Configure MobaXterm as a Service on PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We are trying to configure a MobaXterm SSH Client as a TCP/UDP service on PAM. Can this work with auto-connect?

Environment

This is applicable to any PAM release supported as of November 2019.

Resolution

The PAM SSH proxy supports auto-connect for any custom SSH client, as long as the client has command line arguments that allow specification of the host/IP and port to connect to, as well as the account name. For MobaXTerm the following TCP/UDP service definition should work. Auto-login using password authentication or SSH key authentication was tested successfully with the MobaXTerm Personal Edition v12.3 Build 4208.

Local IP: <any local IP not used by another service>
Ports: 22:*

Protocol: TCP

Enable: Checked

Show In Column: Not checked (not required)

Application Protocol: SSH

X11: Checked

Client Application: "C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe" -newtab "ssh -p <First Port> <User>@<Local IP>"

Note that the "-p <First Port>" command argument is required here because the Ports field was configured with "22:*", which implies that PAM will listen on a random available port on the local IP 127.1.0.188. If the Ports field was configured with just port 22, matching the default port used for SSH, the -p argument would not be needed.

The "-newtab" argument causes multiple service launches to be opened as additional tabs in the same MobaXTerm client.

We could not identify a command line argument to set the title of the new tab in the Personal Edition. The runtime token  for the target device host name available in the Client Application string is <Device Name>.