The credential vault, rotation, proxied and recorded SSH and RDP sessions, just-in-time elevation, approvals and break-glass.
43 articles
Privileged access
The request, review and revoke workflow end to end: the exact states, the attestation an approver must write, and who can now actually approve one since safe-scoped, self-approval-refusing authorisation replaced the old role-attestation gate.
Privileged access
Enrol a workload as an Application identity — allowed safes, allowed account patterns, a rate limit — and let it fetch a secret at run time by certificate, IP or OS attestation.
Privileged access
Break-glass in Qorionix makes privileged access harder, not easier: two approvers instead of one. What it does, what it does not, and how to plan for an emergency.
Privileged access
Qorionix has no classic password checkout. What it has instead — request, approve, session, terminate — and why not seeing the password is the stronger pattern.
Privileged access
How scheduled rotation works, why the interval matters more than the password, what happens when a rotation fails, and the defect that once locked customers out.
Privileged access
Entra ID discovery is real and proven against a live tenant. AWS and GCP are built and unproven. On-premise SSH is not implemented, and says so rather than inventing a result.
Privileged access
Binding an approval workflow to a safe or your whole organisation, minimum approver counts and step timeouts, deleting a workflow, and why the requester and every other raiser of the same request can never approve it themselves.
Privileged access
There is no PAM-branded install screen. The enrolment token comes from the XDR endpoints dialog, one product option among several, on a host that needs rotation done locally.
Privileged access
Holding a credential for exclusive use, checking it back in, an administrator's force-release, and how this relates to the Master Policy exclusive access control.
Privileged access
Two things in the product are called JIT. One is the time-boxed grant that gates a privileged session. The other mints cloud tokens and is not reachable yet.
Privileged access
Let a pod fetch a vault secret by presenting its own Kubernetes ServiceAccount token, verified live against your cluster. Register the cluster from the console; one manual application-identity step remains.
Privileged access
Record the jump account an SSH session should authenticate as before elevating, and the services, scheduled tasks or config files that depend on a credential's password, from the console. Neither is enforced automatically yet.
Privileged access
Watching an active privileged session in real time — a redacted activity log, not video — sending a message to viewers, terminating from the viewer, and how it relates to session recording.
Privileged access
The seven organisation-wide privileged access controls, how a safe or platform exception can loosen one of them without changing your baseline, and the one exception scope that is accepted but not yet honoured.
Privileged access
The rules that decide who may open a privileged session, how long for, and with whose approval — plus the fields that are stored and never enforced.
Privileged access
Connect with mstsc, and the gateway signs in to the Windows server with a vaulted password you never see. What is recorded is an event transcript, not a video.
Privileged access
The gateway fetches the password from the vault and signs in to the server for you, so the person doing the work never learns it. How to connect, and the limits.
Privileged access
Restoring a credential that no longer matches what the vault holds, using a separate reconcile account rather than the credential authenticating as itself — and why it needs a rotation adapter already configured.
Privileged access
The Reveal action on a vaulted credential: a required reason, one-time use against an approved access request, the permission that skips needing one, and the full audit trail behind every reveal.
Privileged access
Export a privileged-access configuration, review proposed changes, and apply a policy file with a recorded result.
Privileged access
How Qorionix changes a Windows local password and an AD service account password over WinRM, what it cannot confirm afterwards, and what breaks.
Privileged access
AWS IAM access keys, RDS IAM tokens, Entra ID service principal secrets, Azure VM local accounts and GCP service-account keys. What each one really does, and which of them has never met a real tenant.
Privileged access
PostgreSQL, SQL Server, MySQL and Oracle rotation, what each engine needs, why most prove their own work, and what a connection pool does when the password changes.
Privileged access
The Linux engine changes a password over SSH and then signs in with the new one to prove it worked. Prerequisites, sudo, SSH key rotation, and what breaks.
Privileged access
How Qorionix changes the password on a Cisco IOS switch, a Palo Alto firewall, a Juniper Junos device, a FortiOS firewall, or a VMware vCenter appliance, and where each one has been tested.
Privileged access
The container every privileged credential lives in, the fifteen CyberArk-style permissions a member can hold, the default safe, and how safe membership decides who sees, uses or approves an account.
Privileged access
The Search tab on the Sessions screen finds a hit and opens it in the replay player at the matched moment — a best-effort seek that works well for SSH, not for RDP.
Privileged access
Every byte in both directions, in asciicast for terminals and parsed events for RDP, encrypted per session — with no secret redaction, a real player, and nothing yet to feed it.
Privileged access
Full-text search across every privileged session in your organisation: what a transcript contains, when it is written, who may read one, and the two things it does not do.
Privileged access
Qorionix records each machine's SSH host key the first time it reaches it, then refuses to connect if that machine ever presents a different one. How to confirm, and what a mismatch means.
Privileged access
The linux_ssh_key engine proves a new ed25519 key works before it removes the old one, and reports a partial success rather than an outage if cleanup fails.
Privileged access
The Sessions screen lists and terminates sessions; it does not start one. Today, starting a session is an API call — what it needs, and where the result shows up.
Privileged access
The read-only credential each cloud scanner needs, the exact permissions to grant, why the test checks permissions and not just sign-in, and what is never returned.
Privileged access
A target is the machine a privileged secret opens. The ten platform types, what connection detail each needs, and what the connection test really proves.
Privileged access
Give an outside technician access to a specific safe for a limited time, follow their sessions, and withdraw access when the work is finished.
Privileged access
Request a time-limited Azure or AWS role, follow approval and provider grant separately, and verify that access is removed after the work.
Privileged access
What the vault stores, the four credential types, how each secret is encrypted, and why losing the encryption key means the vault is gone for good.
Privileged access
Grant a host-local elevation — local admin, sudo, or a temporary ephemeral Windows account — through the PAM agent, with a per-host timeline and a revoke control.
Privileged access
See every host running the Qorionix PAM agent, check its status and recent tasks, and revoke it. Also covers outbound connector mode for a host with no inbound network path — an agent-side setting with no console switch.
Privileged access
Every platform Qorionix can rotate automatically, in one table, each pointing at the article with the actual prerequisites, failure modes and what has been tested.
Privileged access
Which credentials are out of compliance with the rotation your Master Policy requires, and why — including credentials whose one-time-password control has no schedule to run.
Privileged access
Requiring an open Jira or ServiceNow ticket before an access request can be created, resolved per organisation against your own connected instance, and what happens if you turn this on with nothing connected.
Privileged access
A handful of accounts in your business can do anything, everyone shares them, and nobody knows how old the password is. What a vault, rotation and proxying fix.