This chapter contains an example of a basic Wheel Fudo PAM configuration, to monitor RDP access to a remote server. In this scenario, the user connects to the remote server over the RDP protocol and logs in to the Wheel Fudo PAM using an individual login and password combination (john_smith/john). When establishing the connection with the remote server, Wheel Fudo PAM substitutes the login with specified in Account and the password with the password managed by a password changer (authentication modes are described in the User authentication modes section).



Description below assumes that the system has been already initiated. The initiation procedure is described in the System initiation topic.



Adding a server

Server is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.

  1. Select Management > Servers.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name rdp_server
Blocked fail
Protocol RDP
Description fail
Granted users fail
Destination host  
Port 3389
Bind address
  1. Click i to download the target server’s public key.
  1. Click Save.

Adding a user

User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.

  1. Select Management > Users.
  2. Click Add.
  1. Provide essential user information:
Parameter Value
Login john_smith
Blocked fail
Account validity Indefinite
Role user
Preferred language English
Safes default settings
Full name John Smith
Email john@smith.com
Organization fail
Phone fail
AD Domain fail
LDAP Base fail
Granted users fail
Type Password
Password john
Repeat password john
  1. Click Save.

Adding a listener

Listener determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.

  1. Select Management > Listeners.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name rdp_listener
Blocked fail
Protocol RDP
Security Standard RDP Security
Announcement fail
Granted users fail
Mode proxy
Local address
Port 3389
  1. Click i to generate the proxy server’s private key or i to upload the .PEM file private key definition.


For security reasons the form displays server’s public key derived from the generated or uploaded private key.

  1. Click Save.

Adding an account

Account defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.

  1. Select Management > Accounts.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name admin_rdp_server
Blocked fail
Type regular
Session recording all
OCR sessions ok
OCR Language English
Delete session data after 61 days
Granted users fail
Server rdp_server
Domain fail
Login administrator
Replace secret with with password
Password password
Repeat password password
Password change policy Static, without restrictions
Password changer  
Password changer None
Privileged user fail
Privileged user password fail
  1. Click Save.

Defining a safe

Safe directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.

  1. Select Management > Safes.
  2. Click Add.
  1. Provide essential configuration parameters:
Parameter Value
Name rdp_safe
Blocked fail
Login reason fail
Notifications fail
Policies fail
Protocol functionality  
RDP ok
SSH fail
VNC fail
Objects relations  
Users john_smith
Accounts admin_rdp_server
Listeners rdp_listener
  1. Click Save.

Establishing an RDP connection with a remote host

  1. Launch RDP client of your choice.
  2. Enter destination host IP address and RDP service port number.
  1. Enter user login and password and press the [Enter] keyboard key.


Wheel Fudo PAM enables using custom login, no access and session termination screens for RDP and VNC connections. For more information on user defined images for graphical remote sessions, refer to the Resources topic.


Viewing user session

  1. Open a web browser and go to the web address.
  2. Enter the login and password to login to the Wheel Fudo PAM administration panel.
  1. Select Management > Sessions.
  2. Click Active.
  3. Find John Smith’s session and click i.

Related topics: