Skip to Content
DocsOplon Secure AccessVault

Vault

Introduction

The Vault is the section where credentials for machines and Active Directories connected to Oplon Secure Access are managed. You can perform backups, restores, add credentials, and enable/disable automatic password changes.

Within OSA, there are three types of Vault:

  • Host Vault: the vault that contains the credentials of the machines (servers, workstations, network devices, etc.) connected to OSA.
  • AD Vault: the vault that contains the credentials of the Active Directories connected to OSA.
  • SSH PKey Vault: the vault that contains the SSH private keys used to access the machines connected to OSA.

All three vaults are managed by the same interface and share the same features.

Password Entry for an OS Login (Host Vault)

To assign a password to an OS Login (assigned to a User Group) of a Host, you must go to the Host Vault section via the menu PAM Management > Vault Manager > Host Vault.

Search for the corresponding resource in the search bar and click the green key button to edit the OS Login Names.

From here, select from the drop-down menu the users whose passwords you want to enter, and enter the corresponding passwords:

Remember to always perform Save and Re‑Init.

Password Entry for an AD Login (AD Vault)

To assign a password to an AD Login (assigned to a User Group) of a Host, you must go to the AD Vault section via the menu PAM Management > Vault Manager > AD Vault.

Search for the corresponding AD username in the search bar and click the green key button to edit the AD Login Names.

From here it is possible to enter the corresponding password:

Remember to always perform Save and Re‑Init.

Ssh Private Key Entry for a Ssh PKey Login (Ssh PKey Vault)

To enter a Ssh Private Key in the Vault (assigned to a User Group) of a Host, you must go to the Ssh PKey Vault section via the menu PAM Management > Vault Manager > Ssh PKey Vault.

Search for the corresponding resource in the search bar and click the green key button to edit the SSH PKeys.

From here it is possible to enter the Ssh Private Key and the optional passphrase:

Remember to always perform Save and Re‑Init.

Backup & Restore

To access this section, go to Secure Access > PAM Management > Vault Manager.

Legend:

  1. Backup
  2. Restore
  3. Password change

Backup

To back up the credentials of all machines in a node, click the Backup button. A modal window will appear asking for the backup name and a password (which will be required to perform the restore).

Restore

To restore a backup, click the Restore button. A list of all backups performed for each node will be displayed. Choose the backup to restore and click the Restore button. A modal window will appear asking for the password used for that backup; if it is correct, the backup will be restored.

If you are unsure about the restore you are about to perform, run a preventive backup first, so as not to lose passwords that may have been changed since the last backup. To perform a backup or restore, disable scheduled password changes: open the Workspace module settings and, in the RAG setup panel, set Automatic password change to false; otherwise, the module might be changing the passwords on the machines while the backup or restore is being performed.

Password Change

In Oplon Secure Access, password change management supports both Host Vault and AD Vault, but uses different mechanisms to ensure security and agentless operation.

  • Host Vault (Local Users): Password change for local users occurs via a direct SSH connection to the target host. This approach is agentless (no plugin or agent to install on the remote machine). Change modes vary based on the operating system:
    • Linux: Supports password change for all users (local, admin, and non-admin).
    • Windows: Supports password change only for administrative users (local or domain with administrative privileges on the machine).

Best Practice: To best manage resources connected to OSA, it is advisable to create credentials for each of them with administrative powers and keep these credentials excluded from the OSA automatic password change, so as to always have an access point and possibly be able to perform maintenance on other accounts.

  • AD Vault (Domain Users): For Active Directory users, password change occurs via direct APIs to the Domain Controller.
    • No connection to individual hosts is required.
    • Only the connection to the configured AD server is required (see AD configuration guide).

Execution Modes: For both types, password change operations can be performed in two ways:

  • On Demand: Immediate manual execution.
  • Scheduled: Automatic rotation based on a configurable lease time (e.g., every 30 days).

On-demand (Manual)

  1. Single machine, single user: go to Secure Access > PAM Management > Credentials. A list of credentials for each machine will be shown. To change the password, simply click the Change password button.

  2. All machines, all users: go to Secure Access > PAM Management > Vault Manager. To change the passwords, simply click the Change password button, which starts the automatic password change process for the entire Vault.

Automatic

To change one or more passwords automatically, i.e., leaving the burden of creating and setting the password on the machine and in the OSA configuration to the application, there are two ways.

You can enable password changes for the entire vault (only for credentials with automatic password change enabled) every N days.

To enable this feature, open the Workspace module settings and, in the RAG setup panel, set Automatic password change to true.

Then, for each user of each machine:

  • set the enable pwd change field to true
  • configure the number of days after which the password is changed: open each credential and set the desired number of days.
ConfigurationActive Directory