Secure access with a PSM HTML5 gateway

Multiple PSM Servers can work with the same gateway or with different gateways. Repeat steps 3-4 for each PSM server you want to set to use the PSM Gateway.

1. Log in to the PVWA with an administrative user.

2. Go to Options > Privileged Session Management > Configured PSM Servers

3. Select the PSM server entry that you want to set to use the PSM Gateway.

4. Right click Connection Details and select Add PSM Gateway and enter the following:

   Parameter	Value
   ID	The ID of the PSM Gateway that you created in Add the PSM HTML5 gateway server.
   Enable	Yes

5. Set the default connection method to define the connection method you want to use for most of the PSM connections. Then define the toggle per account option for account platforms where you can want the user to have the option to use both connection methods (RDP\HTML5). Or you can duplicate PSM entries.

   Set the default connection method:

   This method requires PVWA 12.2.

   1. Log into the PVWA with an administrator user.

   2. Go to Options > Privileged Session Management UI.

   3. Set DefaultConnectionMethod to HTML5 or RDP.

   HTML5 sessions are triggered only for the PSM machines associated with HTML5 Gateway. Platforms that are connected to the PSM server, that is configured to connect with an RDP file, ignore the AllowSelectHTML5 parameter and automatically connect using RDP.

   Set one of the following options:

   • Toggle per account
   • Duplicate PSM entries

   This method is only available in the Version 10 interface.

   The use of shared privileged accounts often means that the same account is used by both an external third-party vendor and an internal privileged employee. While the external vendor's access is frequently through an HTML5 browser-based session, the internal employee may prefer to connect with an RDP-file based session.

   Users can use either an HTML5-based or RDP-file connection method when connecting to the remote server. The following steps describe how to configure the PVWA so that users can select either method.

   Perform these steps for every connection component for which both connection methods should be available.

   To set a single account for both RDP and HTML5-sessions:

   1. Log in to the PVWA with an administrative user.

   2. Go to Options > Connection Components > {Connection Component} > User Parameters.

   3. Add AllowSelectHTML5. For details, refer to Connection Components.

   Configure a single PSM to enable connectors to use either RDP file or HTML5 Gateway, when connecting to the remote server:

   In PVWA 12.2 and above you must set DefaultConnectionMethod to HTML5.

   1. Duplicate the PSM server and give a unique name to the new server. For example, duplicate the PSMServer_RDP server and call the new server PSMServer_HTML5.

   2. On the new server, add and enable the PSM HTML5 Gateway, as described in Add PSM HTML5 Gateway server and Configure the PSM server to use the HTML5 Gateway.

   3. Connect all platforms that will use the HTML5 Gateway or that will enable the user to select the connection method to the new server.

      For platforms that enable the user to select the connection method, configure the connection components as described in Secure access with a PSM HTML5 gateway.

For additional configuration options, refer to Gateway configuration.

When you connect to the remote target through the PVWA, you can copy files from the local workstation to the remote target. Drag a file to the remote target and the Upload Files window opens, showing the progress of the file upload and all previous files uploads.

Click Cancel to cancel the upload. Any canceled or failed uploads are shown with a red X.

Click Clear to remove a specific file upload from the list.

You can also click Clear Failed Files to remove all canceled and failed uploads from the list or click Clear Completed Files to remove all completed uploads from the list.

Click Close to close the window. You can also minimize the window to show only a summary of the number of current, completed, and failed or canceled file uploads.

The file is copied to a new drive, usually the Z: drive, that is mapped to the remote target to support the file transfer. In non-RDP connections, the drive is named File Transfer. In RDP connections, the drive is named the PSM hostname.

Open the new drive, or refresh it if it is already opened, and drag each file from the new drive to the desired location on the remote target to complete the copy process. The new drive is deleted at the end of the session.

You can copy files from the remote target to the local workstation.

Drag the file to the Download folder in the new drive, usually the Z: drive, that is mapped to the remote target to support the file transfer. In non-RDP connections, the drive is named File Transfer. In RDP connections, the drive name is the PSM hostname.

The file is automatically downloaded to the local workstation using the browser download. You can download up to 2GB or 120 files per session.

You can configure WinSCP during your session and the configuration will remain for all your sessions.

1. In WinSCP, click Options > Preferences.
2. Select Transfer > Endurance.
3. Under Enable transfer resume/transfer to temporary filename for, select Disable.

When you connect to the remote target through the PVWA, you can click Ctrl +Alt + Shift to display the Clipboard Control tool on the remote desktop. In Internet Explorer, the Clipboard Control tool does not appear. Instead, you can use the standard keyboard shortcuts for copying and pasting text. See Internet Explorer for details.

Copy the text from the local workstation and paste the text to the Clipboard Control tool. In the Clipboard Control tool, click Ctrl + V or right-click and select Paste . In the desired location on the remote target, paste the text.

You can copy text from the remote target to the Clipboard Control tool and select the text to copy to the local workstation.

In Internet Explorer, you can use CTRL + C and CTRL + V to copy and paste between the remote target and the local workstation.

When you attempt to copy data from the remote target for the first time in a session, the following message appears:

Click Allow access to enable the copy.

To avoid this message:

1. Go to Tools -> Internet Options.
2. Go to the Security tab.
3. Select the Internet zone, then click Custom level… .
4. Scroll down to the Scripting section.
5. Under the Allow Programmatic clipboard access option, select Enable.
6. Click Ok twice to exit Internet Options.

Following those steps, the browser will allow programmatic clipboard access from every website in the browser.

Run the following command to print the PSM HTML5 gateway container main output:

sudo docker logs <container name>

For example:

sudo docker logs <container name>

This includes output from the container initialization, as well as subsequent log entries by the guacd daemon inside the PSM HTML5 gateway.

1. Open a shell prompt for the running PSM HTML5 gateway container:

   sudo docker exec -ti <container name> bash

2. Once inside the container's shell, you can access the PSM HTML5 gateway web application logs in /var/opt/CARKpsmgw/logs/webapp.

   Log file	Description
   cyberark-psm-gateway-webapp.log	Log file for the web application
   cyberark-psm-gateway-tomcat.<date>.log	Log file for the Tomcat infrastructure related to the web application
   /opt/tomcat/logs/catalina.out	Log file for the Tomcat process