This chapter contains an example of a basic Fudo PAM configuration, to monitor VNC access to a remote server. In this scenario, the user connects to the remote server over the VNC protocol and logs in to the Fudo PAM using an individual login and password combination (john_smith/john). When establishing the connection with the remote server, Fudo PAM substitutes the password with the previously defined value: password (authentication modes are described in the User authentication modes section).


Due to specifics of VNC protocol, which authenticates the user using password only, the substitution login string entered in account properties is ignored when establishing a VNC connection.



Description below assumes that the system has been already initiated. The initiation procedure is described in the System initiation topic.



Adding a server

Server is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.

  1. Select Management > Servers.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name vnc_server
Blocked fail
Protocol VNC
Description fail
Granted users fail
Destination host  
Port 5900
  1. Click Save.

Adding a user

User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.

  1. Select Management > Users.
  2. Click Add.
  3. Provide essential user information:
Parameter Value
Login john_smith
Fudo domain fail
Blocked fail
Account validity Indefinite
Role user
Preferred language English
Safes fail
Full name John Smith
Organization fail
Phone fail
AD Domain fail
LDAP Base fail
Granted users fail
Authentication failures fail
Enforce static password complexity fail
Type Password
Password john
Repeat password john
  1. Click Save.

Adding a listener

Listener determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.

  1. Select Management > Listeners.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name vnc_listener
Blocked fail
Protocol VNC
Granted users fail
Mode proxy
Local address
Port 5900
  1. Click Save.

Adding an account

Account defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.

  1. Select Management > Accounts.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name admin_vnc_server
Account type regular
Session recording complete
OCR sessions ok
Delete session data after 61 days
Granted users fail
Server vnc_server
Domain fail
Login fail
Replace secret with with password
Password root
Repeat password root
Password change policy Static, without restrictions
Password changer  
Password changer None
Privileged user fail
Privileged user password fail
  1. Click Save.

Defining a safe

Safe directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.

  1. Select Management > Safes.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name vnc_safe
Notifications fail
Ask for login reason fail
Policies fail
Users john_smith
Protocol functionality  
RDP fail
SSH fail
VNC ok
admin_vnc_server vnc_listener
  1. Click Save.

Establishing connection

  1. Launch VNC Viewer, enter in the server address field and press the enter key.
  1. Enter username and password and press the enter key.
../../_images/vnc_viewer_2.png ../../_images/vnc_viewer_3.png

Viewing user session

  1. Open a web browser and go to the web address.
  2. Enter the login and password to login to the Fudo PAM administration panel.
  1. Select Management > Sessions.
  2. Find John Smith’s session and click i.

Related topics: