snovak

Awesome! Thank you!

My personal use case is Mac, but Linux would also be appreciated (I have a few Linux coworkers). No current use-case for mobile devices.

Thanks!

Per thread - https://forum.devolutions.net/topics/40021/beyondtrust-password-safe--credential-manager#189294

I and some of my team run different OS's and we're starting to rely heavily on BeyondTrust. Having the ability to leverage the BeyondTrust API to get credentials across the major desktop platforms would make our user experience much better!

Thanks for the consideration!

@fanllawf, which parts are not matching up for you? It works great for me.

@Oliver, any chance we could get it working on Linux and Mac releases? :D

Hi Zach,

Yeah please open a case for it; we'll have to coordinate with my coworker, as I can't reproduce the issue myself.

Thanks,

Sam N.

Hi Zach,

Much to my surprise, it didn't work after elevating my coworker to admin.

Are there any other settings that need to be enabled for this to work?

Thanks,

Sam N.

Hi Zach,

I've confirmed with my coworker that the box is checked, but the issue persists. He is able to create a standalone (non-BeyondTrust) SSH session in his user vault and it does work that way, but that defeats the whole purpose of the BeyondTrust session because he needs to specify the password instead of it getting pulled out of the password safe.

Thanks,

Sam N.

I've followed the instructions at https://docs.devolutions.net/kb/remote-desktop-manager/knowledge-base/connect-su-user-ssh-sessions/ to use sudo su, and have successfully used it myself via a template with a beyondtrust SSH session, but my co-worker, who is not an admin over the RDM data source, is unable to sudo via the post login commands via the template; all the specified commands are sent, but it appears that the $PASSWORD$ variable isn't being filled, despite Administration -> System Settings -> Password Policy -> Allow password in variable for Macros being enabled.

I have a SQL Server data source, for what it matters.

@Richard Thank you, this is exactly what I need!

Is there some documentation I would've found this under for the BeyondTrust plugin?

Hey there,

As I'm working on my Devolutions + BeyondTrust deployment I'm observing some differences between typical RDP/SSH sessions and those offered by the PasswordSafe entries.

For RDP, I don't have the ability to turn of 'connect local drives', nor does the clipboard passthrough seem to work (haven't confirmed if that's a BeyondTrust issue or not).

For SSH, I don't have the ability to send commands after login; my ecosystem is such that my users SSH in and then use sudo to execute admin commands, and our usage of BeyondTrust is focused around my users not needing to know their privileged account password. Having the ability to execute a sudo macro at login would be highly beneficial to my use case.

To work around these, I have a powershell macro/credential to call the Password Safe API to retrieve account passwords, but that seems slightly cumbersome and isn't cross platform (at least doesn't work on Mac, which makes sense because it's powershell (perhaps support for the cross-platform versions of powershell can be added?).

Thanks,

Sam N.

Hi,

I'm thinking about my deployment, and Im' wondering what, if any, sensitive data is stored in cleartext in the database when using SQL Server.

I've already determined that team entries are stored at least mildly in cleartext, and it appears that user vault entries are encrypted in some manner, but I'd like a little insight into how those entries are encrypted; basically is there something in the database that could be used for decryption, should the DB get compromised, or are the entries encrypted with some sort of identifier for the user.

If there is something that could be used to decrypted entries in an offline database, I'd deploy to a different set of servers with stricter access control.

Thanks,

For some reason I had disabled user vault! Thanks, that works :D

For BeyondTrust Password Safe, it's possible to retrieve a user credential via the API. It would be nice to be able to fetch credentials from PWsafe for use with all sorts of objects and entries.

I'm working on setting up a team using a SQL backend to use our Beyondtrust Password Safe for RDP, but I'm finding that API keys and the managed account used by BeyondTrust entries are stored in the database. I need every user/team member to use their own accounts, and api keys so we have accountability and auditing.

Is there something that I'm missing or is this a feature request?

I would also like to state my interest in this feature!