Policies
A policy decides who may connect to which account on which endpoint, and what happens when they try. Without a matching policy, sessions are refused.
Open Policies in the PAM sidebar.
The Policies List
| Column | What it shows |
|---|---|
| Name | The policy's name |
| Gateway | The gateway the policy applies to |
| Who | The users it covers |
| Hosts | The endpoints it covers |
| Accounts | The local accounts it covers |
| Action | Require approval, Deny or Allow without approval |
| Status | Active or Suspended |
| Last modified | When it was last changed |
Each row's ⋮ menu offers:
| Action | Effect |
|---|---|
| Edit | Change the policy |
| Suspend / Resume | Stop the policy for now, or start it again |
| Delete | Remove the policy |
Suspend and Delete take effect at once. They revoke access from live sessions too.
Create a Policy
Click New policy. The form has five parts.
1. Who Can Connect
Add users by email, or turn on Everyone in the organisation.
Groups are not available yet.
2. Where
| Field | What to choose |
|---|---|
| Gateway | The gateway users connect through |
| Hosts | One or more onboarded endpoints behind that gateway |
| Accounts | The local accounts users may log in as. Type a name and press Enter |
root, authnull-svc and nobody cannot be chosen.
3. Sudo
None, Full sudo or Specific commands, with a time limit. See Sudo in Policies.
4. Action
| Action | Effect |
|---|---|
| Require approval | The default. The user approves a push from your MFA provider before the session starts |
| Deny | The session is refused |
| Allow without approval | The session starts without a push. Administrators only |
Deny always wins. If a Deny policy matches a session, it is refused even when another policy allows it.
5. Name
Give the policy a name, then save it.
After You Save
The Connect button appears in Targets → Endpoints only for users a policy grants an account on that endpoint. See Connect through a gateway.
Every attempt, approved or not, is listed in Access Logs.