Automated password management
An embodiment includes an automatic policy managed password management system. One embodiment manages changing the password (with little to no user interaction) every set number of days. Also, password changes can be made within a set amount of time from the password being viewed by a user. Further, an embodiment includes a web service that contains an “insert record” method to insert a password management record into a managed machine and/or database with no “pre-work” required to use the web service. For example, no record needs to be created on a database and/or managed machines in advance of deploying passwords via the web service. The web service can be pushed to various machines and when the web service starts up, it may insert its own record into a database or managed client. This allows for scalability. Other embodiments are described herein.
1. At least one non-transient machine-accessible storage medium including instructions that when executed enable at least one machine to:
log, in an audit database, when first password credentials for a first plurality of processor-based systems were viewed;
query the audit database, using an audit service, to determine the first password credentials were viewed in a first preceding time period;
determine the first preceding time satisfies a threshold; and
from an additional processor-based system remotely located from the first plurality of systems, remotely invoke changing the respective first password credentials for each of the first plurality of systems based on determining: (a) the first password credentials were viewed in the first preceding time period, and (b) the first preceding time satisfies the threshold;
wherein remotely invoking changing the respective first password credentials for each of the first plurality of systems comprises remotely invoking code to be executed on the first plurality of systems to change the first password credentials.
2. The at least one medium of claim 1 including instructions that enable the at least one machine to:
determine a second plurality of systems whose respective second password credentials were not changed in a second preceding time period; and
from the additional system, remotely invoke changing the respective second password credentials for each of the second plurality of systems based on determining the second password credentials were not changed in the second preceding time period.
3. The at least one medium of claim 2 , wherein remotely invoking changing the respective second password credentials includes supplying a unique additional second password for each of the second plurality of systems.
4. The at least one medium of claim 1 , wherein remotely invoking changing the respective first password credentials includes supplying a unique additional first password for each of the first plurality of systems.
5. The at least one medium of claim 1 including instructions that enable the at least one machine to:
initially set up a password credential management account for an additional one of the first plurality of systems; and
upon initially setting up the password credential management account, remotely insert a record into a database from the additional system;
wherein the database had no preexisting record associated with the password credential management account.
6. The at least one medium of claim 5 including instructions that enable the at least one machine to remotely populate the record with a password, wherein the record includes a computing node identifier and access control list (ACL) privileges.
7. The at least one medium of claim 1 including instructions that enable the at least one machine to:
initially set up a password credential management account for an additional one of the first plurality of systems; and
upon initially setting up the password credential management account, remotely insert a password record into the additional one of the first plurality of systems;
wherein the additional one of the first plurality of systems had no preexisting password record associated with the password credential management account.
8. The at least one medium of claim 7 , wherein the password record includes a password.
9. The at least one medium of claim 1 including instructions that enable the at least one machine to:
determine an additional one of the first plurality of systems whose respective first password credentials have not been changed within an expired threshold time period that has transpired since the password credentials were viewed; and
from the additional system, automatically and remotely change the first password credentials for the additional one of the first plurality of systems based on the expiration of the threshold time period.
10. The at least one medium of claim 1 including instructions that enable the at least one machine to:
initially set up a password credential management account for an additional one of the first plurality of systems; and
upon initially setting up the password credential management account, remotely insert a password into the additional one of the first plurality of systems;
wherein the additional one of the first plurality of systems had no preexisting password associated with the password credential management account.
11. The at least one medium of claim 1 including instructions that enable the at least one machine to:
affirmatively identify an additional one of the first plurality of systems whose respective first password credentials have not been changed within an expired threshold time period that has transpired since the password credentials were viewed; and
from the additional system, automatically and remotely change the first password credentials for the additional one of the first plurality of systems based on the expiration of the threshold time period.
12. A method comprising:
logging, in an audit database, when second password credentials for a second plurality of processor-based systems were viewed;
querying the audit database, using an audit service, to determine the second password credentials were viewed in a second preceding time period; and
determining the second preceding time satisfies a threshold;
from an additional processor-based system remotely located from the second plurality of systems, remotely invoke changing the respective second password credentials for each of the second plurality of systems based on: (a) logging when the second password credentials were viewed, (b) querying the audit database to determine the second password credentials were viewed in the second preceding time period, (c) determining the second preceding time satisfies the threshold;
wherein remotely invoking changing the respective second password credentials for each of the second plurality of systems comprises remotely invoking code to be executed on the second plurality of systems to change the second password credentials.
13. The method of claim 12 comprising:
determining a first plurality of systems whose respective first password credentials were not changed in a first preceding time period; and
from the additional system remotely located from the first plurality of systems, remotely invoking changing the respective first password credentials for each of the first plurality of systems based on determining the first password credentials were not changed in the second preceding time period.
14. The method of claim 13 comprising:
determining an additional one of the first plurality of systems whose respective first password credentials have not been changed within an expired threshold time period that has transpired since the password credentials were viewed; and
from the additional system, automatically and remotely changing the first password credentials for the additional one of the first plurality of systems based on the expiration of the threshold time period.
15. The method of claim 13 comprising:
initially setting up a password credential management account for an additional one of the first plurality of first systems; and
upon initially setting up the password credential management account, remotely inserting a record into a database from the additional system;
wherein the database had no preexisting record associated with the password credential management account.
16. A system comprising:
at least one memory;
at least one processor, coupled to the at least one memory, to (a) log, in an audit database, when first password credentials for a first plurality of processor-based systems were viewed; (b) query the audit database, using an audit service, to determine the first password credentials were viewed in a first preceding time period; (c) determine the first preceding time satisfies a threshold; and (d) remotely invoke changing the respective first password credentials for each of the first plurality of systems based on: querying the audit database to determine the first password credentials were viewed in the first preceding time period and determining the first preceding time satisfies the threshold;
wherein remotely invoking changing the respective first password credentials for each of the first plurality of systems comprises remotely invoking code to be executed on the first plurality of systems to change the first password credentials.
17. The system of claim 16 , wherein the processor is to:
determine a second plurality of systems whose respective second password credentials were not changed in a second preceding time period; and
from the additional system, remotely invoke changing the respective second password credentials for each of the second plurality of systems based on determining the second password credentials were not changed in the second preceding time period.
18. The system of claim 16 , wherein remotely invoking changing the respective first password credentials includes supplying a unique additional first password for each of the first plurality of systems.
19. The system of claim 16 , wherein the processor is to:
initially set up a password credential management account for an additional one of the first plurality of systems; and
upon initially setting up the password credential management account, remotely insert a record into a database from the additional one of the first plurality of systems;
wherein the database had no preexisting record associated with the password credential management account.
20. The system of claim 16 , wherein the processor is to:
determining a first plurality of systems whose respective first password credentials were not changed in a first preceding time period; and
from an additional processor-based system remotely located from the first plurality of systems, remotely invoking changing the respective first password credentials for each of the first plurality of systems based on determining the first password credentials were not changed in the second preceding time period.