Vault: Enable Password Rotation

Enabling password rotation for credentials in Vault enhances security by automating password changes on associated resources.

Prerequisites:

• The credential must be registered in Vault.
• The credential must be linked to a server in Vault.

Enabling Password Rotation

1. Log in to your Vault platform.
2. Go to Credentials.
3. From the list, select the credential you want to edit.
4. On the credential's edit screen, select the Password Rotation tab.
5. Select the Enabled checkbox to set password rotation for this credential.
6. Select the target resource (computer or server) on which this password will be rotated.
7. Click Save.

Network requirements

Before installing the rotation script, make sure the target server can reach the PAM Platform API over port 443. The script uses this connection to authenticate and to submit the rotated password back to the platform.

• US Data Center: *.api.vault.jumpcloud.com:443
• EU Data Center: *.api.vault.eu.jumpcloud.com:443
• India Data Center: *.api.vault.in.jumpcloud.com:443

If this outbound connection is blocked, the rotation script will fail even if the credential and server configuration are correct.

Installing Rotation Scripts on the Target Computer

After you enable password rotation in Vault, you must install the necessary script on the target computer. These scripts act as agents, allowing Vault to communicate with the operating system and perform password updates.

• For Windows environments - Vault: Configure Password Rotation for Windows Servers
• Linux/Unix environments - Vault: Configure Password Rotation for Linux and Unix Servers