Privileged Access Security

System Requirements

Version 10.9

Including:
Privileged Identity Management Suite
Privileged Session Management Suite

Copyright © 1999-2019 CyberArk Software Ltd. All rights reserved..

This document contains information and ideas, which are proprietary to CyberArk
Software Ltd. No part of this publication may be reproduced, stored in a retrieval system,
or transmitted, in any form or by any means, electronic, mechanical, photocopying,
recording, scanning, or otherwise, without the prior written permission of CyberArk
Software Ltd.
PASSR 4/17/2019
2 Table of Contents

Table of Contents

Recommended Server Specifications 5

Vault and DR Vault servers 6
Cluster Vault and Cluster DR Vault servers 7
PVWA and CPM servers 9
PSM servers 10
PSM for SSH servers 12
System Requirements by Product 13
Digital Vault Server 14
Minimum requirements 14
Supported platforms 14
Software requirements 14
Supported LDAP directories 14
CyberArk component compatibility 16
Distributed Vaults compatibility 16
High Availability 17
CyberArk High-Availability Digital Vault server for Windows 2008 17
CyberArk Digital Cluster Vault server for Windows 2012 R2 and Windows 2016 17
PrivateArk Client 19
Minimum requirements 19
Supported platforms 19
CyberArk component compatibility 19
NT Authentication Agent 20
CyberArk Vault Backup Utility 20
Remote Control Client 21
Password Vault Web Access 22
Minimum system requirements 22
Supported browsers 23
Supported connections 23
Supported Ticketing Systems 23
Requirements on end-user machines 24
Supported mobile devices 24
Supported languages 25
CyberArk component compatibility 25
Accounts Feed 26
Central Policy Manager 31
Minimum system requirements 31
CyberArk component compatibility 31
Automatic password management 32
SSH Key Manager 38
CyberArk component compatibility 38
Automatic SSH key rotation 38
Operating systems 39
Credentials for scanning SSH keys 39
Managing local copies of private SSH keys 40

Privileged Access Security

 Table of Contents 3

Privileged Session Manager® 41

Minimum system requirements 41
PSM supported connections 42
Storage requirement for PSM recordings 43
CyberArk component compatibility 43
HTML5 Gateway 44
Privileged Session Manager for SSH 45
Minimum system requirements 45
PSM for SSH supported protocols 46
Storage requirement on the Digital Vault server 46
CyberArk component compatibility 46
AD Bridge capabilities 47
Privileged Session Manager for Cloud 48
General 48
Minimum system requirements 48
Network requirements 48
Privileged Threat Analytics 50
PTA Server System Requirements 50
PTA Windows Agents System Requirements 57
PTA Network Sensors System Requirements 58
Application Identity Management 62
Credential Provider 62
Application Password SDKs 65
Application Server Credential Provider 66
Central Credential Provider System Requirements 69
On-Demand Privileges Manager 70
Supported platforms 70
OPM Compatibility 72
AD Bridge capabilities 72
CyberArk Pluggable Authentication Module 72
Password Upload Utility 74
Supported platforms 74
CyberArk components 74
CyberArk component compatibility 74
CyberArk SDKs 75
Minimum requirements 75
CyberArk Component compatibility 75
Digital Vault server SDK 75
CyberArk Command Line Interface (PACLI) 75
Authentication 76
Password Vault Web Access 77
PrivateArk Client 77
Central Policy Manager 77
Password Upload Utility 78
Digital Vault Server SDK (PACLI) 78
Privileged Access Security SDK 78
Network Ports Overview 79
Network Port Definitions for CyberArk Components 80
Network Port Definitions for Third Party Components 83

Privileged Access Security

4 Table of Contents

Standard Ports and Protocols 85

Standard CPM Ports and Protocols 86
Standard Ports used for Accounts Discovery 90
Standard Vault Ports and Protocols 91
Standard PVWA Ports and Protocols 91

Privileged Access Security

 5

Recommended Server Specifications

The following tables summarize the recommended hardware and software specifications
for the required servers when implementing CyberArk’s Privileged Access Security
(PAS) solution. These hardware specifications are based on the entry level industry
standard for small to mid-range servers.
For installation on a VM based environment, the requirements can be customized based
on customer needs, according to the CyberArk server requirements.

Privileged Access Security

Privileged Access Security System Requirements 6

Vault and DR Vault servers

The following table lists the recommended specifications for standalone Vault servers
and standalone DR Vault servers.

