# Resources > Register servers, desktops, databases, clusters and web applications as PAM resources, with the account and the method the broker signs in with. URL: https://docs.ironchip.com/en/pam/administracion/recursos/ A resource (in the console, **target**) is a machine or service that the Ironchip PAM broker opens sessions to: a server, a desktop, a database, a Kubernetes cluster or an internal web application. This page explains how to register resources and what each resource's page shows. It is for whoever administers privileged access. ## Resource types | Protocol | What it is for | Default port | Methods the broker signs in with | | -------------- | ---------------------------------- | ------------ | ---------------------------------------------------------- | | **SSH** | Linux and Unix servers | 22 | Broker key, IAM role, stored password, managed by Ironchip | | **RDP** | Windows desktops and servers | 3389 | Stored password, managed by Ironchip | | **VNC** | Any desktop that shares its screen | 5900 | None, stored password | | **PostgreSQL** | PostgreSQL databases | 5432 | IAM role, stored password, managed by Ironchip | | **MySQL** | MySQL and MariaDB databases | 3306 | IAM role, stored password, managed by Ironchip | | **Kubernetes** | Clusters, with `kubectl` | The API URL | IAM role, stored token, stored client certificate | | **HTTP** | Internal web applications | The URL | The broker stores no credential | Each type has its own page: [SSH](https://docs.ironchip.com/en/pam/recursos/ssh/), [RDP and VNC](https://docs.ironchip.com/en/pam/recursos/rdp/), [Databases](https://docs.ironchip.com/en/pam/recursos/bases-de-datos/), [Kubernetes](https://docs.ironchip.com/en/pam/recursos/kubernetes/) and [Web applications](https://docs.ironchip.com/en/pam/recursos/web/). ## Before you begin - A [site](https://docs.ironchip.com/en/pam/administracion/sitios/) to put the resource in. - A network path from the broker to the resource. With Ironchip Connect, the site's connector. See [Architecture](https://docs.ironchip.com/en/pam/conceptos/arquitectura/). - The **PAM targets, sites and agents** permission. ## Register a resource 1. Go to **PAM > Hosts > Targets**, click **Add target** and choose the protocol. [Image: Targets page with the Add target menu open and the available protocols] 2. In **Name**, enter the name people will see, for example `prod-linux-01`. Use only letters, digits, dots, hyphens and underscores, because it is typed in `ssh` and `psql` commands. It cannot be changed later: it is the name its recordings are filed under. 3. In **Site**, choose the site. 4. In **Where the broker connects**, enter the **Address** and **Port** (for Kubernetes and HTTP, the **URL**). It is the address as the **broker** resolves it, not as your laptop does. 5. In **The account on the far machine**, enter the **Username**. For SSH and RDP you can specify a domain for a [domain account](https://docs.ironchip.com/en/pam/administracion/directorio/). 6. In **How the broker proves itself**, choose the **Method**: | Method | What it means | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **The broker's own key pair** | SSH only. The machine trusts the broker's public key and none of your secrets is stored. | | **A stored password** | A person's password, encrypted in the secret store. Ironchip never changes it. | | **Managed by Ironchip: nobody types or sees it** | Ironchip generates it, nobody has ever seen it, and Ironchip changes it every day and after every session. See [Password rotation](https://docs.ironchip.com/en/pam/boveda/rotacion/). | | **A stored token** / **A stored client certificate** | Kubernetes. They are stored encrypted in the secret store. | | **An IAM role** | The broker identifies itself with an IAM role and no secret is stored. | | **Nothing (the server asks for nothing)** | VNC without a password. | 7. Follow the **Prepare the machine** steps, if they appear. For example, with the broker's key the console shows the line for `authorized_keys`; with a database password, the `CREATE ROLE` or `CREATE USER` statements. [Image: Add SSH target window with the name, site, address, account and method] 8. Click **Add target**. The resource is registered in the broker, but **nobody can reach it yet**: add it to a [target policy](https://docs.ironchip.com/en/pam/administracion/politicas/#target-policies) and name that policy in an [access](https://docs.ironchip.com/en/pam/administracion/accesos/). :::note[RDP: who signs in to Windows] For RDP, **Sign-in** decides whether everyone arrives already signed in as the resource's account (**The broker, as the account below**) or whether each person signs in on the Windows screen with their own account (**Each person, on the Windows sign-in screen**). In the second case, the resource's account only handles Network Level Authentication: use an account that can connect through Remote Desktop and nothing else. ::: ## The resource list [Image: Targets page with each resource, its site, protocol, account, authentication, agent and policies] | Column | What it shows | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Target** | The name (a link to its page) and the address. | | **Connects as** | The account the broker signs in with, and the machine's other accounts. | | **Authentication** | **Managed**, **Stored password**, **Broker key**, **IAM role**, **Stored token**, **Stored certificate** or **None**. | | **Agent** | **online**, **offline**, **enforcer only** or **not installed**, the operating system and, if there are any, the [exposure](https://docs.ironchip.com/en/pam/administracion/exposicion/) warnings. | | **Target policies** | The target policies that include it. **in no policy** means that no access reaches it. | In **Options**, on each resource's row: - **Edit target**: changes everything except the name and the protocol. When you edit, stored secrets are not shown: leave the field empty to keep them or enter a new one to replace them. - **Install agent**: installs the [agent](https://docs.ironchip.com/en/pam/administracion/agente/) on the machine. - **Remove agent** and **Remove enforcer**: forget the machine's agent or enforcer, and its key stops working. To enroll them again you need a new secret from **Install agent**. - **Remove target**: deletes the resource from the company and from the broker, along with its additional accounts. You must first remove it from the target policies that include it. ## A resource's page Click the resource's name to open its page. At the top it shows the address, the account, the status of the agent and the enforcer, and the number of exposure warnings. Below that, these tabs: | Tab | What it contains | | -------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | **Exposure** | Ways into the machine that bypass Ironchip. See [Exposure](https://docs.ironchip.com/en/pam/administracion/exposicion/). | | **Accounts** | The accounts the broker signs in with and the ones the agent finds on the machine. See [Accounts](https://docs.ironchip.com/en/pam/administracion/cuentas/). | | **Agent** | The status of osquery and the enforcer: system, version, whether it sees processes, the last time it reported and the latest warnings. | | **Machine** | What the agent knows about the machine: uptime, installed packages, Windows updates and whether the disks are encrypted. | | **Credential** | Its password rotation and complexity. See [Password rotation](https://docs.ironchip.com/en/pam/boveda/rotacion/). | ## Next steps - [Access policies](https://docs.ironchip.com/en/pam/administracion/politicas/): group resources and limit what can be done on them. - [Accesses](https://docs.ironchip.com/en/pam/administracion/accesos/): decide who reaches them.