# Connect to a resource > Connect to a privileged resource from the console or with your own SSH, RDP, VNC, kubectl or database client, using a single-use ticket. URL: https://docs.ironchip.com/en/pam/usuarios/conectarse/ This page explains how to connect to a resource when you have an open window or permanent access. It is for whoever uses privileged access. You do not need a VPN, and you neither know nor type the resource's password: the Ironchip broker enters it when it opens the session. ## From the console In **PAM > My access**, next to each machine: - **Terminal** opens an SSH terminal in the console itself. - **Desktop** opens the RDP or VNC desktop in the console itself. The connection is decided like any other: if Ironchip asks you for something (for example, to confirm on your phone), the console shows it above the screen and the session opens as soon as you respond. On the desktop, click the screen to type in it. **Ctrl+Alt+Del** has its own button. In full screen, the whole keyboard goes to the remote machine (including Alt+Tab and the Windows key); hold down Esc to exit. To finish, type `exit` or press Ctrl+D in the terminal, or sign out of Windows. ## With your own client 1. In **PAM > My access**, click **Credential** next to the machine. 2. Copy the command from **Run this** or fill in your client with **Host**, **Port** and **Username**. [Image: Connect window with the ssh command, and the host, port and username to fill in the client] The credential is a **single-use ticket**, which goes in the username (`ticket-…`). Leave the password empty or enter anything: it is not read. The ticket expires with your window and does not work a second time. | Resource | How you connect | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | SSH | `ssh ticket-@ -p ` | | RDP | **Download .rdp** opens Remote Desktop on Windows, or Windows App on Mac, with the ticket filled in. Or `xfreerdp /v:: /u:ticket-` | | VNC | `vncviewer -SecurityTypes VeNCrypt,X509Plain ::` | | PostgreSQL | `psql -h -p -U ticket-` | | MySQL | `mysql -h -P -u ticket-` | | Kubernetes | Save the `kubeconfig` the console shows and use `kubectl --kubeconfig get pods` | | HTTP | **Open in the broker** opens the application in the browser with the ticket | The console always shows the exact command, with the address and port of your company's broker. ## What happens when you connect 1. You open the connection with the ticket. 2. The broker holds it while Ironchip checks that you have an open window or permanent access, that you are connecting from an allowed address, and the access's factors. If any factor asks for confirmation, it reaches you by the matching channel: your phone, an SMS, email or your card. 3. If the policy requires approval **on connection**, the connection also waits for an approver to decide. In **My access**, use **Connect and ask** and leave the connection open: it opens on its own when someone says yes. If nobody decides within 5 minutes, it is refused. 4. If everything is correct, the broker opens the session with the resource's credential and starts recording. ## During the session - What you do is [recorded](https://docs.ironchip.com/en/pam/conceptos/grabacion/). - If the machine has the [agent](https://docs.ironchip.com/en/pam/administracion/agente/), each `sudo` asks Ironchip and may wait for an approval; on Windows, only the allowed programs open. - An administrator can watch your session live and end it. In the console you see **The session ended**. - If you need the machine's password to use it without the broker, see [Checkouts and break-glass](https://docs.ironchip.com/en/pam/boveda/checkouts/). ## Troubleshooting | Symptom | Probable cause | | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | The connection keeps waiting | Your confirmation is missing (check the notice or your phone) or the policy requires approval on connection and nobody has decided yet. | | **The connection was refused** | You do not have an open window for that machine, you did not confirm in time or you are connecting from an address that is not allowed. | | `your access arrives as an account this machine does not have` | Your access arrives as a fixed account that the machine does not have. Ask an administrator to add it to the machine's accounts. | | The ticket is not valid | It is single-use: get a new one with **Credential** each time you connect. | | `sudo` is refused with `nobody is connected to this machine through Ironchip` | You are using a session that does not go through Ironchip. Connect through the broker. |