Keycyte PAM 3.2 · Deployment Guide

Connection Paths

Users reach target systems through Keycyte PAM in one of three ways. In every case the user authenticates to Keycyte PAM, Keycyte PAM checks the user’s roles and policies, and the connection to the target system is opened by a Keycyte PAM component with the credential from the Password Vault.

Browser Sessions

Browser sessions need no client software. The user opens a server in the Client Panel and the session runs in a browser tab.

1. The browser connects to the PAM server on port 443 over HTTPS.
2. The user selects a server and an account. The PAM server checks the roles, MFA and approval requirements.
3. The PAM server opens a WebSocket from the browser and connects to the target system:
   • For RDP, VNC, Telnet, Kubernetes, RemoteApp, web application and 3rd party application sessions, the PAM server asks the gateway (guacd, port 4822 on the internal network) to connect to the target. The gateway connects to the target system on the port configured for the server.
   • For SSH terminal and SFTP sessions, the PAM server relays the WebSocket to the SSH proxy (port 8443 on the internal network). The SSH proxy connects to the target system over SSH.
4. The PAM server records the session if the server role requires it.

Web application and 3rd party application sessions run on a jump server: the gateway opens an RDP session to the jump server that is configured on Settings > Connection, and the application starts there.

Native SSH Clients

Users who prefer their own SSH client connect to the SSH proxy on port 2222. The Client Panel shows the command to copy, in this form:

ssh <vault_id>@<server_id>@<pam_user>@pam.example.com -p 2222

1. The SSH client connects to the SSH proxy on port 2222 and authenticates the user.
2. The SSH proxy asks the PAM server, over its internal API, whether the user may use the requested account on the requested server. The request is signed with the SSH proxy’s access key (see Service Access Keys).
3. The SSH proxy connects to the target system with the vault credential and records the session if required.

Native RDP Clients

Native RDP access requires the RDP proxy (see Components).

1. The user selects a server and an account in the Client Panel and chooses to connect with a native RDP client.
2. The PAM server pushes a single-use connection token and the credentials to the RDP proxy over the internal network, signed with the RDP proxy access key.
3. The user receives an .rdp file and a single-use password. The .rdp file points to the public address of the RDP proxy, which is set in KEYCYTE_RDP_PROXY_PUBLIC_ADDRESS.
4. The RDP client connects to the RDP proxy on port 3389. The RDP proxy validates the token and opens the RDP connection to the target system.

The token expires after 120 seconds by default (KEYCYTE_RDP_LAUNCH_TOKEN_TTL_SECS). If the RDP proxy URL, public address or access key is not configured, native RDP launch is disabled.

Service-to-Service Traffic

Besides user connections, the components talk to each other on the internal network: