> ## Documentation Index > Fetch the complete documentation index at: https://docs.2501.ai/llms.txt > Use this file to discover all available pages before exploring further. # Privileged access > Read credentials from CyberArk or WALLIX, and connect to SSH hosts through their session proxy A PAM system is the privileged access management system that keeps your privileged accounts. 2501 works with **CyberArk** and **WALLIX**. It uses one or two parts of each PAM system: > [card] Credential API > > 2501 reads passwords and keys from the PAM system: the Central Credential Provider (CCP) of CyberArk, or the API of WALLIX Bastion. > [card] Session proxy > > 2501 opens SSH sessions on hosts through the PAM system: PSM for SSH of CyberArk, or the SSH proxy of WALLIX Bastion. 2501 never gets the password or the key of the host. [Credentials](https://docs.2501.ai/0.20/core-concepts/credentials.md#pam-accounts) explains how 2501 reads a PAM account and how a [session proxy](https://docs.2501.ai/0.20/core-concepts/credentials.md#session-proxies) opens a session. ![Privileged access](https://mintcdn.com/2501/Nw-5R3i4HUHiTxUb/images/privileged_access_list.png?fit=max\&auto=format\&n=Nw-5R3i4HUHiTxUb\&q=85\&s=6f8265f0d5e0e808a2e7cb9c793e5755) Privileged access: each row is a PAM system with its type and address. ## Before you start * You must be an administrator. Other roles do not see **Privileged access**. * For the credential API: * The engine must reach the PAM system over HTTPS. When you set an [outbound proxy](https://docs.2501.ai/0.20/deployment/configuration.md#outbound-proxy), the engine goes through it. To reach the PAM system directly, add its host to `proxy.noProxy`. * For CyberArk, you need an application ID that signs in to the CCP with a client certificate. The application and the Provider user of the CCP must be members of the safes that 2501 reads. They need the **Retrieve accounts** and **List accounts** permissions. * For WALLIX, you need an API user and its API key. The API user must have password retrieval on the accounts that 2501 checks out. * For the session proxy: * The engine and the executors must connect to the session proxy over SSH, directly or through the [jump hosts](https://docs.2501.ai/0.20/core-concepts/hosts.md#jump-host-ssh-bastion) of the host. On Kubernetes, make sure that the network policies of their pods allow this connection. * For CyberArk, you need a vault user. It must be a member of the safes of the target accounts, with the **Use accounts** and **List accounts** permissions. It does not need **Retrieve accounts**, because it never gets the password. * For CyberArk, the platform of the target accounts must allow PSM for SSH connections. If PSM for SSH asks for multi-factor authentication, make sure that it does not ask the vault user. * For WALLIX, you need a Bastion user with authorizations on the target accounts. Each authorization must let the user run remote SSH commands. ## Add a PAM system ![New PAM system](https://mintcdn.com/2501/JvHcSERCSJTeR-QQ/images/privileged_access_new_020.png?fit=max\&auto=format\&n=JvHcSERCSJTeR-QQ\&q=85\&s=19b7ff1c5f131ff2947686527f4be776) New PAM system: a credential API, a session proxy, or both. **1. Open the form** In Command Center, click **Privileged access**, then click **Add PAM system**. **2. Select the type** Click **CyberArk** or **WALLIX Bastion**. **3. Enter the name and the scope** Enter a name that identifies the PAM system, for example `acme-cyberark`. Then select the scope. The [scope](#scope) table shows who can use the PAM system. **4. Add the credential API** To read credentials, click **Set up** in **Credential API**. Enter the **Address**, for example `https://ccp.acme.internal/AIMWebService`, and the [sign-in fields](#credential-api-fields). **5. Add the session proxy** To connect to hosts through the PAM system, click **Set up** in **Session proxy**. Enter the **Address**, for example `psmp.acme.internal`, and the [sign-in fields](#session-proxy-fields). **6. Save** Click **Add PAM system**. You must add one part or two parts. **7. Test the sign-in** On the page of the PAM system, click **Run test** in **Sign-in test**. The engine signs in to each part as a task does. > [!WARNING] > > Clear **Verify the PAM system's certificate** only to try a PAM system with a self-signed certificate. Do not use this setting in production. ## Create a PAM account credential ![PAM account credential](https://mintcdn.com/2501/Nw-5R3i4HUHiTxUb/images/credential_pam_account.png?fit=max\&auto=format\&n=Nw-5R3i4HUHiTxUb\&q=85\&s=25af10f4da12dd516234d799fae5bedb) New credential of the PAM account type: a PAM system and a path. **1. Open the form** Click **Credentials**, then click **Create Credential**. **2. Select the type** Enter the name and the scope of the credential. Then select **PAM account** as the type. **3. Select the PAM system** Select the PAM system that keeps the account. The list shows only the PAM systems that the scope of the credential can use. **4. Enter the path** Enter the path of the account in the PAM system. The [path format](#path-format) section gives the format for each type. 2501 does not accept a path with a different format. **5. Save** Click **Create Credential**. Use a PAM account credential as you use other credentials. You can [assign it to an agent](https://docs.2501.ai/0.20/configure/credentials.md#assigning-credentials-to-agents) to log in to a host. An agent can also use it by name during a task. ## Connect to a host through a session proxy 2501 connects to the session proxy, not to the host. The agent keeps only the account name. ![Reach through a session proxy](https://mintcdn.com/2501/JvHcSERCSJTeR-QQ/images/host_reach_through_020.png?fit=max\&auto=format\&n=JvHcSERCSJTeR-QQ\&q=85\&s=34b8d2a04ef288c9756cfbc220f01690) Host page: 2501 connects to the host through