A Monopam installation is a small set of services. Users and administrators only ever talk to the web application; the gateway does the work close to your systems.
Components
|
Component |
What it does |
Where it runs |
|---|---|---|
|
Monopam |
Web application and API. Holds the configuration, the vault, policies, requests and the audit log, and serves the user interface. |
Linux server, as containers |
|
Monosign |
Identity provider for Monopam: sign-in, multi-factor authentication, users and groups. |
Linux server, as containers, next to Monopam |
|
Gateway |
Brokers every session to a target system: RDP, SSH, VNC, Telnet, SFTP, the database proxy, the Kubernetes listener and the SSH bastion. Captures recordings and runs password changes and scripts on targets. |
Windows, Linux or a container, in the network that can reach the targets |
|
Agents |
Optional software on a managed machine. The resource agent manages local accounts and runs scripts; the endpoint agent enforces Endpoint Privilege Management. |
Windows, Linux and macOS endpoints |
|
Database |
Stores Monopam's data. Secrets are encrypted before they are written. |
PostgreSQL or Microsoft SQL Server |
|
Cache and file storage |
Shared cache for the application and storage for recordings and uploaded files. |
Containers on the Monopam server, or your own services |
How a session flows
-
The user signs in to Monopam through Monosign and clicks Connect on a resource.
-
Monopam checks the user's policies, and the approval if one is required.
-
Monopam asks a gateway that can reach the target to open the session, and passes it the credential from the vault. The credential is never sent to the user's browser or client.
-
The gateway connects to the target and streams the session to the user. It records the session if the policy says so.
-
When the session ends, the recording is stored and the audit log shows who connected, to what, and when.
Several gateways can serve one installation. Group them by location with Sites so each resource is reached through a gateway in its own network.
Network
Users reach Monopam and Monosign over HTTPS. Monopam talks to each gateway, and each gateway talks to the targets it serves, so users never need a network path to the targets themselves. The ports for each component are listed in the network and firewall requirements of the Installation Guide.