Recommended Server Specifications

The following tables summarize the recommended hardware and software specifications for the required servers when implementing CyberArk’s Privileged Access Manager - Self-Hosted solution. These hardware specifications are based on the entry level industry standard for small to mid-range servers.

For installation on a VM-based environment, the requirements can be customized based on customer needs, according to the CyberArk server requirements.

Standalone Vault server

The following table lists the recommended specifications for standalone Vault servers in a Primary-DR architecture and Distributed Vaults architecture.

This is relevant for the Primary Vault, Disaster Recovery Vaults, and Satellite Vaults.

Small implementation
(Less than 20,000 managed passwords)

Medium implementation
(20,000 – 100,000 managed passwords)

Large implementation
(More than 100,000 managed passwords)
  • 8-12 physical cores x 86-64 architecture
  • 32-64 GB RAM
  • 2 x 80 GB SSD [1]
  • RAID 10 with SAS hot-swappable drives
  • RAID controller
  • 1 GB Network adapter
  • 1 USB port
  • Additional SSD storage for PSM (optional) [2]
  • 24-48 physical cores x 86-64 architecture

  • 64-128 GB RAM

  • 1 x 80 GB SSD, 2 x 512 GB SSD [1]

  • RAID 10 with SAS hot-swappable drives

  • RAID controller

  • 1 GB Network adapter

  • 1 USB port

  • Additional SSD storage for PSM (optional) [2]

  • 60 or more physical cores x 86-64 architecture

  • 256 or more GB RAM

  • 1 x 80 GB SSD, 2 x 512 GB SSD [1] [3]

  • RAID 10 with SAS hot-swappable drives

  • RAID controller

  • 1 GB Network adapter

  • 1 USB port

  • Additional SSD storage for PSM (optional) [2]

For more information about operating system and software requirements, see Digital Vault Server

______________________________

[1] We recommend that the operating system and the application be installed together on one drive, and the data stored on a different drive.

[2] For more information, see Privileged Session Manager.

[3] We recommend using an NMVe SSD

For security reasons, CyberArk recommends installing Vault instances on physical hardware.

Clustered Vault servers

The following table lists the recommended specifications for clustered Vault servers in a Primary-DR architecture and Distributed Vaults architecture.

This is relevant for a clustered Primary Vault, clustered Disaster Recovery Vaults, and clustered Satellite Vaults.

Small implementation
(Less than 20,000 managed passwords)

Medium implementation
(20,000 – 100,000 managed passwords)

Large implementation
(More than 100,000 managed passwords)
  • 8-12 physical cores x 86-64 architecture
  • 32-64 GB RAM
  • 2 x 80 GB SSD [1]
  • RAID 10 with SAS hot-swappable drives
  • RAID controller
  • 1 GB Network adapter
  • 1 USB port
  • SCSI/Fibre shared disk that supports the SCSI3 protocol
  • Additional SSD storage for PSM (optional) [2]
  • 24-48 physical cores x 86-64 architecture

  • 64-128 GB RAM

  • 1 x 80 GB SSD, 2 x 512 GB SSD [1]

  • RAID 10 with SAS hot-swappable drives

  • RAID controller

  • 1 GB Network adapter

  • 1 USB port

  • SCSI/Fibre shared disk that supports the SCSI3 protocol

  • Additional SSD storage for PSM (optional) [2]

  • 60 or more physical cores x 86-64 architecture

  • 256 or more GB RAM

  • 1 x 80 GB SSD, 2 x 512 GB SSD [1] [3]

  • RAID 10 with SAS hot-swappable drives

  • RAID controller

  • 1 GB Network adapter

  • 1 USB port

  • SCSI/Fibre shared disk that supports the SCSI3 protocol

  • Additional SSD storage for PSM (optional) [2]

______________________________

[1] We recommend that the operating system and the application be installed together on one drive, and the data stored on a different drive.

[2] For more information, see Privileged Session Manager.

[3] We recommend using an NMVe SSD

PVWA servers

The following table lists the recommended specifications for PVWA servers.

Small implementation
(<1,000 managed passwords)

Mid-range implementation
(1,000-20,000 managed passwords)

Large implementation
(20,000 – 100,000 managed passwords)

Very large implementation
(more than 100,000 managed passwords)

Hardware specifications
  • Quad core processor (Intel compatible)
  • 8GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 2X Quad core processor (Intel compatible)
  • 16GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 2X Eight core processors (Intel compatible)
  • 32GB RAM
  • 2X 80GB SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 4X Eight core processors (Intel compatible)
  • 64GB RAM
  • 2X 80GB SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM

Software prerequisites

  • Windows 2019, Windows 2016
  • IIS 10.0, 8.5
  • .NET Framework 4.8
  • Internet Explorer 11.0
  • Chrome (any version released in the last six months on Windows and Linux/UNIX)

  • Firefox (any version released in the last six months on Windows and Linux/UNIX)

     

    Not supported for the Monitoring module.
  • PVWA can be installed on Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platforms

CPM servers

The following table lists the recommended specifications for CPM servers.

Small implementation
(<1,000 managed passwords)

Mid-range implementation
(1,000-20,000 managed passwords)

Large implementation
(20,000 – 100,000 managed passwords)

Very large implementation
(more than 100,000 managed passwords)

Hardware specifications
  • Quad core processor (Intel compatible)
  • 8GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 2X Quad core processor (Intel compatible)
  • 16GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 2X Eight core processors (Intel compatible)
  • 32GB RAM
  • 2X 80GB SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 4X Eight core processors (Intel compatible)
  • 64GB RAM
  • 2X 80GB SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM

Software prerequisites

  • Windows 2019, Windows 2016
  • .NET Framework 4.8
  • CPM can be installed on Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platforms

PSM servers

The following table lists the recommended specifications for PSM servers.

Small implementation
(1-10 concurrent RDP/SSH sessions)

Mid-range implementation
(11-50 concurrent RDP/SSH sessions)

Large implementation
(51-100 concurrent RDP/SSH sessions)

Hardware Specifications: Physical Servers
  • 8 core processor (Intel compatible)
  • 8GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 16 core processors (Intel compatible)
  • 16GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 32 core processors (Intel compatible 2.1 GHz - 2.6 GHz)
  • 32GB RAM
  • 2X 250GB SAS hot-swappable drives (15K RPM)
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM

Chrome concurrent sessions

 

  • When adding concurrent sessions per user, make sure to increase the default timeout per session accordingly.

  • When increasing the number of Chrome sessions, regardless of PSM usage, make sure to follow best practices regarding machine CPU and server capabilities.
  • Maximum number of Chrome sessions per user - 15 concurrent connections
  • Maximum total number of Chrome sessions per PSM server - 15 concurrent connections
  • Maximum number of Chrome sessions per user - 50 concurrent connections
  • Maximum total number of Chrome sessions per PSM server - 50 concurrent connections
  • Maximum number of Chrome sessions per user - 100 concurrent connections
  • Maximum total number of Chrome sessions per PSM server - 100 concurrent connections

Microsoft Edge concurrent sessions

 

  • When adding concurrent sessions per user, make sure to increase the default timeout per session accordingly.

  • When increasing the number of Microsoft Edge sessions, regardless of PSM usage, make sure to follow best practices regarding machine CPU and server capabilities.
  • Maximum number of Microsoft Edge sessions per user - 13 concurrent connections
  • Maximum total number of Microsoft Edge sessions per PSM server - 15 concurrent connections
  • Maximum number of Microsoft Edge sessions per user - 45 concurrent connections
  • Maximum total number of Microsoft Edge sessions per PSM server - 45 concurrent connections
  • Maximum number of Microsoft Edge sessions per user - 100 concurrent connections
  • Maximum total number of Microsoft Edge sessions per PSM server - 100 concurrent connections

General Notes:

■ The concurrency of 100 sessions per PSM server must not be exceeded.
■ The concurrent sessions ranges are based on the RDP and SSH connections performance measurements.
■ Running resource-intensive applications like Toad, vSphere Client and so on, on the PSM server will result in lower concurrency.
■ The concurrent session’s ranges assume PSM is running on a dedicated server.
■ The concurrent session’s ranges are based on performance measurements while video recording user’s activities in HD resolution (one screen). Note that video recording resolution is affected by the desktop resolution of the client machine from which the connection was made. This means that performing connections from client machines with more than one HD screen, or with a higher resolution screen, will result in lower concurrency.

