implementing-delinea-secret-server-for-pam

name	implementing-delinea-secret-server-for-pam
description	Implements Delinea Secret Server for privileged access management, covering secret vault configuration, role-based access policies, automated password rotation, session recording, and Active Directory/cloud integration. Use when centralizing privileged credential management, replacing spreadsheet-based secrets, automating password rotation, or meeting PAM compliance (SOX, PCI-DSS, HIPAA, NIST 800-53).
domain	cybersecurity
subdomain	identity-access-management
tags	["PAM","Delinea","Secret-Server","privileged-access","password-vault","credential-management"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]
mitre_attack	["T1078","T1110","T1556","T1098","T1003"]
mitre_f3	{"version":"1.1","tactics":["reconnaissance","initial-access","positioning"],"techniques":[{"id":"T1555.005","name":"Credentials from Password Stores: Password Managers","tactic":"reconnaissance","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"}]}

Implementing Delinea Secret Server for PAM

When to Use

• Organization needs centralized privileged credential management across hybrid infrastructure
• Compliance requirements mandate privileged access controls (SOX, PCI-DSS, HIPAA, NIST 800-53)
• Service accounts and shared credentials are stored in spreadsheets or plaintext files
• Need to implement automated password rotation for privileged accounts
• Require session recording and keystroke logging for privileged user activity
• Migrating from manual PAM processes to an enterprise vault solution

Do not use for standard end-user password management; Delinea Secret Server is designed for privileged and shared account credential management requiring enterprise-grade controls.

Prerequisites

• Delinea Secret Server license (On-Premises or Cloud)
• Windows Server 2019/2022 for on-premises deployment with IIS and SQL Server
• Active Directory service account with read permissions for discovery
• SSL/TLS certificate for web interface encryption
• Network connectivity to target systems for password rotation
• PowerShell 5.1+ for automation scripts

Workflow

Step 1: Deploy Secret Server Infrastructure

Install and configure the Secret Server application server:

# Pre-installation checks for on-premises deployment
# Verify IIS is installed with required features
Import-Module ServerManager
Install-WindowsFeature Web-Server, Web-Asp-Net45, Web-Windows-Auth, Web-Mgmt-Console

# Verify SQL Server connectivity
$sqlConn = New-Object System.Data.SqlClient.SqlConnection
$sqlConn.ConnectionString = "Server=sql01.corp.local;Database=master;Integrated Security=True"
$sqlConn.Open()
Write-Host "SQL Server connection successful: $($sqlConn.ServerVersion)"
$sqlConn.Close()

# Create Secret Server database
Invoke-Sqlcmd -ServerInstance "sql01.corp.local" -Query @"
CREATE DATABASE SecretServer
GO
ALTER DATABASE SecretServer SET RECOVERY FULL
GO
"@

# Download and run Secret Server installer
# Navigate to https://thy.center/ss/link/SSDownload for latest version
# Run setup.exe and follow the installation wizard

# Post-installation: Configure application pool
Import-Module WebAdministration
Set-ItemProperty "IIS:\AppPools\SecretServer" -Name processModel.identityType -Value SpecificUser
Set-ItemProperty "IIS:\AppPools\SecretServer" -Name processModel.userName -Value "CORP\svc-secretserver"

Step 2: Configure Secret Templates and Folder Structure

Define secret templates and organize the vault hierarchy:

# Connect to Secret Server API
$baseUrl = "https://pam.corp.local/SecretServer"
$creds = @{
    username = "ss-admin"
    password = $env:SS_ADMIN_PASSWORD
    grant_type = "password"
}
$token = (Invoke-RestMethod "$baseUrl/oauth2/token" -Method POST -Body $creds).access_token
$headers = @{ Authorization = "Bearer $token" }

# Create folder structure for organizing secrets
$folders = @(
    @{ folderName = "Windows Servers"; parentFolderId = -1; inheritPermissions = $false },
    @{ folderName = "Linux Servers"; parentFolderId = -1; inheritPermissions = $false },
    @{ folderName = "Network Devices"; parentFolderId = -1; inheritPermissions = $false },
    @{ folderName = "Cloud Accounts"; parentFolderId = -1; inheritPermissions = $false },
    @{ folderName = "Service Accounts"; parentFolderId = -1; inheritPermissions = $false },
    @{ folderName = "Database Accounts"; parentFolderId = -1; inheritPermissions = $false }
)

foreach ($folder in $folders) {
    Invoke-RestMethod "$baseUrl/api/v1/folders" -Method POST -Headers $headers `
        -ContentType "application/json" -Body ($folder | ConvertTo-Json)
}

# Create custom secret template for database credentials
$template = @{
    name = "Database Credential"
    fields = @(
        @{ name = "Server"; isRequired = $true; fieldType = "Text" },
        @{ name = "Port"; isRequired = $true; fieldType = "Text" },
        @{ name = "Database"; isRequired = $true; fieldType = "Text" },
        @{ name = "Username"; isRequired = $true; fieldType = "Text" },
        @{ name = "Password"; isRequired = $true; fieldType = "Password" },
        @{ name = "Connection String"; isRequired = $false; fieldType = "Notes" }
    )
}
Invoke-RestMethod "$baseUrl/api/v1/secret-templates" -Method POST -Headers $headers `
    -ContentType "application/json" -Body ($template | ConvertTo-Json -Depth 3)