Please enable JavaScript.
Coggle requires JavaScript to display documents.
🔐 MFA PAM Privileged Access Management (PAM) MFA with CyberArk (Linux) -…
🔐 MFA PAM Privileged Access Management (PAM) MFA with CyberArk (Linux)
1️⃣ PAM Introduction and Security Concept
🔹 What is PAM?
PAM = Privileged Access Management
Problem Without PAM:
❌ Shared root passwords
❌ Unknown administrator access
❌ No password accountability
❌ No session monitoring
❌ Password never changes
❌ Insider threat risk
Purpose of PAM 🔐
Control
Restrict and manage who can use privileged access
Monitor
Track privileged user activities in real time
Secure
Protect admin credentials from unauthorized usage
Audit
Maintain access records for compliance and investigation
Record
Capture privileged sessions for accountability
Manage Privileged Accounts
Store, rotate, and control administrator credentials
Privileged Accounts
root
The highest Linux privilege account with complete control over the operating system.
Linux Administrator Accounts
Admin user accounts used by system administrators for server management and maintenance.
Database Administrator Accounts (DBA)
Accounts with full database privileges to create, modify, secure, and manage databases.
Service Accounts
Non-human accounts used by applications and services to run automated tasks securely.
Application Accounts
Accounts used by business applications to access required systems, files, and resources.
Emergency Accounts (Break Glass)
Highly controlled backup accounts used only during critical failures or emergency situations.
🔹 Why Enterprise Uses PAM
Security Goals:
Least Privilege
User receives only required access
Zero Trust Security
Never trust automatically
Always verify identity
Password Security
Remove manual password handling
Compliance
PCI DSS
ISO 27001
NIST
Saudi NCA ECC
2️⃣ CyberArk PAM Architecture Overview
🔐 CyberArk Components
🏦 Digital Vault
Central secure storage system
Securely stores and protects privileged credentials used by administrators and services.
Stores:
🔑 Privileged Passwords
Stores root, administrator, and service account passwords with automatic rotation.
🔐 SSH Keys
Safely manages Linux SSH private keys to prevent unauthorized server access.
📜 Certificates
Protects digital certificates used for authentication and secure communication.
🗝 Secrets
Stores API keys, database credentials, tokens, and other sensitive information.
Security Features:
🔒 Encryption
Encrypts stored credentials so unauthorized users cannot read sensitive data.
🛡 Multi-layer Protection
Uses multiple security controls like encryption, access policies, and isolation.
👤 Access Control
Allows only approved users through PAM policies, roles, and MFA authentication.
📋 Audit Logging
Records every credential access, password checkout, session activity, and administrative action.
🔐 Connection with MFA + PAM + CyberArk (Linux)
CyberArk Digital Vault works as the secure backend of PAM, where Linux privileged accounts are stored,
controlled, monitored, and accessed only after user verification through MFA.
Example:
Linux Admin → MFA Authentication → CyberArk PAM → Vault Credential Checkout
→ Temporary Password/SSH Access → Linux Server → Session Recording & Audit
🌐 Central Policy Manager (CPM)
Automatic password management engine
Functions:
Change passwords automatically
Verify password changes
Enforce password policies
Example:
Linux root password
Before:
Root password:
Admin123
CPM changes:
RandomStrongPassword#8892
Admin never knows password
🔑 Password Vault Web Access (PVWA)
Web interface for administrators
Used for:
Request access
Approve access
Retrieve accounts
View sessions
🗄️ PrivateArk Database
🗄️ PrivateArk Database
The secure internal database of CyberArk Vault that stores all privileged access information.
Internal CyberArk database
The encrypted Vault database that protects privileged accounts, secrets, and security policies.
Stores:
Account Metadata
Contains account details like username, platform, address, Safe, and management settings (not necessarily the password itself).
Permissions
Defines which users, groups, or applications can view, use, modify, or manage privileged accounts.
Policies
Stores enterprise security rules such as password rotation, MFA requirements, session recording, approval workflow, and access controls.
🚪 Privileged Session Manager (PSM)
Controls administrator sessions
→ Acts as a secure gateway that manages and monitors privileged user connections to critical systems.
