jquintard

Hello William,

Thank you for your reply, I will take a look. Regarding the suggestion to review it together, would it be possible to speak with someone who speaks French? It would be easier for me.

Jerome

Hi there,

I don’t understand how the Devolutions PAM works, or I might be missing something.

For me, PAM involves several actions:

1. Rotating passwords

2. Protocol break between client/server (for example, no direct access to the RDP port)

3. Recording sessions as video

4. Allowing privileged sessions with a workflow/approval system

5. Potentially being able to block certain actions or commands on systems

Which of these actions are handled by Devolutions? I believe that for points 2 and 3, it is necessary to go through Devolutions Gateway. Is that correct? My usage is internal only.

I mainly want to use PAM for actions 1 to 3 for the IT Admin team. What I don’t understand now is how to import PAM accounts for individual use. Let me explain :

• In my Active Directory, I have T0 and T1 OUs (for a tiering model).

• In T0 and T1, I have admin accounts (e.g., t0.jdoe, t0.bdupont, t1.jdoe, t1.bdupont).

• These are the privileged accounts.

• On the Devolution Server, I therefore have a user John Doe and a user Bernard Dupont.

• On RDM, each of them has T0 resources (AD VMs, routers, etc.) and T1 resources (business VMs, switches, etc.).

How can I ensure that John Doe can only use his own accounts (t0.jdoe on T0 ressources and t1.jdoe on T1 ressources) and not Bernard Dupont’s accounts?

At the moment, he can see all of them.

Jerome