Specifications

Small Mid-range Large Very large

implementation implementation implementation implementation
(<1,000 (1,000-20,000 (20,000 – 100,000 (more than
managed managed managed 100,000 managed
passwords) passwords) passwords) passwords)

Hardware specifications

Quad core 2X Quad 2X Eight core 4X Eight core

processor core processors processors
(Intel processor (Intel (Intel
compatible) (Intel compatible) compatible)
8GB RAM compatible) 32GB RAM 64GB RAM
2X 80GB 16GB RAM Two 250GB Two 500GB
SATA/SAS 2X 80GB SAS hot- SAS hot-
hot- SATA/SAS swappable swappable
swappable hot- drives (15K drives (15K
drives swappable RPM) RPM)
RAID drives RAID RAID
Controller RAID Controller Controller
Network Controller Network Network
adapter Network adapter (1Gb) adapter (1Gb)
(1Gb) adapter DVD ROM DVD ROM
DVD ROM (1Gb) Additional Additional
Additional DVD ROM storage for storage for
storage for Additional PSM PSM
PSM storage for (optional) [1] (optional) [1]
(optional) PSM
(optional)
[1]

Software prerequisites

Windows 2016 English Edition

Windows 2012 R2 English/German version [2]
Windows 2008 R2 SP1 (64-bit) English/German version (for upgrades of existing
deployments only) [2]
.NET Framework 4.5.2

______________________________
[1] For more information, refer to Privileged Session Manager®, page 41.
[2] Contact your CyberArk support representative for the most recent supported service pack
requirements.

Privileged Access Security

7 Cluster Vault and Cluster DR Vault servers

For security reasons, CyberArk recommends installing Vault instances on physical

hardware.

Cluster Vault and Cluster DR Vault servers

The following table lists the recommended specifications for the Cluster Vault server and
the Cluster DR Vault server [1] .

Specifications

Very large
Mid-range Large
Small implementation
implementation implementation
implementation (more than
(1,000-20,000 (20,000 – 100,000
(<1,000 managed 100,000
managed managed
passwords) managed
passwords) passwords)
passwords)

Hardware specifications

Quad core 2X Quad core 2X Eight core 4X Eight

processor processor processors core
(Intel (Intel (Intel processors
compatible) compatible) compatible) (Intel
8GB RAM 16GB RAM 32GB RAM compatible)
2X 80GB 2X 80GB Two 250GB 64GB RAM
SATA/SAS SATA/SAS SAS hot- Two 500GB
hot- hot- swappable SAS hot-
swappable swappable drives (15K swappable
drives drives RPM) drives (15K
RAID RAID RAID RPM)
Controller Controller Controller RAID
2X Network 2X Network 2X Network Controller
adapter (1Gb) adapter (1Gb) adapter (1Gb) 2X Network
DVD ROM DVD ROM DVD ROM adapter
SCSI/Fibre SCSI/Fibre SCSI/Fibre (1Gb)
shared disk shared disk shared disk DVD ROM
that supports that supports that supports SCSI/Fibre
the SCSI3 the SCSI3 the SCSI3 shared disk
protocol protocol protocol supports
Additional Additional Additional the SCSI3
storage for storage for storage for protocol
PSM PSM PSM Additional
(optional) [2] (optional) [2] (optional) [2] storage for
PSM
(optional)
[2]

Software prerequisites

Windows 2016 English Edition

Windows 2012 R2 Standard Edition

Privileged Access Security

Privileged Access Security System Requirements 8

Very large
Mid-range Large
Small implementation
implementation implementation
implementation (more than
(1,000-20,000 (20,000 – 100,000
(<1,000 managed 100,000
managed managed
passwords) managed
passwords) passwords)
passwords)

Windows 2012 R2 English/German versions [3]

Windows 2008 R2 SP1 (64-bit) Enterprise Edition English/German version (for
upgrades of existing deployments only)
.NET Framework 4.5.2

Note:
Cluster Nodes must be installed only on physical servers.

Privileged Access Security

9 PVWA and CPM servers

PVWA and CPM servers

The following table lists the recommended specifications for the PVWA and CPM servers
[1] .

Specifications

Small Mid-range Large Very large

implementation implementation implementation implementation
(<1,000 (1,000-20,000 (20,000 – 100,000 (more than
managed managed managed 100,000 managed
passwords) passwords) passwords) passwords)

Hardware specifications

Quad core 2X Quad 2X Eight 4X Eight core

processor core core processors
(Intel processor processors (Intel
compatible) (Intel (Intel compatible)
8GB RAM compatible) compatible) 64GB RAM
2X 80GB 16GB RAM 32GB RAM 2X 80GB
SATA/SAS 2X 80GB 2X 80GB SAS hot-
hot- SATA/SAS SAS hot- swappable
swappable hot- swappable drives
drives swappable drives RAID
RAID drives RAID Controller
Controller RAID Controller Network
Network Controller Network adapter (1Gb)
adapter Network adapter DVD ROM
(1Gb) adapter (1Gb)
DVD ROM (1Gb) DVD ROM
DVD ROM

Software prerequisites [3]

Windows 2016, Windows 2012 R2

IIS 10.0, 8.5
.NET Framework 4.5.2 or 4.6.2
For Windows 2016, we recommend installing .Net Framework 4.7.1 with update
KB4054856
Internet Explorer 11.0 or Chrome 56 and higher
PVWA and CPM can be installed on Amazon Web Services (AWS), Microsoft
Azure, and Google Cloud Platforms

Privileged Access Security

Privileged Access Security System Requirements 10

PSM servers
The following table lists the recommended specifications for PSM servers.

