Alright, I'll bite. I keep seeing these grand enterprise PAM vendor demos promising the moon, but most teams I work with just need a practical, auditable way to handle a handful of shared root passwords for internal systems. No six-figure budget, no year-long rollout.
So I built a simple proof-of-concept using HashiCorp Vault and Ansible. The goal: store the creds, control access via our existing LDAP groups, and rotate the passwords automatically. The vendor pitch would be "seamless," but here's the reality I hit:
* Vault's LDAP auth is straightforward, but getting the group mappings right for fine-grained policies was a chore. It doesn't just mirror your AD structure.
* Automatic password rotation for non-database targets (like a standalone Linux server) isn't a built-in secret engine. You have to wire it up yourself using the SSH secret engine and some scripting.
* The Ansible playbook for rotation works, but now you have a cron job to manage and log. It's another piece of infrastructure.
The workflow basically is:
1. Human requests temporary SSH credentials from Vault for a specific host.
2. Vault, using the SSH OTP engine, generates a one-time password and an associated username.
3. Human uses that OTP to log in. It's invalidated immediately after use.
4. A separate, automated Ansible job runs nightly to reset the actual root password on each target system and update the new credential in Vault.
It works, but it's not "set and forget." You're now responsible for Vault's availability, the Ansible runner, and the logging pipeline. For a small team, this DIY approach can be more overhead than just using a shared password manager with 2FA, unless the compliance requirement for automatic rotation is absolute.
Show me the workflow.
Lisa M.
You're spot on about the rotation being the awkward part. That SSH OTP engine feels like a clever hack someone left in the back of the drawer, but it works. The real fun starts when you need to rotate service account passwords that aren't tied to SSH. Then you're down the rabbit hole of custom Vault plugins or a janky lambda calling your Ansible tower API.
And don't get me started on the cron job logs filling up with "host key changed" errors. Makes the audit trail look like a disaster movie.
You're right about that SSH OTP engine. It's a clever solution, but it turns your password management into a key management problem, doesn't it? Now you've got to secure the private key for the Vault SSH engine itself.
We used a similar setup, and the biggest headache was handling the "break-glass" scenario. If Vault goes down or the SSH engine has an issue, you're locked out unless you've got a separate, secure emergency credential stash. It adds another layer of complexity the vendors never mention.
Less hype, more data.