the session proxy of a PAM system. **1. Open the host** Click **Hosts**, then click an SSH host. Create the host first if necessary. **2. Select the PAM system** In **Reach through**, select the PAM system, for example `acme-cyberark (CyberArk session proxy)`. Then click **Save Changes**. **3. Give the account to the agent** Open the agent of the host. Assign one credential with the **SSH Username** role. Its value is the [agent account](#agent-account) in the format of the PAM system. **4. Test the connection** Click **Test connection** on the agent. ## Reference ### Credential API fields 2501 keeps the sign-in values on the PAM system, not in a credential. The client certificate, the client key, the API key and the CA bundle are write-only. When you edit a PAM system, leave one of these fields empty to keep its saved value. | Type | Field | Value | | - | - | - | | All | **Address** | The address of the API, for example `https://ccp.acme.internal/AIMWebService` or `https://bastion.acme.internal`. For CyberArk, when you enter only the host, 2501 adds `/AIMWebService`. | | All | **CA bundle** | The certificate authority of the PAM system, in PEM format. Use it when the PAM system has a private certificate authority. | | CyberArk | **Application ID** | The application ID that 2501 signs in as, for example `2501-engine` | | CyberArk | **Client certificate (PEM)** | The client certificate of the application | | CyberArk | **Client key (PEM)** | The private key of the client certificate | | WALLIX | **API user** | The API user that 2501 signs in as, for example `svc-2501` | | WALLIX | **API key** | The API key of the API user | ### Session proxy fields The password or key is write-only. When you edit a PAM system, leave it empty to keep its saved value. | CyberArk | WALLIX | Value | | - | - | - | | **Address** | **Address** | The SSH address of the session proxy, `host` or `host:port`, for example `psmp.acme.internal` or `bastion.acme.internal:22`. The port is 22 when you do not enter one. | | **Vault user** | **Bastion user** | The user that 2501 signs in as, for example `svc-2501` | | **Vault user password or key** | **Bastion user password or key** | A password, or an OpenSSH private key | ### Agent account The agent username is the account as your SSH clients give it to the PAM system. 2501 adds its own user. | Type | Agent username | Format | 2501 signs in to the session proxy as | | - | - | - | - | | CyberArk | `root@srv42.example.com` | `@` | `svc-2501@root@srv42.example.com` | | WALLIX | `root@local@srv42` | `@@`, then `::` if necessary | `root@local@srv42:svc-2501` | For CyberArk, the target address is the **Address** property of the account in the vault. It can be different from the address of the host in 2501, for example a host name instead of an IP address. ### Path format | Type | Path | 2501 reads | | - | - | - | | CyberArk | `Safe/Object` | The password of the account | | CyberArk | `Safe/Object#UserName` | The `UserName` property. Use the name of a different property to read that property. | | WALLIX | `account@domain@device` | The password of the account. `#password` gives the same value. | | WALLIX | `account@domain@application` | The password of an application account | | WALLIX | `account@domain` | The password of an account in a global domain | | WALLIX | `account@domain@device#login` | The login of the account | | WALLIX | `account@domain@device#ssh_key` | The SSH private key of the account | For CyberArk, `Object` is the name of the account in the vault, not its user name. For example: `Linux-Prod/Operating System-UnixSSH-db01-root`. ### Scope | Item | PAM systems it can use | | - | - | | Organization credential | The PAM systems of its organization and the tenant-wide PAM systems | | Tenant-wide credential | The tenant-wide PAM systems only | | Host | The PAM systems of its organization and the tenant-wide PAM systems, if they have a session proxy | The tenant scope requires tenant-level access. ### Session proxy limits * Only SSH hosts that are not jump hosts can use a session proxy. The jump hosts of the host can lead to the proxy. * Set it on the page of the host. The create form, the [public API](https://docs.2501.ai/0.20/api/overview.md) and [import files](https://docs.2501.ai/0.20/configure/import-export.md) do not set it. ### Changes and deletion * You cannot change the type or the scope of a PAM system. To change them, add a new PAM system. * You can change the name, the addresses, the CA bundle and the sign-in values. Save the changes before you test. * You can add a part to a saved PAM system. You cannot remove a saved part. * You cannot delete a PAM system while credentials or hosts use it. The **Used by** panel shows these credentials and hosts. ### Troubleshooting | Message or result | Cause and action | | - | - | | Sign-in test: `The session proxy refused 2501's sign-in` | Make sure that the user and its password or key are correct. | | Sign-in test: `Could not open a session on
` | The engine cannot reach the proxy. The test does not use jump hosts: test an agent instead. | | A task stops: the PAM system refused the session | Make sure that the account exists and that its authorization lets 2501 run remote commands. For CyberArk, make sure that the agent username has the **Address** of the account in the vault. | | `CyberArk answered APPAP004E` | The vault has no account with this path. Or the application or the Provider user is not a member of its safe. | | `CyberArk refused the application` | Make sure that the application ID exists and that its authentication allows the certificate and the machine of 2501. | | `The web server in front of CyberArk refused 2501's client certificate` | The web server of the CCP does not accept the client certificate. Use a certificate that it trusts. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.