Keycyte PAM 3.2 · Deployment Guide

Components

A Keycyte PAM deployment consists of the containers described below. All containers are attached to one internal Docker bridge network (keycyte-net) and reach each other by service name. Only the ports listed as published are reachable from outside the host.

Component Overview

PAM Server

The PAM server (pam container) is the core of Keycyte PAM. It:

• serves the Client Panel (at https://<pam-address>/) and the Admin Panel (at https://<pam-address>/admin) over HTTPS on port 443;
• stores all data in the PostgreSQL database and creates or updates the database schema at startup;
• encrypts secrets (vault passwords, keys, provider credentials, backups and session recordings) with the encryption key that is set in its environment;
• authenticates users (local, LDAP/Active Directory, RADIUS, Microsoft Entra ID) and applies MFA, roles and access policies;
• controls sessions: it asks the gateway, SSH proxy or RDP proxy to open the connection, records the session and writes the audit logs;
• runs scheduled jobs: password rotation, scheduled reports and scheduled backups (on the master node only, see High Availability);
• lists and manages the other containers on Settings > Services through the read-only Docker socket that is mounted into the container.

SSH Proxy

The SSH proxy (ssh-proxy container) handles SSH traffic:

• Native SSH clients connect to it on port 2222. The SSH proxy asks the PAM server whether the user may use the requested account, and then opens the SSH connection to the target system.
• Web terminal (SSH) and SFTP sessions that are opened in the Client Panel are relayed by the PAM server to the SSH proxy over the internal network (WebSocket, port 8443 inside the network).

The SSH proxy writes SSH session recordings to the recordings directory.

RDP Proxy

The RDP proxy (rdp-proxy container) accepts connections from native RDP clients on port 3389 (port 13389 inside the container). When a user chooses to connect with a native client, the PAM server pushes a single-use connection token and the credentials to the RDP proxy, and gives the user an .rdp file. The RDP proxy then opens the RDP connection to the target system.

Gateway (guacd)

The gateway (guacd container) is an Apache Guacamole proxy daemon. The PAM server uses it, on port 4822 inside the network, for sessions that run in the browser: RDP, VNC, Telnet, Kubernetes, RemoteApp, web application and 3rd party application sessions. The gateway has access to the file transfer directory (/drive) and the recordings directory.

Password Manager

The Password Manager service (password-manager container) changes and verifies passwords on target systems, for example Windows local accounts and Active Directory accounts. The PAM server calls it, on port 1453 inside the network, during manual and scheduled password changes. It reads the LDAP CA file from the shared application directory.

RADIUS Server

The RADIUS server (radius container) listens on port 1812/udp. It authenticates RADIUS clients (for example network devices or VPN gateways) against Keycyte PAM users by calling the PAM server’s internal API. Its settings are managed on Settings > Radius Server in the Admin Panel.

TACACS+ Server

The TACACS+ server (tacacs container) listens on port 49/tcp. It authenticates administrators of network devices against Keycyte PAM, returns authorization decisions and sends accounting records to the PAM server. Its settings are managed on Settings > TACACS+ Server in the Admin Panel.

Database

The PostgreSQL database (postgres container, PostgreSQL 17) stores all Keycyte PAM data. Its data is kept in the Docker volume postgres-data. The database port is not published on the host; only the containers on the internal network can reach it.

Host Directories

The installer creates three directories in the home directory of the user who runs it and mounts them into the containers: