- 📑
Getting Started
- About senhasegura
- Use Cases
- Technical specification
- senhasegura Installation
- Architecture
- Virtual Appliances
- Crypto Appliance
- Deploy on cloud provider
- Firewall rules
- Administrative users
- How to activate the senhasegura license
- How to set up the network and change the hostname
- How to accept the End User License Agreement
- Backup
- Data Replication
- How to enable the application
- Update senhasegura
- Troubleshooting
- Basic Usage
- 📣 News
- ⚙️
Settings
- Explanation
- About Active Directory
- About Segregated Entities and Their Properties
- About User Groups
- About Related Users
- About the Access Control Layer
- About the Master Key
- About OpenID
- About LDAP/AD servers
- About senhasegura's ITSM integration
- About the Notifications
- About the authentication process with Active Directory
- About SAML
- How-to guides
- Information about settings
- User management
- Authentication
- Notifications
- Backup
- SSH
- Integrations with ticket systems
- How to manage integrations with ticket systems
- How to configure a Freshdesk integration on senhasegura
- How to configure the integration with CA Service Desk Manager in senhasegura
- How to configure GLPi integration in senhasegura
- How to configure Zendesk integration in senhasegura
- How to configure Jira Service Desk integration in senhasegura
- How to configure ServiceNow integration in senhasegura
- How to manage approver users
- How to manage bulk actions requests
- How to configure the logo in senhasegura
- Reference
- LDAP/AD
- E-mail notifications
- System Parameters
- Users management
- Services
- Multi-factor authentication
- User authentication tokens
- Export history
- Protected Informations
- Master Key
- Servers
- View Master Key
- Credentials
- Bulk operations report
- Backup Logs
- Identity management providers (IGA)
- Notifications
- List notifications
- My Notifications
- Notification texts
- OpenID providers
- Types of providers
- Providers
- Provider by user
- RADIUS server
- SAML providers
- Screen notification parameters
- SIEM
- Sent notifications
- Synchronized users
- Synchronized users for IGA
- System Parameters
- User authentication tokens
- TACACS servers
- Explanation
- 📦
senhasegura 360
- PAM Core
- Credential Management
- Devices
- Explanation
- How-to guides
- How to perform a batch import
- How to download the template file for batch import
- How to use the “Bulk Action” feature for devices
- How to approve bulk actions requests
- How to configure a device
- How to manage devices
- How to manage devices without credentials
- How to configure device categories
- How to download a local connection file for Putty and Remote Desktop
- How to check the device connectivity
- How to consult device logs
- Reference
- Credentials
- Explanation
- How-to guides
- How to setup up a credential in senhasegura
- How to register an application credential
- How to create a credential policy
- How to create a pool of credentials
- How to use domain credentials
- How to register password strength
- How to use the "bulk action" feature for credentials
- How to verify the execution history of a credential
- How to reconcile a credential
- How to configure a reconciliation credential
- How to generate a TOTP authentication token
- How to use MFA authentication with YubiKey
- How to configure a JIT credential in senhasegura
- How to connect using a JIT credential
- How to set up an SSH key
- How to perform remote access with SSH key
- How to manage SSH keys
- Reference
- Reference for access control reports
- Reference for credentials
- Reference for credential types
- Reference for domain credentials settings
- Reference for password strength
- Reference for pool of credentials
- Reference for credential policies
- Reference for credential management
- Reference for credential filtering
- Reference for JIT credentials
- Devices
- Session Management
- Explanation
- PAM Dashboard
- Session Actions
- Remote Session
- Session text
- Transfered files
- Blocked users
- PAM - Access Group
- Access Request Worlfow
- Exceptional Access
- Remote Session Configuration
- Personal Credential
- Audit
- Video Session
- senhasegura Proxy
- Database Proxy
- About Oracle wallet
- About compatibility with legacy MS SQL Server
- How-to guides
- How to configure senhasegura Database Proxy
- Database Proxy for Oracle - Setup guide
- Oracle Stand Alone Environment
- How to create the Oracle DB server Wallet
- How to generate the database credential’s certificate and key
- How to create a senhasegura user wallet
- How to configure the Oracle server to use wallet authentication
- How to configure a device in senhasegura to use the Database Proxy with Oracle
- How to configure a credential in senhasegura to use the Database Proxy with Oracle
- How to configure IDEs for the end user to connect to Oracle DB
- Oracle Cluster Environment with grid infrastructure
- How to configure the wallet for Oracle in a cluster with grid infrastructure
- How to create a senhasegura user wallet
- How to configure a device in senhasegura to use the Database Proxy with Oracle
- How to configure a credential in senhasegura to use the Database Proxy with Oracle
- How to configure IDEs for the end user to connect to Oracle DB
- How to collect the senhasegura user certificate
- Oracle Stand Alone Environment
- MS SQL Server sessions
- PostgreSQL sessions
- Oracle sessions
- How to start a Database Proxy Oracle session with DBeaver on Linux
- How to start a Database Proxy Oracle session with DBeaver on Windows
- How to start a Database Proxy Oracle session with SQL Developer on Linux
- How to start a Database Proxy Oracle session with SQL Developer on Windows
- How to start a Database Proxy Oracle session with SQL Plus
- How to modify Database Proxy port number
- Web Proxy
- About Customize settings - Web sessions parameters
- About HTTP web sessions
- How-to guides
- How to register a new web session parameter
- How to access a Web Proxy session
- How to transfer or download a file in HTTP Web Proxy sessions
- How to transfer files between Web HTTP/HTTPS sessions
- How to transfer a file over RDP Web Proxy sessions
- How to perform a PDF download in HTTP/HTTPS Web Proxy sessions
- Reference
- RDP Proxy
- About Encryption Keys - RDP Proxy
- About RDP RemoteApp
- About security settings for RDP Proxy and RemoteApp
- How-to guides
- How to connect to a remote device with RDP Proxy
- How to make an RDP Proxy connection using Multihop
- How to transfer files in RDP Proxy sessions
- How to configure Kerberos authentication for RDP sessions on Windows Server
- How to configure authentication via Kerberos for RDP sessions in senhasegura
- How to use a .rdp file to start a remote session
- Terminal Proxy
- About Encryption keys - Terminal Proxy
- About senhasegura Terminal
- How-to guides
- How to make an SSH connection via Terminal Proxy
- How to make an SSH Multihop connection via Terminal Proxy
- How to make a TELNET connection via Terminal Proxy
- How to transfer a file in Terminal Proxy sessions using SFTP
- How to transfer a file in Terminal Proxy sessions using SCP
- How to set up SSH SOCKS Tunnel for private browsing
- RemoteApp
- Troubleshooting
- Citrix Virtual Apps and Desktops
- How-to guides
- How to install Citrix Bridge Server using Docker container
- How to install Citrix Bridge Server using senhasegura Extended Services OVA
- How to add Citrix Bridge Server as a device
- How to add a RemoteApp to Citrix Bridge Server
- How to add Citrix Bridge Server credential
- How to access a Citrix desktop or application
- How-to guides
- Use cases
- Credential Management
- DevOps Secret Manager
- Explanation
- About the Secrets management dashboard
- About access control
- About applications and authorizations per application
- About authenticators in DSM
- About CI/CD
- About dynamic provisioning
- About encryption keys
- About events in DSM
- About plugins in DSM
- About secrets in DSM
- About the CI/CD variables dashboard
- About profiles on dynamic provisioning
- About the Application dashboard
- How-to guides
- How to manage authorizations per application
- How to manage an application
- How to manage secrets
- How to manage dynamic provisioning in DSM
- How to use bulk actions for secrets
- How to create and manage encryption keys
- How to use a DSM automation to inject a secret
- How to manage DSM automations
- How to configure authenticators
- Hot to use DevOps Secret Manager CLI
- How to integrate DSM with Azure DevOps
- How to integrate DSM with GitHub Actions
- How to integrate DSM with GitLab CI/CD
- How to integrate DSM with Jenkins
- How to integrate DSM with Kubernetes
- How to manage access groups
- How to manage API settings
- How to manage lines of business
- How to manage application types
- How to manage environments
- How to manage systems
- Reference
- Reference for API Logs
- Reference for DSM Audit Tracking
- Reference for bulk actions
- Reference for dynamic provisioning profiles
- Reference for DSM executions
- Reference for secrets
- Reference for credentials
- Reference for application
- Reference for authorization by application
- Reference for Encryption Keys
- Reference for CI/CD variables
- Reference for CI/CD deploys
- Reference for executions
- Reference for DSM automations
- Reference for access groups
- Reference for My approvals
- Reference for My requests
- Reference for API settings
- Reference for lines of business
- Reference for application types
- Reference for environments
- Reference for systems
- Explanation
- Domum Remote Access
- Overview
- Architecture and Domum gateway regions
- License activation
- Administrator
- About Domum user nomenclature
- Dashboards
- Request Access
- Reports
- Access control
- Settings
- Third party-user
- Internal user
- Remote users
- GO Endpoint Manager
- General introduction
- Control panel report
- Dashboard report
- Automation report
- About automation
- How to clone or edit an automation
- How to enable or turn off an automation
- How to create web authentication automation for general segregation
- How to create web authentication automation for workstation segregation
- How to create a RemoteApp type automation on GO Windows
- Automation use case
- Workstation report
- User report
- Application report
- Uninstallers report
- Go for Windows
- About the new GO Endpoint Manager
- Windows
- Introduction Windows
- Architecture
- GO for Windows Agent
- Installation
- Execute
- Control Panel
- Approval workflow
- Network Adapters
- Network Sharing
- Uninstall
- Segregated parameters
- System parameters
- Permission
- Application access lists
- Automation access lists
- Uninstaller access lists
- Privilege elevation block
- Directory and file control
- DLL blocking
- Trusted directories
- Impersonation
- GO Shell
- JIT Access
- Offline mode
- Token MFA OTP
- Application access lists
- Single Sign-On (SSO)
- Directory and file scan
- Network access blocking
- UAC integration
- Automatic update
- Session recording
- Malware analysis
- Reports
- About parent and child processes
- FAQ
- Troubleshooting
- Troubleshooting: API Authorization Error When Trying to Open the Agent
- How permissions management and application dependencies affect senhasegura.go
- Installation error messages
- Go Endpoint Manager for Windows flagged as a threat in antivirus scanners
- Applications in the control panel don't elevate privilege
- Linux
- Introduction Linux
- Getting started
- Agent installation
- Access policies
- Rules for sudo
- DAC permission
- Reports
- System parameters
- Session recording
- Troubleshooting
- Certificate Manager
- Getting started
- Certificates workflow
- Cloud certificates workflow
- Additional settings
- How to make action requests
- How to manage your approvals
- How to download the CSR and key
- How to download the certificate and key
- How to retrieve the certificate passwords
- How to link devices to a certificate
- How to set up a certificate pool
- How to automate the lifecycle of a certificate
- How to configure receiving notifications
- How to generate random certificates
- Reference
- Use case
- Cloud IAM
- Executions
- Introduction Executions
- Executors
- Templates
- Operations
- Attempt Parameters and triggers
- Profiles
- Chained operation automation
- Password change
- How to configure a password change
- Password change example
- How to change a domain user's permission in AD
- How to change a domain user's password in AD
- How to change a password with Kerberos authentication for Windows RM
- How to change a password with NTLM authentication for Windows RM
- SSH Keys rotation
- How to change SSH keys
- How to setup SAP password change
- Credentials execution profiles
- How to create a credential profile
- How to change passwords using Tk Expect for Oracle databases
- Examples
- Discovery
- MySafe
- Reference
- Passwords
- API secrets
- Files
- Notes
- Sharing center
- Batch import
- Audit
- Access control
- Integrations
- Admin
- MySafe extension
- Task Manager
- Load Balancer
- Arbitrator
- senhasegura mobile app
- Orbit Config Manager
- Monitoring
- Orbit CLI
- Explanation
- How-to guides
- How to change default passwords
- How to configure backup
- How to perform disk management
- How to check the senhasegura version
- How to configure network interfaces
- How to manage the firewall
- How to manage proxy settings
- How to set the hostname
- How to check the instance's health
- How to manage the application
- How to configure instance location
- How to manage the cluster
- How to configure NTP servers
- How to configure Domum Gateway
- How to manage operating system services
- How to configure DNS servers
- How to enable proxy or loadbalancer IPs
- How to configure remote partitions
- How to perform manual execution of senhasegura services
- How to shutdown or restart the server
- How to configure SNMP monitoring
- How to manage repositories with Orbit CLI
- How to login with certificates
- How to manage web application SSL certificate
- How to update the solution
- How to run the Discovery cleaning procedure
- How to configure Zabbix via Orbit CLI
- How to tuning the environment
- Reference
- Orbit Web
- Explanation
- How-to guides
- Reference
- Reference for Panel
- Reference for Application settings
- Reference for Application backup settings
- Reference for Recovery
- Reference for Replication settings
- Reference for Replication status