Functions:
Proxy connection
→ CyberArk PSM creates a controlled connection between the administrator and target server without exposing the server directly.
Session recording
→ Records the complete administrator session (screen activity) for security monitoring, auditing, and compliance.
Keystroke monitoring
→ Captures every command and keyboard action performed during a privileged session.
Command auditing
→ Tracks executed commands to verify administrator activities and detect unauthorized actions.
User does not connect directly:
→ Administrators never access production servers using their own direct credentials; CyberArk controls the entire access path.
Normal:
Admin
→ Administrator connects directly using SSH or remote access.
|
|
Linux Server
→ Target server where privileged operations are performed.
PAM:
Admin
→ Authorized user requests privileged access through CyberArk.
|
|
CyberArk PSM
→ Secure proxy server that authenticates users, injects credentials, records sessions, and controls commands.
|
|
Linux Server
→ Protected target system accessed only through CyberArk PSM.
Enterprise Security Benefits:
Credential Protection
→ Administrator passwords are stored inside CyberArk Vault and never exposed to users.
Password Rotation
→ CyberArk automatically changes privileged account passwords after use or on schedule.
Just-In-Time Access (JIT)
→ Users receive privileged access only for the required time period.
Approval Workflow
→ Access requests can require manager or security team approval before connection.
MFA Integration
→ Adds an additional authentication factor such as OTP, hardware token, or mobile approval before privileged access.
Session Isolation
→ Separates administrators from target servers to reduce insider threats and credential theft.
Compliance Auditing
→ Provides detailed logs and reports required for standards like ISO 27001, NIST, PCI-DSS, and NCA ECC.
Linux PAM MFA Flow:
User Login Request
→ Administrator requests access to Linux privileged account.
MFA Authentication
→ User verifies identity using additional authentication (OTP, token, smart card, etc.).
CyberArk Vault Verification
→ CyberArk checks stored privileged credentials securely.
PSM Connection
→ PSM opens a controlled SSH session to the Linux server.
Session Monitoring
→ Commands, activities, and screen actions are recorded.
Session Termination
→ Access ends and CyberArk rotates the password if configured.
CyberArk Components:
Digital Vault
→ Secure encrypted database where privileged account passwords and secrets are stored.
Password Vault Web Access (PVWA)
→ Web interface where users request and manage privileged access.
Central Policy Manager (CPM)
→ Automatically changes and manages privileged account passwords.
Privileged Session Manager (PSM)
→ Controls, records, and monitors privileged user sessions.
PrivateArk Client
→ Administrative tool used to manage CyberArk Vault operations.
Linux Integration:
SSH Privileged Accounts
→ Linux root and administrator accounts are onboarded into CyberArk.
SSH Proxy Access
→ Users connect through CyberArk instead of directly using SSH.
Sudo Control
→ Controls which privileged commands users can execute.
Root Password Protection
→ Root credentials remain hidden inside CyberArk Vault.
Session Recording
→ Every Linux administration activity is available for investigation.
3️⃣ CyberArk Core Terms
🏦 Vault
Definition:
Secure encrypted storage location
Stores:
Root passwords
SSH private keys
Service passwords
API secrets
Example:
Linux Server:
root password
Stored inside:
CyberArk Vault
Users never see:
Real password
Instead:
CyberArk provides controlled access
📦 Safe
Definition:
Logical container inside CyberArk Vault
Similar to:
Linux directory
Windows folder
Example:
Vault
|
|
Safe-Linux-Production
|
|
root-account
oracle-account
Safe Controls:
Who can access
What permissions
Audit logs
Example Safe:
Safe Name:
Linux-Production-Root
Members:
Linux Admin Team
Permissions:
View Account
Use Account
Manage Account
👤 Accounts
Definition:
Privileged identities managed by CyberArk
Examples:
Linux:
root
oracle
mysql
backup
Windows:
Administrator
Network:
Cisco enable account
Account Object Contains:
Username
Server IP
Operating System
Password
Rotation policy
Example:
Account:
root@server01.company.com
Username:
root
Platform:
Linux
Address:
10.10.10.50
4️⃣ Password Rotation
Definition:
Automatic password changing process
Without PAM:
Admin knows password
Password remains unchanged for years
With CyberArk:
CyberArk changes password automatically
Process:
1.
