Operating systems

This topic describes how to configure PSM server connection parameters.

Server connections

The following PSM server connections can be customized to meet your specific requirements:

Connection

Customization

PSM sessions

to Windows

(PSM-RDP)

 

Secure connections to target machines with SSL – PSM-RDP connections can verify the target machine before connecting to it and encrypt the session, using an SSL connection. For more information, see Connect through Privileged Session Manager for Windows.

Running Specific Commands on RDP Connections – PSM-RDP connections can start by launching a dedicated program on the target machine. For more information, refer to Run specific commands on RDP connections.

Windows Sessions (PSM-RDP)

PSM sessions to Windows and *NIX(PSM-RDP and PSM-SSH)

Configuring Multiple Target Addresses The PVWA can be configured to display multiple target addresses for users to select from when they create a request or connect to a remote machine. For more information, refer to Multiple target addresses.

Unix/Linux or other SSH Sessions (PSM-SSH)Customize Unix Connection Component Parameters

PSM for Unix and Telnet sessions (PSM-SSH and PSM-Telnet)

Configure logon accounts that elevate users to the role of privileged user – When the root user is forbidden from logging on directly, a logon account in the Vault can be associated with a Unix session to log on to the remote machine and then elevate itself to the role of privileged user.  For more information, refer to Operating systems.

Telnet Sessions (PSM-Telnet)

PSM for Telnet sessions (PSM-Telnet)

Automatic login sequence – The PVWA can be configured to initiate an automatic login sequence using dynamic values to log on to a remote machine using Telnet. For more information, refer to Operating systems.

Telnet Sessions (PSM-Telnet)

PSM for Unix File Transfer (WinSCP) sessions (PSM-WinSCP)

Connection through a CLI – PSM-WinSCP connections can be initiated through a CLI to integrate with your enterprise workflow. For more information, refer to Operating systems.

Telnet Sessions (PSM-Telnet)

PSM for AS400 (iSeries) sessions (PSM-AS400) and OS/390 (Z/OS)

 

Customizing AS400 (iSeries) emulation parameters – PSM-AS400 connections can be customized to support command line arguments for the wc3270 emulation that is used by PSM. For more information, refer to Customize AS400 (iSeries) and OS/390 (Z/OS) emulation parameters.

OS/390 (Z/OS) Sessions

AS400 (iSeries) Sessions

Run specific commands on RDP connections

Users can configure a PSM-RDP connection component to start the connection by launching a dedicated application on the target machine. When this dedicated application is closed, the RDP session is closed as well.

 

Make sure that the Remote Desktop Session Host role is installed.

Make sure you have the required number of RDS CALs to enable you to access the RDS server. For more information, refer to Connect to the PSM server with Microsoft Remote Desktop Services (RDS) Session Host.

The following example shows the list of applications which are configured for RDP connections that are made with the selected account, and which will be launched automatically if used to establish the connection.

If you are working with the RemoteApp UX and you have enabled session video recording, PSM performance is affected by the client machine's resolution. This means as the number of screens on the client machines increases, PSM can support fewer concurrent sessions.

  1. In the System Configuration page, in the Component Settings section, click Options, then select Connection Components; the connection component parameters that define target addresses are displayed in the properties list.

  2. Right-click the PSM-RDP connection component, then from the pop-up menu select Copy.

  3. Right-click Connection Components, then from the pop-up menu select Paste Connection Component; a copy of the PSM-RDP connection component is added to the list of configured connection components with its original ID (PSM-RDP).

  4. Configure the new connection component to run a specific command:

    1. In the list of properties, specify a new ID that reflects the purpose of the connection. This ID will be displayed in the drop-down list of available connections in the Accounts Details page and must be self-explanatory.

    2. Expand the connection component, then expand the Target Settings.

    3. Right-click Client Specific, then in the pop-up menu select Add Parameter; a new parameter is added to the list of client specific parameters.

