是的，您可以更改默认端口，如下所述：
只有通过电子邮件通知用户其PMP帐户。如果他们没有收到通知邮件，请检查
可以使用以下三种机制之一：
Active Directory: 启用时，身份验证请求被转发到配置的域控制器，并且根据结果，允许或拒绝用户访问PMP。用户名、密码和域在PMP登录屏幕中提供。此方案仅适用于以前已从AD导入详细信息的用户。只有在Windows系统上安装PMP服务器时才可用。
LDAP Directory: 启用时，身份验证请求将转发到配置的
LDAP目录服务器，根据结果，允许或拒绝用户访问PMP。用户名和密码以及使用LDAP身份验证的选项在PMP登录屏幕中提供。此方案仅适用于先前已从LDAP目录导入详细信息的用户
PMP本地身份验证： 身份验证由PMP服务器在本地完成。无论是否启用了AD或LDAP身份验证，此方案始终可供用户在登录页面中选择。此方案为用户提供了单独的密码，并且AD或LDAP密码从未存储在PMP数据库中。
PMP有三个预定义的角色：
Any administrator can be made as "Super Administrator" with the privilege to view and manage all resources.Refer help documentation for details on access levels.
PMP comes with three pre-defined roles:
If you were already given a valid PMP account, you can use the 'Forgot Password?' link available in the login page to reset the password. The user name/e-mail id pair supplied should match the one already configured for the user and in that case, the password will be reset for that user and the new password will be emailed to that email id.
为什么InternetExplorer7（和其他浏览器）在访问PMP控制台时有问题？
PMP comes with three pre-defined roles:
The PMP web console always uses HTTPS to communicate with the PMP server. The PMP server comes with a default self-signed SSL certificate, which the standard web browsers will not recognize and issue a warning. Particularly IE 7's warning message appears serious. Ignoring this warning still guarantees encrypted communication between the PMP console and the server but if you want your users to be particularly sure that they are connecting only to the PMP server, you will need to install a SSL certificate that you have bought from a certificate authority, that is recognised by all standard web browsers.
Ensuring the secure storage of passwords and offering high defence against intrusion are the mandatory requirements of PMP. The following measures ensure the high level security for the passwords:
For detailed information, refer to Prouct Security Specifications document.
通过密码管理API进行的A-to-A、A-to-DB密码管理的安全性如何？
The web API exposed by PMP forms the basis for Application-to-Application/Database Password Management in PMP. The applications connect and interact with PMP through HTTPS. The application's identity is verified by forcing it to issue a valid SSL certificate, matching the details already provided to PMP corresponding to that application.
The PMP runs as a HTTPS service. It requires a valid CA-signed SSL certificate with the principal name as the name of the host on which it runs. By default, on first time startup, it creates a self signed certificate. This self signed certificate will not be trusted by the user browsers. Thus, while connecting to PMP, you need to manually verify the certificate information and the hostname of PMP server carefully and should force the browser to accept the certificate.
To make the PMP server identify itself correctly to the web browser and theuser:
You can use OpenSSL or keytool (bundled with Java) to create your certificates, get them signed by a CA and use them with PMP. The choice of which tool to use is yours, based on what your security administrators say. Detailed instructions on using both the tools are provided here. If you already have a certificate signed by a CA, then we recommend using OpenSSL to create the keystore and configure it in PMP (steps 4 and 5 in the instructions below).
OpenSSL is available bundled with most of the Linux distributions. If you have Windows and do not have OpenSSL installed, download it from http://www.slproweb.com/products/Win32OpenSSL.html. Make sure the 'bin' folder under the OpenSSL installation is included in the 'PATH' environment variable.
步骤1：第一步是创建用于SSL握手的公私密钥对
步骤2：创建一个证书签名请求（CSR），提交给证书颁发机构，以使用在上一步中生成的公钥创建签名证书。
步骤3：将CSR提交给证书颁发机构（CA）以获取CA签名的证书
步骤4：将CA签名证书导入密钥库
第5步：最后，配置PMP服务器以使用SSL证书的密钥库
步骤1：第一步是创建用于SSL握手的公私密钥对
步骤2：创建一个证书签名请求（CSR），提交给证书颁发机构，以使用在上一步中生成的公钥创建签名证书。
步骤3：将CSR提交给证书颁发机构（CA）以获取CA签名的证书
步骤4：将CA签名证书导入PMP服务器
第5步：最后，配置PMP服务器以使用SSL证书的密钥库
Note : Tomcat by default accepts only the JKS (Java Key Store) and PKCS #12 format keystores. In case, the keystore is of PKCS #12 format, include the following option in the server.xml file along with the keystore name, keystoreType="PKCS12?This tells tomcat that the format is PKCS12. Restart the server after this change.
