Veritas Appliance Guide for CyberArk Plugin Configuration

To configure PSM-SSH

1. Log in to the CyberArk PVWA.
2. Navigate to the following page:

   Administration > Configuration Options > Options > Connection Components

   Click the + symbol to expand and view the component contents. Then, right-click on PSM-SSH and click Copy.

3. Right-click on Connection Components and select Paste Connection Component.

   The new component should now appear in the expanded list of components: PSM-SSH. To rename the component do the following:

   • Click once on the new PSM-SSH component.

   • In the right pane of the page, in the first row at the top of the page for the ID, change the component name where it appears in the Value column on the right. For example: PSM-NBFSAA.

   • Right-click the new component name and select Copy.

4. Navigate to Administration > Platform Management.
5. On the page with the list of Target Account Platforms, do the following:

   • Locate the CPM PSM name to add PSM support and click on it once.

   • In the lower-right corner of the page, click Edit.

6. In the left column of the page, do the following:

   • Right-click on UI & Workflows and select Add Privileged Session Management.

   • Right-click again on UI & Workflows and select Add Connection Components.

   • Right-click on Connection Components and select Add Connection Component.

   • Paste the Id content that you copied in step 3.

   • In the lower-right corner of the page, click Apply, then click OK.

7. Right-click on the new PSM to ensure that both the Privileged Session Management and Connection Components menus appear.
8. To add the override functionality, do the following:

   • In the left column of the page, right-click on the PSM and select Add Override User Parameters.

     Note:

     Do not select Add Override Component Parameters.

   • Right-click on the PSM again and select Add Parameter.

   • On the Properties side of the page, at the top of the page for Name, enter PSMRemoteMachine into the Value column.

   • On the Properties side of the page, for Type, enter the following into the Value column:

     CyberArk.PasswordVault.Web.TransparentConnection.RemoteMachineUserParameter, CyberArk.PasswordVault.Web

   • In the upper-left corner of the page, click Apply, then click OK.

9. Restart the CyberArk Password Manager as follows:

   • Navigate to Services (Local).

   • Right-click on CyberArk Password Manager and select Restart.

10. Log in to CyberArk Password Manager and do the following:

    • Navigate to the Accounts View page.

    • Select a user account to connect to a machine and click Connect.

    • When prompted, add the IP address for the machine to allow the user to access it.

To configure PSMP SSH

1. Contact your CyberArk representative to obtain the PSMP software.
2. Install the PAMP software on your Linux machine.
3. Set up PSM for SSH on your Linux machine as follows:

   • Download the PSM for SSH software from the following site:

     https://cyberark.my.site.com/mplace/s/#software-aK4Ht000000fxT4KAI-

   • Obtain the necessary documentation from the following site:

     https://docs.cyberark.com/PAS/Latest/en/Content/PASIMP/...

4. Log in to the CyberArk PVWA and navigate to the following page:

   Administration > Platform Management > Veritas NetBackup Flex Scale or Access Appliance API via REST > Connection Components. In the lower-right corner of the page, click Edit.

5. Right-click on UI & Workflows and select Add Privileged Session Management. On the Properties side of the page, verify that the Value for PrivilegedSSO is set to Yes.
6. In the left column of the page, right-click UI & Workflows and select Add Connection Components.
7. In the left column of the page, right-click Connection Component and select Add Connection Component.

   On the Properties side of the page, in the Value column for the Id, change the name of the newly added component to PSMP-SSH.

8. To use one account to connect to multiple target machines, complete the following tasks to add the Override User Parameter, as in the previous procedure.

   • In the left column of the page, right-click on the PSMP-SSH component and select Add Override User Parameters.

     Note:

     Do not select Add Override Component Parameters.

   • Right-click on Override User Parameters and select Add Parameter.

   • On the Properties side of the page, at the top of the page for Name, enter PSMRemoteMachine into the Value column.

   • On the Properties side of the page, for Type, enter the following into the Value column:

     CyberArk.PasswordVault.Web.TransparentConnection.RemoteMachineUserParameter, CyberArk.PasswordVault.Web

   • In the upper-left corner of the page, click Apply, then click OK.

9. You are now ready to connect to the NetBackup Flex Scale or Access Appliances in the Linux environment. Use the following connection string to connect:

   ssh <vault_login_user>@<cyberark_account_name>#<IP/FQDN>@<targetmachine>

   #targetport@<vaultuserpassword>@<PSMPserverIP/FQDN>

   Where vault_login_user is the administrator that logs into the PVWA and cyberark_account_name is the Access Appliance or NetBackup Flex Scale user login account name.

   Note:

   The IP/FQDN parameter for the cyberark_account_name must match the target machine context exactly as it appears in the PVWA. For example, to use an IP address instead of a machine name in the PVWA, you must also use the IP address in the string. This same rule applies in the reverse situation whereas if you use a machine name in the string, you must also use the machine name in the PVWA. The concept here is to match the values. Name resolution does not work or apply here.