Symantec Privileged Access Management

  • 1.  Cisco transparent login

    Posted Nov 26, 2018 03:30 PM

    Hello Everyone,

     

    I read a lot, but I don't see examples. I know PAM can login into a cisco device (SSH) and when the user type "enable" command, PAM will feed the second password transparently (same as the first password).

     

    I don't know how do that. I don't know where set this "second password".

     

    Example how works the normal login:

    https://comm.support.ca.com/kb/servlet/servlet.FileDownload?file=0150c000004AJciAAG 

     

    Sorry for my english.

     

    Regards.



  • 2.  Re: Cisco transparent login

    Broadcom Employee
    Posted Nov 27, 2018 02:43 AM

    Hello Juan,

     

    PAM provides a feature to inject a target user's password within a SSH connection upon execution of the sudo or pbrun command.

    See https://docops.ca.com/ca-privileged-access-manager/3-2-2/EN/implementing/provision-users-and-devices/provisioning-devices/setting-up-transparent-login/set-up-transparent-login-for-ssh-connections for details.

     

    However this is not configurable for other commands, i.e. in your case "enable”

     

    I suggest to open an Idea in this forum for Product Management to consider making the Transparent Login feature configurable for other commands as well.



  • 3.  Re: Cisco transparent login
    Best Answer

    Posted Nov 27, 2018 03:18 AM

    Hello There,

     

    This is very much possible and we used it every day in thousands of devices.

     

    There is a option called command string on the device itself. 

    Here are the steps to achieve this: 

    1. Go to devices : Transparent login : There are three option ie None, Pb run , Command String, Select Command String

    2 . You will get two more options : Commands and Authentication

    3. Under the text box of Commands : enter "enable" without double quotes. and under Authentication text box enter "Password:" with out double quotes, But remember the value of authentication will depend on what you actually see when you issue enable command on the target device, The exact string should match with what you see on the device. in some cases you will see "P" in small case and vice versa.

    4. Click on save.

     

    Create policy : User/User group and Device (You cannot create policy for Device group, Product limitation , Idea already open long back)

    Inside the policy you need to select SSH and specify target account as you do for any SSH connection

    Under same policy you will have a new text box call Transparent login : Select the same account.

     

    This should solve your problem. Happy Learning!!!.



  • 4.  Re: Cisco transparent login

    Broadcom Employee
    Posted Nov 27, 2018 03:37 AM

    Thanks Asif for your good feedback - you are right - note this feature is disabled for security reasons

     

    To enable it, go to Configuration, Security, Access, and select Enabled for Command String.

     

    Please see also

    https://docops.ca.com/ca-privileged-access-manager/3-2-2/EN/implementing/provision-users-and-devices/provisioning-devices/device-setup/#DeviceSetup-TransparentLogin

     

     



  • 5.  Re: Cisco transparent login

    Posted Nov 27, 2018 07:40 AM

    Guys, you are awesome. Both helped me a lot! 

     

    Thanks!



  • 6.  Re: Cisco transparent login

    Posted Dec 11, 2018 12:36 PM

    Hi Asif,

    Are you using local or TACACS AD ID for the CISCO ASA transparent login?  From what I can tell I don't see a way to use AD for authentication if I just go with User/User group and Device 



  • 7.  Re: Cisco transparent login

    Posted Dec 11, 2018 11:55 PM

    you have rightly said, There is no way we can configure "Command string" on a device Group that is why you cannot use AD credential , AS we can apply ad credential only to a Group(as a data source),

     

      I don't remember raising an IDEA for that, But its worth doing it.



  • 8.  Re: Cisco transparent login

    Posted Dec 12, 2018 12:00 AM