This page outlines the server specifications and network ports required for deploying Securden Password Vault for Enterprises. It covers on-premises installations on physical or virtual servers, customer-managed AWS and Azure deployments, and the connectivity and Remote Connector requirements applicable to Securden-hosted SaaS deployments.
Before understanding the technical specifications, choose your deployment:
On-Premises Deployment
1. Server Specifications
Verify the information pertaining to the servers required, specifications, and the scalability requirements for your on-premises deployment.
Servers in Your Deployment
| Server / Component | Required For | Details |
|---|---|---|
| Primary Application Server | Every deployment | Hosts the Securden Password Vault application and processes user and API requests. |
| Primary Database | Every deployment | Use the bundled PostgreSQL database or Microsoft SQL Server. The database can share the application host or be hosted separately, according to your deployment architecture. |
| Secondary Application Server | Application high availability | Provides a standby application server for failover. |
| Secondary Database | Database high availability | Maintains a replicated copy of the primary PostgreSQL database and supports database failover. |
| Read-Only Replica | Additional read-only continuity | Provides access to synchronized vault data for password retrieval and remote connection operations. |
| Additional Application Server | Distributed deployments | Provides application services in additional locations. |
Note: These are deployment components, not a mandatory count of separate machines. The number of hosts depends on database placement and the availability or distributed-access options you select.
Recommended Server Configuration
Review the server specifications for deploying Securden Password Vault for Enterprises. The configuration requirements below apply to each application server, database server, and read-only replica server in your deployment.
| Specification | Recommended configuration per server |
|---|---|
| Memory | 16 GB RAM |
| Processor | 4 or more cores, Intel or AMD |
| Storage | 50 GB or more |
| Operating system | Windows Server 2016 or later |
| Network | One static IP address |
Additional Requirements
- Database selection: PostgreSQL is included in the installation package. If using Microsoft SQL Server, provision a supported version and the applicable database licensing.
- Operating system licensing: A valid Windows Server license is needed for the server in which Securden Password Vault is deployed. If you use more application servers in your environment, each application server requires a valid Windows Server license.
- Version consistency: All primary, secondary, additional application, and read-only replica servers must run the same Password Vault version.
- Connectivity: Ensure each host can reach its required database, directory services, target systems, and integration endpoints. Refer to Ports Required for the corresponding firewall rules.
- Deployment preparation: Configure DNS, HTTPS certificates, service accounts, and backup arrangements as described in Deployment Prerequisites and Checklist.
2. Ports Required
Review the ports required for different functions and connections in the table below, along with the protocol, source, and destination for each connection.
| Port | Protocol | Source | Destination | Connection Details |
|---|---|---|---|---|
| Application Access | ||||
| TCP 5454; configurable to 443 or another port | HTTPS | User devices, API clients, agents, and other Vault servers, as applicable | Vault application servers | Web, desktop, mobile, browser extension, and API access; inter-server application communication. |
| TCP 5422 | Browser-based SSH session transport | User browser | Vault application server | Browser-based SSH connections. |
| TCP 5426 | Browser-based RDP session transport | User browser | Vault application server | Browser-based RDP connections. |
| Backend Database Connectivity | ||||
| TCP 5353 | PostgreSQL | Vault application servers | PostgreSQL backend database | Application-to-database communication. |
| TCP 1433 | TDS | Vault application servers | Microsoft SQL Server backend | Application-to-database communication when SQL Server is used as the backend. |
| Target-System Connectivity | ||||
| TCP 3389 | Web-based RDP | Vault application server | Target Windows systems | Browser-based RDP connections to Windows targets. |
| Native RDP | End User Machine | Target Windows systems | Native RDP connections to Windows targets. | |
| TCP 22 | Web-based SSH | Vault application server | Target Linux/Unix systems and network devices | Web-based SSH connections to managed targets. |
