SSH Command Control Filtering

PAM360 enables users to initiate remote sessions using the SSH protocol to perform specific operations through command execution. With the SSH Command Control Filtering feature, administrators can define and enforce a set of pre-approved command lists by associating command groups with relevant accounts, resources, or resource groups. This feature ensures that users with access to SSH-enabled resources are restricted to executing only those commands explicitly permitted within the assigned command groups. This granular level of access control significantly enhances security by preventing unauthorized or unintended command executions during SSH sessions.

All actions involving commands and command groups, such as creation, modification, association, and execution, are fully audited and logged under the resource audit section, complete with operation types and user-provided reasons for traceability and compliance.

By the end of this document you will have learned the following topics relevant to SSH Command Control Filtering in PAM360:

1. Roles and Permissions
2. Managing the Commands
3. Managing the Command Groups
4. Configuring SSH Command Control
5. Executing the Filtered Commands
6. How Configuration Precedence Works in Real-Time?

1. Roles and Permissions

By default, users with roles such as Administrator, Privileged Administrator, Password Administrator, and Cloud Administrator are granted permissions to manage or use SSH Command Control in PAM360. Additionally, administrators can configure custom roles with the following privileges to manage and use SSH command control effectively:

• Manage Command Lists : Enabling this privilege allows users to create, edit, delete, and manage command lists and command groups. Users can also associate or dissociate commands within groups.
• Associate Command Groups : Enabling this privilege allows users to associate or dissociate command groups with accounts, resources, or resource groups. Users can also view available commands and command groups from the Manage Command Lists interface.
• Use Command Control : Enabling this privilege restricts users to executing only the predefined commands associated with SSH-based resources. Users without this privilege will be restricted from initiating SSH connections for accounts configured with SSH command control.

2. Managing the Commands

The Manage Commands section in PAM360 allows users to create, import, edit, delete, and export commands used in SSH command control. This helps enforce fine-grained access control by limiting users to a predefined set of commands during remote SSH sessions.

To begin, navigate to Admin >> Privilege Elevation >> Manage Commands. From the Commands tab in the Manage Commands window, you can perform the following operations:

2.1 Adding the Commands

You can add commands to PAM360 in two ways. Follow the below steps to add the commands manually

1. In the Commands tab, click the Add button.
2. In the window that appears, enter the following:
   • Command Name: A name for the quick identification of the command.
   • Command: The actual command to be executed.
   • Description: A brief explanation of the command.
3. Click Add to save the command or Add More to add additional commands. The newly added commands will appear in the Commands tab.
   
   

To import the commands via CSV, follow these steps:

1. In the Commands tab, click the Import button.
2. In the pop-up, select the file type and attach the appropriate file using the Attach File field, click Next. If importing from a password-protected ZIP, provide the ZIP file name and password.
3. Map the CSV columns to the required fields.

   Additional Details

   • Command Name and Command are mandatory.
   • CSV fields can be in any order.
   • You can also associate commands with command groups by mapping the Associate to Command Group field. If a command group mentioned in the CSV does not exist, it will be created automatically.
4. If you select the file type as Password protected ZIP file, enter the file name in the zip file and the password to access the file in the zip.
5. Click Import to complete the process. Imported commands will be listed in the Commands tab.
   

   Additional Detail

   To understand the correct CSV format, manually add a few sample commands and export them. Use the exported CSV as a template.

   

Click on the desired command from the command list. From the Command Details window that opens, you will get the command information, and you can also perform operations that include Edit and Delete.

2.2 Modifying the Commands

1. In the Commands tab, click the Edit icon next to the command you want to modify, or open the command's detail view and click Edit.
   
2. In the edit window, update the necessary fields.
   
3. Optionally, associate the command with existing command groups using the Associate to Command Group field.
   
4. Click Save to apply the changes.

2.3 Deleting the Commands

1. In the Commands tab, click the Delete Command icon under Actions beside the desired command or the Delete button from the Command Details pop-up.
2. In the pop-up that opens, click on the Delete button to delete the command from the command list.
3. To delete the commands in bulk:
   1. Select the desired commands to be deleted.
   2. Click the Delete button on the top pane.
   3. Click Delete to delete the selected commands in bulk.

   Caution

   Deleting a command will permanently remove it from the command list and dissociate it from any associated command groups.

2.4 Exporting the Commands

You can export all commands listed in the Commands tab as a CSV file:

• Click the Export button in the Commands tab.
• A CSV file containing all available commands will be generated and downloaded to your browser’s default download directory.

3. Managing the Command Groups

Once you have created and configured the necessary commands, you can begin managing the command groups through the Command Groups tab in the Manage Commands window. This section outlines the key operations you can perform such as Add, Edit, Associate, Dissociate, and Delete, with step-by-step instructions for each.

3.1. Adding a Command Group

1. Navigate to the Command Groups tab and click the Add button.
2. In the pop-up window, enter the Command Group Name and Description, then click Add.

