What are dependent accounts?

Create a dependent account

1. In the PVWA, on the Accounts page, select the target account to which you want to add the dependent account.
2. On the Account Details page, in the right pane, select the relevant dependency type, and then click Add.

3. On the Add Dependent Account page, enter the required information, and then click Save.

How CPM Managing Service Accounts

• PUSH - Out of the box, CyberArk can use the CPM to connect to target machines, and update the passwords on certain types of service accounts. For example: Windows Scheduled Tasks (which it can restart after the change), Windows Services, text files, registry files, IIS app users. There are certain limitations here, and risks.
• • For example, if I remember correctly, you can only have 100 of these "usages" per a single managed account.
• • It takes time for the CPM to reach out to each target machine running such a service, something like 3 at a time, so there is a possibility that accounts can get locked, or services can fail.
• • You basically want to use this for non-critical service accounts, or at least service accounts that have some tolerance for how quickly the password is updated in the service account's definition.
• PULL If you have certain business systems, specific applications which have been built to work with the CyberArk vault, or custom applications you can update, or applications that can get passwords using SOAP calls, then you can use the CyberArk "pull" mechanisms to pull passwords straight from the vault, which are grouped together as "AIM". For the most part it requires a separate license per device that needs these passwords, and you either install a CyberArk service on those devices can talk directly to the Vault, or implement code which can querry the CCP (Central Credential Provider) for a password, whenever the service needs it. The benefit here is that each service runs independently, and they can all be updated concurrently.

/etc/init.d/psmpsrv {start|stop|restart|status} [{psmp|psmpadb}]

/etc/init.d/sshd restart 

PSMPAPP_ account Authentication Failure and PSMP disconnected

[root@psmp conf]# vi /etc/opt/CARKpsmp/conf/basic_psmpserver.conf
[Main]
PSMPServerVaultFile="/etc/opt/CARKpsmp/vault/vault.ini"
PSMPServerCredFile="/etc/opt/CARKpsmp/vault/psmpappuser.cred"
PSMPServerGWCredFile="/etc/opt/CARKpsmp/vault/psmpgwuser.cred"
LogsFolder="/var/opt/CARKpsmp/logs"
LocalParmsFileFolder="/var/opt/CARKpsmp"
TempFolder="/var/opt/CARKpsmp/temp"
PSMPConfigurationSafe="PVWAConfig"
PSMPConfigurationFolder="Root"
PSMPPVConfigurationFileName="PVConfiguration.xml"
PSMPPoliciesConfigurationFileName="Policies.xml"
PSMPServerId="PSMPServer"
PSMPTempFolder="/var/opt/CARKpsmp/temp"

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe psmpappuser.cred
Vault Username [mandatory] ==> PSMPAPP_psmp
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No
] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==>
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User
/No) [No] ==>
Command ended successfully

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe psmpgwuser.cred
Vault Username [mandatory] ==> PSMPGW_psmp
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No
] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==>
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User
/No) [No] ==>
Command ended successfully

C:\CyberArk\Password Vault Web Access\Env>

PSMP_ADB_psmp suspended

[root@psmp conf]# cat /etc/opt/CARKpsmpadb/conf/basic_psmpadbridge.conf
[Main]
AppProviderParmsSafe="PSMPADBridgeConf"
AppProviderVaultParmsFolder=Root
AppProviderVaultParmsFile="main_psmpadbridge.conf.linux.11.04"
AppProviderVaultFile="/etc/opt/CARKpsmp/vault/vault.ini"
AppProviderCredFile="/etc/opt/CARKpsmpadb/vault/psmpadbridgeserveruser.cred"
LogsFolder="/var/opt/CARKpsmpadb/logs"
LocalParmsFileFolder="/var/opt/CARKpsmpadb"
TempFolder="/var/opt/CARKpsmpadb/tmp"
AdvancedFIPSCryptography="No"
PIMConfigurationSafe="PVWAConfig"
PIMConfigurationFolder="Root"
PIMPVConfigurationFileName="PVConfiguration.xml"
PIMPoliciesConfigurationFileName="Policies.xml"

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe psmpadbridgeserveru
ser.cred
Vault Username [mandatory] ==> PSMP_ADB_psmp
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No
] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==>
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User
/No) [No] ==>
Command ended successfully

[root@psmp vault]# cp /home/root1/psmpadbridgeserveruser.cred .
cp: overwrite ‘./psmpadbridgeserveruser.cred’? y
[root@psmp vault]# /etc/init.d/psmpsrv restart
Stopping PSM SSH Proxy....
PSM SSH Proxy was stopped successfully.
Starting PSM SSH Proxy...
PSM SSH Proxy was started successfully.
PSMP ADBridge is already stopped.
Starting PSMP ADBridge...
PSMP ADBridge was started successfully.
[root@psmp vault]#

/opt/CARKpsmp/bin/envmanager "CreateEnv" -AcceptEULA "Y" -CredFile "/tmp/user.cred" -PSMPAppUser "PSMPAppUser_PSMP1" -PSMPGWUser "PSMPGWUser _PSMP1"