Best way to handle sudo access in Password Safe without exposing passwords

​@Hashan_Neth To answer your questions:

1. Is there a way to handle sudo password injection through Password Safe for SSH sessions? A: Directly from Password Safe, there is NO credential injection available for elevation.

2. How are others managing privilege escalation in similar environments without exposing credentials? A: You have a few options:

• First: EPM-UL (Endpoint Privilege Management for Unix/Linux) can handle elevation on Linux servers as seamlessly as possible.

• Second: You could use psrun to request the password from the server via API and use that same command to elevate the session.

• Third: Instead of using a generic account like 'root', you can create dedicated accounts (e.g., a.hneth). Once the user logs into Password Safe, that specific account is only available to them, and you can then allow NOPASSWD in the sudoers file for that specific user.

3. Any recommended best practices for scaling this across a large number of Linux servers? A: This is the tricky part. You will need to decide which approach is less demanding for your team to manage at scale.

​@Pulitros144 Is it possible to configure Password Safe sessions to initiate directly with root privileges (or an equivalent privileged account), so that users do not need to perform su or sudo after login?

It is not possible unless you create a script directly on the server—for example, by adding it to the .bashrc file. As of today, Password Safe does not allow you to input a command directly onto the screen during the login process. There is currently an Idea open on the AHA portal for this feature, but for now, the recommendation is to set the account to NOPASSWD in the sudoers file and leave it at that.

​Hello @Pulitros144 

We are currently facing a challenge in securely providing users with sudo/root access. 
Our requirement is to allow users to log in to servers and perform tasks with elevated permissions without retrieving or exposing the root password.

Currently, when users launch a PuTTY session, it does not prompt for additional permissions initially. 
However, once they attempt to execute commands using sudo (the user is LDAP-authenticated with sudo privileges), the system requests a password.

Our concern is that enabling password retrieval for such access would violate our internal security policies. 
We are looking for a secure solution that allows users to perform sudo tasks during the PuTTY session without compromising password security.