   Additional Detail

   Before confirming the addition, you can associate commands with this new command group by selecting them from the list displayed below. Once added, click on the desired command group in the Command Groups tab to open the Command Group Details window. Here, you can view the group’s information, its associated commands, and perform further actions such as Edit or Delete.

   

3.2 Modifying a Command Group

1. In the Command Groups tab, locate the command group you want to modify.
   
2. Click the Edit icon under the Actions column or click the Edit button in the Command Group Details pop-up.
   
3. In the edit window, make the necessary updates and click Save to apply the changes.

3.3 Deleting the Command Groups

To delete an individual command group:

1. In the Command Groups tab, click the Delete icon under Actions for the desired command group, or click the Delete button in the Command Group Details pop-up.
   
2. Confirm the deletion in the prompt that appears.

To delete multiple command groups at once:

1. Select the checkboxes next to the command groups you want to delete.
   
2. Click the Delete button in the top toolbar.
   
3. Confirm the deletion in the pop-up dialog.

3.4 Associating or Dissociating the Commands in Command Groups

1. In the Command Groups tab, click the Edit icon beside the desired command group or open the Command Group Details and click Edit.
   
2. In the edit view, select or deselect the commands from the available list to associate or dissociate them with/from the command group.
   
3. Click Save to confirm the changes.
   

   Additional Detail

   You can also associate commands while creating a new command group by selecting them during the initial setup.

4. Configure SSH Command Control

Once the desired command groups are created, you can begin configuring SSH Command Control at the account, resource, and resource group levels. The following sub-sections outline the step-by-step process to configure SSH Command Control at each of these levels.

4.1 Configuring SSH Command Control for Accounts

To configure SSH Command Control for an account, follow these steps:

1. Navigate to Resources >> All My Passwords >> Resources, and click on the desired SSH resource. Alternatively, navigate to Resources >> All My Passwords >> Passwords.
   
2. On the page that appears, click the Account Actions drop-down beside the desired account and select Configure SSH Command Control.
   
3. In the pop-up window, select the required command groups to associate with the account and click Associate.
The selected command groups will now be associated successfully, and SSH command control will be enabled for the account.


Additional Detail

To dissociate command groups, deselect the desired command groups or click Dissociate to remove command control from the account.

The same can be configured in bulk for accounts by selecting the desired accounts, clicking the More Actions drop-down, choosing Configure SSH Command Control, selecting the desired command groups in the pop-up window, and clicking Associate.

4.2 Configuring Command Control for Resources

To configure SSH Command Control for a resource, follow these steps:

1. Navigate to Resources >> All My Passwords >> Resources.
2. Click the Resource Actions drop-down beside the desired SSH resource and select Configure >> SSH Command Control.
3. In the pop-up window, select the command groups to associate with the resource and click Associate.
   
   
The selected command groups will now be associated successfully, and SSH command control will be enabled for the resource.


Additional Detail

To dissociate command groups, deselect the desired command groups or click Dissociate to remove command control from the resource.

The same can be configured in bulk for resources by selecting the desired resources, clicking the Resource Actions drop-down, choosing Configure SSH Command Control, selecting the desired command groups in the pop-up window, and clicking Associate.

4.3 Configuring Command Control for Resource Groups

To configure SSH Command Control for a resource group, follow these steps:

1. Navigate to the Groups tab.
2. Click the Actions drop-down beside the desired resource group and select Configure SSH Command Control.
3. In the pop-up that opens, select the required command groups to associate with the resource groups and click Associate.
The selected command groups will now be associated successfully, and SSH command control will be enabled for the resource.


Additional Detail

To dissociate command groups, deselect the desired command groups or click Dissociate to remove command control from the resource groups.

The same can be configured in bulk for resources by selecting the desired resources, clicking the Bulk Configuration drop-down, choosing Configure >> SSH Command Control, selecting the desired command groups in the pop-up window, and clicking Associate.

5. Executing the Filtered Commands

Users assigned the Use Command Control role can only execute the commands defined in the associated command groups at the configured levels. To execute allowed commands:

1. Launch a remote session for the desired account using the SSH protocol.
   
2. In the opened session, a predefined list of allowed commands, associated with the logged-in SSH account, will appear in the right pane.
3. Hover over the right pane and click the Execute icon next to the command to run it in the SSH console.
4. Click the Preview icon to view execution logs for the selected command.
   

6. How Configuration Precedence Works in Real-Time?

The following cases describe how command control configurations are prioritized when applied at multiple levels:

Case 1: Account + Resource + Resource Group - If an SSH session is governed by configurations at all three levels (account, resource, and resource group), account-level configurations take precedence.

Precedence Order: Account << Resource << Resource Group

Case 2: Resource + Resource Group - If configurations exist at both the resource and resource group levels, the resource-level configuration takes precedence.

Case 3: Multiple Resource Groups - If configurations are applied via multiple resource groups, the authorized SSH session will use the combined set of commands from all associated command groups.