8.2 PSM Connection Components (PSM-RDP, PSM-SSH, PSM-Web)

8.2 PSM Connection Components (PSM-RDP, PSM-SSH, PSM-Web)

Quick Answer: A Connection Component (CC) in CyberArk defines how the PSM launches target client software, connects to endpoints, and injects credentials. Pre-configured components include PSM-RDP (mstsc.exe for Windows desktops), PSM-SSH (putty.exe on Windows PSM for Unix terminals), and PSM-Web (Chromium browser automation using WebFormFields for cloud and web portals like AWS, Azure, and vSphere). Connection components are defined globally in PVWA under Administration > Options > Connection Components and are assigned and customized at the platform level under Target Settings.

---

Architecture and Object Hierarchy of Connection Components

Connection Components provide a modular framework that decouples target access logic from account data:

• Master Component Definitions: Stored in the PVWAConfig Safe and managed globally in Administration > Options > Connection Components. Each definition establishes the component ID, executable path, dispatcher binary, default arguments, and window management policies.
• Platform Association: Administrators link connection components to target platforms under Platform Management > [Platform] > UI & Workflows > Privileged Session Management. Once linked, accounts on that platform expose a Connect option for that component.
• Platform Target Settings Overrides: Specific connection parameters can be overridden at the platform level—such as modifying command-line parameters, screen resolution, or timeout values—without modifying the master baseline.

Session Execution Lifecycle

1. User Initiation: The user selects Connect in PVWA on an authorized privileged account.
2. Token Creation: PVWA generates an ephemeral session token in the Vault and returns a dynamically constructed .rdp file containing token parameters.
3. Session Brokering: The user's RDP client establishes an RDS session to the PSM host using PSMConnect.
4. Dispatcher Execution: PSM reads the token, identifies the assigned Connection Component, and launches the designated dispatcher.
5. Credential Retrieval & Injection: The dispatcher requests the target credential from the Vault over TCP port 1858 via PSMApp, launches the target application, and injects credentials into client memory.
6. Audit Hook Attachment: The PSM recorder binds to the application process, capturing video frames, text keystrokes, and window titles.

---

Standard Out-of-the-Box Connection Components

CyberArk provides pre-configured Connection Components supporting standard enterprise administrative protocols:

PSM-RDP: Windows Desktop Administration

• Client Executable: Microsoft Remote Desktop Client (mstsc.exe).
• Injection Mechanism: Native Windows RDP APIs. The dispatcher dynamically configures RDP parameters and injects vaulted Windows credentials without displaying passwords.
• Display Modes: Supports full desktop sessions or seamless RemoteApp windows where the remote client displays as a standalone application on the user's desktop.
• Audit Capabilities: Video recording, active window title tracking, process launch auditing, and keystroke logging.

PSM-SSH: Terminal Access via Windows-Hosted PuTTY

• Client Executable: Embedded PuTTY client (putty.exe) hosted locally on the Windows PSM server.
• Architectural Distinction: PSM-SSH executes on the Windows PSM server within an RDS session, rendering a graphical PuTTY terminal. This differs from PSM for SSH (PSMP), which is an independent Linux appliance proxying native command-line SSH sessions.
• Injection Mechanism: The dispatcher launches PuTTY with dynamic command-line arguments, injecting vaulted SSH keys or passwords during the SSH handshake.
• Audit Capabilities: Keystroke logging, terminal output capture, executed command auditing, and integration with Privileged Threat Analytics (PTA).

Specialized Thick-Client Administration

CyberArk provides tailored dispatchers for common administrative tools:

• PSM-WinSCP: Automates secure SFTP/SCP file transfers to Linux systems while disabling interactive shell access within the GUI to prevent unmonitored command execution.
• PSM-Toad & PSM-SQLPlus: Facilitates Oracle database management, injecting TNS net service names, database usernames, and passwords into client connection dialogs.
• PSM-SQLServerManagementStudio (SSMS): Manages Microsoft SQL Server instances, supporting both SQL Server authentication and Windows Authentication via runas process elevation.

---

Modern Web and Cloud Automation: The PSM-Web Framework

The PSM-Web (WebApp) framework automates privileged access to cloud consoles and SaaS interfaces (AWS, Azure, GCP, VMware vSphere, Snowflake) using Chromium-based browsers (Google Chrome or Microsoft Edge) driven by CyberArk.Extensions.WebAutomation.Dispatcher.exe.

WebFormFields Syntax and DOM Injection

The dispatcher locates HTML Document Object Model (DOM) elements and executes automated actions defined in the WebFormFields configuration:

<Element Selector> > <Target Value / Variable> (<Action Qualifier>)

• Element Selectors: Identifies elements via SearchBy=id, SearchBy=name, SearchBy=class, SearchBy=xpath, or SearchBy=css.
• Dynamic Vault Macros: Populated at runtime, including {Username}, {Password}, {Address}, {LogonDomain}, and {ExtraPass1}.
• Action Qualifiers: Directives such as (click) for buttons, (submit) for form submission, (check) for checkboxes, and (select) for dropdowns.

For multi-page authentication workflows (e.g., Azure or AWS where username and password exist on sequential screens), WebFormFields executes sequential steps:

//input[@type='email'] > {Username} (SearchBy=xpath)
//input[@type='submit'] > (click) (SearchBy=xpath)
//input[@type='password'] > {Password} (SearchBy=xpath)
//input[@id='idSIButton9'] > (click) (SearchBy=xpath)

Browser Hardening & Kiosk Lockdown

To maintain jump-host isolation, PSM browser instances are strictly hardened:

• Kiosk Mode: Launched with --kiosk and --app flags to hide the address bar, navigation buttons, and tabs.
• Developer Tools Disabled: Registry policies block F12 Developer Tools, page source inspection, and web consoles.
• File Downloads Blocked: Local file downloads, printing (Ctrl+P), and file:// URL schemes are blocked to prevent data exfiltration from the PSM host.

---

Target Settings and Parameter Configuration

Administrators configure operational behavior under the Target Settings branch in PVWA:

• ClientApp: Defines the path and CLI arguments for the target application.
• ClientDispatcher: Path to the dispatcher binary orchestrating the session.
• ClientInvokeType: Set to Dispatcher when using a wrapper or Executable for direct binary invocation.
• LockApplicationWindow: Restricts the RDS session strictly to the target client window. When the user closes the application, the PSM RDS session immediately terminates, preventing access to the underlying jump host desktop.
• ConnectionData: Defines dynamic parameters passed from the Vault to the dispatcher.
• Timeout: Maximum time (in seconds) allowed for client launch and credential injection before raising an error.

---

Connection Components Technical Comparison