Getting started

This page explains what you need to start using Ironchip PAM, which console permissions each administrator needs and in what order everything is configured. It is for whoever sets up privileged access in a company.

The plan

Privileged access is part of the company’s plan. If it is not included, the PAM pages show Privileged access is not part of your company's plan with the Go to billing button. To add it, go to billing or write to sales@ironchip.com.

PAM > Approvals and Authentication policies > Approval policies work without the plan, because approvals also serve single sign-on applications.

Permissions

Each PAM area has its own resource in Security > Permissions, so you can split administration between teams. See Roles and permissions.

Permission resource	What it allows
PAM targets, sites and agents	Sites, resources, their accounts, their rotation, agents, account inventory, exposure and target policies
PAM control and password policies	Control policies and the company’s password complexity
PAM directory	Directory for domain accounts
PAM secrets	The company’s secrets
PAM workloads	Workloads that read the secrets
PAM cloud accounts and credentials	AWS, Google Cloud and Azure accounts, and temporary credential roles
PAM break-glass and checkouts	Who can break the glass and the record of passwords handed over
PAM approvals and sessions	See all requests and decide them (Update), see sessions in progress (Read) and end them (Delete)
PAM recordings and live view	Watch recordings and live sessions

People who only request access and connect need no permission: being in an access’s group is enough. Team passwords need no permission either.

Configuration order

1. Sites. Where the machines are.
2. Resources. Each server, desktop, database or cluster, with the account the broker signs in with.
3. Target policies. Named sets of resources, such as Production Linux.
4. Control policies (optional). Which sudo commands and which Windows programs are allowed, rejected or wait for approval.
5. Approval policies (optional). Who approves, how many people and how long the window lasts.
6. Accesses. In Integrations, a Privileged access integration with one access per group: which target policies it reaches, what it can do and with which factors and approvals.
7. Agent (optional). On the machines where you want to control sudo or Windows programs, rotate local accounts or see each session’s processes.

After that, the people in the group can request access and connect.

PAM menu

Menu	What it is for
Hosts > Sites	Sites
Hosts > Targets	Resources
Hosts > Accounts	Accounts that the agents find on the machines
Hosts > Target policies	Target policies
Hosts > Control policies	Control policies
Hosts > Password complexity	Password complexity
Hosts > Directory	Directory
Hosts > Exposure	Exposure: ways in that bypass Ironchip
Secrets > Secrets	Secrets for applications
Secrets > Workloads	Workloads
Secrets > Credentials	Short-lived credentials
Approvals	Requests and commands waiting for approval
Checkouts	Checkouts and break-glass
My access	Request access and connect
Passwords	Team passwords
Sessions and Recordings	Sessions and recordings