PSM automatic installation

This stage performs the following:

Configure the readiness stage

1. From the installation CD, copy the PSM folder to the component server and unzip.

2. Open InstallationAutomation\Readiness\ReadinessConfig.XML and select the steps to enable by setting Enable = "Yes".

3. Select the deployment size based on your environment.

Run the readiness stage

To run the script in standard mode, open a PowerShell window and run the following command:

CD “<CD-Image Path>\InstallationAutomation”
.\Execute-Stage.ps1 “<CD-Image Path>\InstallationAutomation\Readiness\ReadinessConfig.XML”

To run the script in silent mode which includes an automatic restart, open a PowerShell window and run the following command:

 .\Execute-Stage.ps1 .\Readiness\ReadinessConfig.XML silent

This stage performs the following:

Configure the set up stage

1. From the installation CD, copy the PSM folder to the component server and unzip.

2. Open InstallationAutomation\Prerequisites\PrerequisitesConfig.XML and select the steps to enable by setting Enable = "Yes".

Run the set up stage

To run the script in standard mode, open a PowerShell window and run the following command:

CD “<CD-Image Path>\InstallationAutomation”
.\Execute-Stage.ps1 “<CD-Image Path>\InstallationAutomation\Prerequisites\PrerequisitesConfig.XML”

To run the script in silent mode which includes an automatic restart, open a PowerShell window and run the following command:

 .\Execute-Stage.ps1 .\Prerequisites\PrerequisitesConfig.XML silent

The installation stage installs Privileged Session Manager automatically using the PAM - Self-Hosted deployment scripts. For details about manually installing the PSM, see PSM wizard installation.

Configure installation

From the CD image, open InstallationAutomation\Installation\InstallationConfig.XML and edit the following parameters:

Run installation

To run the script in standard mode, open a PowerShell window and run the following command:

CD “<CD-Image Path>\InstallationAutomation”
.\Execute-Stage.ps1 “<CD-Image Path>\
InstallationAutomation\Installation\InstallationConfig.XML”

Or, to run the script in silent mode which includes an automatic restart, open a PowerShell window and run the following command:

.\Execute-Stage.ps1 .\Installation\InstallationConfig.XML silent

The post installation stage configures the PSM server after it has been installed successfully.

The post installation stages does the following steps automatically. For troubleshooting or to perform the step manually, see the procedure:

Configure the post-installation stage

From the CD image, open InstallationAutomation\PostInstallation\PostInstallationConfig.XML. and select the steps you want to enable by setting Enable = "Yes"

Run the post-installation stage

Open a PowerShell window and run the following command:

CD “<CD-Image Path>\InstallationAutomation”
.\Execute-Stage.ps1 “<CD-Image Path>\Installation automation\PostInstallation\PostInstallationConfig.XML

Following installation

Perform the following steps, if required:

The PSM hardening stage enhances PSM security by defining a highly secured Windows server. The hardening procedure, which disables multiple operating system services on the PSM server machine, is included as part of the PSM installation.

Configure the hardening stage

From the CD image, open InstallationAutomation\Hardening\HardeningConfig.XML and verify that the following parameters are set to Enable = Yes:

Run the hardening stage

Open a PowerShell window and run the following command:

CD “<CD-Image Path>\InstallationAutomation”
.\Execute-Stage.ps1 “<CD-Image Path>\Installation automation\Hardening\HardeningConfig.XML

After the hardening stage, see the following steps for in-domain and out-of-domain deployments:

The Registration stage registers the Privileged Session Manager server to the Vault.

Register server to the Vault

1. Configure the registration stage. From the installation package, open InstallationAutomation\Registration\RegistrationConfig.XML and edit the following parameters:

   Parameter	Description
   Vaultip	IP address or hostname of the vault server When you register PSM to a DR Vault environment, value Vaultip with <vault ip>,<DR ip>
   vaultport	Vault’s configured communication port. Default Vault port: 1858
   vaultusername	Vault user performing the installation. We recommend using the Vault administrator user to install Privileged Session Manager as this user has the appropriate Vault authorizations and is created in the appropriate location in the Vault hierarchy. If you install multiple PSMs in the same Vault environment, you must install all PSMs with the same Vault user.
   usercredfile	The path to the user credential file. For details on creating a cred file, see CreateCredFile utility. The user credential file must be placed in a folder that is accessible only for the machine or domain administrator who runs the PSM installation. We highly recommend that you delete the credential file after completing the registration.
   accepteula	Accept the end user License agreement
   apigwhost	The PVWA host name. In a Distributed Vaults environment, you must define the PVWA where PSM will send REST API calls. To automatically unlock accounts, you must define the PVWA.
   apigwprotocol	The protocol. By default the value is HTTPS. To automatically unlock accounts, you must define the protocol.
   usepkiauthentication	This parameter enables PKI authentication to the Vault via a smart card for PSM connections. Do not enable this setting if PKI authentication is not used in your organization. If you do not enable this setting during installation and want to enable PKI authentication for PSM, follow the instructions in During PSM installation.
   registerpsmwithdomain	This parameter enables registration to the Vault using the DNS name. By default the value is No. Set the value to Yes to enable registration with the DNS name.

2. Run the registration stage with a password. Open a PowerShell window and run one of the following commands:

   1. Interactively run the script with the -spwd parameter to securely pass the password to the script. After running the script, enter the Vault user password and press Enter.

      CD “<installation package Path>InstallationAutomation” .\Execute-Stage.ps1 “<installation package Path>\InstallationAutomation\Registration\RegistrationConfig.XML”-spwd

   2. Automatically run the script with the -spwdObj parameter to securely pass the password to the script. First create a secure string that holds the Vault user password. For example:

      $sp = Read-Host -AsSecureString

      Enter the Vault user password, press Enter, and run the script.

      CD “<installation package Path>InstallationAutomation” .\Execute-Stage.ps1 “<installation package Path>\InstallationAutomation\Registration\RegistrationConfig.XML”-spwdObj $sp

   3. Interactively run the script with the -pwd parameter:

      CD “<installation package Path>InstallationAutomation” .\Execute-Stage.ps1 “<installation package Path>\InstallationAutomation\Registration\RegistrationConfig.XML”-pwd <vaultpassword>

       

      This method is not recommended, as it runs with the password in clear text.

3. If you use a credfile, open a PowerShell window and run the following command:

   CD “<installation package Path>InstallationAutomation” .\Execute-Stage.ps1 “<installation package Path>\InstallationAutomation\Registration\RegistrationConfig.XML”

4. When you use the registration tool, the PSM server is assigned a unique identifier, PSM-<identifier>.

   To view the ID assigned to each of PSM servers in your environment, go to PVWA > ADMINISTRATION > Systems Configuration > Options > Privileged Session Management > Configured PSM Servers.

5. When you use the registration tool on an existing Vault environment, every platform's PSM in this Vault environment is set to the unique identifier described in the previous step.

   To edit a PSM Server ID on an individual platform, go to Platform Management, select the platform and reset the PSM server ID.

   To edit multiple PSM Server IDs, you can do a bulk change. Go to Vault > PVWAConfiguration Safe > Policies.XML, and edit the PSM server IDs.

For more information, see Advanced PSM Implementations