    4. In the parameter properties, specify the following:

      Parameter

      Description

      Name

      The name of the client specific parameter. Specify StartProgram.

      Value

      The full path of the executable program that will be started when the connection is initiated.

      To specify a file that is not an executable, specify the executable that is used in order to execute this application.

       

      For example, to specify ‘msc’, you would specify: "c:\Windows\System32\mmc.exe""c:\windows\system32\services.msc"

      The following example shows the configuration for a connection component that will start the task manager on the remote machine when the connection is made. This connection component specifies the full path of the task manager executable.

  1. To specify a working directory for the selected application, usually required to ensure the correct resolution of any relative file names, create another new Client Specific parameter and specify the following:

    Parameter

    Description

    Name

    The name of the client specific parameter. Specify WorkDir.

    Value

    The full path of the working directory for the program specified in the StartProgram parameter. If this property is not specified, the default working directory will be used. The default working directory is C:\Users\<current user>.
     

    Do not include quotation marks or a trailing slash.

  2. Click OK to save the new Connection Component configurations and return to the System Configuration page.

  3. Click ADMINISTRATION to display the System Configuration page, then click Platform Management to display a list of supported target account platforms.

  4. Select the platform to configure, then click Edit; the configuration page for the selected platform appears.

  5. Expand UI & Workflows, and right-click Connection Components, then from the pop-up menu select Add Connection Component; a new connection component is added to the current list of connection components that are configured for this platform.

  6. In the new Connection Component, specify the following properties:

    Property

    Description

    ID

    The unique ID that identifies the connection component you created previously for the specific command.

    Enable

    Whether or not this connection component will be enabled for this platform. Specify Yes.

  7. Click Apply to apply the new platform configurations or,

  8. Click OK to save the new configurations and return to the System Configuration page.

  1. For Windows target machines, do the following to configure the target machine to allow an initial startup program by the Remote Desktop Services:

    1. Using a domain administrator user, login to the target server.

    2. In Server Manager, display the Dashboard, then select Remote Desktop Services > Collections > QuickSessionCollection.

    3. Publish the RemoteApp Program.
       

      Installing a RemoteApp program on Windows requires first installing a connection broker and associating a session collection with it.

      For more information on how to install RemoteApp programs on Windows, see Microsoft documentation.

Domain accounts

You can use PSM to access target machines using Windows Domain accounts or UNIX Domain/NIS accounts.

 

In SSH protocol, there is no foolproof way to ensure the identity of the target machine, which could potentially lead to a security risk. Please take this into consideration when using this feature.

Create a platform that determines how domain accounts will be managed.

Use the predefined Windows Domain platform. For general information about managing platforms, see Manage platforms v10 interface.

There is no predefined platform to manage UNIX Domain/NIS accounts, and it must be configured manually.

UNIX Domain/NIS platforms

  1. Click ADMINISTRATION to display the System Configuration page, then click Platform Management to display a list of supported target account platforms.

  2. Select an existing SSH platform that is similar to the new target account platform. For example, Unix via SSH.

  3. Click Duplicate; the Duplicate Platform window appears.

  4. Type the name and a description of the new platform, then click Save & Close to create the new platform.

  5. Select the new target account platform, and then click Edit; the configuration page for the selected platform appears.

  6. Expand UI & Workflows, and then expand Connection Components; the Connection Components parameters are displayed with their default values.

  7. Right-click PSM-SSH and select Add Override User Parameters; a new set of parameters is added.

  8. Right-click Override User Parameters and select Add Parameter; a new parameter is added.

  9. Select the new parameter. Then, in the Properties list, set the following properties.

    Property Description
    Name The name of the parameter.
    Specify PSMRemoteMachine.
    Visible Whether or not the user will be prompted for this parameter before the connection is established.
    Specify Yes.
    Type The type that will be used to modify the appearance or behavior of a parameter UI field. Specify the following:
    CyberArk.PasswordVault.Web.TransparentConnection.RemoteMachineUserParameter, CyberArk.PasswordVault.Web
    Note: Do not change this value.
    Required Whether or not the user is required to provide this information for the remote connection to be activated.
    Specify Yes.
    EnforceInDual
    ControlRequest     		Whether or not the user will be required to provide information in order to create a dual control request.
    Specify No.

