2.2.1 Using SSH Relay

SSH Relay allows you to access the target computer through Privileged Account Manager proxy where the Privileged Account Manager does a single sign on as a privileged user. You can launch the SSH relay sessions in the following ways:

Launch from User Console

Prerequisites:

You must have JRE installed for the JNLP file to launch. For information about the supported JRE versions, see the Technical Information for Privileged Account Manager.

To launch an SSH or a Telnet session:

  1. You can launch the SSH session by clicking either of the following:

    • Resource Name: Allows you to add session notes before launching the session.

    • The icon:Allows you to download the session without adding notes. A JNLP file is downloaded.

  2. Save and open the JNLP file to launch the Java user interface.

    In Edge browser, modify the default program for launching the JNLP file to javaws.exe.

  3. Specify your user console credentials to start the session.

The downloaded JNLP file is valid only for 1 minute. After 1 minute, repeat the above steps to download a new JNLP file. These files are not deleted automatically. Hence, after using delete these files manually.

Launching Live Session Using SSH Web Relay

Privileged Account Manager now allows administrators to provision privilege access without a need for an agent on the target host, which the provisioned users can access without the need of any client application, from within their browsers. You can launch the session using the icon, which allows you to launch the live session for SSH web relay. You can now monitor all the live sessions using Active Sessions.

Launch Using SSH Client

To launch the SSH Relay session using SSH client:

  1. Open the SSH client.

  2. (conditional) If you know the target hostname and the target user as whom you want to access the computer, use the following command:

    To initialize an SSH session:

    ssh -t -p2222 <PAMuser@PAMsshrelayhost> <targetuser@targethostname>

    To initialize an SSH relay session with X11 forwarding, use the command:

    ssh -X -t -p2222 <PAMuser@PAMsshrelayhost> <targetuser@targethostname>

  3. (Conditional) If you do not know the target host name, perform the following:

    1. To initialize an SSH session, use the command:

      ssh -t -p2222 <PAMuser@PAMsshrelayhost>

      To initialize an SSH relay session with X11 forwarding, use the command:

      ssh -X -t -p2222 <PAMuser@PAMsshrelayhost>

      A list of all the available SSH sessions are displayed.

    2. Enter the appropriate option to start the respective SSH session and provide your user console credentials.

      NOTE:When you exit from the SSH session, all the available SSH Relay sessions are displayed again that enables you to connect to a different target system.