For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/features/pam/security/change-secrets.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Change Secrets

    Enterprise Edition

    Change Secrets requires JumpServer Enterprise Edition. Without a license, the Security > Change Secrets tabs are disabled.

    Request 14-day free trial

    Change Secrets rotates the credentials of accounts stored in JumpServer. A change-secret task can run immediately or on a schedule, generate a specific or random secret, and notify recipients by email when it finishes.

    A change-secret task authenticates through a privileged account on the asset, so the asset's account list must contain a working privileged account.

    Prerequisites

    • Access to PAM > Security > Change Secrets with permission to view change-secret tasks.
    • The target assets or nodes already exist. See Assets.
    • Each target account has secret change enabled. See Accounts.
    • A privileged account is available on the asset and can authenticate to it.

    Overview

    The page contains five tabs:

    • Overview – summary counts, success and failure trend, and failed-account list.
    • Change secret tasks – task definitions and schedules.
    • Execution history – one row per run with status, duration, and log.
    • Execution records – per-account results, with old and new secret access.
    • Change secret status – in-progress changes, shown when the change-after-session setting is enabled.

    Figure 1: Change secret overview with task summary and failure trend

    Create a change secret task

    1

    At the top-left of the page, select , then click PAM.

    image
    2

    Open Security > Change Secrets and select Change secret tasks.

    3

    Click Create.

    4

    In the Name field, type the task name.

    5

    In the Accounts field, type the usernames to rotate and press Enter after each.

    6

    In the Assets and Nodes fields, select the targets. The two fields can be combined.

    7

    Choose the Secret strategy (Specific secret or Random generate), the Secret type (Password or SSH key), and then supply the Password, Private key, and optional Key password, or the Password rules for random generation.

    8

    Optionally configure Parameters for the platform, enable Periodic to schedule the task, keep Check connection after change enabled, leave Active selected, and add Recipients for email notification.

    9

    Click Submit.

    Field reference

    FieldDescription
    NameRequired. Task name.
    AccountsRequired. Usernames whose secrets are rotated.
    Assets / NodesTargets of the change; both can be selected.
    Secret strategySpecific secret or Random generate.
    Secret typePassword or SSH key.
    PasswordValue to set when the strategy is specific and the type is password.
    Password rulesLength and character rules used when generating a random password.
    ParametersPlatform-specific change parameters. Applies to AIX, Linux, and Unix assets only.
    PeriodicRepeats the task on a schedule; crontab takes priority over interval.
    Check connection after changeVerifies the new secret by connecting. Enabled by default.
    RecipientsUsers notified by email after execution.
    ActiveEnables the task.
    CommentOptional notes.

    Figure 2: Create account secret change drawer

    Note

    Do not place accounts that share a switch from relationship on the same asset into one task. Split them into two tasks and rotate them separately, because the first change can invalidate the account that the second change depends on.

    How privileged accounts are handled

    Warning

    By default JumpServer does not change the secrets of privileged accounts, nor of accounts named root or administrator, and it excludes the privileged account used to run the task. To allow privileged-account rotation, set CHANGE_AUTH_PLAN_SECURE_MODE_ENABLED=false in the configuration file and restart the JumpServer service.

    Because this changes a high-risk credential, use a separate, controlled task for privileged accounts and test it on a non-production asset first.

    Run and review

    Use the green run button in the row, or open the task and use the manual execution action, to start a change. The More menu provides Edit, Delete, and Duplicate.

    The Overview tab summarizes today, the last 7 days, or the last 30 days: task counts (total, periodic, asset management), execution counts (total, success, failed), and running changes. The Account secret change success/failure chart plots success against failure, and the failed-account list shows each failure with its error.

    Execution records lists the changed accounts with asset, username, end date, success, test, and error. Opening a record requires MFA verification before the old and new secrets are shown, and a failed change can be retried from there.