Specifications

Mid-range
Small implementation Large implementation
implementation
(1-10 concurrent (51-100 concurrent
(11-50 concurrent
RDP/SSH sessions) RDP/SSH sessions)
RDP/SSH sessions)

Hardware Specifications: Physical Servers

8 core processor 16 core processors 32 core processors

(Intel compatible) (Intel compatible) (Intel compatible 2.1
8GB RAM 16GB RAM GHz - 2.6 GHz)
2X 80GB 2X 80GB 32GB RAM
SATA/SAS hot- SATA/SAS hot- 2X 250GB SAS hot-
swappable drives swappable drives swappable drives
RAID Controller RAID Controller (15K RPM)
Network adapter Network adapter RAID Controller
(1Gb) (1Gb) Network adapter
DVD ROM DVD ROM (1Gb)
DVD ROM

General Notes:
■ The concurrency of 100 sessions per PSM server should not be exceeded.
■ The concurrent sessions ranges are based on the RDP and SSH connections
performance measurements.
■ Running resource-intensive applications like Toad, vSphere Client and so on, on the
PSM server will result in lower concurrency.
■ The concurrent session’s ranges assume PSM is running on a dedicated server.
■ The concurrent session’s ranges are based on performance measurements while
video recording user’s activities in HD resolution (one screen). Note that video
recording resolution is affected by the desktop resolution of the client machine from
which the connection was made. This means that performing connections from
client machines with more than one HD screen, or with a higher resolution screen,
will result in lower concurrency.
Server Virtualization Note:
■ Installing the PSM server on a virtual machine requires allocating virtual hardware
resources that are equivalent to the physical hardware specifications. For details,
refer to the recommended settings for installing PSM on a virtual machine in the
Privileged Access Security Installation Guide.
■ The maximum concurrency is lower (up to 40%) when installing the PSM server on a
virtual machine.

Software Prerequisites

Windows 2016, Windows 2012 R2

For Windows 2012 R2, verify that Windows update KB2999226 is installed
Verify that Windows update KB4458842 is installed

Privileged Access Security

11 PSM servers

Mid-range
Small implementation Large implementation
implementation
(1-10 concurrent (51-100 concurrent
(11-50 concurrent
RDP/SSH sessions) RDP/SSH sessions)
RDP/SSH sessions)

.NET Framework 4.5.2 - 4.7.2

Microsoft Remote Desktop Services (RDS) Session Host
Microsoft Remote Desktop Services Gateway (optional)
PSM can be installed on Amazon Web Services (AWS), Microsoft Azure, and
Google Cloud Platforms

Privileged Access Security

Privileged Access Security System Requirements 12

PSM for SSH servers

The following table lists the recommended specifications for PSM for SSH servers.

Specifications

Mid-range
Small implementation Large implementation
implementation
(<100 concurrent (>200 concurrent
(100-200 concurrent
sessions) sessions)
sessions)

Hardware Specifications: Physical Servers

Quad core processor 2X Quad core 2X Eight core

(Intel compatible) processor (Intel processors (Intel
8GB RAM compatible) compatible)
2X 80GB 16GB RAM 32GB RAM
SATA/SAS hot- 2X 80GB 2X 80GB SAS hot-
swappable drives SATA/SAS hot- swappable drives
RAID Controller swappable drives RAID Controller
Network adapter RAID Controller Network adapter
(1Gb) Network adapter (1Gb)
DVD ROM (1Gb) DVD ROM
DVD ROM

Server Virtualization Note:

Installing the PSM for SSH server on a virtual machine requires allocating virtual
hardware resources that are equivalent to the physical hardware specifications.

Software Prerequisites

Red Hat Enterprise Linux 5.x versions (5.6 and above), 6.x versions (6.4 and above)
and 7.x versions.
CentOS Linux 5.x versions (5.6 and above), 6.x versions (6.4 and above) and 7.x
versions.

Note:
Security patches, and OS vendor recommended minor 5.x, 6.x or 7.x
RHEL and CentOS upgrades can be applied on the server without
reinstalling PSM for SSH.

