Supporting Zero Standing Privilege for Traditional Infrastructure

See how to implement time-bound privileged access using Delinea Server Suite to move toward just-in-time (JIT) access without granting permanent administrative privileges.

View Transcript ▼

I'm on the box. I am an administrator,

and I'm going to be creating a time-boxed manual role assignment for my users.

What I'm showing you guys is just that I have all of my users in this global zone, right?

So again, it's a lab. I have a bunch of stuff that is garbage, and I only have two domain admins.

Now, this is important because this is most likely what I see when I get on

customer environments. I see that you have your domain admins assigned login

for Windows and Unix. Great. The start time and end time, though—a lot of people don't see that,

or maybe they just ignore it. That's what we're going to focus on here.

So when I create a role assignment for my user, who's my contractor that we were just

talking about before, I'm going to go in here and give him a Unix login role definition.

I'm going to create it. I'm going to look for my user. There we go.

A lot of customers just hit that OK button. Boom. So easy. I almost did it too,

but you want to check the top. This is where you can start implementing just-in-time.

So I say, okay, he's going to be working on the weekend. I'm going to give it to him on Friday,

and I'm going to expire it on Sunday. That's all he should need. If he needs more time,

we can come in and change the times.

So right here, you can see the manual effort behind it.

All of this that you're seeing in this UI can be done with AD Edit,

which is the Linux equivalent of the PowerShell commands that we provide.

Once I do this manually, this right here is affecting the global zone.

What this means is that yes, it's time-bound, but this person is going to be working across

my infrastructure all weekend. So he needs access to all of my boxes.

Right here, he has access to anything under Global.

I'm going to delete it here because, again, I want to keep my lab as clean as possible.

Now what I'm going to show you is how to apply it to only one system.

He's going to be working on this one RHEL machine.

So what I do now is use the PowerShell integration that my customer sent me.

We already have this integration with our product. We call it a computer-level override.

Here I'm showing you the script. It's not that long. I'm happy to

share a sample with anybody who's interested.

What it's going to do is allow you to customize the workflow.

I know there was a question around whether you can customize this to

prompt for certain things. This is where you can go crazy with it.

In this example, the PowerShell script prompts me for:

The zone I'm interested in

The machine the user is going to be working on The user or Active Directory group I want to

create the role assignment for The start and end time

I'm going to give it a date here: 3/6.

Again, you can make this as simple as possible.

I'm not that great with PowerShell, so I'm sure there's a nice way to have a calendar

pop up or something similar. You could even have your AI tool help build that for you.

Once we go through here, I'm going to put in the end time—24 hours.

Yep. So I gave him 24 hours.

I'm going to authenticate with my credentials to make sure that this role assignment gets created.

You can see how a lot of customers have their end users get prompted for this

and have embedded it into their existing workflow.

Now when I refresh my screen, you're going to see that role assignment get created.

It's for Unix login on this one machine, and it has a start and end time.