This article provides answers to the most frequently asked questions about accessing and using the Privileged Access Management (PAM) software, as well as common issues that you may encounter when using PAM. Please contact IT Services if you have questions or need technical support for an issue that is not covered in this article or the PAM Operations FAQ.

Select a topic to learn more about privileged access management and its implementation at UChicago.

---

What software do I need to use PAM?

You will need a Secure Shell (SSH) client to connect to Unix-like hosts through PAM and a remote desktop client (RDP) to connect to Windows hosts through PAM.

You can download the latest copy of PuTTY that includes an SSH binary file or get the standalone SSH file from the same website, or obtain the built-in SSH client in PowerShell for Windows.

Microsoft has a Windows RDP remote desktop client for Mac if you need an RDP client for Windows machines on Mac.

How do I get started with PAM?

Fill out the PAM service request form.

Will I be able to access my systems with my own CNetID as I do today?

Yes, although the workflow will be different. Instead of going to a bastion host such as jump.uchicago.edu, you will sign into PAM with your CNetID and password and then choose your systems from a list. Alternatively, you can use SSH, or RDP direct connect which will also ask for your CNetID and password to connect to your systems.

How do I access the BeyondTrust Password Safe Web Portal?

Visit square.uchicago.edu to log into the BeyondTrust Password Safe Portal. You will be prompted for a username and password. Please enter your CNetID and password and complete two-factor authentication if prompted.

The BeyondTrust Password Safe Web Portal is hanging on a spinning square, what do I do?

Refresh the page or try navigating back to square.uchicago.edu in a new browser window.

The "Start SSH Session" button does not do anything when I click on it in my web browser. What should I do?

Please follow the directions in the Auto-Launch PuTTY Registry File section of BeyondTrust's Configure SSH and RDP Connections help document, then restart your computer before trying again. If the issue persists, contact IT Services.

Why doesn't anything show up under Accounts in the BeyondTrust Password Safe Web Portal?

You may not have any privileged accounts assigned to you. Check with your systems administrator to see if you are assigned to the systems appropriately.

I can't connect to any of my assigned systems because they are timing out. What should I do?

Please be sure you are connected to the University's Virtual Private Network (cVPN) before attempting to connect to systems assigned to you. If the issue persists, please contact IT Services.

How do I add a user to PAM so that they can access the systems I have set up?

You can grant a user access to PAM by adding them to the proper Grouper assignment group. If you do not have access to Grouper, please contact the Identity Access Management (IDM) team for assistance.

How do I make a change to my existing PAM setup to add, remove, or change something about the systems?

You can make changes using the Privileged Access Management Support form.

What other resources will help me better understand and use PAM?

You may visit BeyondTrust's Password Safe Guides for technical assistance.

When connecting via SSH, I get this message: "Internal Server Error Authentication failed." What should I do?

In most cases, this error message is due to your password containing a "plus sign" (+). If this is the case, please change your password via MyAccount (myaccount.uchicago.edu). (Note: A permanent solution is being sought.) If this is not the case, please contact IT Services for troubleshooting.

How long are the recorded sessions held?

Your recorded sessions are held for one year.

Does the BeyondTrust Password Safe have the ability to create, edit, or delete user accounts or applications on a system?

No. PAM only allows specified account passwords to be managed; however, those privileged accounts may have the ability to make those changes.

After my systems are onboarded, does this mean anyone has access to them?

No. By default, no one has access to your onboarded systems. It is only after the managed accounts are assigned that groups get access to specific systems.

How do I see who has access to my systems and devices?

You can utilize your existing access controls to see who has access to your system and devices. Alternatively, you may ask the Identity Access Management (IAM) team about what role-based accounts are in use on your systems according to groups. You may also check the Grouper group you are a member of for PAM to see which individuals have access to the systems assigned.

You will also utilize your existing system logging to monitor activity. If replays are required from PAM, they can be requested or viewed in the web portal.

When I try to connect via RDP or SSH, Why do I get an "invalid session token" message?

This is because you did not "check out" the session in time. Sessions must be started within 30 seconds of checkout, otherwise, you will get this message. To resolve this, go back to your requests and select open session again.

How do I get access to my systems and devices in the event of not having internet?

PAM requires internet access to function and connect to systems. If you have direct console access, this should be utilized until your internet access is restored to the affected system. 

What happens if the PAM systems are down?

PAM will be unavailable until the service is back up. Please contact IT Services if an unexpected outage occurs.