  10. Change any additional parameter values and/or add new values to define the new platform.

  11. Click Apply to save the new configurations and apply them immediately,

or,

Click OK to save the new configuration and return to the System Configuration page.

  1. In the Add Account page, add the domain account that will be used to access the target account. Specify the following account properties:

■ Platform Name – Select the platform that you created for the domain account in the previous section.
■ Address – Specify the IP address or DNS of the domain server in the domain where the target machine resides.

  1. Specify additional required and optional account properties.

For more information about adding accounts, refer to Add Accounts.

For specific information about the information required to add Windows Domain accounts, refer to Account properties.

For specific information about the information required to add Unix Domain/NIS accounts, refer to Account properties.

Remote machine access

The Vault administrator can configure a list of addresses of remote machines to which a domain account can be used to connect. When a user tries to connect with this account, the list of addresses is displayed and the user can choose an address from the list. The Vault administrator determines whether the user is only allowed to connect to machines that are in the list of addresses or if they are allowed to connect to other machines as well.

If the user tries to connect to a remote machine which is not allowed to them, an error will appear.

 

This capability can prevent the ability to use the account to connect to machines which are not in the list through PSM or through the PVWA. It will not prevent access to machines in the domain by other means and therefore should not be used for access control to servers. It is recommended to configure and set appropriate access on the target machines through external controls such as firewalls, domain separation and more.

Define a list of remote machines

Make sure you have configured the relevant domain platform to which you will add the account. For more information, refer to Operating systems.

To add or edit a list of addresses, select one of the following procedures:

Does The Account Exist? Is There An Existing List of Addresses? Use Procedure…
N N Define a list of remote machines to access in a new domain account
Y N Define a list of remote machines to access in an existing domain account
Y Y Edit an existing list of remote machines to access in a domain account

  1. Click ACCOUNTS to display the Accounts page, then click Add Account; the Add Account page appears.

  2. From the Store in Safe drop-down list, select the Safe where the account will be stored.

  3. From the Device Type drop-down list, select the Operating System on which the new password is used.

  4. From the Platform Name drop-down list, select an active target Domain platform.

■ If the platform you want to select is not activated, see Activate and deactivate a platform.

  1. Specify the account’s Required Properties and any relevant Optional Properties.

■ The options in the Required Properties and Optional Properties areas differ, depending on the selected Domain Platform’s configurations. For more information, refer to:
■ Unix Domain/NIS Accounts in Account properties
■ Windows Domain Accounts in Account properties

  1. To configure a predefined list of addresses in the Domain account, select Limit Domain Access To; the text box becomes available.

  1. In the text box, enter machine addresses, separated by Enter. You can copy and paste addresses, delete text and so on.

  2. To enable end users to connect with this account to addresses that are not in the preconfigured list of addresses, select Allow User Connections to Other Machines. The end user will see the list of addresses when trying to connect with this account, but will be able to connect to other addresses as well.

  3. Continue with specifying the password see page In the Password field, specify the password. Make sure this password meets your enterprise password policy requirements..

  1. In the Accounts window, select the Account, then click Edit; the Edit Account window appears.

■ The left textbox displays the current status.
■ The right textbox will display any updates that are made.

  1. To add a list of addresses in the domain account, select the checkbox Limit Domain Access To.

  2. In the right textbox, enter machine addresses, separated by Enter. You can copy and paste addresses, delete text and so on.

  3. To enable the end users to connect with this account to addresses that are not in the preconfigured list of addresses, select Allow User Connections to Other Machines. The end user will see the list of addresses when trying to connect with this account, but will be able to connect to other addresses as well.

