Connect to an Endpoint
You connect to an endpoint through its gateway. Use your own terminal or a terminal in the browser. Either way, you approve a push before the session opens.
Before You Start
- A policy grants you an account on the endpoint.
- Your phone is set up with your organisation's MFA provider (Duo Security or Okta Verify). See MFA Providers.
Open the Connect Dialog
- Choose Switch product → PAM and go to Targets → Endpoints.
- Click Connect in the endpoint's row.
Connect is shown only on endpoints where a policy grants you at least one account.
- Pick the Account.
- Choose Connection string or Open terminal.
The dialog also shows the gateway's host-key fingerprint. The first time you connect, check that it matches the one your administrator shared.
Connect from Your Terminal
Choose Connection string and copy the command. It has this form:
ssh -p 2222 <your-name>@<account>@<endpoint>@<gateway>
| Part | Value |
|---|---|
<your-name> | The part of your email before the @. If that matches more than one person, use your full email |
<account> | The account on the endpoint |
<endpoint> | The endpoint |
<gateway> | The gateway's address |
Run it from any terminal. You need no certificate, SSH key or AuthNull CLI.
Approve the push on your phone. The session opens.
Connect from the Browser
Choose Open terminal. A terminal opens in the console. Approve the push on your phone. Type exit when you are done.
If You Are Refused
The connection closes with a short message. Every refusal looks the same, whatever the reason. Check that:
- a policy grants you this account on this endpoint, through this gateway,
- you approved the push before it timed out,
- the gateway is Online and not Disabled,
- you have not hit the push limits.
See Connecting by Name: Security for the limits.
After the Session
The attempt and its recording are in Access Logs.