CyberArk connects to Linux server
2.
Authenticates
3.
Changes root password
4.
Stores new password in Vault
5.
Updates record
Password Rotation Types:
Automatic rotation
Scheduled rotation
Emergency rotation
Example:
Every 24 hours:
root password changes
5️⃣ Session Recording
Definition:
Recording privileged activity
Captures:
Commands
Terminal activity
Screen recording
User identity
Time
Example:
Admin:
ssh
root@server01
Through CyberArk:
Session recorded
Recorded:
whoami
sudo commands
configuration changes
Security Benefit:
Investigation:
Who changed firewall?
Who deleted file?
Who restarted service?
6️⃣ Approval Workflow
Definition:
Access requires authorization
Example:
Engineer wants root access
Request
|
|
Manager Approval
|
|
CyberArk grants access
|
|
Session starts
Workflow:
User Request
↓
Ticket Creation
↓
Manager Approval
↓
Time Limited Access
↓
Session Monitoring
↓
Access Removal
4️⃣ Linux Enterprise Integration with CyberArk
🔹 SSH PAM Integration
Normal SSH:
ssh
root@linux-server
CyberArk Controlled SSH:
User
|
|
CyberArk PSM
|
|
Linux Server
🔹 Linux Components
SSH Server
Path:
/etc/ssh/sshd_config
PAM Configuration
Path:
/etc/pam.d/
Authentication Modules
Path:
/lib/security/
/usr/lib64/security/
User Management
Files:
/etc/passwd
/etc/shadow
/etc/group
5️⃣ Linux Commands for PAM Administration
🔍 Check Users
cat /etc/passwd
🔍 Check Groups
cat /etc/group
🔍 Check SSH Configuration
cat /etc/ssh/sshd_config
🔍 Check Authentication Logs
RHEL:
/var/log/secure
Ubuntu:
/var/log/auth.log
🔍 Check Current Login Sessions
who
w
🔍 Check sudo Access
sudo -l
6️⃣ CyberArk Linux Account Onboarding Process
Step 1:
Discover Linux privileged accounts
Step 2:
Add server into CyberArk
Step 3:
Create Safe
Step 4:
Add Account Object
Step 5:
Configure Platform
Step 6:
Enable Password Rotation
Step 7:
Test Connection
Step 8:
Enable Session Recording
7️⃣ Enterprise Linux PAM Security Model
Before PAM:
Admin
|
|
Root Password
|
|
Linux Server
After PAM:
Admin
|
|
MFA Authentication
|
|
CyberArk
|
|
Approval
|
|
Session Recording
|
|
Linux Server
8️⃣ MFA Integration with CyberArk
Authentication Factors:
Password
Hardware Token
Mobile Push
TOTP
Smart Card
Example:
User Login:
Username
+
Password
+
MFA Token
|
|
CyberArk Access
9️⃣ Enterprise CyberArk Roles
👑 CyberArk Administrator
Manages:
Vault
Policies
Platforms
👨💻 Linux Administrator
Uses privileged accounts
👨💼 Manager
Approves access
🔎 Auditor
Reviews:
Logs
Sessions
Reports
🔟 CyberArk Monitoring and Auditing
Logs:
Authentication logs
Session recordings
Password changes
Access requests
Reports:
Failed login attempts
Privileged activity
Policy violations
1️⃣1️⃣ Job Skill Roadmap for Saudi Arabia Enterprise Jobs
Beginner:
Linux Administration
SSH Security
sudo
PAM authentication
Intermediate:
MFA
LDAP
Active Directory
Kerberos
Advanced:
CyberArk PAS
CyberArk PSM
CyberArk CPM
Vault Administration
Enterprise Level:
SIEM Integration
Splunk / Elastic
NCA ECC Compliance
ISO 27001 Controls
1️⃣2️⃣ Practical Lab Implementation
Build Linux Server:
Ubuntu / RHEL
Configure:
SSH
sudo
PAM
MFA
Deploy:
CyberArk Trial Lab
Integrate:
Linux SSH
Root Account
Password Rotation
Session Recording
Monitor:
SIEM
Logs
Alerts