Privileged Access Management (PAM): Pre-requisites & Technical Requirements
This page consolidates everything you must have ready before you can deploy Securden Unified PAM in your on-premises environment. It covers details such as recommended server sizing, operating system and licensing needs, network ports, and the component-specific pre-requisites.
You may use it as a reference for assessing product fit, planning implementation, firewall change requests and deployment.
Privileged Access Management (Unified PAM) Components
Summary of the standard components that will be part of your Unified PAM implementation.
Note: Each of these components does represent a mandatory count of separate dedicated machines for deployment. The exact number of components needed in your implementation depends on the approach you take towards high availability, network distribution, infrastructure hosting etc. Engineers at Securden will recommend the exact components, sizing and configurations pre-implementation.
| PAM Components | Functional Role |
|---|---|
| Primary Application Server | Main PAM server hosting the web console core services, operations |
| Secondary Application Server | Load-balancing / High Availability partner connected to the common database |
| Primary Database | Backend database bundled with the primary application server. PostgreSQL by default; MS SQL Server optional. |
| Secondary Database (Optional) | Continuously replicates data from the primary database. |
| Securden Session Manager (SSM) / Remote Gateway | Launches and records remote sessions (RDP, SSH, etc.) between users and target machines. Mandatory for distributed networks and native connections. |
| App Server/Remote Connector (Optional) | Supports remote functions such as remote password reset, password verification and account discovery. |
| Read-Only (Replica) Server (Optional) | Helps users access Securden when the primary server is down, allows users to perform ‘READ’ operations and prevents them from modifying data. |
| Securden Agent (Optional) | Installed on endpoints/targets (Windows) for local privilege elevation and delegation management. |
High Availability Operating Mode
Two application servers (primary and secondary) connected to a common database keep privileged credentials highly available. If one server fails or becomes unresponsive: incoming traffic is redirected to the other active server. The application servers can be two separate physical machines or two virtual machines.
3 System Requirements for PAM Components
3.1 Primary and Secondary Application Servers
Any physical or virtual server meeting the configuration below is acceptable.
Note: The exact server specifications for the primary & secondary application server are determined by the number of concurrent sessions that your users will take. The sample below is the estimate for 0-15 concurrent sessions.
| Unit | Primary Application Server | Secondary Application Server |
|---|---|---|
| Memory | 16 GB RAM | 16 GB RAM |
| Disk (HDD) | 50 GB or more | 50 GB or more |
| vCPU (Intel or AMD) | 4 or more cores | 4 or more cores |
| Operating system | Windows Server 2016 or above | Windows Server 2016 or above |
| IP address | 1 static IP | 1 static IP |
| Quantity | 1 | 1 or more |
| Purpose | Core PAM server | High Availability |
Note: A Windows Server licence is required for each application server.
3.2 Remote Gateway (SSM) and App Server
To enable remote connections and certain remote functions across multiple networks, deploy the Session Manager / Gateway Server and the Remote Connector.
- Deploy SSM, the Remote Connector, or both on the machine that serves as the gateway.
- If you only need to launch remote sessions and record them, SSM alone is sufficient.
- If you need remote password resets, associate the gateway with the application server.
- The SSM must be deployed on a domain-joined machine.
Note: The exact server specifications for the SSM server are determined by the number of concurrent sessions that your users will take. The sample below is the estimate for 0-15 concurrent sessions.
| Unit | SSM Server / Remote Gateway | Remote Connector |
|---|---|---|
| Memory | 16 GB RAM | 16 GB RAM |
| Disk (HDD) | 50 GB or more | 50 GB or more |
| vCPU (Intel or AMD) | 4 or more cores | 4 or more cores |
| Operating system | Windows Server 2016 or Linux OS | Windows Server 2016 or above |
| IP address | 1 static IP | 1 static IP |
| Quantity | 1 or more | 1 |
| Purpose | Terminal server for session launch and recording | Remote password reset, password verification, account discovery and other remote functions |
3.3 Securden Privilege Management Agent
- Installed as an .msi (Windows Installer) package.
- Supported on machines running Windows 7 or above.
3.4 Terminal (RDS) Licensing for Windows SSM
A Microsoft Remote Desktop Services (RDS CAL) licence is required when a Remote Gateway Server is used.