Note : Please refer your CA's documentation for more details and troubleshooting
Follow the steps below to gererate SSL certificate for MySQL Server. (If you want to have a self-signed key, follow all the steps. If you are using a CA signed certificate, skip steps 1, 2 and 5.)
Step 2 Create a self-signed certificate authority certificate
Step 3 Generate private key
Step 4 Generate a certificate request
Step 5 Create a Certificate Signing Request (CSR) for submission to a certificate authority (perform this step only if you are using a self-signed certificate. Otherwise, proceed to step 6)
Step 6 Generate .p12 file
Step 7 Configure the PMP server to use the keystore with your SSL certificate
Step 8 Import CAcert.pem into PMP
In Windows: importcert.bat <absolute path of the CAcert.pem file created in step 2>
In Linux: sh importcert.sh\bat <absolute path of the CAcert.pem file created in step 2>
Step 9 Put these files into MySQL
CAcert.pem to be renamed as ca-cert.pem
ServerKey.key to be renamed as server-key.pem
ServerCer.cer to be renamed as server-cert.pem
Important Note: If you are having High Availability setup, execute the steps 7, 8 and 9 in PMP secondary installation also.
Can I also change resource passwords from the PMP console?
Yes, of course. PMP can change the passwords currently for Windows, Windows domain and Linux systems. Capability to change passwords of other types of resources like databases, routers, switches etc will be gradually added. PMP supports both agent-based and agent-less modes of changing passwords.
When to use the agent and agent-less modes for password synchronization?
Let us first look at the requisites for both the modes:
The agent mode requires the agent to be installed as a service and run with administrative privileges to perform password changes. The communication between the PMP server and agent takes place through TCP for normal information and HTTPS for password transfer and hence communication paths must exist (ports to be kept open) between the server and agent.
For the agentless mode, you must supply administrative credentials to perform the password changes. For Linux you must specify two accounts, one with root privileges and one with normal user privileges that can be used to login from remote. Telnet or SSH service must be running on the resources. For Windows domain, you must supply the domain administrator credentials. For Windows and Windows domain, PMP uses remote calls and relevant ports must be open on the resource.
Based on this you can choose which mode you want for your environment, indicated by the following tips:
Choose agent mode when,
Choose agentless mode in all other cases as it is a more convenient and reliable way of doing password changes.
Can I enable agentless password synchronization if I add my own resource type for other distributions of Linux / other versions of Windows?
Yes, you can. As long as your resource type label contains the string 'Linux' or 'Windows', you can still configure agentless password synchronization for those resources.
Example of valid resource type labels to enable password synchronization:
Debian Linux, Linux - Cent OS, SuSE Linux, Windows XP Workstation, Windows 2003 Server
Is there a way to do remote password syncronization for resource types other than the ones for which remote reset is supported now?
Yes, you can make use of Password Reset Listeners, which enable invoking a custom script or executable as a follow-up action to Password Reset action in PMP. Refer to Help Documentation for more details.
How to troubleshoot when password synchronization does not happen?
In the agent mode,
In the agentless mode,
Windows domain password reset fails with the error message: "The authentication mechanism is unknown"
This happens when PMP is run as a Windows service and the 'Log on as" property of the service is set to the local system account. Change it to any domain user account to be able to reset domain passwords. Follow the instructions below to effect that setting:
What are the prerequisites for enabling Windows Service Account Reset?
Before enabling windows service account reset, ensure if the following services are enabled in the servers where the dependent services are running:
(1) Windows RPC service should have been enabled
(2) Windows Management Instrumentation (WMI) service should have been enabled
Can I setup disaster recovery for the PMP database?
Yes, you can. PMP can periodically backup the entire contents of the database, which can be configured through the PMP console. Refer help documentation for more details.
Where does the backup data get stored? Is it encrypted?
All sensitive data in the backup file are stored in encrypted form in a .zip file under <PMP_Install_Directory/backUp> directory. It is recommended that you backup this file in your secure, secondary storage for disaster recovery.
Do I need any pre-requisite software to be installed before using PMP?
There is no prerequisite software installation required to use PMP.
Can others see the resources added by me?
Except super administrators (if configured in your PMP set up), no one, including admin users will be able to see the resources added by you. Apart from this, if you decide to share your resources with other administrators, they will be able to see tham.
