Password Reset Script Requirements
There are different System Requirements, and host configurations, depending upon which Password Reset scripts you would like to use. The following table describes the possible scenarios.
Note 1: For detailed information about open ports, refer to “Passwordstate Open Port Requirements” document here Open Ports Requirements
Note 2: If you are using the Remote Site Locations Agent, this has the same system requirements as your Passwordstate web server, and the hosts on that network will have the same requirements as the table below.
Note 3: All Linux Distributions such as Redhat, Mint, Ubuntu, Mac OS X, etc are all consolidated under the Account type of Linux in the table below.
Note 4: VMWare ESXi accounts can use either SSH or HTTPS to connect. If you use SSH, choose the Linux Reset script option. If you prefer to use HTTPS, check the VMWare ESXi requirements in the table below.
Note 5: For Windows operating systems, Server 2016 and above are supported.
| Account Type | Port Requirements | Passwordstate Web Server Requirements | Privileged Account Required? | Notes |
|---|---|---|---|---|
| Active Directory | 9389, 389 or 636, 88, 464 | RSAT Tools needs to be installed on web server – See section On Premise Active Directory Passwords in this documentation below for more information. | Yes | 1. Privileged Account must have Account Operator rights when changing passwords on the domain, or delegate equivalent permissions 2. If you need to change passwords for accounts which have Domain Admin rights, then your Privileged Account may also need Domain Admin rights, or delegate equivalent permissions |
| Cisco IOS | 22 | None | Yes or No – See Notes | 1. When resetting Cisco accounts, a Privilege Level 15 type account must be used in order to perform the reset. This is either for a Privileged Account Credential if being used, or the account on the password record itself, if not using a Privileged Account Credential 2. When resetting the enable password, you must use a Privileged Account Credential which will SSH to the Cisco device, and this account performs the password reset for enable. The Username field for the password record itself must be named as 'enable' 3. This script will work if the account's password is of type 'secret' or 'password' 4. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 5. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| Dell iDRAC | 22 | None | No – See Notes | 1. The reset script for this account type does not use a Privileged Account, so assigning one to the password record is not recommended as it will have no effect 2. The user will connect into the iDrac as itself and reset its own password 3. Requires RACADM tools to be installed on the iDRAC card 4. iDrac cards with firmware version 4.40 or high has replaced getconfig command with get command. get commands no longer return the index number of the user account, so you must manually set the index number for each account running on these firmware versions. See iDrac example in section Dell iDrac Accounts in this documentation below for more information. 5. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 6. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| F5 BIG-IP | 22 | None | Yes | 1. Accounts in BIG-IP appliances can be configured with Terminal Access of type 'Advanced Shell' or 'TMSH'. You need to select the appropriate BIG-IP reset script to use, depending on the Terminal Access type for the Privileged Account Credentials you have associated with the Password Reset Script |
| Fortigate | 22 | None | No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| HP H3C | 22 | None | Yes | None |
| HP iLO | 22 | None | No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| HP Procurve | 22 | None | Yes or No – See Notes | 1. The only account which has permissions to change passwords is the Manager account. If you are wanting to reset the password for the Operator account, you need to associate a Privileged Account Credential to the password record - where the Privileged Account Credential is the Manager account |
| IBM IMM | 22 | None | Yes or No – See Notes | 1. When resetting passwords on IBM IMM cards, you must know the LoginID of the account you wish to reset passwords for. In order to use this script, you must configure Generic Field 1 on the PasswordList named as 'LoginID'. See IBM IMM Accounts in this documentation below for more information. |
| Juniper Junos | 22 | None | No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| Juniper NetScreen ScreenOS | 22 | None | Yes – See Notes | 1. The Privileged Account can be used to reset the root account, and any other non-root accounts |