How RDS works in Securden: a single domain account is used to log in to the gateway device, which then connects onward to the target devices. When users launch connections, they use the domain account to log in to the gateway, and their own user account is then used from the gateway to reach the targets systems.
Based on this model, you can work with Microsoft to choose the appropriate licensing (one user CAL or multiple user CALs). Securden does not recommend or comment on third-party licensing.
3.5 Supporting Infrastructure & Credential Requirements
| Item | Requirement |
|---|---|
| Domain Settings | A domain service account needs to be created in your Active Directory domain controller, that has domain admin rights or local admin rights for the Unified PAM server and for the remote privileged systems you would like to manage. |
| Encryption key storage | A separate, access-controlled network location, or a Hardware Security Module (HSM) to store the key. |
| SSL certificate | Publicly trusted certificate with private key and intermediate CA bundle. The public SSL certificate needs to be installed on all application servers to authenticate and encrypt connections between user devices and the Unified PAM server. |
| DNS | Public DNS records for the Primary/Secondary servers and the session-manager (SSM) gateways |
| SMTP | An external mail server needs to be set up and integrated with Unified PAM for users to receive email notifications. |
| Service Account for Remote Operations | Organizations would be required to create a dedicated service account with domain admin privileges that will be used by Securden to carry out various privileged operations such as - discovering domain computers, managing domain accounts, and more. |
| Licensing | PAM licence key obtained; Module licence confirmed if EPM (Endpoint privilege), CIEM, IGA, SSPR is required. |
4. Unified PAM Network and Port Requirements
All ports below are TCP unless otherwise noted. Submit and approve firewall changes across all target subnets before deployment, including client-to-gateway and gateway-to-target ports for remote protocols.
4.1 Core Product Ports
| Port name | Source | Destination | Port (TCP) | Details |
|---|---|---|---|---|
| PostgreSQL database | Primary, Secondary and all Application Servers | PostgreSQL server | 5858 | Default backend RDBMS connection |
| MS SQL database | Primary and Application Servers | MS SQL server | 1433 | Only if MS SQL Server is the backend |
| Securden server (web) | All users (end machines), agents and Secondary servers | Primary server | 5959 | Web port; can be changed to 443 or another port |
| Securden server (web) | All users (end machines), agents and Secondary servers | Secondary server | 5959 | Web port; can be changed to 443 or another port |
| SSM inbound | All client machines | SSM server machine(s) | 3389 (RDP) | Opened on the SSM for all client machines |
| SSM outbound | SSM server machine(s) | All target machines | 3389 (RDP) | Opened to all target machines from the SSM server |
| Web SSH | All users (end machines) | All Application Servers | 5622 | Web-based SSH remote connections |
| Web RDP | All users (end machines) | All Application Servers | 5626 | Web-based RDP remote connections |
| Session recording (web applications) | Browser Extension component | All Application Servers | 5936 | Required for web application session recording captured by the Browser Extension |
| SMTP (TLS) | Application server | Mail server | 587 | Mail delivery using TLS |
| SMTP (SSL) | Application server | Mail server | 465 | Mail delivery using SSL |
4.2 Directory, Authentication and Integration Ports
| Port name | Source | Destination | Port | Details |
|---|---|---|---|---|
| Proxy server | Primary server | Proxy server | Based on your settings | Only if a proxy regulates internet traffic; configured under Admin > General > Proxy Server Settings |
| AD (DC), secure | Primary server | AD domain controller | 636 (TCP) | SSL/TLS; used for Active Directory account discovery (default) |
| AD (DC), standard | Primary server | AD domain controller | 389 (TCP) | Used only if SSL/TLS is not enabled |
| RADIUS server | PAM servers | RADIUS / MFA server | 1812 | Only if RADIUS-based two-factor authentication is configured |
| Entra ID (Azure AD) | Primary / Application server | Entra ID | Graph API (HTTPS) | Only if Entra ID integration is used |
| Breached password identification | Primary server (needs internet access) | api.pwnedpasswords.com | HTTPS | Checks for breached or compromised passwords |
4.3 Configuration Notes
- The Securden web port (default 5959) may be changed to 443 or any other available port.
- The AD port defaults to 636; 389 applies only when SSL/TLS is not enabled for the directory connection.