Agentless password rotation for baremetal servers
An orchestrator manages password rotation bare metal servers that lack an agent for performing password rotation. A user configures parameters for performing password rotation such as the frequency (e.g., cron command) and password rules for a bare metal server. Parameters may be associated with a theme that can be applied to one or multiple bare metal servers. When indicated by the frequency, the orchestrator runs a workflow with respect to one or more bare metal servers in order to change the passwords and update a vault store recording the passwords.
1 . A method comprising:
selecting, by a first computer system, one or more parameters defining performing password rotation with respect to a remote server connected to the first computer system by a network, the first computer system selecting the one or more parameters according to both of (a) a location of the server in a telecommunication system and (b) a frequency of unsuccessful login attempts detected for the server, the one or more parameters including a frequency of password changes and password requirements;
detecting, by the first computer system, that password rotation is due for the server according to the one or more parameters; and
executing, by the first computer system, a workflow to perform password rotation on the server over the network, the workflow including making application programming interface (API) calls, by the workflow, to an API of an operating system executing on the server to perform the password rotation.
2 . The method of claim 1 , wherein the one or more parameters include one or more rules for generating passwords for the server.
3 . The method of claim 1 , wherein the one or more parameters include a cron command.
4 . The method of claim 1 , wherein the one or more parameters are associated with a theme to which the server is assigned.
5 . The method of claim 4 , wherein the theme corresponds to the location of the server in the telecommunication network.
6 . The method of claim 1 , wherein invoking execution of the workflow comprises selecting a worker from a worker pool and instructing the worker to execute the workflow.
7 . The method of claim 1 , wherein execution of the workflow includes storing passwords in a password vault store.
8 . The method of claim 1 , wherein execution of the workflow includes establishing a secure command line interface to the server and transmitting instructions through the secure command line interface.
9 . The method of claim 8 , wherein the secure command line interface includes a secure shell (SSH) connection to the server.
10 . The method of claim 1 , further comprising modifying the one or more parameters to increase a frequency of performance of password rotation in response to unsuccessful login attempts on the server.
11 . A system comprising:
a computing device including one or more processing devices and one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code that, when executed by the one or more processing devices, causes the one or more processing devices to:
select one or more parameters defining performing password rotation with respect to a remote bare metal server connected to the computing device by a network, the one or more parameters selected according to both of (a) a location of the bare metal server in a telecommunication system and (b) a frequency of unsuccessful login attempts detected for the bare metal server, the one or more parameters including a frequency of password changes and password requirements;
detect that password rotation is due for the bare metal server according to the one or more parameters; and
executing a workflow to perform password rotation on the bare metal server over the network, the workflow including making application programming interface (API) calls, by the workflow, to an API of an operating system executing on the bare metal server to perform the password rotation.
12 . The system of claim 11 , wherein the one or more parameters include one or more rules for generating passwords for the bare metal server.
13 . The system of claim 11 , wherein the one or more parameters include a cron command.
14 . The system of claim 11 , wherein the one or more parameters are associated with a theme to which the bare metal server is assigned.
15 . The system of claim 11 , wherein the executable code, when executed by the one or more processing devices, further causes the one or more processing devices to invoke execution of the workflow by selecting a worker from a worker pool and instructing the worker to execute the workflow.
16 . The system of claim 15 , wherein the executable code, when executed by the one or more processing devices, further causes the one or more processing devices to invoke execution of the workflow by retrieving the workflow from a repository.
17 . The system of claim 11 , wherein execution of the workflow includes storing passwords from a password vault store.
18 . The system of claim 11 , further comprising the bare metal server, the bare metal server being an edge server coupled to an antenna of a telecommunication network.
19 . A non-transitory computer-readable medium storing executable code that, when executed by one or more processing devices, causes the one or more processing devices to:
select one or more parameters defining performing password rotation with respect to a remote bare metal server connected to a computing device by a network according to both of (a) a location of the bare metal server in a telecommunication system and (b) a frequency of unsuccessful login attempts detected for the bare metal server, the one or more parameters including a frequency of password changes and password requirements;
detect that password rotation is due for the bare metal server according to the one or more parameters; and
invoke execution of a workflow to perform password rotation on the bare metal server over the network, the workflow being executed by the computing device and including making calls, by the workflow, to application programming interface (API) of an operating system executing on the bare metal server.
20 . The non-transitory computer-readable medium of claim 19 , wherein the one or more parameters include one or more rules for generating passwords for the bare metal server and a cron command.