  4. Click Save to save your changes; the Account Details page reappears and displays the updated list.

  1. In the Accounts Details window, click Edit; the Edit Account window appears.

■ The left textbox displays the current status.
■ The right textbox will display any updates that are made.

  1. In the right textbox, add or delete addresses, separated by Enter. You can copy and paste addresses, delete text and so on.

  2. To enable the end user to connect with this account to addresses that are not in the preconfigured list of addresses, select Allow User Connections to Other Machines. The end user will see the list of addresses when trying to connect with this account, but will be able to connect to other addresses as well.

  3. Click Save to save your settings; the Account Details page reappears and displays the updated list.

Customize connection history to target machines

You can configure connection history to target machines by customizing connection component settings for PSM sessions. You can either use the predefined settings or customize them to meet your specific requirements.

  1. Click Options to display the Web Access Options parameters, then select Connection Components to set the connection history.

  2. Define the following parameters:

    Parameter Description Default Value
    EnableConnectAddressHistory Determines whether or not a list of addresses accessed with the selected account will be displayed in the Connect with Account window Yes
    MaxConnectHistory Defines the maximum number of remote machine addresses that can be displayed in the Connect with Account window. The address history is saved per account for each PVWA user. 7 addresses
    MaxConnectAccountsNumber Defines the maximum number of accounts whose machine addresses history will be displayed in the Connect with Account window. 20 accounts

  3. In the Privileged Account Request parameters, define the following parameters:

    Parameter Description Default Value
    AddressSeparatorCharacter Defines the separator between addresses for remote connections. , (comma)
    AnyAddressCharacter Defines the character that will represent “all addresses” in dual control requests * (asterisk)

  4. Click Apply to apply the new Connection Component configurations. Or,

  5. Click OK to save the new Connection Component configurations and return to the System Configuration page.

Multiple target addresses

For scenarios where you would like to access multiple targets using the same account, without using a domain account, you can configure the PVWA to display multiple target addresses for users to select from when they create a request or connect to a remote machine.

 

This can be configured for Windows and Unix accounts.

  1. Click ADMINISTRATION to display the System Configuration page, then click Platform Management to display a list of supported target account platforms.

  2. Select the platform that will manage accounts used to access the remote machines that will be displayed in the multiple targets list, then click Edit; the settings page for the selected platform appears.

  3. Expand UI & Workflows, and then expand Connection Components and select the component to configure.

  4. Display the component’s Override User Parameters.

  5. In the PSMRemoteMachine parameters specify the following text in the Type property:

      
    CyberArk.PasswordVault.Web.TransparentConnection.RemoteMachineUserParameter, CyberArk.PasswordVault.Web

     

     

    As with Domain Platforms, you can also limit this platform to a specific list of addresses. See Define a list of remote machines to access in a new domain account.

  6. Click OK to save the changes and return to the main System Configuration page.

Enable X-forwarding for SSH connections

Users can connect to remote SSH devices through PSM using X-Forwarding, in addition to using SSH protocol. As with all PSM connections, users do not need to know the privileged password or key content, and the entire session can be recorded for auditing.

  1. In the ADMINISTRATION page, click Options; the Web Access Options are displayed.

  2. Expand Connection Components, then expand PSM-SSH, and then Client Specific; the dynamic parameters for specific clients are displayed.

  3. Set the EnableXForwarding parameter to Yes.

  4. Click Apply to apply the new configurations immediately or,

  5. Click OK to save the new configurations and return to the System Configuration page.

Customize AS400 (iSeries) and OS/390 (Z/OS) emulation parameters

Users can customize PSM-AS400 and PSM-OS390 connections by specifying command line arguments for the WC3270 emulation that is used by PSM.

Users can also configure the AS400 (iSeries) and OS/390 (Z/OS) connection components to connect to AS400 and OS/390 targets with SSL through PSM.

  1. In the System Configuration page, click Options to display the Web Access Options parameters, then select Connection Components; the connection component parameters that define target addresses are displayed in the properties list.

