Remote Password Rotation

The Remote Password Rotation functionality allows you to automatically change the passwords of the corresponding privileged user accounts at a specified frequency, as well as manually, at any time.

Remote Password Rotation can only be enabled for Active Directory account, Windows account, Unix account (SSH), and MS SQL account secret types, and by a user with the Owner permission for the secret.

To configure Remote Password Rotation for the account that users will access by using a secret in the Ekran System Connection Manager, open the Password Management section, and then click anywhere on the required Active Directory account, Windows account, Unix account (SSH), or MS SQL account secret. In the Edit Secret pop-up window that opens, on the Automation tab, select the Enable remote password rotation checkbox and specify how frequently the password will be changed, or click the Rotate Now button to change the password immediately at any time.

NOTE: If Remote Password Rotation ever fails, the secret is marked with the red circular (

Table of Contents

1. Preconditions for Windows Account Secrets

[For the Windows account secret type only:] The following preconditions need to be met on the remote computer where the Windows account is located (i.e. on the computer that the secret connects to by using the Ekran System Connection Manager):

•  On computers running the Windows 11 and Windows 10 desktop operating systems:

- Remote UAC must be disabled.

- The Remote Registry service must be running.

• Make sure that the local security policy is configured correctly.

• Make sure that the password settings for the account are configured correctly.

• In the firewall, the following rules must be enabled:

- Remote Service Management (NP-ln).

- Remote Service Management (RPC).

• Also, on the computer where the Ekran System Application Server is installed, the EkranServer service must be run under any user account other than the LocalSystem account.

NOTE: Remote Password Rotation is only available for local administrator accounts.

To disable remote User Account Control (UAC), do the following:

1. Open the Windows Registry Editor.

2. Locate and select the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

3. If the LocalAccountTokenFilterPolicy registry entry does not exist, select Edit > New > DWORD (32-bit) Value, and add the following new values in the fields:

• Value name: LocalAccountTokenFilterPolicy

• Value data: 1

4. If a LocalAccountTokenFilterPolicy registry entry already exists, right-click it and select Modify in the context menu, then enter “1” in the Value data field, and click OK.

5. Restart the computer.

To make sure the local security policy is configured (so that the account will never be locked out), do the following:

1. Press Win+R, then enter secpol.msc, and click Enter.

2. In the Local Security Policy window that opens, select the Security Settings section (on the left).

3. Open Account Policies, and select Account Lockout Policy.

4. Double-click on the Account lockout threshold policy (on the right) to open the settings Account lockout threshold Properties window.

5. Make sure that the value specified in the Account will lock out after field is “0” to disable account lockout, and click Apply and then OK to save any changes made.

To make sure the password is configured to never expire, do the following:

1. Press Win+R, then enter lusrmgr.msc, and click Enter.

2. In the Local Users and Groups (Local) section, select the Users section.

3. Right-click on the user required, and select Properties.

4. On the General tab, make sure that the Password never expires checkbox is selected, and then click OK.

2. Preconditions for Unix Account (SSH) Secrets (for Password and SSH Key Rotation)

NOTE: [For the Unix (SSH) account secret type only:] PuTTY needs to be installed on the jump server computer (i.e. the computer with the Ekran System Connection Manager) for the secret to work, and the "Use SSH key" option can also be selected instead of the "Use password" option when adding the secret.

Ekran System allows the passwords and SSH keys of Unix Account (SSH) secrets to be rotated, which means that they are changed/reset on a regular basis to reduce the risk of them being compromised.

An SSH secret has two account options for connection:

• Using a password

• Using an SSH key

Accordingly, rotation of SSH passwords and SSH keys work in different ways.

NOTE: In most cases, the target host defined in the secret will use an OpenSSH server that is commonly used in most Linux systems. For this reason, for the purposes of this document it is assumed that this SSH server is used. For correct usage and password/key rotation of Unix account (SSH) secrets, the target host defined in the SSH secret should first of all be correctly configured and running the OpenSSH server.

SSH Password Rotation for SSH Secrets

Preconditions: The user Login and Password defined in the Unix account (SSH) secret should be valid for the target host.

Rotation logic: The Ekran System Application Server connects to the target host using the credentials defined in the secret, and changes the password of the current user to the new one generated.

Both the old and new passwords are stored in the Application Server database during all operations, and the old password is deleted from the database only after all operations have completed successfully.

In the case of failure, the secret's password is restored to a valid state using one of the two passwords.

SSH Key Rotation for SSH Secrets

Preconditions: The user Login and Private Key (and the Private Key Passphrase) defined in the Unix account (SSH) secret should be valid for the target host, and the corresponding public key needs to be located in the ~/.ssh/authorized_keys file (in the user's home directory on the target host).

As an SSH client, the PuTTY application can be used, and should be installed on the Jump Server computer (although this is not required for rotation, the SSH key used in the secret should be in the PuTTY format). For PuTTY key generation, and for OpenSSH server configuration using PuTTY, see: https://www.ssh.com/academy/ssh/putty/windows/puttygen.

Rotation logic: Ekran System Application Server connects to the target host using the Login and Private Key defined in the secret, and replaces the public key defined in the ~/.ssh/authorized_keys file with the new one that corresponds to the new PuTTY key generated.

Both the old and new keys (and their passphrases) are stored in the Application Server database during all operations, and the old key is deleted from the database only after all operations have completed successfully.

In the case of failure, the secret key (and passphrase) are restored to a valid state using one of the two keys.