# SSH Proxy for PAM360 Remote Connect Connections PAM360 Remote Connect is a native desktop application that allows users to launch secure remote sessions to target systems using credentials managed in PAM360. By default, the Remote Connect application establishes a direct connection from the user’s machine to the target endpoint. While effective, this approach may not align with strict security policies that require network isolation between end-user devices and critical systems. To avoid direct communication between the PAM360 Remote Connect application and the target endpoints during remote sessions for enhanced security, configure the SSH proxy available in PAM360 for the PAM360 Remote Connect application. When configured, all remote connect requests are routed through a designated proxy resource managed within PAM360, ensuring better network control, reduced attack surface, and improved compliance with organizational security standards. ![ssh-proxy-architecture](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/ssh-proxy-architecture.webp) This document outlines the roles required, prerequisites, and SSH proxy configuration within the PAM360 web interface. Read further to know more about them in detail. 1. [Roles and Permissions](https://www.manageengine.com/privileged-access-management/help/ssh-remote-proxy.html#Roles_and_Permissions) 2. [Prerequisites](https://www.manageengine.com/privileged-access-management/help/ssh-remote-proxy.html#Prerequisites) 3. [Configuring SSH Proxy for PAM360 Remote Connect](https://www.manageengine.com/privileged-access-management/help/ssh-remote-proxy.html#Configuring_SSH_Proxy_Server) ## 1. Roles and Permissions By default, users assigned to the **Privilege Administrator**, **Cloud Administrator**, or **Administrator** roles can configure the SSH Proxy for PAM360 Remote Connect. In addition to these predefined roles, users with a custom role that has the **Configure SSH Proxy** privilege enabled are also allowed to perform SSH Proxy configuration. ## 2. Prerequisites Below are the prerequisites for the SSH proxy to work seamlessly to attain a secure remote connection: - The endpoint that will act as the proxy between the PAM360 Remote Connect and the target machine should be added as a resource in PAM360. - The user machine installed with the PAM360 Remote Connect should be able to communicate with the PAM360 server. - Similarly, the PAM360 server should be able to communicate with the resource configured as a proxy, and the proxy resource must be able to communicate with the target endpoints. - While configuring Windows resource as an SSH proxy, ensure that the OpenSSH Server runs as a service on the Windows resource. This requirement does not apply to Linux resources, as they have OpenSSH Server running by default. - To establish a successful connection between the machines running the Remote Connect application and the PAM360 server configured with SSH Proxy for Remote Connect, ensure that the TCP ports 50100 to 50300 are open as outbound ports on the PAM360 server. Remote Connect uses one TCP port per active session. Based on the expected number of concurrent Remote Connect sessions, administrators should allow the required number of ports within this range. For example, if 20 concurrent sessions are expected, at least 20 ports in this range should be permitted. If you require a customized port range, please contact our [support](mailto:pam360-support@manageengine.com) team for assistance. ## 3. Configuring SSH Proxy for PAM360 Remote Connect Connections **Best Practice** To bind the necessary ports to PAM360's IP address or FQDN instead of the default 'localhost', we recommend you to add the system property **sshtunnel.tunnelapi.bindaddress=** to the **system_properties.conf** file, which is located in the PAM360 installation directory's **conf** folder. To configure the SSH proxy for PAM360 Remote Connect from the PAM360 web interface, follow these steps: 1. Log in to PAM360 and navigate to **Admin >> PAM360 Gateways >> SSH Proxy - Remote Connect**. ![remote-connect-proxy](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/remote-connect-proxy.webp) 2. In the pop-up that opens, select the resource that acts as an SSH proxy in the **Resource Name** dropdown. **Additional Details** Users can set the PAM360 installed server/resource as the SSH proxy resource. However, the Windows Domain Server cannot be set as an SSH proxy. 3. Select a account from the **Account Name** dropdown, which is used to access the above-selected resource. 4. Click **Save** to make the selected resource act as an SSH proxy between the PAM360 server and the target endpoints. Administrators can manage SSH proxy access for individual users using the **Remote Connect Access via SSH Proxy** option in the **Edit User** window. When enabled, remote connections initiated by the user through the PAM360 Remote Connect application are routed through the configured SSH proxy. When disabled, Remote Connect establishes direct connections to the target resources. If the configured SSH proxy becomes unavailable, remote connections initiated by users with SSH proxy access enabled will fail. PAM360 Remote Connect does not automatically establish direct connections to the target resources. To allow direct connections for that user, administrators can disable the **Remote Connect Access via SSH Proxy** option in the **Edit User** window. Refer to [this](https://www.manageengine.com/privileged-access-management/help/editing_users.html#Editing_User_Account) section to enable or disable Remote Connect access via SSH proxy for a user. ![editing-users-1](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/editing-users-1.webp)