| Native SSH | End User Machine | Target Linux/Unix systems and network devices | Native SSH connections to managed targets. | |
| TCP 1521 | Web-based TNS | Vault application server | Target Oracle database server | Remote, web-based Oracle database connections. |
| Native TNS | End User Machine | Target Oracle database server | Remote, native Oracle database connections. | |
| TCP 1433 | Web-based TDS | Vault application server | Target Microsoft SQL Server | Remote, web-based SQL Server connections. |
| Native TDS | End User Machine | Target Microsoft SQL Server | Remote, native SQL Server connections. | |
| Directory and Authentication Integrations | ||||
| TCP 636 | LDAPS | Vault application server | Active Directory domain controller | Encrypted directory access for the configured AD integration. |
| TCP 389 | LDAP | Vault application server | Active Directory domain controller | Unencrypted directory access when LDAP without SSL/TLS is configured. |
| UDP 1812; or the configured authentication port | RADIUS | Vault application server | RADIUS authentication server | RADIUS authentication or RADIUS-based MFA. |
| TCP 443 | HTTPS | Vault application server | Microsoft Entra ID / Microsoft Graph endpoints | Microsoft Entra ID integration. |
| TCP 443 | HTTPS | Vault application server | Google Workspace APIs and OAuth endpoints | Google Workspace integration for user import and synchronization |
| Email, SIEM, and Other Integrations | ||||
| TCP 587 | SMTP with STARTTLS | Vault application server | SMTP server | Email notifications through a STARTTLS-enabled mail server. |
| TCP 465 | SMTP over implicit TLS | Vault application server | SMTP server | Email notifications through an implicit-TLS mail server. |
| TCP 443 | HTTPS | Vault application server | api.pwnedpasswords.com | Breached-password identification, when enabled. |
| Any Configured Proxy Port | Any Configured Proxy Protocol | Vault application server | Customer proxy server | Internet connectivity through the configured proxy. |
| Any Configured Port | Any Configured Protocol | Vault application server | SIEM platform | Audit event forwarding. |
SaaS Deployment
1. Server Specifications
Review the Securden-hosted components, customer-side server requirements, and sizing considerations for your SaaS deployment. Securden completely manages the hosted Vault infrastructure. A dedicated Remote Connector server is deployed in the customer’s environment when integration with on-premises Active Directory is required for user onboarding or with a locally hosted SIEM system for audit log forwarding.
Servers Included
| Server / Component | Required For | Details |
|---|---|---|
| Primary Application Server | Securden-Hosted, Every Deployment | Hosts the Password Vault application and processes user and API requests. Provisioning, security, configuration, and maintenance are managed by Securden. |
| Primary Database | Securden-Hosted, Every Deployment | Amazon RDS for PostgreSQL stores the vault data. Securden manages database provisioning, security, backups, and maintenance. |
| Secondary Application Server | Securden-Hosted, Application high availability | Provides application redundancy. Securden manages the secondary server and availability configuration; customers do not need to administer or switch between servers. |
| Secondary Database | Securden-Hosted, Database High Availability | Maintains a replicated copy of the primary database and supports automatic failover. Replication, maintenance, and failover are managed by Securden. |
| Remote Connector | Deployed in the Customer Environment, Connectivity to Customer-Hosted Resources | Deployed within the customer environment to connect the hosted Vault with on-premises Active Directory, private target systems, and locally hosted SIEM platforms. |
Note: All the hosted application and database components are provisioned and managed by Securden. Customers do not need to deploy application servers, database servers, or hosted-service HA infrastructure. Only the Remote Connector deployment needs to be done from the customer’s end and depends on the internal resources and integrations in use.
Recommended Server Configuration
The following specifications apply per Remote Connector instance deployed within your environment.
| Specification | Configuration per Remote Connector |
|---|---|
| Memory | 16 GB RAM |
| Processor | 4 vCPUs, Intel or AMD |
| Storage | 200 GB or more |
| Operating system | Windows Server 2019 or later |
| Network | One static IP address |
Additional Requirements
- Operating system licensing: Provide a valid Windows Server licence for each customer-hosted Remote Connector.