  2. Expand the connection component to customize, and then expand the Target Settings.

  3. Right-click Client Specific, then in the pop-up menu select Add Parameter; a new parameter is added to the list of client specific parameters.

  4. In the parameter properties, specify the following:

    • Name - The name of the client specific parameter. Specify CommandLineArguments.

    • Value - The command line arguments that will be sent to the wc3270 client at the start of the connection session.

      When you specify the value of the CommandLineArguments parameter, use the following guidelines:

      • Parameters that contain spaces must be enclosed in quotation marks.

      • To specify an option that creates files on the file system, make sure that the user running the PSM connection has permissions for the specified folder. For example, a command that creates a new file.

      • To run a command that manages the session file, specify the full path of the session file. In addition, do not specify the hostnames in the session file as the PSM server uses the hostname specified in the managed account.

        The following table lists the command options that are supported by PSM. For more information about the wc3270 options, refer to the wc3270 manual at http://x3270.bgp.nu/wc3270-man.html.

        Command option Description
        -accepthostname spec Specifies a particular hostname to accept when validating the name presented in the host's SSL certificate, instead of comparing to the name or address used to make the connection. spec can either be any, which disables name validation, DNS:hostname, which matches a particular DNS hostname, or IP:address, which matches a particular numeric IPv4 or IPv6 address.
        -allbold Forces all characters to be displayed using the ‘bold’ colors (colors 8 through 15, rather than colors 0 through 7). This helps with PC console windows in which colors 0 through 7 are unreadably dim. All-bold mode is the default for color (3279) emulation, but not for monochrome (3278) emulation.
        -cadir directory Specifies a directory containing CA (root) certificates to use when verifying a certificate provided by the host.
        -cafile filename Specifies a PEM-format file containing CA (root) certificates to use when verifying a certificate provided by the host.
        -certfile filename Specifies a file containing a certificate to provide to the host, if requested. The default file type is PEM.
        -certfiletype type Specifies the type of the certificate file specified by -certfile. Type can be pem or asn1.
        -chainfile filename Specifies a certificate chain file in PEM format, containing a certificate to provide to the host if requested, as well as one or more intermediate certificates and the CA certificate used to sign that certificate. If -chainfile is specified, it overrides -certfile.
        -charset name Specifies an EBCDIC host character set. For more information about the available character sets, refer to in the wc3270 manual.
        -clear toggle Sets the initial value of toggle to false. For a full list of available toggle names, refer to the wc3270 manual.
        -connecttimeout seconds Specifies the time that wc3270 will wait for a host connection to complete.
        -hostsfile file Uses file as the hosts file, which allows aliases for host names and scripts to be executed at login. For more information, refer the wc3270 manual
        -keyfile filename Specifies a file containing the private key for the certificate file (specified via -certfile or -chainfile). The default file type is PEM.
        -keyfiletype type Specifies the type of the private key file specified by -keyfile. Type can be pem or asn1.
        -keypasswd type:value Specifies the password for the private key file, if it is encrypted. The argument can be file:filename, specifying that the password is in a file, or string:string, specifying the password on the command-line directly. If the private key file is encrypted and no -keypasswd option is given, the password will be prompted for interactively.
        -loginmacro Action(arg...) ... Specifies a macro to run at login time.
        -model name             The model of 3270 display to be emulated. The model name is in two parts, either of which may be omitted:
        ■The first part is the base model, which is either 3278 or 3279. 3278 specifies a monochrome (green on black) 3270 display; 3279 specifies a color 3270 display.
        ■The second part is the model number, which specifies the number of rows and columns. Model 4 is the default.
        Model Number Columns Rows
        2 80 24
        3 80 32
        4 80 43
        5 132 27
         

        Technically, there is no such 3270 display as a 3279-4 or 3279-5, but most hosts seem to work with them . The default model is 3278-4.

        -oversize colsxrows Makes the screen larger than the default for the chosen model number. This option has effect only in combination with extended data stream support (controlled by the “wc3270.extended” resource), and only if the host supports the Query Reply structured field. The number of columns multiplied by the number of rows must not exceed 16383 (3fff hex), the limit of 14-bit 3270 buffer addressing. It can also be specified as auto, which causes wc3270 to fill the entire terminal or console window.
        -port n Specifies a different TCP port to connect to. N can be a name from /etc/services like telnet, or a number. This option changes the default port number used for all connections. (The positional parameter affects only the initial connection.)
        -proxy type:host[:port] Causes wc3270 to connect via the specified proxy, instead of using a direct connection. The host can be an IP address, DNS, or hostname. The optional port can be a number or a service name. For a list of supported proxy types, refer to the wc3270 manual.
        -S Runs wc3270 in auto-shortcut mode. Wc3270 will create a temporary shorcut (.LNK file) that matches the parameters in the session file (model number, characterset, etc.) and re-run itself from the shortcut.
        +S Disables auto-shortcut mode. It is generally a good idea to put this option on the command lines of all shortcuts, to avoid infinite looping.
        -scriptport port Causes wc3270 to listen for scripting connections on local TCP port port.
        -scriptportonce Allows wc3270 to accept only one script connection. When that connection is broken, wc3270 will exit.
        -selfsignedok When verifying a host SSL certificate, allow it to be self-signed
        -set toggle Sets the initial value of toggle to true. For a complete list of toggle names, refer to the wc3270 manual. The -p option of x3270if causes it to use this socket, instead of pipes specified by environment variables.
        -sl n Specifies that n lines should be saved for scrolling back. The default is 4096.
        -title text Sets the console window title to text, overriding the automatic setting of the hostname and the string wc3270.
        -tn name Specifies the terminal name to be transmitted over the telnet connection. The default name is IBM-model_name-E, for example, IBM-3278-4-E. Some hosts are confused by the -E suffix on the terminal name, and will ignore the extra screen area on models 3, 4 and 5. Prepending an s: on the hostname, or setting the "wc3270.extended" resource to "false", removes the -E from the terminal name when connecting to such hosts. The name can also be specified with the "wc3270.termName" resource.
        -trace Turns on data stream and event tracing at startup. The default trace file name is x3trc.process_id.txt in the wc3270 Application Data directory.
        -tracefile file   Specifies a file to save data stream and event traces into.
        -tracefilesize size   Places a limit on the size of a trace file. If this option is not specified, or is specified as 0 or none, the trace file will be unlimited. If specified, the trace file cannot already exist, and the (silently enforced) minimum size is 64 Kbytes. The value of size can have a K or M suffix, indicating kilobytes or megabytes respectively.
        -v Display the version and build options for wc3270 and exit.
        -verifycert For SSL or SSL/TLS connections, verify the host certificate, and do not allow the connection to complete unless it can be validated.
        -xrm "wc3270.resource:
        value"         		Sets the value of the named resource to value. Resources control less common wc3270 options. For a full list of resources, refer to the wc3270 manual.

  1. Click Apply to apply the new Connection Component configurations,

or,

Click OK to save the new Connection Component configurations and return to the System Configuration page.

  1. Update the connection component settings in PVWA:

    1. In the PVWA , display the ADMINISTRATION tab; the System Configuration page appears.

    2. Click Options, then navigate to Connection components > PSM-AS400 or PSM-OS390 > Target settings > Client specific > SourceFileTemplate.

    3. Change the property in the Value field according to the below example.

      In this example, 992 is the SSL port number on the target machine. Modify this as required.

        
      connect L:{ADDRESS}:992
      String {USERNAME}
      HOME
      TAB
      String {PASSWORD}
      Enter
      Enter

  1. Add the root certificate database that will be used by WC3270. To do this, navigate to the PSM Installation folder and open the Components folder. Add the root certificate database text file (root_certs.txt).

For further information, see http://x3270.bgp.nu/documentation-ssl.html.

  1. If you need to connect to targets with a certificate that is not FIPS compliant, proceed with Customize connection history to target machines.

Disable FIPS compliancy enforcement

By default, the AS400 and OS/390 connection components enforce the use of certificates that are FIPS compliant.

You can connect to targets with a certificate that is not FIPS compliant, by using the following procedure.

  1. Update the connection component settings in PVWA. To do this, in the PVWA portal, click the ADMINISTRATION tab.

  2. The System Configuration page appears.

  3. Click Options, then navigate to Connection components > PSM-AS400 or PSM-OS390 > Target settings > Client specific > CommandLineArguments.

  4. In the Value field, add the property -disablefipscryptography.

Keyboard mapping

The -keymap option or the wc3270.keymap resource allows a custom keymap to be specified. If the option -–keymapxxx is given (or the wc3270.keymap resource has the value xxx), wc3270 will look for a resource named wc3270.keymap.xxx. If no resource definition is found, it will look for a file named xxx.wc3270km.

Multiple keymaps may be specified by separating their names with commas. Definitions in later keymaps supersede those in earlier keymaps.

In addition, separate keymaps may be defined that apply only in 3270 mode or NVT mode. For example, the resource definition wc3270.keymap.xxx.nvt or the file xxx .nvt.wc3270km will augment the definition of keymap xxx in NVT mode. Similarly, the resource definition wc3270.keymap.xxx.3270 or the file xxx.3270.wc3270km will augment the definition of keymap xxx in 3270 mode.

Each line (rule) in a keymap specifies actions to perform when a particular key or sequence of keys is pressed. Keymap rules have the following syntax:

 

[modifier...]<Key>key...: action[(param[,...])] ...

The optional Shift, Alt or Ctrl modifiers specify that the Shift, Alt and Ctrl keys are pressed along with the specified key, respectively. The LeftCtrl, RightCtrl, LeftAlt, and RightAlt modifiers specifify a particular Ctrl or Alt key. The Enhanced modifier is also available; Enhanced <Key>ENTER is the keypad Enter key. Key is either an ISO 8859-1 symbol name, such as equal for ‘=’ and a for ‘a’, or a symbolic Windows key name, such as UP. More than one key can be specified, indicating that a sequence of keys must be pressed in order for the rule to be matched. The action is an action from the actions list. More than one action may be specified; they will be executed in order. For more a full list of actions, refer to http://x3270.bgp.nu/wc3270-man.html#Actions.

Keymap entries are case-sensitive and modifier-specific. This means that a keymap for the b key will match only a lowercase b. Actions for uppercase B, or for Alt-b or Control-B, must be specified separately.

ADD, ALT, APPS, BACK (Backspace), CLEAR, CTRL, DECIMAL, DELETE, DIVIDE, DOWN, END, Enter (alias for RETURN), ESCAPE, EXECUTE, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, F13, F14, F15, F16, F17, F18, F19, F20, F21, F22, F23, F24, HELP, HOME, INSERT, LEFT, LMENU, LWIN (Left Windows key), MULTIPLY, NEXT (Page Down), NUMLOCK, NUMPAD0, NUMPAD1, NUMPAD2, NUMPAD3, NUMPAD4, NUMPAD5, NUMPAD6, NUMPAD7, NUMPAD8, NUMPAD9, PageUp (alias for PRIOR), PageDown (alias for Next), PAUSE, PRINT, PRIOR (Page Up), RETURN (Enter), RIGHT, RMENU, RWIN (Right Windows key), SCROLL, SELECT, SEPARATOR, SHIFT, SLEEP, SNAPSHOT, SUBTRACT, TAB and UP.

CyberArk supplies a keymap file that is required for wc3270 on AS400 (iSeries) machines. Copy this file to the PSM server machine, and specify the name of this keymap file in the CommandLineArguments. For example –keymap “PSMCustomFnKeyMap”, as shown in the example above. For more information about the keymap file, refer to the wc3270 manual at http://x3270.bgp.nu/wc3270-man.html#Keymaps.