Configuration files

This topic describes the Configuration files plugin for CPM.

Overview

The CPM enables organizations to manage application accounts that are stored externally from Privilege Cloud in the following types of files:

File type

Password location in file

Plain text Passwords in plain text files can be specified anywhere in any format. The CPM identifies passwords using a regular expression.
INI Passwords in INI files are specified in a particular section and parameter. The CPM uses these details to identify passwords and change them.
XML Passwords in XML files are specified in XmlElements. The CPM uses XPath for these XmlElements and XmlAttributes to identify passwords and change them.
Web configuration Passwords are stored in the same way as in XML files. However, any changes made in web configuration files cause the application to restart. Account management for accounts that are managed with the web configuration service account must be initiated manually in the Privilege Cloud Portal so that users can control the application restart.

In all of the above file formats, the password value can be stored in either of the following ways:

Password type

Password storage

Direct account password The password stored in the configuration file is exactly the same as the password stored in Privilege Cloud.
Encrypted account password The password stored in the configuration file is an encrypted version of the password stored in Privilege Cloud.

Support

Target devices

This plugin is supported on the following target devices:

Connection protocols

This plug-in supports the following protocols to connect to the remote machine:

Windows – Windows file and printer sharing protocol
Unix – SSH protocol

Prerequisites

This plugin requires .NET Framework 4.8. If you are using an older version of the CPM, .NET Framework 4.8 must be installed on the CPM machine as well.

Required authorizations

The account used to access the file requires the following permissions to access the configuration file on the remote machine:

Windows:
Permissions

The CPM can connect to a remote machine using a logon account that has the following permissions:

View the configuration file
Edit the configuration file
Create files (if the CPM is configured to create a backup password file)

If the password will be encrypted, the local system account used to run the CPM service requires the following file system permissions for the encryption program executable:

Administrative permissions
Communication
On the remote machine, make sure that the following options are enabled:
Client for Microsoft Networks
File and Printer Sharing for Microsoft Networks
On the CPM machine, if DEP is supported, disable it.
Unix
Permissions

The CPM can connect to a remote machine using a Unix/Linux connection with a logon account that has the following permissions:

SSH login permissions
View the password file
Edit the password file
Create files (if the CPM is configured to create a backup password file)
Communication
Open port 22 to enable SSH and SFTP activities.

Platform

In the Platform Management page, make sure that one of the following service account platforms is displayed, depending on the service account to implement:

Text Config File – To manage passwords stored in plain text files.
INI Config File – To manage passwords stored in INI files.
XML Config File – To manage passwords stored in XML files.
Web Config File – To manage passwords stored in web configuration files.

Encrypt passwords

Passwords stored in configuration files can be encrypted using an external command.

Additional logon passwords

If the CPM manages a password in a configuration file on a remote machine, and the remote machine requires an additional password for log on, create an additional password object to contain the extra user’s logon details. You must link the additional password object to the original password object.

For more information, see Create linked accounts.

Usage

In the relevant platform, in the UI & Workflows parameters, add the ID of the service account in the list of Usages. For more information, see Edit a platform.

Add service accounts

When you add service account for an account stored in a configuration file, specify the following parameters:

Run multiple service accounts concurrently

At any time, only one configuration file service account process can manage a specific configuration file. If multiple processes specify the same Address and FilePath properties, the processes will run consecutively. However, if two service accounts specify the same configuration file, but one specifies an IP address and the other specifies the FQDN address, the CPM might run these service accounts simultaneously, which may cause an error.

Manage comments in INI configuration files

Comments that appear in the same line as passwords will be managed according to the following guidelines:

Lines that start with ‘#’ (hash) or ‘;’ (semi-colon) are line comments.
The INIConfigFile service account recognizes inline comments that are marked with a space followed by ‘ ;’ (space followed by a semi-colon), and will treat them as comments, as shown in the following example:
Previous password:  Password=Abc123 ; comment
New password: Password=Def456 ; comment
The INIConfigFile service account does not recognize inline comments that are marked with a hash (#), and will treat them as part of the password value.
Semi-colons that are not preceded by a space can be included in password values managed by the INIConfigFile service accounts, as shown in the following example:
Previous password:  Password=Abc;123
New password: Password=Def456
 

In lines that use a semi-colon as part of a password, you cannot specify inline comments with ‘ ;’ (space followed by a semi-colon).