Configure recordings and audits (PSM for SSH)

Customize recordings in PSM for SSH

Video and text recordings for PSM for SSH connections are configured at PSM general level (in Web Access Options). These instructions describe how to customize these recordings at platform level, which overrides the general level.

You can customize settings for the following text recorders:

PSMP-SSH

1. Open the platform for editing, as described in Edit a platform.

2. In the platform settings page, in the left pane, expand UI & Workflows, then right-click Privileged Session Management, a pop-up menu displays the parameter sets that you can add and customize to manage your PSM recordings.

3. From the pop-up menu, select Add Recorder Settings; a new set of parameters called Recorder Settings is added.

4. Disable or customize text and video recordings for this platform:

   Video recording in PSM for SSH is affected by the same parameter as text recording. These settings affect SSH text recordings for SSH connections through PSM as well as PSM for SSH connections.

   1. Right-click Recorder Settings, then select Add SSH Text Recorder.

      Anew set of parameters called SSH Text Recorder is added.

   2. By default, SSH text recordings for SSH connections are enabled. To disable these recordings for this platform, set the value of Enabled to No.

   3. Define the channels that will be recorded during the session. By default, the following channels are recorded for SSH connections:

      Property	Default Value	Description
      In	Yes	Whether or not the terminal’s STDIN stream will be recorded.
      Out	Yes	Whether or not the terminal’s STDOUT and STDERR streams will be recorded.
      Keystrokes	Yes	Whether or not all the keystrokes logged by the user from the start of the line until the user presses Enter will be recorded. Note: Control characters are not recorded.

      To disable recordings on any of these channels, set the value of the channel property to No.

5. Click OK.

Configure detailed audit in PSM for SSH

By default, PSM for SSH records all the activities that take place during privileged sessions and provides audits for the following events:

1. Open the platform for editing, as described in Edit a platform.

2. Expand UI & Workflows, and then right-click Privileged Session Management.

3. From the pop-up menu, select Add Audit Settings; a new parameter is added to the Privileged Session Management settings.

4. Select the Audit Settings, then from the pop-up menu, disable or customize SSH Keystrokes Audits for PSMP-SSH connection component using this platform:

   1. Right-click Audit Settings, then from the pop-up menu, select Add SSH Keystrokes Audit.

   2. By default, SSH keystrokes auditing is enabled for the supported connection component. To disable auditing for this component, in the Properties list, set the value of Enable to No.

   3. To audit SSH keystrokes, PSM for SSH uses the shell prompt of the target system to understand text that was entered by the end-user. As different systems and devices have different prompts, you can configure the regular expression that represents the shell prompt so that PSM/PSM for SSH is able to recognize the text entered by the user.

      In addition, you can configure whether the session will continue without an audit, or will be terminated if the shell prompt is not recognized.

      ■

      To configure the regular expression, use the parameter ShellPromptForAudit.

      ■

      To configure whether the session will continue without an audit, or will be terminated if the shell prompt is not recognized, use the parameter TerminateOnShellPromptFailure.

      See the table PSM for SSH Connection Component Parameters for details on the relevant parameters.

5. Configure advanced properties to determine how PSM for SSH will manage audit records.

6. Click OK.

Hide passwords during recordings

PSM for SSH  identifies passwords that are typed by users during SSH sessions by looking for password prompts. By default, the prompts that PSM for SSH looks for include common prompts for Unix platforms or for Vault passwords. Customize this list to include all password prompts that are received in your environment. When users type a character that cannot be included in a password, such as a space, or when they press Enter, PSM for SSH resumes the audit and recording. You can update this list of characters too.

This can be configured at platform level, overriding the general configuration.

1. Open the platform for editing, as described in Edit a platform.

2. Expand UI & Workflows, then right-click Privileged Session Management.

3. From the pop-up menu, select Internal Capability Settings.

   A new set of parameters called Internal Capability Settings is added.

4. Right-click Internal Capability Settings, then from the pop-up menu, select Add SSH Password Hiding.

   A new capability parameter is added.

5. Select SSH Password Hiding, then specify the following properties:

   Property	Description
   Enabled	Determines whether or not passwords will be recorded during PSM for SSH sessions. The default value is Yes, indicating that this feature is enabled and passwords will not be recorded.
   PasswordPrompts	This is a regular expression that is used to identify password prompts. When the system finds a match to this regular expression, it omits the password from the PSM session recording.
   InvalidPasswordChars	Defines characters that cannot be included in passwords. When the user specifies one of these characters, PSM resumes auditing and recording each keystroke. The default values are spaces and tabs.

6. Click OK.

Configure SCP audit capabilities

By default, PSM for SSH records SCP commands that are issued in order to copy files securely. This type of auditing is supported for the PSMP-SCP connection component. SCP auditing is automatically configured and enabled at system level and can be overridden at platform level, enabling you to customize detailed audit for platforms.

1. Open the platform for editing, as described in Edit a platform.

2. On the platform settings page, expand UI & Workflows, then right-click Privileged Session Management.

3. From the pop-up menu, select Add Audit Settings; a new parameter is added to the Privileged Session Management setting.

4. Right-click Audit Settings, then from the pop-up menu, select SCP Audit.

   • By default, SCP Audit is enabled for the supported connection components. To disable auditing for these components, in the Properties list, set the value of Enable to No.

   • Configure advanced properties to determine how PSM for SSH will manage SCP audit records.

5. Click OK.