gdepaola

I would like to know if there is support for the Devolutions Password Manager browser extension to automatically log a user into the extension using Microsoft SSO if they have already authenticated once from using the extension for the first time. Some users would prefer to not have to manually log into the extension daily.

Hello,

Thank you for your feedback. I understand your concern and the need for such a feature.

If I understand correctly, your objective is to ensure that access to your critical infrastructure always goes through approved connections where session recording is enabled. Is that correct?

Restricting the entry type in a user vault could partially address this requirement; however, it would not be fully effective, as users could still create connections in other vaults if they have the appropriate permissions. To better understand your use case, are we specifically referring to RDP sessions?

From a security standpoint, the most robust approach to ensure that all connections to your servers originate from a single, controlled entry point is to enforce the use of Devolutions Gateway and configure your firewall to allow connections only from the Gateway.

While users could technically create connections in their user vault using the Devolutions Gateway, it is currently possible to disallow Gateway usage in user vaults, which could address this scenario. Additionally, we could consider enhancing the Virtual Gateway by introducing a rule that enforces mandatory session recording. This could be a valuable improvement to better support your requirements.

Would this approach meet your needs?

Best regards,

@François Dubois

I personally like the approach of disabling Gateway usage for User vaults (I did not know it was an option) and requiring the use of gateway for remote access to our infrastructure. We currently centrally manage connections and configuration of vaults so enforcing the use of Gateway at the network level should make things pretty airtight!

We would love to see this feature be implemented for our organization as well. We require session recording when connecting to critical infrastructure, but a user could simply bypass that requirement by creating their own session in a user vault. We only want our users to use our approved and managed connections (similar setup to the one OP described).

Thanks for providing those resources. So it would be safe to say that I only need to attach my share to a single application server and a single database server then? And then of course make sure to properly back up my encryption key in a different location. for proper DR.

I was going through documentation relating to backups and was not able to find anything that calls out how backups are handled in a load-balanced, high-availability architecture where there are two web servers and two database servers. This doc mentions using a CIFS share if you have separate servers for app and DB.

I am not sure if it is necessary to have my backup share attached to all 4 servers or just on two of them (one web and one DB).