Administrator access without anyone holding the administrator password

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

PrivilegeVault vaults privileged credentials, brokers SSH, RDP and VNC sessions without revealing them, records everything and rotates the password afterwards. Check-out needs a reason, a time box and human approval, and AI agents can never request, approve or open a session.

2The challenge

Shared administrator passwords for servers, Windows machines and databases are known to too many people, never change and leave no record of what was done with them. One leaked admin password is often the whole breach.

The TotalHeal approach. A per-organisation encrypted vault, check-out with human approval, SSH/RDP/VNC sessions brokered without showing the password, recordings and automatic rotation.

3Architecture

4How it works

1. RequestA user asks for an account with a reason and a time box.
2. Approve0, 1 or 2 distinct human approvers; never the requester.
3. ConnectThe session opens with the credential injected and the host key pinned.
4. RecordScreens and SSH commands are recorded; risky commands are blocked or alerted.
5. RotateAt check-in the password or key is rotated, verified and restored on failure.

5Capabilities in detail

• Encrypted credential vaultAES-256-GCM with a per-organisation key; each secret version is bound to its organisation, account and version. OS passwords, SSH keys, database logins, API and cloud keys, kubeconfig. Lists never return secrets.
• Check-out with dual controlA reason, a time box and 0, 1 or 2 distinct human approvers — the requester can never approve. Exclusive check-out and reveal-once by policy.
• Sessions without the passwordSSH with the credential injected and the host key pinned; RDP and VNC through a broker with drive, printing and file transfer off.
• Recording and playbackSSH and RDP/VNC recordings sealed with SHA-256 at close, registered as evidence with chain of custody, played in the browser.
• Command capture and filteringEvery SSH command recorded and searchable; deny/allow lists that block or alert; risky commands raise SOC alerts mapped to ATT&CK.
• Live monitoringWatch a running session and terminate it with a reason; idle timeout and automatic end at the time box, check-in or revoke.
• Automatic rotationAfter check-in and on a schedule: Linux passwords and SSH keys, Windows local accounts on corporate devices, and PostgreSQL and MySQL logins with verify and restore on failure.
• Humans onlyAI agents and machine identities can never request, approve, reveal, rotate or open a session.
• Tamper-evident auditEvery PAM action in the hash-chained audit with a verified export; risky-command alerts can be forwarded to your SIEM.

6Security and data handling

• Secrets never listedEach secret is encrypted and bound to its organisation, account and version; lists never return secrets.
• Humans onlyAI agents and machine identities can never request, approve, reveal, rotate or open a session.
• Sealed evidenceRecordings are sealed with SHA-256 at close and kept with chain of custody.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A modern browser
• Network reachability from the broker, or a Secure Access connector
• TotalHeal server agent on Linux targets and desktop agent on Windows targets for rotation
• A database login that can change its own password for database rotation

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.