Setting up PuTTY as a TCP/UDP PAM Service

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PAM allows the inclusion of several applications as TCP/UDP Services to be invoked from within its environment and controls the access to the devices through these applications. This document explains how to add PuTTY as a PAM service.

Resolution

PuTTY can be added to PAM as a TCP/UDP Service for autologon to SSH target servers using a target account assigned to the service in an access policy.
To do so, fill up the fields in the TCP/UDP service definition window as shown below. Use a different service name if desired, and a local IP that doesn't conflict with other services. The client application string in this example assumes that the 64-bit version of PuTTY is installed for all users on a Windows PAM client host. Change the path to the putty executable as needed.

  Service Name: WindowsPuTTY
  Local IP: 127.0.1.22
  Port(s): 22:*
  Protocol: TCP
  Enable: <selected>
  Application Protocol: SSH 
  Client Application: "C:\Program Files\PuTTY\putty.exe" -ssh <user>@<Local IP> <First Port> -loghost <Device Name>

In the following screenshot of a service edited from the Services > Manage TCP/UDP Services page, the 'Comments' field contains the full command for readability, as the 'Client Application' field truncates the command string:

Note that the tokens, such as <user>, need to be entered exactly as shown. When the service is launched to connect to a specific device, PAM will replace these tokens with the appropriate values. <user> will be replaced with the name of the target account configured for auto-logon. There is no need to provide the password as a command line argument, PAM will insert the password of the target account automatically when prompted for it.

Additional Information

PAM TCP/UDP services using the SSH protocol allow for text-based session recording.