| Linux | 22 | None | Yes or No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. See section Password Resets and Account Validation for Linux Root Accounts in this documentation below for more information. 3. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user 4. If your root account has SSH abilities, it will connect to the host and reset its own password. If SSH for root is disabled, you’ll need to assign a Privileged Account that will connect to the host and reset the root password. See section Password Resets and Account Validation for Linux Root Accounts in this documentation below for more information. 5. When resetting passwords for Mac OS X, no Privileged Account Credential is required, as OSX prevents one account from updating the keychain of another account 6. Public/Private Key authentication can also be used with the Privileged Account Credential to connect to the Host. See example in Section SSH Accounts with Public/Private Key Authentication in this documentation below for more information. 7. Please note that for 'root' accounts, the password value for the root account in Passwordstate must be correct before any password resets can occur. This means that if you are using a Linux Account Discovery Job, and a root account is discovered and added into a Password List, then you must edit the password record and make the following changes: - Untick the option 'Password Enabled for Resets' - Reset the password to the correct value save the record - Edit the record again, tick the 'Password Enabled for Resets', and save the record again |
| MariaDB | 3306 | None | No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| MS SQL Server | 1433 | None | Yes or No – See Notes | 1. Firewall allows access on SQL Server port – default port is 1433 for SQL Standard and above, and SQL Express can use a Dynamic Port – generally 49260 2. You must also have the TCP/IP Protocol enabled for SQL Server, and this can be done using the SQL Server Configuration Manager Utility, under the section SQL Server Network Configuration -> Protocols for <InstanceName>. Generally, this is not enabled for SQL Server Express 3. The Privileged Account Credential you are using to perform resets must have the ‘ALTER ANY LOGIN’ permission as minimum on order to perform resets. The Privileged Account Credential can be either an SQL Account, or an Active Directory Account - if an AD Account, the Username field must be in the format of domain\Username. If no Privileged Account Credential is being used, an SQL Account can change its own password without any special privileges required in SQL Server. 4. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 5. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| MySQL Server | 3306 | None | No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| Office 365 and Microsoft Entra ID | NA | 1. Azure Az PowerShell module – See section Office 365 and Microsoft Entra ID Accounts in this documentation below for more information. 2. Internet access | Yes or No – See Notes | 1. See section Office 365 and Microsoft Entra ID Accounts in this documentation below for more information. 2. Username in password record must be the Entra ID “User principal name” of the account being reset – See Password Record Examples section further down in this guide 3. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the Tenant and reset its own password 4. If you do assign a Privileged Account, this Privileged Account will connect to the Tenant and reset the passwor for the user |
| Oracle DB Server | 1521 | Oracle Data Access Components (ODAC) – See Section 4 in this documentation below for more information. | Yes or No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| Palo Alto | 22 | None | No – See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user 3. Public/Private Key authentication can also be used with the Privileged Account Credential to connect to the Host. See section SSH Accounts with Public/Private Key Authentication in this documentation below for more information. |
| PostgreSQL | 5432 | None | Yes or No: See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| SonicWALL | 22 | None | Yes or No: See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |
| Windows OS | 5985 or 5986 | None | Yes or No: See Notes | 1. PowerShell 3.0 or above required on Remote Host 2. PowerShell Remoting enabled on Remote Host 3. If you are performing resets Local Administrator Windows Accounts on Non-Trusted Active Directory Domains, or against WorkGroup computers, see section Account Discovery and Password Resets between Non-Trusted Domains, or against Workgroup Computers in this documentation below for more information. 4. If you edit the scheduled task and make a change, then you will need to confirm the current password when saving changes. Doing this removes the domain from the Scheduled Task and prevents Passwordstate from discovering it. Ensure you type in your username as domain\username when saving a Scheduled Task 5. Port 5985 uses HTTP and this is the default Powershell protocol. Port 5986 uses HTTPS and the -UseSSL parameter on all Invoke-Command cmdlets. Search Administration -> System Settings in Passwordstate for usessl to toggle this setting on or off. 6. Powershell traffic through HTTP is still encrypted, but HTTPS is an extra layer of security |
| VMWare ESXi | 443 | VMWare PowerCLI Powershell module – See section VMWare ESXi Accounts - PowerCLI Powershell Module in this documentation below for more information. | Yes or No: See Notes | 1. If you do not assign a Privileged Account on your password record for this account, the user will attempt to connect to the host and reset its own password 2. If you do assign a Privileged Account, this Privileged Account will connect to the Host and reset the password for the user |