8.1 PSM Architecture, Jump Host Isolation & Service Accounts

8.1 PSM Architecture, Jump Host Isolation & Service Accounts

Quick Answer: The CyberArk Privileged Session Manager (PSM) serves as an isolated jump-server proxy between user workstations and critical target infrastructure. Administrators initiate an RDP connection over TCP port 3389 to the PSM host, which retrieves privileged credentials from the Digital Vault over TCP port 1858 and establishes an independent session to the target system. Through transparent credential injection, secrets are injected directly into client process memory without ever being revealed to the user. The PSM runs on hardened Windows Server with Remote Desktop Services (RDS) and utilizes two dedicated service accounts: PSMApp_<hostname> for retrieving Vault secrets and PSMGw_<hostname> for session brokering and token validation.

---

The Jump Host Isolation Paradigm

In standard enterprise environments, direct administrative access from user workstations to production servers introduces grave security risks:

• Endpoint Compromise & Keylogging: Workstations run email clients and web browsers exposed to phishing and malware. Keyloggers on compromised endpoints easily intercept typed administrative credentials.
• Memory Scraping: Attackers use tools like Mimikatz to scrape plaintext credentials, NTLM hashes, and Kerberos tickets from endpoint memory.
• Network Traversal: Direct routing between user subnets and sensitive management subnets allows ransomware and worms to propagate laterally.

The CyberArk PSM eliminates these risks by enforcing a dual-session isolation architecture:

1. Client-to-PSM Session (Session 1): The user connects from their workstation to the PSM jump host via standard RDP (TCP port 3389) or browser-based HTML5 Gateway.
2. PSM-to-Target Session (Session 2): The PSM independently initiates a secondary connection to the target system using the target's native protocol (such as RDP on 3389, SSH on 22, or HTTPS on 443).

Because the two sessions terminate on the PSM host, there is zero direct IP routing between the client subnet and the target system. Malware on the client endpoint cannot traverse the network boundary. Additionally, PSM sanitizes the connection by stripping risky virtual channels—such as local drive redirection and client printer sharing—preventing unauthorized file transfers and device exploitation.

---

Transparent Credential Injection Mechanics

CyberArk PSM decouples administrative access from credential knowledge through transparent credential injection:

• No Cleartext Exposure: Privileged passwords, SSH keys, and cloud API tokens are managed and rotated in the Vault. The user never views, types, or knows the secret.
• In-Memory Injection: When a session launches, the PSM retrieves the credential payload into volatile memory and injects it directly into the target client process via Windows API hooks. Credentials never touch the client clipboard or endpoint disk.
• Ephemeral Token Validation: During launch, PVWA validates user permissions, writes a short-lived session token to the Vault, and embeds it into a dynamic .rdp file. The PSM validates this token against the Vault over TCP port 1858 before fetching credentials.
• Session Auditing: PSM attaches video recording, keystroke logging, and window title monitors directly to the target process, persisting audit logs into the PSMRecordings Safe.

---

Windows Server Hardening & Remote Desktop Services (RDS) Role

The PSM server is installed on Windows Server configured with the Remote Desktop Services (RDS) Session Host role and requires valid RDS Client Access Licenses (CALs). To prevent users from escaping the proxied session, the host undergoes rigorous hardening:

Automated Hardening & Security Controls

• PSMHardening.ps1 Script: Executes post-installation to apply local security templates, disable unused Windows features, and lock down user rights.
• AppLocker Enforcement: Windows AppLocker rules (PSMConfigureAppLocker.xml) enforce a strict whitelist, blocking unauthorized binaries, DLLs, and scripts. Only approved CyberArk dispatchers and target client executables can run.
• Shell Lockdown: Standard Windows Explorer shell, taskbar, Start menu, and system hotkeys (Win+R, Ctrl+Alt+Del) are disabled for standard sessions. Users interact solely with the assigned client window.
• Virtual Channel Restriction: Group policies disable client drive mapping, clipboard redirection (or restrict to unidirectional text auditing), smart cards, and serial COM ports.
• Local Service Accounts: The installation creates two local user accounts:
  • PSMConnect: Low-privilege local user executing RDS sessions and connection dispatchers.
  • PSMAdminConnect: Used exclusively for administrative sessions, session shadowing, and live monitoring.

---

Dedicated PSM Service Accounts: PSMApp and PSMGw

During installation, two dedicated machine identities are created in the Digital Vault: PSMApp_<hostname> and PSMGw_<hostname>.

Both .cred files are bound to the PSM host using local cryptographic entropy, preventing offline extraction if files are moved.

---

Network Port Matrix & Enterprise Traffic Flow

Proper firewall rules are essential for establishing the PSM security perimeter:

The Digital Vault never initiates connections to the PSM server; all Vault traffic is initiated outbound from PSM over TCP port 1858. Workstations never route directly to target ports or Vault TCP 1858.