. Checkpoint Firewall
  9. Cisco Management Integration Center
  10. Cisco Catalyst
  11. Cisco Nexus OS
  12. Cisco SG300
  13. Cisco UCS
  14. Cisco Wireless LAN Controller
  15. Citrix Netscaler SDX
  16. Citrix Netscaler VPX
  17. Dell IDRAC
  18. Extreme Networks
  19. F5
  20. Fortinet
  21. FortiGate Firewall
  22. Fortimail
  23. FortiManager-FortiAnalyzer
  24. Fujitsu Switch
  25. Gigamon
  26. H3C
  27. HMC
  28. HP Printer
  29. HP Onboard Administrator
  30. HPUX
  31. HP Virtual Connect
  32. HPE StoreOnce
  33. Huawei
  34. Juniper Netscreen ScreenOS
  35. JunOS
  36. Mac OS
  37. Magento
  38. Mikrotik
  39. Netapp 7Mode
  40. Netapp CDot
  41. Nimble Storage
  42. Nortel
  43. OpenGear
  44. Orange Firewall
  45. Palo Alto Networks
  46. Pfsense
  47. Routerboard
  48. Ruijie
  49. Sonicwall
  50. TPLINK
  51. VMWare VCenter, VMWare ESXi
  52. Linux
  53. IBM AIX
  54. Solaris

4. Steps to Configure SSH Command Sets for Custom Resource Types

Follow the below steps to add or delete new commands to PAM360 and create a new command set.

4.1 Adding Custom Commands

  1. Navigate to Admin >> Customization >> SSH Command Sets.
  2. Under the SSH Commands section, there are other default commands ready to use. You can pick the required commands from the list and create a new command set for your resource type.

  3. To add new commands for your custom resource, click the Add Commands option and enter the Command Name, Command, the appropriate prompt, a short description, a timeout period in seconds and click Save.
    • The Command entered must be of the format specified in the tool tip below. Refer to the tooltip text for examples.
    • The Command Prompt entered must be the same as in your CLI. For example, if the prompt in the device is a colon and a space, then it should be entered here as such ": " (without quotes).
    • The Timeout period denotes the amount of time for which the system awaits for an input.


4.1.1 Deleting Commands

  1. To delete an existing command, click the delete icon beside the command under Actions.
  2. To delete multiple commands at once, select the commands and click the Delete Command option at the top.

Note:

  • Default commands cannot be edited or deleted.
  • Custom commands that are already associated with a resource type cannot be deleted.
  • While deleting commands in bulk, in case you select a default command or a custom command that is already in use, those commands will be excluded and the rest will be deleted. Details of this operation will be registered in the Audit logs.

4.2 Creating a Command Set

  1. Once you have added your custom commands to PAM360, go to the SSH Command Sets section to create your command set.
  2. Click the Add command set option. In the Add command set dialog box, add a name and a description for your command set.
  3. The default commands and the custom commands you have added will be listed in the Command Name box.
  4. On the right, you will find two sections: Verify SSH Command Sequence and Reset Command Sequence.

4.2.1 Verify SSH Command Sequence

  1. Hover your mouse over a command in the Command Name box and you will see two options: Verify and Reset.
  2. Click Verify to move the commands into the Verify SSH Command Sequence box. Drag the commands to re-order them into the correct sequence. This is the command sequence that is to be carried out to verify the integrity of the password i.e., check if the password of an account is in sync with the one stored in PAM360.
  3. Click Save. A new verify password command set will be added to PAM360.
  4. Once this command set is associated with an account and remote password reset is configured for the resource it belongs to, the password verification check will be carried out in given sequence.

4.2.2 Reset Command Sequence

  1. Hover your mouse over a command in the Command Name box and you will see two options: Verify and Reset.
  2. Click Reset to move the commands into the Reset Command Sequence box. Place the commands in the correct sequence and click Save. A new command set will be added to PAM360.
  3. Once this command set is associated with an account and remote password reset is configured for the resource it belongs to, the password reset will be carried out in given sequence.

5. Adding a Custom Resource Type and Mapping Command Sets to It

Once your command sets are created, follow the below steps to create a custom resource type and map the command sets to it:

  1. Navigate to the Resources tab >> Resource Types and click Add.
  2. Enter a name and browse for an icon of your choice. This icon image will be displayed under Type in the Resources tab.

  3. Under the General section, select the Resource and Account Attributes for the resource type.

  4. In the Advanced section, select SSH Command Sets. Default and custom command sets will be listed under this option.

  5. Choose any by clicking on the names of the command sets. You can assign multiple command sets to one resource type.
  6. Once you have selected the required command sets, click Save. Now, the new resource type will be added to the list of resource types in PAM360.

6. Adding a New Resource and Mapping it to the Resource Type

Follow the below steps to add a new resource which can be mapped to the newly-created resource type:

  1. Navigate to the Resources tab >> Add Resource >> Add Manually.
  2. Enter the Resource Name, DNS Name, and choose the new resource type from the Resource Type drop down under Others.
  3. Click Save and Proceed to continue adding accounts to the resource.

7. Adding Accounts to the Resource

  1. In the Add Accounts dialog box, enter the User Account name, Password, and Password Policy.
  2. The SSH Command Sets drop down will display all the command sets mapped to this resource type. Pick a command set from the drop down, click Add and Save.
  3. The selected command set will be mapped to the account.
  4. You can add multiple accounts and map command sets to each account in the same way.

Note: The user account credentials provided here must be valid for the Verify and Reset command sets to work as expected.

8. Configuring Remote Password Reset

Once the command set is mapped to an account, follow the below steps to configure remote password reset and select a root account, if applicable.

  1. Navigate to the Resources tab.
  2. Click the Resource Actions icon beside the required resource and click Configure Remote Password Reset.

  3. Select the Remote Login Method and Remote Login Account as required. Fill in the other details such as User Mode Prompt, Configuration Mode Prompt.
  4. Click Save to save the changes.

    5. Click here to read more about Remote Password Reset.

9. Applying Command Sets to Accounts in Bulk

Follow the below steps to apply a single command set to multiple accounts within a single resource:

  1. Navigate to the Resources tab and click any resource name. A list of all the accounts associated with that resource will be displayed.
  2. Select the accounts for which you want to apply a command set, and click Apply Command Set in Bulk from the top.

  3. In the Apply Command Set in Bulk pop-up form, choose the required command set from the drop down and click Save.
  4. The chosen command set will be applied to all the selected accounts, overriding their previous command set configuration, if any.
Top