2.2 Linux, UNIX, Mainframes, and Network Devices

You can access resources such as, UNIX or Linux machines, Mainframes, or network devices in the following ways based on the policies defined by administrator:

2.2.1 Using SSH Relay

SSH Relay allows you to access the target computer through Privileged Account Manager proxy where the Privileged Account Manager does a single sign on as a privileged user. You can launch the SSH relay sessions in the following ways:

Launch from User Console

Prerequisites:

You must have JRE installed for the JNLP file to launch. For information about the supported JRE versions, see the Technical Information for Privileged Account Manager.

To launch an SSH or a Telnet session:

  1. You can launch the SSH session by clicking either of the following:

    • Resource Name: Allows you to add session notes before launching the session.

    • The icon:Allows you to launch the session without adding notes.

      A JNLP file is downloaded.

      1. Save and open the JNLP file to launch the Java user interface.

        In Edge browser, modify the default program for launching the JNLP file to javaws.exe.

      2. Specify your user console credentials to start the session.

        The downloaded JNLP file is valid only for 1 minute. After 1 minute, repeat the above steps to download a new JNLP file. These files are not deleted automatically. Hence, after using delete these files manually.

    • The icon:Allows you to launch the session for web SSH.

Launch Using SSH Client

To launch the SSH Relay session using SSH client:

  1. Open the SSH client.

  2. (conditional) If you know the target hostname and the target user as whom you want to access the computer, use the following command:

    To initialize an SSH session:

    ssh -t -p2222 <PAMuser@PAMsshrelayhost> <targetuser@targethostname>

    To initialize an SSH relay session with X11 forwarding, use the command:

    ssh -X -t -p2222 <PAMuser@PAMsshrelayhost> <targetuser@targethostname>

  3. (Conditional) If you do not know the target host name, perform the following:

    1. To initialize an SSH session, use the command and provide your user console credentials:

      ssh -t -p2222 <PAMuser@PAMsshrelayhost>

      To initialize an SSH relay session with X11 forwarding, use the command:

      ssh -X -t -p2222 <PAMuser@PAMsshrelayhost>

      A list of all the available SSH sessions are displayed.

    2. Enter the appropriate option to start the respective SSH session.

      NOTE:When you exit from the SSH session, all the available SSH Relay sessions are displayed again that enables you to connect to a different target system.

2.2.2 Using Privileged Shell

Using privileged shell you can gain elevated access to the Linux or Unix machine. These resource accesses are not displayed in the user console as you cannot launch these sessions from the user console.

To access privileged sessions on Linux or UNIX systems, perform the following:

  1. Log in to the required system using the SSH client as a non-privileged user.

  2. Specify usrun pcksh or usrun shell.

  3. Execute the commands that require privileged access.