Keycyte PAM 3.2 · Deployment Guide
Service Access Keys
The Keycyte PAM services authenticate to each other with access keys. Each key is a pair of an access key ID and a secret. A service signs every request to another service with an HMAC-SHA256 HTTP signature made with the secret, and the receiving service verifies the signature with the same pair.
Access keys are set in the environment of the containers, in the installation package’s .env file. The PAM server reads them at startup and keeps them in memory. You cannot create or change access keys in the Admin Panel.
Access Keys in a Deployment
| Key | Signed by | Verified by | Variable in .env | Variable in the PAM server | Variable in the other service |
|---|---|---|---|---|---|
| SSH proxy key | SSH proxy | PAM server | SSH_PROXY_ACCESS_KEY_ID, SSH_PROXY_ACCESS_KEY_SECRET | KEYCYTE_SSH_PROXY_ACCESS_KEY_ID, KEYCYTE_SSH_PROXY_ACCESS_KEY_SECRET | KEYCYTE_ACCESS_KEY_ID, KEYCYTE_ACCESS_KEY_SECRET (SSH proxy) |
| RADIUS server key | RADIUS server | PAM server | RADIUS_ACCESS_KEY_ID, RADIUS_ACCESS_KEY_SECRET | KEYCYTE_RADIUS_SERVER_ACCESS_KEY_ID, KEYCYTE_RADIUS_SERVER_ACCESS_KEY_SECRET | KEYCYTE_ACCESS_KEY_ID, KEYCYTE_ACCESS_KEY_SECRET (RADIUS server) |
| PAM key | PAM server | SSH proxy | PAM_ACCESS_KEY_ID, PAM_ACCESS_KEY_SECRET | KEYCYTE_PAM_ACCESS_KEY_ID, KEYCYTE_PAM_ACCESS_KEY_SECRET | KEYCYTE_PAM_ACCESS_KEY_ID, KEYCYTE_PAM_ACCESS_KEY_SECRET (SSH proxy) |
| RDP proxy key | PAM server | RDP proxy | RDP_PROXY_ACCESS_KEY_ID, RDP_PROXY_ACCESS_KEY_SECRET | KEYCYTE_RDP_PROXY_ACCESS_KEY_ID, KEYCYTE_RDP_PROXY_ACCESS_KEY_SECRET | KEYCYTE_ACCESS_KEY_ID, KEYCYTE_ACCESS_KEY_SECRET (RDP proxy) |
The docker-compose.yml file passes the same .env value to both sides, so the pair always matches as long as you change it only in .env.
If a key is missing, the PAM server still starts and logs a warning for the service. The affected service cannot authenticate: for example, without the SSH proxy key native SSH and web terminal sessions fail, and without the RDP proxy key native RDP launch is disabled.
Note
Service access keys are different from the API keys of service identities, which applications use to read secrets through the Secrets API. Those are managed per user in the Admin Panel. See the Administrator Guide, section Users.
Viewing the Access Keys
To view the access keys that the PAM server loaded:
-
In the Admin Panel, open Settings > Services.
-
Find the Service AccessKeys card.
For each Service, the card shows the Access Key ID and the last four characters of the Secret. Services without a key are shown as not configured.
The access keys are stored in the .env file of the installation. To rotate a key, follow the procedure below.
Rotating an Access Key
Rotate an access key if you suspect that its secret was disclosed, or according to your security policy.
To rotate an access key:
-
On the host, open the
.envfile in the installation package folder. -
Set a new value for the key’s secret, for example a random value created with
openssl rand -hex 32. You can also set a new access key ID. -
Save the file.
-
In the package folder, recreate the containers so that they read the new values:
sudo docker compose --env-file .env -f docker-compose.yml up -d
Docker Compose recreates the containers whose environment changed. The new key is used after the containers start.
Warning
Recreating the containers interrupts the active sessions that run through them. Rotate keys in a maintenance window.
Warning
Never copy access key secrets into tickets, e-mails or chat. Anyone with a secret can call the internal API as that service.