Policies are patterns definitions facilitating proactive session monitoring. In case a defined pattern is detected, Wheel Fudo PAM can automatically pause or terminate given connection, block the user and send notification to Wheel Fudo PAM administrator.

Defining patterns

  1. Select Management > Policies.
  2. Select Regular expressions tab.
  3. Click Add regular expression.
  1. Enter pattern name.
  2. Define the pattern itself.


Patterns can be defined as regular expressions.

Wheel Fudo PAM does not recognize expressions which use backslash character, e.g. \d, \D, \w, \W.

  1. Repeat steps 3-5 to define additional patterns.
  2. Click Save.


Regular expressions examples

Command rm


Command rm -rf (also -fr; -Rf; -fR)


Command rm file (^|[^a-zA-Z])rm[[:space:]]+([^[:space:]]+[[:space:]]*)?/full/path/to/a/file([[:space:]]|\;|$) (^|[^a-zA-Z])rm[[:space:]]+.*justafilename

Defining policies

  1. Select Management > Policies.
  1. Click Add policy.
  1. Enter policy name.
  2. Select actions.
email Send email notification to system administrator.
pause Pause connection.
terminate Terminate connection.
block Block user.


Note that terminating connection also blocks the user account and vice versa - blocking user automatically terminates user’s connections.

  1. Select monitored patterns.
  2. Click Save.


After defining a policy, you can assign it to a particular server configured in connection.

Deleting patterns

  1. Select Management > Policies.
  2. Select the Regular expressions tab.
  3. Find desired pattern definition and select the Delete option.
  4. Click Save.

Deleting policies

To delete policy definition, proceed as follows.

  1. Select Management > Policies.
  1. Find desired policy definition and select corresponding Delete option.
  2. Click Save.

Related topics: