PAM360 Architecture, Components, Ports and Protocols

PAM360 is a unified privileged access management solution designed to manage and monitor privileged accounts in IT environments. Now that you have a grasp of the fundamental modules of PAM360, it is time to explore its architecture, functionality, and process flow. This document provides a detailed overview of the PAM360 architecture.

1. Architecture Overview

The diagram illustrates the various components, their interactions, and the flow of data within the system.

2. PAM360 Components

PAM360 comprises multiple components that work in hand with each other to protect your privileged accounts and strengthen security in your environment.

2.1 Interface and Access

PAM360 can be installed on Windows and Unix-based machines as a web application configurable according to user requirements. It is accessible via web clients and mobile applications, providing a web-based or mobile interface for users to interact with PAM360. It also supports remote desktop and SSH sessions via the web-based interface. Additionally, PAM360 communicates with applications through REST APIs and SSH APIs.

2.2 Databases

PAM360 supports several databases, including PostgreSQL, MS SQL, Amazon RDS MS SQL, Amazon RDS PgSQL, and MS Azure SQL as the backend database. By default, it comes bundled with PostgreSQL but allows migration between databases for flexibility and convenience. This database is integral to the storage and retrieval of data within the PAM360 ecosystem.

2.3 Users

Users in PAM360 are identified by their user ID or username and gain access to the application through a network service, either on a computer or mobile device. Users can be imported using Active Directory, Microsoft Entra ID, and LDAP or added manually via API or file imports. Once added, users can be assigned appropriate access roles and password policies. Custom user roles with specific permissions can also be created to meet organizational needs.

2.4 Supported Resource Types

Resources in PAM360 encompass any server, application, network device, or appliance with authentication credentials that need securing. PAM360 supports various resource types including:

1. Operating System - Windows, Windows Domain, Linux, Mac, Solaris, HP UNIX, IBM AIX, HPUX, JunOS
2. Cisco Devices - Cisco IOS, Cisco PIX, Cisco Cat OS, Cisco Management Integration Center, Cisco Catalyst, Cisco sg300, Cisco UCS, Cisco Wireless LAN Controller, Cisco Nexus OS
3. Database Servers - MS SQL Server, MySQL Server, Sybase ASE, Oracle DB Server, PostgreSQL
4. Network Devices - HP ProCurve, Juniper NetScreen ScreenOS, HP iLO, ASA Firewall, Audiocode, Brocade, Brocade VDX, Brocade SAN Switch, Checkpoint Firewall, Extreme Networks, F5, Fortinet, FortiGate Firewall, Fortimail, Fujitsu Switch, Gigamon, H3C, HMC, HP Printer, HP Onboard Administrator, HP Virtual Connect, Huawei, Juniper, Mikrotik, OpenGear, Orange Firewall, Palo Alto Networks, Pfsense, Routerboard, Ruijie, Sonicwall, TPLINK, VMWare VCenter
5. Cloud Devices - AWS IAM, Google Workspace, Microsoft Entra ID, Rackspace, Salesforce, Azure App, Citrix Netscaler SDX, Citrix Netscaler VPX, Magento, Netapp 7Mode, Netapp CDot
6. File Stores - File Store, Key Store, License Store
7. MQ Applications - RabbitMQ
8. Others - Web Site Accounts, LDAP Server, VMware ESXi, IBM AS400, Oracle XSCF, Oracle ALOM, Oracle ILOM, WebLogic, Aruba ATP, AVAYA-GW, FortiManager-FortiAnalyzer, HPE StoreOnce, Nimble Storage, Nortel, OS Type, Microsoft Azure

2.5 Primary and Secondary Servers

The primary server/central server is responsible for executing the core operations of PAM360. The secondary or configured servers act as backup nodes that ensure service continuity and high availability in case of a failure. These secondary servers stay synchronized with the primary server, depending on the chosen high-availability architecture.

PAM360 supports the following high-availability architectures:

1. Application Scaling : Optimizes performance by dynamically allocating requests based on workload demand.
2. Secondary Server Architecture : Maintains continuous availability by automatically switching operations to the secondary server during downtime or maintenance.
   
3. Failover Service : Ensures uninterrupted access by allowing a standby system to seamlessly take over when the primary server becomes unavailable.
   
4. Read-Only Server : Provides a replicated data instance that can be promoted to a primary server during outages, ensuring operational continuity without compromising data integrity.

3. Ports and Protocols Used