Device Groups Properties

some kron pam features are managed via device groups the features are activated by defining the device group properties to set the property for device group 1\ navigate to devices > inventory 2 click on the +add button and select the add group option 3 fill out the device group name and description fields and click next 4 set the preferred properties (i e direct credential, additional credentials, or custom properties ) property key definition adddevicesshkeytouserselection this property only applies to devices imported from aws (amazon web services) if the value is set as true , connecting to devices with an ssh key is offered as a connection option this property can be used when the following conditions are set the sshkeyname and the sshusername property keys should be defined in the device properties for preferred devices the ssh private key corresponding to the sshkeyname in the device property should be defined in the sapm addmanuallogintouserselection this property applies to ssh/telnet and rdp/vnc proxies in the session manager module the default value is false when the value is set as true , the user can manually enter the device username and password at the start of the session addsessionusertouserselection this property only applies to ssh/telnet and rdp/vnc proxies in the session manager module when the addsessionusertouserselection property is set as true on a device group, users can connect to target devices in the device group using their username to log in to kron pam approvalrequiredforconnection this property only applies to ssh and rdp proxies in the session manager module when its value is set as true , managerial approval is requested via email for users to connect to devices in the device group globalenablepassword this property only applies to the tacacs+ access manager module bot/script users need to use a common password to switch to enable mode in scripts the globalenablepassword property allows the definition of a common password for a device group, to be used when the enabled password is prompted globalpassword it is the password of the globalusername the password is to be used when connecting to all devices covered by the device group globalsecretkey this property only applies to the tacacs+ access manager module the secret key to be used when authenticating all devices covered by the device group to tacacs+ servers it is a mandatory property when using the tacacs+ access manager globalsshkey this property only applies to ssh proxies in the session manager module if connecting to the device with an ssh key is preferred, globalsshkey should be defined for the device group globalsshkeypassphrase this property only applies to ssh proxies in the session manager module if the device to be connected to has an ssh passphrase, globalsshkeypassphrase should be defined for the device group globalusername the username is to be used when connecting to all devices covered by the device group this username must be pre defined as a user on all devices in the device group sapmmaillist the sapmmaillist is notified when the following situations occur in sapm • when a user retrieves a password for an sapm account included in the device group • if an error occurs during the password reset of an sapm account included in the device group • if the password cannot be verified while checking the password of an sapm account included in the device group • if a new user is detected on a device that has an sapm account included in the device group sessionplayalertmailaddresses users can enter one or more email addresses separated by commas in this parameter to specify where the alert notifications when someone views a "play session" in the "session logs should be sent showindevicetree this property is used along with the useasrolegroup property when its value is set as false , the device group cannot be seen in the device inventory screen once devices are authorized with the main device group, this property can be set for the device group after that, users cannot see this device group in their device inventory users with the same authorization level as the device group, defined by the group role, can still only see the other device groups tag discoverinterfacetype when importing devices from cloud platforms, the management ip is set according to the values of the defined property possible values are public and private the default value is private useasrolegroup some devices can be defined in multiple device groups in this situation, device authorization can be defined in one device group the useasrolegroup device group property value must be set as true for the device group in which authorizations are managed with policy enforcement, such as the black key/white key usesudoforlinuxauditreport this property only applies to the linux audit report feature the default value is false if the globalusername defined on the device group is sudo user and the sudo command execution is required to get report details, the property must be defined as true on the device group addassignedcredentialtouserselection the default value is false when the value is set as true, the users can use their assigned credentials in the target device for more details, please refer to chapter docid\ zgitedt9msgtvmrtyizz sessiondurationlimitminute user session duration can be limited reasonrequiredforconnection when the value is set as true , a comment/reason field appears when users try to connect to the devices in the device group the text entered here will appear in the session logs, managerial approval emails, and notifications (if enabled) skiprdpauthonautodiscovery when the value is set as true on the device group kronpam will not try to send smb messages to a server if a network is successful, a device will be added