Configure CyberArk PSM-SSH With the Support of HTML5 and AutoLogonSequenceWithLogonAccount – 51 Security

As different devices may have different logon processes, you can configure how PSM for SSH will log on to a device using the AutoLogonSequence parameter. This parameter defines a multi-line sequence that is used by PSM for SSH during the automatic logon process and contains regular expression prompts and responses that define the process. The regular expressions can include dynamic values that PSM for SSH reads from the account properties, user parameters, or client-specific parameters, in this order. You can override this configuration at platform level.

For more information, refer to Login Sequences.

Modify PSM Connectors’ Priority

If you have multiple Connection Compnents, the first one in the list will be shown as default, which will be used when user clicked Connect button.

1. Log onto the Password Vault Web Access as a user with permission to configure platforms.

2. Click ADMINISTRATION to display the System Configuration page, then click Platform Management to display a list of supported target account platforms.

3. Select the platform in which you will enable PSM for SSH, then click Edit; the settings page for the selected platform appears.

4. Expand UI & Workflows, and then expand Connection Components, and make sure that the PSM-SSH Connection Component is defined and enabled. Further, to enable users to copy files with PSM for SSH make sure that the PSM-SCPand PSM-SFTP Connection Components are defined and enabled.

5. Expand UI & Workflows, and then select Privileged Session Management; the PSM parameters are displayed with their default values.

6. To enable PSM to use accounts that are required to initiate PSM connections without requiring confirmation, even if the Safes are configured for Dual Control, change the value of DisableDualControlForPSMConnections to Yes.

7. Click Apply to save the new parameter values and stay in the same page,

or,

Click OK to save them and return to the System Configuration page.

Regex Value

If you are getting a freezing screen, and “059E Failed to execute login sequence” error, just like below, it most likely your auto logon sequece is having issue on Regex. 

Note: https://cyberark.my.site.com/s/article/PSM-059E-Failed-to-execute-login-sequence

The error is received, when the incoming prompt doesn’t match the defined regular expression.

The default is:

==

 \[.*\@.* ~]\$ >exec su – {Username} 

Password:>{Password} 
==

Change the regex to a more inclusive value.

 

For Prompts ending with the # character (Usually AIX machines):  .*\#

For Prompts ending with the $ character (Usually Unix and Linux):  .*\$

 

Note: It is less recommended to use the inclusive RegEx due to security concerns, therefore it is not applied for general use, and should be used only when the default or a specific value fail.

To change the default automatic logon sequence with logon account for all SSH connections that will be done with the PSMP-SSH connection component:

1. Click ADMINISTRATION, then in the System Configuration page click Options; the Web Access Options are displayed.

2. Expand Target Settings and then expand Client Specific; a list of Client Specific parameters appears.

3. Select AutoLogonSequenceWithLogonAccount, then in the Properties list, click the value of the Value property; the Value edit box appears.

4. Specify the prompts and responses to include in the automatic logon process, using regular expressions and dynamic account properties to mimic the exact sequence that will be run on the remote machine.

   As prompts differ according to machine, it is important to make sure that you write the prompt exactly as the machine requires.

   Specify the command that will elevate the logon user to the user who will run sessions on the remote machine. Use regular expression prompts and responses with dynamic values, as shown in the following example:

   In each line, the text to the left of the ‘>’ (parenthesis) represents the regular expression for the prompt on the remote machine. The text to the right of the ‘>’ (parenthesis) represents the PSM for SSH response, including a dynamic reference to an account property.

   This response can include one or more dynamic references. PSM for SSH reads these references in the following order: account properties, user parameters, then client specific parameters.

   To specify ‘>’ as a character in the prompt, use the character code \x3e.

Default PSM-SSH Connection Components Value:

\[.*\@.* ~]\$ >exec su - {Username}
Password:>{Password}

Change to:

.*\@.*~\$ >exec /usr/bin/su - {Username}
Password:>{Password}
.*\@.*~\$ >exec sudo -i
.*>{Password}

Troubleshooting

Some error screenshots  from CyberArk PSM.

The further logs can be found from PSM installation folder for troubleshooting purpose.