Blue Coat Secret Template for RPC
Overview
This document briefly discusses using Verify Privilege Vault Remote Password Changing (RPC) for Blue Coat accounts. With Remote Password Changing (RPC), secrets can automatically change remote account passwords when a secret expires, either immediately or on a defined schedule. In addition, the new passwords’ strengths and other qualities are completely configurable. See the Password Changer List for a complete list of available password changers.
Verify Privilege Vault can use scripted password changers for devices that support SSH or Telnet (this allows for flexibility in changing passwords on less common devices). The Blue Coat password changers are scripted SSH changers: they open an SSH session to the appliance and issue the same command sequence an administrator would type at the command line.
Verify Privilege Vault includes two Blue Coat password changers:
| Password changer | What it changes | Requires an associated secret |
|---|---|---|
| Blue Coat Account Custom (SSH) | The password of a user account on the appliance | Yes |
| Blue Coat Enable Password Custom (SSH) | The appliance’s enable (privileged mode) password | No |
Blue Coat Account Custom (SSH) enters privileged mode using the enable password stored on an associated secret, then changes the account password. You must link that associated secret before the password change can succeed. See Creating a Custom SSH Password Changer for how associated secret fields are referenced in a command set.
Blue Coat Enable Password Custom (SSH) enters privileged mode using the password stored on the secret itself, then changes that same enable password. No associated secret is needed.
Creating a Secret Template for Blue Coat
Verify Privilege Vault does not include a built-in Blue Coat secret template. Create one by copying an existing SSH template that has the fields the Blue Coat password changer needs, then map the Blue Coat password changer to your copy.
Copy the template that matches the changer you plan to use:
| Password changer | Copy this template |
|---|---|
| Blue Coat Account Custom (SSH) | Cisco Account (SSH) |
| Blue Coat Enable Password Custom (SSH) | Cisco Enable Secret (SSH) |
To create the template:
-
Search for Secret Templates. The Secrets Administration page is displayed.
-
In the Core Actions section, click Secret Templates. The list of available templates is displayed.
-
Select the template you are copying and click Edit. The Secret Template Designer page is displayed.
-
Scroll to the bottom of the page and click Copy Secret Template.
-
Give the new template a name that identifies it, such as Blue Coat Account (SSH), and click OK.
-
On the confirmation page, click Continue.
Ensure that the new secret template is in active status. See Activating and Deactivating Templates for details. For the full range of template options, see Creating or Editing Secret Templates.
Assigning a Password Changer to a Secret Template
After creating the secret template, assign the Blue Coat password changer to it:
-
Search for Secret Templates. The Secrets Administration page is displayed.
-
In the Core Actions section, click Secret Templates. The list of available templates is displayed.
-
Select the Blue Coat secret template you created and then click the Mapping tab.
-
Set the password changer to Blue Coat Account Custom (SSH) or Blue Coat Enable Password Custom (SSH), then map each template field to the corresponding field the password changer uses.
Blue Coat is a scripted SSH password changer, so the fields it uses depend on its command set and on how your appliance is configured. Add and map the fields your environment requires, and test the password change against a non-production appliance before you enable auto change on any secret. See Running a Manual RPC for how to trigger a single change and read the result in the RPC log.
It is possible to assign several password changers to one secret template. For more information, see Assigning a Password Changer to a Secret Template. To edit the command set the changer sends to the appliance, see Editing Custom Commands.
Secret templates determine the fields, launchers, and the remote password changer for secrets. To use the Blue Coat template on a secret, see Managing Secrets.