9.1 PSM for SSH (PSMP) Architecture & Unix Proxy Brokering

9.1 PSM for SSH (PSMP) Architecture & Unix Proxy Brokering

Quick Answer: PSM for SSH (historically designated PSMP or Privileged Session Manager Proxy) is a specialized Linux-based component running on hardened Red Hat Enterprise Linux, CentOS, or Rocky Linux. It enables Unix and Linux administrators, SREs, and DevOps engineers to connect directly to remote target servers using native SSH client tools (OpenSSH, PuTTY, SecureCRT) without opening a web browser or logging into Password Vault Web Access (PVWA). PSMP intercepts the SSH handshake, authenticates the user against the Digital Vault over TCP port 1858, retrieves and injects the target account's password or SSH private key, proxies the session over TCP port 22, and enforces real-time command access control and keystroke auditing.

---

Native Command-Line Access vs. GUI Jump Hosts

In enterprise PAM deployments, standard Privileged Session Manager (PSM) jump servers run on Windows Server with Remote Desktop Services (RDS). While Windows RDS functions effectively for graphical administration, it introduces operational friction for Unix administrators who rely on native terminal workflows, low-latency keystrokes, terminal multiplexers (tmux, screen), and scripting pipelines.

CyberArk addresses this divide with PSM for SSH (PSMP). Acting as a transparent SSH bastion proxy, PSMP provides:

• Native Terminal Experience: Administrators connect directly from command prompts, macOS Terminal, Linux shells, PuTTY, or SecureCRT without downloading .rdp files.
• Zero Credential Exposure: Users authenticate with their personal Vault identity. Target credentials (root, oracle, or service accounts) are retrieved from the Vault and injected into the downstream SSH stream without revealing secrets.
• Continuous Governance: Despite bypassing the PVWA portal, sessions remain audited, commands are filtered in real time, and transcripts are indexed in the Vault.

---

PSM for SSH Architecture & Linux Host Hardening

PSM for SSH installs on a dedicated, hardened 64-bit Linux server (RHEL, CentOS, Rocky Linux). CyberArk applies strict OS hardening templates to secure the host:

• Network Isolation: Inbound traffic is restricted strictly to TCP port 22 (SSH) from client subnets. Outbound traffic is restricted to TCP port 1858 to the Digital Vault and TCP port 22 to target Unix systems.
• Service Lockdown: Compilers, network diagnostics, legacy protocols (Telnet, FTP, R-commands), and unneeded daemons are deactivated. Root SSH access is disabled.
• Modified OpenSSH Daemon (sshd): Listens on TCP port 22 and hands off incoming connections to CyberArk's PAM layer.
• CyberArk PAM Module (pam_psmp.so): Intercepts incoming SSH connection strings, parses compound arguments, and routes authentication requests to the Vault.
• PSMP Server Service (psmpsrv): Core background engine that manages connection state, executes credential injection, enforces command filters, and buffers session audits.
• Service Identities: Operates using dedicated Vault identities (PSMPAppUser, PSMPGWUser) secured in local machine-bound .cred files.

---

Connection String Syntax & Parsing Variations

Users supply connection metadata within a single compound SSH command line to connect without a web interface.

1. Standard OpenSSH Delimiter Syntax

The default syntax uses the @ delimiter:

ssh <VaultUser>@<TargetUser>@<TargetHost>@<PSMPHost>

• <VaultUser>: The human operator's identity in the Vault (AD user or local Vault user).
• <TargetUser>: The target account managed in the Vault (e.g., root, appadmin).
• <TargetHost>: The hostname or IP address of the destination Unix endpoint.
• <PSMPHost>: The FQDN or IP address of the PSM for SSH proxy server.

Example: An administrator named jdoe connecting to linux-prod01.corp.local as root via psmp.corp.local:

ssh jdoe@root@linux-prod01.corp.local@psmp.corp.local

2. Alternate Delimiter Syntax

Certain terminal clients or scripts struggle parsing multiple @ symbols. Configurable delimiters in basic_psmpserver.conf resolve this:

• Hash Delimiter (#): ssh <VaultUser>#<TargetUser>#<TargetHost>@<PSMPHost>
• Percent Delimiter (%): ssh <VaultUser>%<TargetUser>%<TargetHost>@<PSMPHost>
• Plus Delimiter (+): ssh <VaultUser>+<TargetUser>+<TargetHost>@<PSMPHost>

Example using hash syntax:

ssh jdoe#root#linux-prod01.corp.local@psmp.corp.local

3. Port & Target Domain Syntax

When target endpoints listen on non-standard SSH ports, append the port parameter:

ssh <VaultUser>#<TargetUser>#<TargetHost>#<TargetPort>@<PSMPHost>

Example for port 2222: ssh jdoe#root#linux-prod01.corp.local#2222@psmp.corp.local

4. Direct Account Query Syntax

To connect directly to a uniquely named Vault account object:

ssh <VaultUser>#<AccountName>@<PSMPHost>

---

The Authentication & Brokering Lifecycle

1. Client Handshake (TCP 22): The user runs the compound SSH command. The client establishes an SSH tunnel with the PSMP host. The OpenSSH daemon invokes pam_psmp.so to extract the connection string arguments.
2. Vault Authentication & Authorization (TCP 1858): PSMP prompts the user for their Vault password or MFA token (supporting local passwords, LDAP/AD, or RADIUS). PSMP queries the Vault over TCP port 1858 via PSMPAppUser to verify the user holds Use accounts, Retrieve accounts, and List accounts permissions on the Safe.
3. Transparent Credential Injection: If authorized, the Vault releases the target secret (password or SSH private key) to PSMP over TCP 1858. The secret is held in volatile non-pageable memory and never written to disk or shown to the user.
4. Proxied Target Execution (TCP 22): PSMP initiates an outbound SSH connection to <TargetHost> on TCP port 22, completes authentication using the retrieved secret, and bridges the user's terminal stream to the target pseudo-terminal (pty).

---

Command Access Control & Security Enforcement

PSMP acts as an active security filter through SSH Command Access Control, configured in platform settings:

• Blacklist Mode: Permits standard Unix commands while blocking explicitly forbidden commands or flags (e.g., reboot, shutdown, fdisk, iptables -F).
• Whitelist Mode: Enforces zero trust by denying all commands by default, permitting only explicitly approved commands (e.g., systemctl status *, df -h, cat /var/log/*).
• In-Line Inspection: PSMP parses command input at the proxy layer before forwarding bytes to the target, checking against regular expressions, subshells (bash -c), and pipelines.
• Enforcement Actions: Violations trigger a Block and Notify response (warning banner displayed, command blocked) or an Immediate Session Termination response (both client and target sessions severed immediately).

---

Keystroke Logging, Auditing & Transcripts

PSMP provides exhaustive session visibility for compliance:

• Keystroke Logging: Every typed command, backspace, and terminal response byte is captured by psmpsrv at the proxy layer, preventing user bypass.
• Searchable Transcripts: Audit events are formatted into text transcripts and uploaded to the PSMRecordings Safe in the Vault for PVWA search.
• Packet Capture (pcap): High-security configurations can capture full raw network packet streams of the SSH conversation for forensic analysis.

---

PSM (Windows RDS) vs. PSM for SSH (Linux Proxy)