Delinea Server PAM

Why Delinea Server PAM?

74% of organizations have shared root/admin accounts on servers. Local accounts are impossible to audit. sudo abuse is a common attack vector. No visibility into administrator actions on servers.

Delinea Server PAM is privileged access management for servers. AD bridging eliminates local accounts on Linux/Unix. Just-in-time privilege instead of standing admin. Session recording for complete audit.

How does it work?

AD Bridging

Centralized identity:

• Single AD identity for Windows and Linux
• Eliminate local accounts
• Federated authentication
• Group Policy extension
• SSO for servers

Just-in-Time Privileges

Temporary elevation:

• Request-based access
• Time-limited privileges
• Automatic revocation
• Approval workflow
• Emergency access

Just-Enough Privileges

Granular control:

• Command-level control
• Zone-based access
• Role definitions
• Least privilege enforcement
• Custom privilege sets

Main features

Identity Consolidation

• Reduce local accounts
• AD as identity source
• Multi-forest support
• LDAP integration
• NIS migration

Privilege Elevation

• sudo replacement
• Fine-grained elevation
• Privilege zones
• Request workflows
• MFA for elevation

Session Monitoring

• SSH session recording
• RDP session capture
• Keystroke logging
• Command auditing
• Video playback

Change Auditing

• File integrity monitoring
• Configuration changes
• Registry monitoring
• Compliance reporting
• Alert generation

Architecture

Zones:

• Logical server grouping
• Per-zone policies
• Role assignments
• Privilege definitions
• Hierarchical structure

Agents:

• Lightweight server agent
• Local enforcement
• Offline capability
• Auto-update
• Low overhead

Supported Platforms

Platform	Versions
Windows Server	2016, 2019, 2022
RHEL/CentOS	7, 8, 9
Ubuntu	18.04, 20.04, 22.04
SUSE	SLES 12, 15
AIX	7.1, 7.2
Solaris	10, 11

Who is it for?

• Enterprise with mixed Windows/Linux environment
• Organizations eliminating local accounts
• Security teams implementing least privilege on servers
• Compliance-driven organizations

Benefits

For security: Eliminate shared accounts, just-in-time access, full audit

For IT: Centralized identity, reduced account sprawl, simplified management

For compliance: Session recording, command logging, compliance reports

Specification

Platforms	Windows, Linux, Unix, AIX
Identity	AD bridging, LDAP
Privilege	JIT, JEP, zones
Recording	SSH, RDP, commands

FAQ

How is Server PAM different from Secret Server? Secret Server is a password vault. Server PAM is identity and privilege management on servers - complementary.

Can I eliminate local root accounts? Yes. AD bridging allows login via AD. Local root for break-glass only.

How does sudo replacement work? dzdo (Delinea sudo) replaces native sudo with central policy, logging, workflow.

Does Server PAM require AD? AD preferred. LDAP alternative. Standalone identity store for isolated environments.

What about offline operation? Agent caches policies. Functions offline with cached credentials and policies.

Are containers supported? Kubernetes and container environments via integration. Dedicated sidecar option.

How to migrate from NIS? Built-in NIS migration tools. AD bridging replaces NIS for identity.

What about multi-factor for server access? MFA for login and/or privilege elevation. TOTP, push, smart cards.

What about session recording storage? Centralized storage. Retention policies. Search and playback via console.

What about support? Delinea support for software. nFlo offers deployment, AD bridging design, and support.