- Reference for Data search cluster
- Reference for Tokens
- Reference for Application versions
- Reference for Licenses
- Reference for Incidents
- Reference for System updates
- Reference for Eula
- Reference for Server settings
- Reference for Server information
- Reference for Disk and partition
- Reference for Services
- Reference for Certificates
- Reference for Backup Recovery
- Reference for Security
- Reference for Tuning system
- Reference for Orbit incidents log
- Reference for Logs
- Reference for Access proxy settings
- Reference for Proxy Services
- Reference for API - Proxy requests
- Reference for API - PEDM Windows
- Reference for API - PEDM Linux
- Reference for Application activation
- A2A
- Network Connector
- Explanation
- How-to guides
- How to install Network Connector
- How to configure devices on Network Connector
- How to configure Network Connector agents
- How to update the Network Connector agent
- How to use the Network Connector dashboard
- How to install the Network Connector agent on Google Cloud
- How to install the Network Connector agent on Microsoft Azure
- Reference
- Protected Information
- User Behavior
- Reports
- Dashboards
- PAM Core
- ☁️
Cloud Products
- Changelogs
- Cloud Security
- Cloud Entitlements
- Explanation
- Reference
- How-to
- How to access auditing details
- How to connect an AWS account
- How to connect an AWS organization
- How to connect a Google Cloud Platform project
- How to connect a Google Cloud Platform organization
- How to connect an Azure tenant
- How to connect an Oracle Cloud account
- How to customize Security policies
- How to view an identity’s information
- How to view recommendations
- senhasegura SaaS
- 💻 senhasegura APIs
- Other information
- Other versions
How to manage the master key
In this document, you’ll find a step-by-step guide on how to configure the Master Key in senhasegura.
Requirements
- Have a System Administrator role.
Define master key
To define the master key, you should follow the steps below:
This step is also called the Master Key Ceremony.
- On senhasegura, in the upper-left corner, click the Grid Menu, represented by nine squares, and select Settings.
- In the side menu, select Backup > Set master key.
- When you click on Set master key, the Master key definition window will open.
- In this window, fill in the following fields:
- Number of parts to Restore: indicates the number of parts needed to recover the master key.
- The minimum number of parts is 2, and the maximum is 10.
- Guardians: from the drop-down menu, select the user who should be one of the guardians of the Master Key.
- To add more Guardian users, click on the plus sign next to the word Add above the Guardians drop-down menu.Info
A recommended practice is to select between two and three times more guardians than key parts.
- To add more Guardian users, click on the plus sign next to the word Add above the Guardians drop-down menu.
- Number of parts to Restore: indicates the number of parts needed to recover the master key.
- Click on Generate New Key.
The electronic vault's master key is used to encrypt backup files created by the application. These files are encrypted using the AES algorithm with a 256-bit key and can be decrypted using the AESCrypt application.
Set a new master key
If necessary, you can redefine the Master Key. To redefine the Master Key, you have two paths:
Master key ceremony report
- In senhasegura, in the upper left corner, click on Grid Menu, represented by nine squares, and select Settings.
- In the side menu, select Backup > Master Key Ceremony.
- In the Set key ceremony report, click on Define new master key.
Set a new master key
- On senhasegura, in the upper-left corner, click on Grid Menu, represented by nine squares, and select Settings.
- In the side menu, select Backup > Define master key.
In both cases, the Master key definition window will open. When you define a new master key, however, you have an additional session in this window. To redefine the master key, follow the steps below:
- In the Current key session:
3. Key mode select whether you want to use Parts or Complete Key for your Master Key. In this case, the Master Key field is locked.
4. Complete Key: if you choose the Complete Key option, you must fill in the Master Key field with the master key's value. In this case, the Key Parts field is locked.InfoTo access the complete key, you must join the key parts at https://breakglass.senhasegura.com/. For more information, see the Restore master key section at the end of this document.
- Key Parts (one per line): if you choose the Parts option, you must fill in, in this field, which are the parts that make up the Master Key. Each part should be placed on a separate line. In this case, the Master Key field is locked.
