PAM Remote Worker Integration

A PAM remote worker node is a PAM node with the Job Engine application installed, but not the main PAM GUI/API application.

In the context of this Ansible project, the following terms are used:

• A master node is a PAM node with GUI/API, Job Engine, and Session Manager applications.
• A remote node is a PAM node with Job Engine and Session Manager but not GUI/API.
• A worker node is a PAM node with Job Engine but not Session Manager or GUI/API.
• A remote worker is the Job Engine application on a remote or worker node.

Why Remote Worker Nodes?

The main reason to deploy PAM remote worker nodes is to align the deployment of PAM with the topology and security boundaries of the network, as in the following scenario. Installing a PAM remote worker node in each remote network provides these advantages:

• Traffic across the firewalls is only HTTPS. No need to open native traffic (SSH/WINRM) in the firewall.
• Puts job management and execution closer to the managed hosts.
• Helps prevent cross-network secrets exposure.

Remote Worker Authentication (Default)

PAM remote worker nodes integrate to a PAM farm through the PAM API. User account configuration for remote worker integration is an important design consideration when deploying a PAM farm.

The default behavior of this Ansible project is to create a single local user remote.user on all PAM master nodes, and use that to integrate all remote worker nodes into the farm.

This is only suitable for simple PAM deployments with a single remote worker, or when trust boundaries between remote workers is not a concern.

Remote Worker Authentication (Advanced)

A more advanced PAM remote worker deployment strategy is as follows:

• Configure the PAM farm for Active Directory (AD) integration.
• For each remote worker, create a unique service account in AD.
• In the Ansible inventory file, set the ldap_user_worker attribute like this:

[pam_master]
pam-master1.corp.net
pam-master2.corp.net

[pam_remote]
pam-remote1.corp.net ldap_user_worker=pam-remote1
pam-remote2.corp.net ldap_user_worker=pam-remote2

[pam_worker]
pam-worker1.corp.net ldap_user_worker=pam-worker1
pam-worker2.corp.net ldap_user_worker=pam-worker2

The ldap_user_worker may also be set in Ansible host_vars files.

This must be done before deploying the PAM farm with Ansible. With this configuration in place, each remote worker will use a unique AD account for API integration. Permissions can be set on PAM records or vaults to restrict which jobs can be run by which workers.