Keycyte PAM 3.2 · Administrator Guide

Adding Servers

Add a server for each system that users should reach through Keycyte PAM. You can also create servers in bulk with discovery templates; see Discovery.

Before you begin:

• You need the Add permission for Servers (a MASTER has it by default).
• For 3rd Party and WEBAPP servers, a MASTER must first define the jump server, and the application or web application script, in Settings > Connection. The lists for these fields are filled only for MASTER users.
• If you want to assign the server to roles while you create it, create the server roles first. You can also add the server to roles later.

To add a server:

1. Select Servers in the menu.

2. Click Add in the toolbar. The Server Details panel opens.

3. In Protocol, select the connection protocol. Port is set to the default port of the protocol. For the list of protocols, see Connection Protocols.

4. Fill in the common fields:

   Field	Description
   Protocol	Connection protocol. Default: RDP.
   Name	Display name of the server, shown to users in the Client Panel. Required.
   Address	Host name or IP address of the target, for example 10.0.0.10 or srv01.example.com. Required.
   Port	TCP port of the target service. Filled in from the protocol; change it if the service listens on another port.
   Manager User	A privileged password vault account that Keycyte PAM uses to manage accounts on this server: changing passwords of local Windows accounts, the operations of the password policy that run before and after a connection, and the Details view. If you leave it empty, Keycyte PAM uses the service account of a configured LDAP directory where one applies.
   Tags	Descriptive labels for grouping and filtering. Tags do not grant access.
   Roles	Server roles that the server is added to.
   Description	Free-text note.
   Clipboard	How line endings of copied text are converted: preserve (no change), unix or windows.
   Duration (min)	Maximum length of a session in minutes, from 0 to 1440. When the time is reached, the session is closed. 0 means no limit. A role schedule can end a session earlier.
   Command	Command to run when the session starts. Used by SSH and KUBERNETES servers. For SSH, <USERNAME> and <PASSWORD> in the command are replaced with the credentials of the account used.
   TACACS+ Shared Secret	Registers the server as a TACACS+ device for the Keycyte TACACS+ server. The secret is never shown again after saving; leave the field empty when editing to keep the current secret.

5. Fill in the fields that the selected protocol adds. For details, see Connection Settings.

6. Click Save.

The server appears in the list. If you are an ADMIN and did not select owners, you are recorded as the owner of the server.

Next Steps

• Link password vault accounts to the server. See Adding Accounts.
• Make sure that a server role contains the server and authorizes the users who need it. See Server Roles.