Policies

The section contains a list of policies, sorted by priority.

The following data is displayed for policies:

• Priority - a number indicating the order in which a particular policy is applied. Zero priority is the default policy that is applied last. The higher the policy, the higher its priority, and vice versa.
• Name - policy name.
• Description - policy description.
•  - number of users with policy.
•  - number of accounts with policy.
•  - number of resources with policy.
• - number of domains with policy.

The default policy contains a set of parameters for all available sections and applies to all new objects, so it is advisable to start configuring there.

Open the policy page, set the desired parameters for the Accounts, Sessions, RDP sections, save settings.

Adding new policy

Click Add in the Policies section, fill in the Policy Name, Description, and Priority fields. The new policy will appear in the list.

General information

Open the policy page, review the general information, edit Name, Description, or Priority if necessary by clicking the pencil icon

• Name - the name of the policy, it is set when creating a new policy. It can be changed at any time.
• Description - policy description.
• Priority - a number indicating the order in which a particular policy is applied. Zero priority is the default policy that is applied last.
• Created by - Indeed Identity PAM administrator name.
• Date created - date and time when the policy was created.
• Changed by - name of Indeed Identity PAM administrator who saved the policy settings.
• Date changed - date and time when the policy settings were saved.

To edit Name, Description and Priority click 

Sections

Go to the Sections and mark the sections which will be determined by the policy, save the changes. The corresponding sections will become available for setting up.

Scope

Contains information about which users, accounts, resources, or domains the policy is applied to.

To apply a policy to an object, click Add, select the type of object to apply the policy,select the objects.

To remove the policy from objects, select the required objects and click Remove. 

Creating a copy of the policy

Check the policy in the Policies section and click Create copy, fill in the Policy name, Description and Priority fields. The copied policy will appear in the list.

Removing policy

Before removing a policy, make sure that it does not apply to any objects.

Check the required policies in the Policies section and click Remove.

Changing the priority of a policy

Check one policy under Policies, click Change priority and enter a number for the policy priority value.

You can also change the priority by opening the required policy and in the General Information section click the pencil icon next to the priority value.

Policy sections

Accounts

Sessions

Gateway & SSH Proxy

RDP

SSH

Privilege elevation

• Allow run pamsu - support for executing commands with root privileges on resources with the PamSu component installed.

Allowed and forbidden commands

• Prompt - regular expression to correctly recognize command input.
• Reaction to forbidden command - terminal behavior in response to a forbidden command: CTRL + C (cancel execution) or Abort the session.

Creating a list of controlled commands:

1. Click the Add button
2. Enter the command or regular expression
3. Select the status Allowed or Forbidden.

To allow or prohibit several commands at once, select them with the check boxes and click the appropriate button.

When working with the list of commands, as well as when trying to execute a prohibited command, the corresponding events are recorded in the Events section.