CyberArk PSM

CyberArk PSM

This page explains how a session, or every session in a folder, connects through CyberArk's Privileged Session Manager instead of directly: SSH and SFTP through PSM for SSH, Remote Desktop through the PSM server. It needs a CyberArk source; see Credential sources.

Through PSM, the target's password never reaches your PC: PSM logs in to the target with the account CyberArk holds, and records the session when your company has that switched on.

Like the rest of the CyberArk support, this was built from CyberArk's documentation and has not yet run against a real PSM. If you have one, please try it and report what you see through Report a problem.

Setting up the source

In the CyberArk source (Settings, Credential sources, Edit), under Connecting through PSM:

• PSM for SSH server and PSM for SSH port (22): the address of PSM for SSH, for SSH and SFTP sessions.
• Your user name for PSM for SSH: optional, when it differs from the one you sign in with. On Privilege Cloud it is your full login name, such as name@company.com.
• Sign in to PSM for SSH with a key (on by default): after you sign in, Cablebag asks CyberArk for a short-lived SSH key, so PSM for SSH does not ask for your password. Needed with single sign-on, which has no password PSM could take.
• Remote Desktop through PSM: Choose for me, Through CyberArk (CyberArk hands out the connection for the account) or With an RDP client (Cablebag connects to the PSM server and PSM asks for your CyberArk sign-in).
• PSM server and PSM server port (3389): the PSM server or its load balancer, for connecting with an RDP client.
• Connection component (PSM-RDP): the PSM connection component for Remote Desktop.
• Your user name for PSM: optional, the CyberArk user name the PSM server gets, when it differs from the one you sign in with.

Per session and per folder

• In the editor of an SSH, SFTP or RDP session, the CyberArk PSM field offers Directly and Through CyberArk PSM: for each CyberArk source. Without a CyberArk source it says so, with a link to Credential sources.
• In a folder's Folder settings, CyberArk PSM (SSH, SFTP, RDP) sets it for every session in the folder and its subfolders. A session inside then shows "As the folder ...: through PSM of " and can still choose Directly to opt out; the session editor lists it under "From the folder".

The session's User name is the user on the target (such as root or Administrator). Leave it empty to take the user of the login linked under Login from the vault. For a domain account, write it as user#domain, which is how PSM for SSH itself asks for one.

SSH and SFTP through PSM for SSH

Cablebag connects to the PSM for SSH server instead of the target, and tells PSM where to go in the login name, as CyberArk documents it:

• The short form is <your CyberArk user>@<target user>@<target address>, with #<domain> after the target user when there is one and #<port> after the address when the port is not 22. For example jsmith@root@10.0.0.5 or jsmith@admin#corp.example.com@srv1#2222.
• When the short form cannot hold it (a target user with an @ in it, no target user, your CyberArk user with more than one @), Cablebag uses the documented key-value form instead: +vu+<your user>+tu+<target user>+da+<domain>+ta+<address>+tp+<port>.
• An IPv6 address goes in with hyphens instead of colons.

The terminal says "Through CyberArk PSM for SSH ()." when it connects. With Sign in to PSM for SSH with a key, Cablebag signs in to CyberArk first (the single sign-on window opens if needed), fetches the key and logs in with it: "Logged in with the key from CyberArk." Without a key, PSM for SSH asks for your CyberArk password in the terminal, as it would for any SSH client. Without a target user, PSM for SSH asks for that in the terminal too.

SFTP sessions take the same route. Logins that hold an SSH key rather than a password cannot be fetched by Cablebag; the message says to connect to them through PSM for SSH.

Remote Desktop through PSM

There are two ways, chosen under Remote Desktop through PSM in the source:

• Through CyberArk: Cablebag signs in to CyberArk, takes the account linked to the session (or looks for one that fits the target user and address, and asks when there are several), asks for a reason or ticket when the account's platform wants one, and asks CyberArk to hand out the connection. The Remote Desktop tab then opens to the PSM server with what CyberArk returned. Accounts that CyberArk checks out for that are listed under Settings, Credential sources with Check in.
• With an RDP client: Cablebag opens a Remote Desktop connection to the PSM server with the documented start program psm /u <target user> /a <target address> /c <connection component>, and PSM logs you in from there. Before it connects, Cablebag asks for your CyberArk password for the PSM server; leave it empty to type it on the PSM sign-in screen instead. This way is not available with single sign-on, which has no password the PSM sign-in screen could take.
• Choose for me takes Through CyberArk when the session has a linked login, when you sign in with single sign-on, or when no PSM server is filled in; otherwise it connects with an RDP client.

The Remote Desktop log shows "Through CyberArk PSM ()."

What a PSM administrator needs to have set up

• Your CyberArk user may see the accounts and is allowed to connect through PSM with them.
• For SSH and SFTP: PSM for SSH reachable from this PC on its port, and the accounts' platforms allowing connections through PSM for SSH. For Sign in to PSM for SSH with a key, MFA caching SSH keys have to be enabled in CyberArk for your user.
• For Remote Desktop: the PSM server (or its load balancer) reachable from this PC, and a connection component (PSM-RDP unless yours is named differently) on the accounts' platforms. For Through CyberArk, the PSM connection through the API has to be allowed for the account.
• For Single sign-on (SAML): "IdP initiated SSO" enabled on the PVWA, as the SAML API needs it.

Troubleshooting

• "Fill in the PSM for SSH server of under Settings, Credential sources." or "Fill in the PSM server of ...": the source has the PSM option on a session but no server address.
• "Fill in your CyberArk user name for under Settings, Credential sources.": with single sign-on CyberArk did not say who you are; fill in the User name (or Your user name for PSM for SSH) in the source.
• "PSM for SSH did not accept the key from CyberArk.": PSM for SSH then asks for your password. Check that MFA caching keys are enabled for your user and that Your user name for PSM for SSH is the login name PSM expects (on Privilege Cloud the full one).
• " holds an SSH key, not a password. Connect to it through PSM for SSH.": set Through CyberArk PSM on that session instead of fetching the password.
• "Connecting through PSM with an RDP client needs the target's user name and address.": fill in the session's User name and Remote host, or link a login.
• "There are N CyberArk accounts for . Which one?": pick one, or link the right account under Login from the vault so the question does not come back.
• A window Access through asking for a reason or ticket is CyberArk's doing, not an error: the account's platform wants one.
• Nothing answers at all: check that the PSM for SSH or PSM server address and port are reachable from this PC (Tools, Port scanner), and that a WireGuard network or jump host the session uses is right for the PSM server, not only for the target.

When something does not behave as described here, use Report a problem (Settings, About Cablebag) and say which CyberArk edition and sign-in method you use; the exact message from the terminal or the Remote Desktop log helps most.