Server Virtualization Note:

■ Installing the PSM server on a virtual machine requires allocating virtual hardware resources that are equivalent to the physical hardware specifications. For details, refer to Recommended settings for installing PSM on a virtual machine.
■ The maximum concurrency is up to 40% less when installing the PSM server on a virtual machine.

Software Prerequisites
  • Windows 2019, Windows 2016 Standard
  • For Windows 2016, verify that Windows update KB4458842 is installed
  • .NET Framework 4.8
  • Microsoft Remote Desktop Services (RDS) Session Host
  • Microsoft Remote Desktop Services Gateway (optional)
  • PSM can be installed on Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platforms

  • If you are installing the PSM Gateway using an RPM package, the PSM Gateway supports any Web service, such as Tomcat v 8.5 or v 9, that can support Java 1.6 or later and that can support WAR files.

     

    We recommend using Tomcat as your Web service.

  • Hardware specifications

    Small + Mid-range implementation

    (1-50 concurrent RDP/SSH sessions)

    Mid-range + Large implementation

    (51-100 concurrent RDP/SSH sessions)

    Very large implementation

    (101-200 concurrent RDP/SSH sessions)
    • 2 core processors (Intel compatible)
    • 4 GB RAM
    • 4 core processors (Intel compatible)
    • 8 GB RAM
    • 8 core processors (Intel compatible)
    • 16GB RAM
     
    • Tests are based on 40% SSH and 60% RDP concurrent sessions running with full HD resolution.
    • These requirements are based on a dedicated machine for HTML5 Gateway.
  • Files that are transferred during an HTML5 Gateway session are temporarily stored on the HTML5 Gateway machine, so the machine must have enough available storage space. For example, if there will be 20 sessions that transfer files at the same time, and each session will transfer at most 5GB, you need 100GB of available storage.

PSM for SSH servers

The following table lists the recommended specifications for PSM for SSH servers.

Small implementation
(<100 concurrent sessions)

Mid-range implementation
(100-200 concurrent sessions)

Large implementation
(>200 concurrent sessions)

Hardware Specifications: Physical Servers
  • Quad core processor (Intel compatible)
  • 8GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 2X Quad core processor (Intel compatible)
  • 16GB RAM
  • 2X 80GB SATA/SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM
  • 2X Eight core processors (Intel compatible)
  • 32GB RAM
  • 2X 80GB SAS hot-swappable drives
  • RAID Controller
  • Network adapter (1Gb)
  • DVD ROM

Server Virtualization Note:

Installing the PSM for SSH server on a virtual machine requires allocating virtual hardware resources that are equivalent to the physical hardware specifications.

Supported Platforms and Operating Systems
  • Red Hat Enterprise Linux versions 7.9, 8.2, 8.4, 8.5 and 8.6

  • Rocky Linux 8.6

  • CentOS Linux version 7.9

     

    Security patches and OS vendor recommended minor RHEL and CentOS upgrades can be applied on the server without reinstalling PSM for SSH.

  • SUSE Linux Enterprise Server 12.4 and 12.5

  • PSM for SSH can be installed on Amazon Web Services (AWS), Microsoft Azure, and Google Cloud platforms

 

PTA servers

The following table lists the recommended specifications for PTA servers.

Small implementation
(<300 syslogs per second)

Mid-range implementation
(300-700 syslogs per second)

Large implementation
(>700 syslogs per second)

Hardware Specifications: Virtual Machine
  • 4 Core-CPU
  • 16 GB RAM memory
  • 500 GB hard disk storage thin provisioned
  • VMXNET3 network card for VMWare
  • 8 Core-CPU
  • 16 GB RAM memory
  • 500 GB hard disk storage thin provisioned
  • VMXNET3 network card for VMWare
  • 8 Core-CPU
  • 16 GB RAM memory
  • 500 GB hard disk storage thin provisioned
  • VMXNET3 network card for VMWare

Supported Platforms and Operating Systems

PTA can be deployed on the following platforms:

  • Automatic deployment of PTA AMI in Amazon Web Services

PTA as a software can be installed on the following English-based operating systems:

  • Red Hat 8.6 or 8.7 (Minimal Install) or its compatible forks, Rocky Linux or AlmaLinux
  • Amazon Web Services