Keycyte PAM 3.2 · Deployment Guide
Network Ports
Open the following ports in the firewalls between users, network devices, target systems and the Keycyte PAM host.
Inbound Ports
These ports are published on the Keycyte PAM host.
| Port | Protocol | Source | Component | Purpose |
|---|---|---|---|---|
| 443 | TCP | User browsers, API clients | PAM server | Client Panel, Admin Panel, REST API, WebSocket traffic of browser sessions. |
| 2222 | TCP | User workstations | SSH proxy | Native SSH client connections. |
| 3389 | TCP | User workstations | RDP proxy | Native RDP client connections. Only when the RDP proxy is deployed. |
| 1812 | UDP | RADIUS clients (network devices, VPN gateways) | RADIUS server | RADIUS authentication. |
| 49 | TCP | Network devices | TACACS+ server | TACACS+ authentication, authorization and accounting. Only when the TACACS+ server is deployed. |
Outbound Ports
These connections start from the Keycyte PAM host. The exact ports depend on your environment and on the port configured for each server.
| Destination | Typical port | Protocol | Component | Purpose |
|---|---|---|---|---|
| Target systems (RDP, RemoteApp, jump servers) | 3389 | TCP | Gateway, RDP proxy | RDP sessions. |
| Target systems (SSH, SFTP) | 22 | TCP | SSH proxy | SSH and SFTP sessions. |
| Target systems (VNC, Telnet, Kubernetes, databases) | Configured per server | TCP | Gateway | Sessions of other protocols. |
| Windows and Active Directory targets | Depends on the change method | TCP | Password Manager | Password change and verification. |
| LDAP / Active Directory servers | 389 or 636 | TCP | PAM server, Password Manager | Directory authentication, user synchronization, discovery. |
| Mail server | Configured on Settings > Notification | TCP | PAM server | E-mail notifications and reports. |
| SMS gateway | Configured on Settings > Notification | TCP | PAM server | SMS notifications and one-time passwords. |
| Syslog servers | Configured on Settings > Syslog Settings | As configured | PAM server | Forwarding audit records to SIEM. |
| SFTP backup target | Port in the backup configuration (SSH, usually 22) | TCP | PAM server | Copying backup files. |
| DNS servers | 53 | UDP, TCP | All containers | Name resolution. |
| Docker Hub | 443 | TCP | Docker Engine | Pulling postgres:17 during installation, if it is not loaded in advance. |
Internal Ports
These ports are used only on the internal Docker network keycyte-net and are not published on the host. You do not need to open them in a firewall.
| Port | Component | Used by | Purpose |
|---|---|---|---|
| 443 | PAM server | SSH proxy, RADIUS server, TACACS+ server | Internal API (https://pam). |
| 4822 | Gateway (guacd) | PAM server | Browser sessions. |
| 8443 | SSH proxy | PAM server | Web terminal and SFTP WebSocket relay, session control. |
| 7171 | RDP proxy | PAM server | Pushing native RDP connection tokens. |
| 13389 | RDP proxy | Docker (published as 3389) | RDP listener inside the container. |
| 1453 | Password Manager | PAM server | Password change and verification requests. |
| 5432 | PostgreSQL | PAM server, SSH proxy | Database. |