PAM MFA
AuthNull's privileged access management (PAM) controls SSH access to your Linux servers.
- Servers are reached through an SSH gateway. No agent runs on the server.
- Every session needs a push approval from your organisation's MFA provider (Duo Security or Okta Verify). See MFA Providers.
- AuthNull keeps the servers' local account passwords in its vault and rotates them.
- Every session is recorded.
Windows servers cannot be reached through a gateway. They are protected with the AuthNull agent. See Agent-Based Endpoints.
Open PAM
In the console, choose Switch product → PAM.
The PAM sidebar has these items:
| Sidebar item | What it is for |
|---|---|
| Gateways | The SSH gateways in your network |
| Targets → Endpoints | The servers reached through a gateway |
| Targets → Endpoint Users | The local accounts on those servers |
| Targets → Endpoint Groups | Collections of endpoints |
| Policies | Who may use which account on which server |
| Access Logs | Every SSH attempt, its outcome and its recording |
Settings is opened from the account menu in the top right.
Dashboard
Administrators land on the PAM dashboard (PAM · Overview / Dashboard). Click Refresh to update it.
| Card | Shows |
|---|---|
| Gateways live | Gateways online, out of the total |
| Endpoints online | Endpoints online, out of the total, and how many endpoints need setup |
| SSH policies | The number of policies, and the operators they cover |
| Live now | Open sessions and active sudo elevations |
| Last 24h attempts | Approved, denied and refused attempts, and recordings |
Below the cards, a chart shows activity per hour for the last 24 hours.
How It Works
- Onboard a gateway in your network, next to the servers it will reach.
- Add endpoints through the gateway. AuthNull sets each one up, scans its accounts and takes over their passwords.
- Create a policy naming who may use which account on which endpoint, through which gateway.
- Connect and approve. The user connects from a terminal or the browser and approves the push.
- Review Access Logs. Every attempt is logged, and every session can be replayed.
Sections
| Section | What it covers |
|---|---|
| Gateways | Onboarding a gateway and connecting through it |
| Endpoints | Adding servers, their local users, password rotation and endpoint actions |
| Policies | Who may connect, where, with what sudo, and whether approval is needed |
| Access Logs | SSH attempts, session recordings and recording storage |
| Agent-Based Endpoints | The AuthNull agent, for Windows machines and servers not behind a gateway |
Where Secrets Are Kept
Passwords and other secrets are kept in AuthNull's built-in vault by default. They are encrypted with the server's ENCRYPTION_KEY.
You can keep them in your own HashiCorp Vault instead (KV v2, AppRole login). Set these environment variables on the AuthNull server:
| Variable | Value |
|---|---|
VAULT_BACKEND | hashicorp |
VAULT_ADDR | The address of your Vault |
VAULT_APPROLE_ROLE_ID | The AppRole role ID |
VAULT_APPROLE_SECRET_ID | The AppRole secret ID (or VAULT_APPROLE_SECRET_ID_FILE, a path to a file holding it) |
VAULT_KV_MOUNT | The KV v2 mount. Default secret |
VAULT_KV_PREFIX | The path prefix inside the mount. Default authnull |
Existing secrets move to the new vault when the server starts.
The vault is configured on the AuthNull server, not in the console. There is no vault screen in the console.