- In the New key session you can follow the same instructions on the previous session of this document.
- Click on Generate New Key.
Information about the Guardian user
- These users will be informed by email, notification, or SMS that they have been chosen to guard one of the key parts, so it’s important that the selected Guardians have at least their emails registered in the system.
- The user cannot be the guardian of more than one part of the key.
Monitor the progress of the master key ceremony
It is possible to monitor the progress of the Master Key Ceremony. To do this, follow the steps below:
To finalize the Master Key Ceremony process, the guardian user must view and/or download the .pdf
file containing the master key.
- Access, through the side menu, Settings > Backup > Master key ceremony.
- In the Master key ceremony report, you can follow the process.
- The fields are:
- Name: indicates the name of the user, as registered in senhasegura.
- Phone: indicates the user's phone, as registered in senhasegura.
- Email: indicates the user's email address.
- It is important that the user has an email registered in senhasegura to receive the guardian notification.
- Ceremony: indicates the state of the master key ceremony. It can assume the values Pending or Finished.
- User status: indicates the user's status within senhasegura. It can assume the values Enabled or Disabled.
- Last login: indicates the date and time of the user's last login. It is displayed in the format
DD/MM/YYYY HH:MM:SS.
- Last part view: indicates the date and time of the user's last view in relation to the key part they are guardian of. It is displayed in the format
DD/MM/YYYY HH:MM:SS.
- Last part download: indicates the date and time of the last download made by the user of the key part they are guardian of. It is displayed in the format
DD/MM/YYYY HH:MM:SS.
- On the left side of the report, you find information about the master key ceremony. The information is:
- Status: indicates the overall status of the ceremony. The status is only completed when all guardian users have viewed and/or downloaded their part of the master key. It can assume the values Pending or Finished.
- Parts to restore: indicates how many parts are needed for the restoration of the master key.
- Start: indicates the date and time of the start of the master key ceremony.
- End: indicates the date and time of the end of the master key ceremony. If it has not yet been completed, the field will show only
--
. - Set new master key: link to define a new master key. Opens the Master key definition window to restart the process.
View master key parts
Each guardian should access their account in senhasegura to view their part. If a guardian happens to have an inactive status, the system will report it as an incident via Orbit Web and SYSLOG, displaying an alert message about the guardian's inactive status and suggesting that the master key ceremony procedure be redone.
By default, to view a part of the Master Key, the Guardian user must have MFA authentication configured. To turn off this requirement, go to Grid Menu > Settings > System Parameters > System Parameters > Application and, in the Master key ceremony section, select No for the option MFA required for master key ceremony?.
Disabling MFA authentication for viewing the master key reduces the security of your vault.
To view a key, as a Guardian user, follow the steps below:
- On senhasegura, in the upper-right corner, click on the user's name and, in the drop-down menu, select Master Key.
- In the Master Key window, you have the following fields:
- Name: indicates the part of the key that the user is a guardian of. It’s informed according to the pattern
Key part number 1
. - Generation: indicates the date the part was generated. It is presented in the format
DD/MM/YYYY HH:MM:SS
. - Query: indicates the date and time the query was made. It is presented in the format
DD/MM/YYYY HH:MM:SS
.
- Name: indicates the part of the key that the user is a guardian of. It’s informed according to the pattern
- Below the informative fields, there are three buttons:
- View part: displays the part of which the user is a guardian.
- When clicking on View part, the Password visualization modal is opened. To view the part, slide the Contrast control located at the bottom of the modal.
- Copy part: copies the part in question to the clipboard.
- Download file: download the file, in
.pdf
format, containing the key part.
- View part: displays the part of which the user is a guardian.
Restore master key
Once the Master Key Ceremony is finished, it is possible to perform the restoration process. To do this, follow the steps below:
- Gather the guardians and access the Combine secret link.
- In the Parts of key text field, enter the key parts, obeying the order.
The key parts should be entered as in the example:
1-dbfcc9e0fef3542c6fe5494aerr284h
2-dbfcc9e0fef3542c6fe5494ae45284g
- In the Total number of parts field, indicate the total number of parts that key has.
- In the Number of parts to Restore field, indicate the number of parts needed to restore the master key.
- Click on Recover Key to restore the master key.
Do you still have questions? Reach out to the senhasegura Community.