- Connector registration: Install and register the Remote Connector with your assigned SaaS Vault instance.
- Outbound connectivity: Allow the Remote Connector to initiate HTTPS connections to the assigned SaaS Vault URL over TCP 443.
- Internal connectivity: Ensure the connector can reach the directory servers, target systems, and locally hosted SIEM endpoints required by your deployment.
- Deployment preparation: Prepare identity integrations, authentication settings, and customer-side connectivity as described in Deployment Prerequisites and Checklist.
2. Ports Required
Review the ports required for SaaS access, Remote Connector communication, target-system connections, and integrations, along with the protocol, source, and destination.
| Port | Protocol | Source | Destination | Connection Details |
|---|---|---|---|---|
| Application Access | ||||
| TCP 443 | HTTPS | User devices, browser extensions, and API clients | Organization-specific SaaS Vault URL | Web, desktop, mobile, browser extension, Remote Launcher, and API access. |
| Remote Connector Connectivity | ||||
| TCP 443 | HTTPS | Remote Connector | Organization-specific SaaS Vault URL | Outbound connection initiated by the connector to communicate with the hosted Vault. No Internet-facing inbound firewall rule is required for this link. |
| Target-System Connectivity | ||||
| TCP 3389 | RDP | End User Machine | Target Windows systems | Native RDP connections to Windows targets. |
| TCP 22 | SSH | End User Machine | Target Linux/Unix systems and network devices | Native SSH connections to managed targets. |
| TCP 1521 | TNS | End User Machine | Target Oracle database server | Native Oracle database connections. |
| TCP 1433 | TDS | End User Machine | Target Microsoft SQL Server | Native SQL Server connections. |
| Directory and Authentication Integrations | ||||
| TCP 636 | LDAPS | Remote Connector | Active Directory domain controller | Encrypted directory access for the configured Active Directory integration and user onboarding. |
| TCP 389 | LDAP | Remote Connector | Active Directory domain controller | Unencrypted directory access when LDAP without SSL/TLS is configured. |
| TCP 443 | HTTPS | Cloud-hosted Securden server | Microsoft Entra ID / Microsoft Graph endpoints | Direct Microsoft Entra ID integration for user import and synchronization. |
| TCP 443 | HTTPS | Cloud-hosted Securden server | Google Workspace APIs and OAuth endpoints | Direct Google Workspace integration for user import and synchronization. |
| TCP 443 | HTTPS | User browser | Configured cloud identity provider’s sign-in endpoint | Browser access for SAML-based SSO, when configured. |
| Web Application and SIEM Connectivity | ||||
| Any configured application port | HTTPS | User browser | Web applications / cloud services | Access to the destination application for browser-extension launch and autofill. |
| Any configured application port | HTTPS | Remote Connector | Web applications / cloud services | Application access where connectivity through the Remote Connector is configured. |
| Any configured port | Configured protocol | Remote Connector | Locally hosted SIEM platform | Audit event forwarding to a SIEM within the customer environment. |
| Any configured port | Configured protocol | Cloud-hosted Securden server | Cloud-hosted SIEM platform | Direct audit event forwarding to the configured cloud SIEM endpoint. |
Configuration notes
- URL allowlisting: Allow outbound HTTPS access from the Remote Connector to the SaaS Vault URL supplied for your deployment.
- Internal firewall restrictions: Permit inbound access on directory servers and target systems from the Remote Connector’s IP address. Direct inbound access from the cloud-hosted Vault to these internal systems is not required.
- Customized listeners: Where a directory, target system, web application, or SIEM listener uses a different port, permit that configured value.
- Cloud-hosted SIEM: Configure the integration and allowlist the Securden-provided source IP address where required, including for Azure-hosted platforms such as Microsoft Sentinel. A Remote Connector is not required for this forwarding path.
- Backend database connectivity: Hosted application-to-database connections and database replication are managed by Securden. Customers DO NOT need to open backend database ports.