01 Set up credentials and connectivity policies

[ Applies to ] StorageGuard 9.2.8 and later  /  All supported storage, backup, SAN and cloud systems  /  Windows and Linux deployments

StorageGuard needs two things before it can sign in to a system. A credential is the account it signs in with. A connectivity policy says how it connects: which protocol, which credential, and whether to go through a proxy or use sudo. You create credentials first, then the policies that use them. Every data source and host you add references one connectivity policy, so one policy can serve many systems that connect the same way.

StorageGuard only needs read-only access: it runs queries, commands and API calls that read configuration, and never changes it.

Choose a credential type

Pick the type that matches how the target system authenticates, or where the password is stored.

Credential type	Use it for
Username and password	Most storage systems, hosts and databases.
SSH public key	Systems that require SSH key authentication.
Cyber-Ark	Passwords managed in CyberArk through the agent-based Credential Provider.
Cyber-Ark CCP	Passwords and certificates managed in CyberArk through the Central Credential Provider API.
Hashicorp	Credentials managed in HashiCorp Vault.
Hashicorp Vault (Token)	Tokens managed in HashiCorp Vault.
Cloakware	Credentials managed in CA Privileged Access Manager (formerly Cloakware).
Kerberos V5	Linux hosts that authenticate with Kerberos.
Rotating Password	SSH accounts whose password StorageGuard changes automatically.
AWS access keys	AWS accounts. Enter the access key and secret.
Azure Access Keys	Azure accounts. Enter the access key and secret.
Storage Protect	IBM Storage Protect hosts and the dsmadmc administrative client.
Group Managed Service Accounts (gMSA)	Windows-based storage or backup systems that use gMSA.
Cloud Scale	Hitachi HCP for Cloud Scale.
Networker	Dell NetWorker.

Add a credential

1. Go to Settings > Scan > Authentication > Credentials.
2. Click +.
3. Select the Credential type.
4. In Name, enter a name that identifies the account and where it's used, for example PowerStore read-only (Boston). You pick credentials by this name later.
5. Enter the user name and password, or the fields your credential type requires. For rotating passwords and Kerberos, see the extra settings below.
6. Click Save. The credential appears in the credentials list.

Extra settings for rotating passwords

Set Password expiration to Each Scan to change the password every time StorageGuard scans the host, or to a number of days.

Extra settings for Kerberos V5

Field	What to enter
KDC	The Key Distribution Center to use, for example a Microsoft domain controller.
Realm	The Kerberos realm or Active Directory domain.
Keytab	The path to the keytab file on the StorageGuard server. If you use a keytab, leave Password blank.
Username	The account name.
Password	The password, entered twice. Leave blank if you use a keytab.

Decide what the connectivity policy needs

Component	Required	When you need it
Protocol	Yes	Always. StorageGuard connects over secure protocols such as SSH, HTTPS and WinRM. Automatic Protocol is the default and recommended setting.
Credential	Yes	Always.
Proxy	No	When StorageGuard must reach systems through a hardened jump server or an outbound proxy instead of connecting directly.
Sudo	No	When the account isn't an administrator and must run privileged read-only commands, for example on Linux hosts or Dell PowerScale. Not needed with an administrative account.

If you need a proxy or sudo, add it first so you can select it in the policy. Otherwise, continue below.

Create the connectivity policy

1. Go to Settings > Scan > Authentication > Policies.
2. Click +.
3. In Name, enter a name that describes how the policy connects, for example HTTPS – PowerStore read-only or SSH + sudo – Linux via jump server.
4. Select the Protocol. It's recommended to keep the default Automatic Protocol setting.
5. If you need them, select a Proxy and a Sudo configuration.
6. Select the Credential.
7. Click Save.

Edit or delete credentials and policies

• Credentials: in Settings > Scan > Authentication > Credentials, double-click a credential to edit it, then click Save. To delete one, right-click it and select Delete.
• Connectivity policies: in Settings > Scan > Authentication > Policies, right-click a policy and select Edit or Delete, then confirm.
• Proxies and sudo configurations: edit or delete them the same way on the Connectivity Methods page.

Add a proxy (optional)

1. Go to Settings > Scan > Authentication > Connectivity Methods.
2. In the top-left corner, select Proxy.
3. Click +.
4. Enter the proxy's name, IP address, protocol and credential.
5. Click Save. The proxy appears in the proxy list.

Then select the proxy when you create the connectivity policy, or edit an existing policy to add it.

Add a sudo configuration (optional)

A sudo configuration lets a non-root account run the privileged read-only commands a scan needs, without full root access.

1. Go to Settings > Scan > Authentication > Connectivity Methods.
2. In the top-left corner, select Sudo.
3. Click +.
4. Enter the following, then click Save.

Field	What to enter
Name	A name you'll recognize when you build the policy.
Path	The path to the sudo binary on the target system.
Credential	The credential sudo runs with.
PTY	Select this if the target system only allows interactive SSH sessions.

Then select it when you create the connectivity policy, or edit an existing policy to add it.

Related articles

• StorageGuard Integration with CyberArk
• Configuring HashiCorp Vault in StorageGuard
• Add a data source
• StorageGuard Scan Requirements