PAM › User Guide
Adding Servers
Register servers, network devices, and infrastructure assets as targets so users can connect to them securely through GAccess
Adding Servers
Overview
A server in GAccess represents a infrastructure target you want people to connect to, like a Windows or Linux server, a network device, Firewall. Once registered, you assign credentials and access policies to it, and authorized users can open sessions to it without ever handling the underlying passwords or keys.
You add a server from the Infrastructure section by clicking Add Server.
Basic target information
| Field | Description |
|---|---|
| Server Name | A unique, friendly name for the target. |
| Category | The kind of target: Server, Network Device, or Database. |
| Operating System / Device Type / Database Type | The specific platform, shown after you pick a category. For Server choose Windows or Linux; for Network Device choose Cisco, Fortinet, or Others; for Database choose MySQL, Oracle, or Others. |
| IP Address | The internal IP address the Gateway uses to reach the target. |
| Port | The port to connect on (1–65535) — for example, 22 for SSH or 3389 for RDP. |
| Description | Free-text notes about the target. Optional. |
| Tags | Labels for searching and organizing targets. Type a tag and press Tab or Enter to add it. Optional. |
Session policy
These settings control what is allowed during a session to this server. They apply to everyone who connects.
| Setting | Effect when enabled |
|---|---|
| Record video session | The session is recorded for audit. A notice is shown to the user when recording is active. |
| Disable Copy From Session | Prevents copying text or data out of the remote session. |
| Disable Paste To Session | Prevents pasting text or data into the remote session. |
| Disable Session File Transfer | Turns off file upload and download for the session. |
| Maximum Session Timeout (Minutes) | The longest a single session can run before it is closed automatically. Defaults to 30 minutes. |
Assigning credentials
In the Credentials section you choose which stored credentials can be used to log in to this server. Search by name, username, or tag, filter by credential type, and tick each credential you want to associate. Selected credentials appear in a summary list, and you can remove any of them before saving.
A server can have more than one credential assigned — for example, different accounts for different users.
To actually connect, a user needs both access to the server and access to one of these credentials (see Permissions below).
Permissions
Access to each server is controlled by policies attached to that server, by ownership, and by roles. From a server's detail page you can add a policy that targets a user or a group and grants one or more of the following permissions:
| Permission | What it allows |
|---|---|
| Read | The server appears in the Infrastructure list and its details can be viewed. |
| Connect | The user can open a session to the server. To connect successfully they must also have Connect on at least one credential assigned to that server. |
| Manage | Full control: edit and delete the server. Includes Read and Connect. |
How permissions are determined
- Creating a new server requires the Create permission, which is granted through a Role, not through a per-server policy.
- The owner — the person who created the server — automatically has full (Manage) control of it.
- Permissions are additive: a user receives the combined total of every policy that applies to them, whether granted directly or through one of their groups, plus anything they get from ownership.
- Policies can be time-bound (a start and end date) and scheduled (specific days of the week and time ranges in a chosen timezone). Access applies only within those windows.