Keycyte PAM 3.2 · Administrator Guide
Configuring General Settings
The General page collects system-wide options that do not belong to a specific feature: recording storage, the password policy for local users, branding of the sign-in pages, the user agreement, and bulk import of servers and accounts.
To open the page, select Settings > General. Each card on the page has its own Save button; changes on one card do not save the others.
System Information and Language
The System Information card shows the operating system, host name, IP address, MAC address, CPU, CPU cores, memory and disk of the Keycyte PAM server.
The language list below the card sets the Admin Panel language of your own account: English or Turkce.
Diagnostic Logging
Log Level sets how much detail the Keycyte PAM service writes to its own service log: DEBUG, INFO, WARN or ERROR. The change takes effect immediately.
Warning
Debug-level logging significantly increases log volume and exposes more session detail. Revert to INFO once troubleshooting is complete.
External Source
Use the External Source card to add many accounts or servers at once from an Excel file.
To import accounts or servers:
- Click Download Account Template or Download Server Template and fill in the downloaded
.xlsxfile. - Click Import Account Template or Import Server Template and select the file.
- In the Preview dialog, check the rows.
- Click Save All.
Record Configuration
| Field | Description |
|---|---|
| Record Base | Directory on the Keycyte PAM server where session recordings are stored. Default: /record/. |
| Export Resolution | 1920x1080 (default), 1280x720, 720x576 or 720x480. |
| Bitrate | 1 Mbps, 2 Mbps (default), 3 Mbps or 4 Mbps. |
OTP Configuration
| Field | Description |
|---|---|
| Algorithm | SHA1, SHA256 or SHA512. |
| Digits | Code length, 4 to 8. |
| Period | Code validity in seconds, 15 to 120. |
Access Request, URL and History Options
| Card | Description |
|---|---|
| ACL Admin Count | Value from 1 to 10. |
| Redirect URL | Base address of Keycyte PAM, for example https://pam.example.com. It is used for the links in access request e-mails: the approval link sent to approvers and the portal link sent to the requester. |
| Password History Count | Number of previous passwords kept in the history of each password vault account, 1 to 50. Default: 5. Older versions are deleted. |
| Recycle Bin Retention | Number of days a deleted password vault account stays restorable in the recycle bin before it is purged automatically. Default: 30. The change applies only to new deletions. |
Warning
A password vault account in the recycle bin is not rotated on its target. The archived password stays valid on the target system for the whole retention period.
Local User Password Policy
These rules apply to the passwords of local Keycyte PAM users (not to vault accounts).
| Section | Field | Description |
|---|---|---|
| Complexity | Minimum Length, Maximum Length | Allowed password length. |
| Require Uppercase, Require Lowercase, Require Digit, Require Special Character | Character classes the password must contain. | |
| Expiration | Password Expiry (days) | Days after which the password must be changed. 0 means the password never expires. |
| Warning Before Expiry (days) | Days before expiry when the user is warned. | |
| Account Lockout | Max Failed Login Attempts | Failed sign-ins after which the account is locked. 0 means no lockout. |
| Lockout Duration (minutes) | How long the account stays locked. 0 means an administrator must unlock it. | |
| Password History | Password History Count | Number of previous passwords that cannot be reused. |
| Banned Passwords | Passwords that are never accepted. Type a password and press Enter to add it. |
Click Save at the bottom of the card to apply the policy.
Customize
Use the Customize card to brand the sign-in pages and the application.
- Import Login Logo, Import App Logo, Import Footer Logo, Import Login Background: upload an image for each element.
- App Title: title of the application. Click Save next to the field.
- Client Login Banner: text shown on the Client Panel sign-in page. Leave it empty to use the default banner. Click Save next to the field.
- Reset to Defaults: removes all logos, the title, the banners and the background, and restores the defaults.
User Agreement
When the user agreement is enabled, users must accept it to sign in. Sign-in attempts without acceptance are recorded in the Access log.
| Field | Description |
|---|---|
| Enabled | Turns the agreement on. |
| Agreement Header | Title of the agreement. |
| Agreement Text | Text of the agreement. |