PuTTY Duplicate Session action connects to wrong target device

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PuTTY is configured as a single TCP/IP service that is assigned to multiple UNIX devices.  Clicking on the PuTTY  icon in PAM launches PuTTY as expected and connects to the target device for which the service was launched. This can be done for multiple target devices. But when selecting the Duplicate Session menu item from any of the open PuTTY sessions, PAM always connects the new session to the last device for which the service was launched from the access page.

The TCP/UDP service is configured with an application path similar to the following:

"C:\Program Files\PuTTY\putty.exe" -ssh <user>@<Local IP> <First Port> -loghost <Device Name>

Cause

The service configuration instructs the PuTTY client to connect to IP <local IP> on port <First Port>. All PuTTY clients launched by the service connect to the same listener socket that the PAM client creates when building the access page. When you launch the service from the access page for a specific device, the PAM client knows which row the service was launched for, and thus which target device the connection should be routed to. Using the Duplicate Session menu from any PuTTY client connected to <local IP>:<First Port> will create another PuTTY session connection to this local IP and port. PAM has no other choice than routing this connection to the last device for which the service was launched from the access page.

Resolution

This is expected behavior that cannot be fixed in PAM. The PAM administrator should inform PAM users about this limitation and ask them not to use the Duplicate Session option, but create duplicate sessions if needed by launching the service multiple times from the access page for the same target device.