Can I add my own attributes to PMP resources?
Yes, you can extend the attributes of the PMP resource and user account to include details that are specific to your needs. Refer the help documentation for more details.
What if a user who has not shared his sensitive passwords, leaves the enterprise?
This can very well happen in any enterprise, but with PMP you need not worry about passwords getting orphaned. Administrators can 'transfer' resources owned by users to other administrator users and in the process they have no access to those resources themselves, unless they do the transfer to their name. Refer the help documentation for more details.
Importing users/resources from AD fails...
Ensure the following:
In case, if fails even after ensuring the above, contact passwordmanagerpro-support@manageengine.com.
Does PMP provide high availability support?
Yes, refer to Help Documentation for more details
How to make the PMP application work with a MySQL database server installed in a separate machine (other than the one in which PMP server is running)?
It is always recommended to run the PMP application (built over Tomcat web server) and the MySQL database in the same machine for better security. We have configured the bundled MySQL database so as it is not visible outside the machine in which it is installed (it will accept connections requested only from localhost) and you will lose this aspect when you separate them. If there is a pressing need to run MySQL elsewhere, follow the procedure detailed below:
Does domain SSO work across firewalls / VPNs?
The domain Single Sign On (windows integrated authentication) is achieved in the Windows environment by setting non-standard parameters in the HTTP header, which are usually stripped off by devices like firewalls / VPNs. PMP is designed for use within the network. So, if you have users connecting from outside the network, you cannot have SSO this enabled.
Can I rebrand PMP with our logo?
Yes. If you want to replace the PMP logo appearing on the login screen and on the web-interface with that of yours, you can do so from the web-interface itself. It is preferable to have your logo of the size 210 * 50 pixels.
To rebrand the logo,
Does PMP record Password viewing attempts and retrievals by users?
Yes, PMP records all operations performed by the user including the password viewing and copying operations. From audit trails, you can get a comprehensive list of all the actions and attempts by the users with password retrieval. The list of operations that are audited (with the timestamp and the IP address) includes:
What's the maximum size of a password that Password Manager Pro can store?
The resource passwords are stored as encrypted text (SQL type TEXT) in the database and hence the size of the content can be upto 64KB. For the PMP application login password, the maximum password length is 100 characters.
What is the Licensing Policy for PMP?
Evaluation Edition - Evaluation Edition allows you to have 2 administrators in for 30 days. You can manage unlimited resources and evaluate all features of Premium Edition. During evaluation you can get free technical assistance.
Free Edition - Download valid for ever, capable for supporting a maximum of 1 administrator. You can manage a maximum of 10 resources and you will all functionalities of Standard Edition.
Registered Version - need to buy license based on the number of administrators required and the type of edition Standard/Premium:
| Feature | Standard Edition | Premium Edition |
| User / User group Management |  |
|
| Password Repository | |
|
| Password Policies | |
|
| Password Sharing and Management | |
|
| Audit / Audit Notifications | |
|
| AD / LDAP integration | |
|
| Auto Logon Helper | |
|
| Password change listener | |
|
| Backup and Disaster Recovery | |
|
| Password Alerts and Notifications |  |
|
| Remote Password Reset(on demand, scheduled and rule based) - for Windows, Windows Domain, Windows Service Accounts, Windows Scheduled Accounts, Flavours of UNIX and Linux, Cisco and HP ProCurve Devices and MS SQL, MySQL servers ) | |
|
| Reports | |
|
| Password Management API | |
|
| High Availability | |
|
Can I buy a permanent license for PMP? What are the options available?
Though PMP follows an annual subscription model for pricing, we also provide perpetual licensing option. The perpetual license will cost approximately three times the annual subscription price, with 20% AMS from the second yea onwards. Contact sales@manageengine.com and passwordmanagerpro-support@manageengine.com for more details.
I want to have high availability setup with redundant servers. Is one license enough?
Yes, if you buy a single PREMIUM Edition license, you are entitled to have high availability setup. You can apply the same license on Primary as well as Standby servers.
Can PMP support more than 100 administrators?
Yes, very much. If you want a license with more than 100 administrator users, please contact sales@manageengine.com and passwordmanagerpro-support@manageengine.com for more details.
Can I extend my evaluation to include more administrator users or for more number of days?
Yes. Fill in the required details in the website and we will send you the license keys.
Do I have to reinstall PMP when moving to the Professional Edition?
No. You need not have to reinstall or shut down the server. You just need to enter the new license file in the "License" link present in the top right corner of the PMP web interface.