Keycyte PAM 3.2 · Administrator Guide

Connection Protocols

Every server has exactly one connection protocol. The protocol decides how Keycyte PAM connects to the target, which port is used by default and which additional settings the server has.

RDP

Connects to a Windows host over the Remote Desktop Protocol. Use password vault accounts of the Windows or Windows Domain type. For a domain account, the domain of the account is sent to the target.

RDP servers have the most connection options: security mode, keyboard layout, color depth and display features. The Details button in the server list shows the local users and Windows services of an RDP server.

SSH

Connects to a host over SSH and opens a terminal. Use Linux accounts. An account can authenticate with a password or with a private key and passphrase. A Linux account can switch to a root account automatically after login (Su/Sudo); for details, see Adding Accounts.

Command runs the given command instead of an interactive shell.

VNC

Connects to a VNC server and shows its desktop. The password of the selected account is used as the VNC password. The only protocol-specific option is Cursor.

Telnet

Opens a Telnet terminal. Telnet has no standard login exchange, so Keycyte PAM detects the login prompts with regular expressions: set Username Regex and Password Regex to patterns that match the prompts of the target, and Keycyte PAM types the account’s user name and password when they appear.

RemoteApp (APP)

Connects to a Windows host over RDP and shows a single published application instead of the full desktop. Set App Name to the RemoteApp program name published on the host; you can also set Working Directory and App Args. The RDP display options also apply. The Details button in the server list is available for RemoteApp servers too.

Web Application (WEBAPP)

Opens a web application in a browser that runs on a jump server, and fills in the login form with the account’s credentials.

A WEBAPP server needs:

• Jump Server: the host that runs the browser. A Windows jump server is reached over RDP and the browser is started as a RemoteApp; a Linux jump server is reached over VNC.
• Script: the web application script that drives the login.
• Username Id and Password Id: identifiers of the user name and password fields of the login form.

Jump servers and web application scripts are defined by a MASTER in Settings > Connection. See Connection Settings.

3rd-Party Application (3rd)

Starts a desktop application, for example a database console or a vendor management tool, on a jump server over RDP RemoteApp. Select the Jump Server and the 3rd Party application. Both are defined by a MASTER in Settings > Connection.

If the application saved on a server no longer exists, the server cannot connect and the edit panel shows a warning; select the application again.

MySQL, MSSQL and PostgreSQL

Open a terminal session that runs the command-line client of the database with the credentials of the selected account and the database in Database:

Use password vault accounts of the matching type (MySQL, MSSQL or PostgreSQL).

Kubernetes

Opens a terminal in a container of a Kubernetes pod through the Kubernetes API. Set Namespace, Pod and, if the pod has several containers, Container. Command sets the command that is executed in the container.

If the API server uses TLS, select Use SSL and paste the Client Certificate, Client Key and CA Certificate in PEM format. Ignore Certificate skips verification of the API server certificate.