SUSE Linux Enterprise Server 11 SP4 or 12

PSM for SSH can be installed on Amazon Web Services (AWS), Microsoft Azure,
and Google Cloud Platforms

Privileged Access Security

 13

System Requirements by Product

The following system requirements list the most up-to-date supported platforms,
including service packs. Unless otherwise specified, new service packs are not
automatically supported.
CyberArk may choose not to provide maintenance and support services for the CyberArk
Privileged Access Security (PAS) solution with relation to any of the platforms and
systems listed below which have reached their formal End-of-Life date, as published by
their respective vendors from time to time. For more details, contact your CyberArk
support representative.

Privileged Access Security

Privileged Access Security System Requirements 14

Digital Vault Server

Note:
CyberArk may choose not to provide maintenance and support services for the
CyberArk Digital Vault Server with relation to any of the platforms and systems listed
below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

Minimum requirements
The Digital Vault server requires an Intel Pentium IV (or compatible) processor or later.
To ensure maximum protection for the sensitive data inside the Digital Vault Server, the
server is designed to be installed on a dedicated computer in a clean environment that
does not have any additional software installed on it.

Supported platforms
The Digital Vault server is currently supported on the following platforms:
■ Windows 2016 English Edition
■ Windows 2012 R2 Standard Edition
■ Windows 2012 R2 English/German Edition
■ Windows 2008 R2 with Service Pack 1 (64-bit) English/German Edition (for
upgrades of existing deployments only)

Software requirements
■ .NET Framework 4.5.2

Note:
As a result of Microsoft’s backward compatibility, Vault can run on servers with .NET
Framework 4.6.* (excluding .NET Framework 4.6.1) or .NET Framework 4.7.*.

Supported LDAP directories

The Privileged Access Security solution provides standard LDAP v3 support and has
been tested and certified with the following directories.

Directories:

Directory Platforms

MS Active-Directory – Each of the following platforms is ■ Windows 2008

supported with its corresponding functional level: ■ Windows 2012

Privileged Access Security

15 Digital Vault Server

Directory Platforms

■ Windows 2012 R2
■ Windows 2016

Sun One v5.2

IBM Tivoli Directory Server v6.0

Novell eDirectory v8.7.1

Oracle Internet Directory v10.1.4

This list may be updated frequently as additional directories are certified. Please contact
CyberArk Customer Support for information about additional directories that are not
mentioned in the list above.

Supported ciphers for syslog servers

The following ciphers are supported for encrypted communication between the Vault
and syslog servers:
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-SHA
ECDHE-ECDSA-AES256-SHA
ECDHE-ECDSA-AES128-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-SHA
ECDHE-RSA-AES256-SHA
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES256-SHA384
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES128-SHA
DHE-RSA-AES256-SHA
DHE-RSA-AES128-SHA256
DHE-RSA-AES256-SHA256

Privileged Access Security

Privileged Access Security System Requirements 16

CyberArk component compatibility

Digital Vault server

Compatible
CyberArk component
versions

PrivateArk Client/WebClient 8.0

Central Policy Manager 10.2 or later

Password Vault Web Access 10.2 or later

Privileged Session Manager 9.0.1 or later

Privileged Session Manager SSH Proxy 7.2.9 or later

On-Demand Privileges Manager 6.0 or later

Credential Provider 4.5 or later

Distributed Vaults compatibility

CyberArk clients on a Satellite Vault

Client Compatible versions

Credential Provider 9.7

ExportVaultData utility 9.8 or later

PAReplicate utility 9.8 or later

All other clients can only run on a Master Vault.

Privileged Access Security

17 High Availability

High Availability

CyberArk High-Availability Digital Vault server for Windows

2008
The minimum requirements for the High-Availability Digital Vault server are as
follows:
■ Windows 2008 R2
■ Two Domain Controllers
■ DNS server
■ Microsoft Cluster Service

CyberArk Digital Cluster Vault server for Windows 2012 R2

and Windows 2016
The minimum requirements for the CyberArk Digital Cluster Vault Server are as
follows:

Requirement Description

Windows 2012 R2 or Windows

2016 English Edition Note:
In Windows 2012, if the
CyberArk Digital Cluster
Vault Server is being
installed on an iSCSi
network storage location
over TCP/IP, Windows
update KB2955164 must
be installed to prevent data
corruption.

Servers Only physical servers are supported.

You can install Vaults on Virtual machines using
virtual availability solutions offered by the various
vendors.

Both nodes must have the same If the two nodes do not have the same amount of
amount of physical memory. physical memory, update the innodb_log_file_
size parameter in the my.ini file of the second
node and specify the same value as in the first
node.

Both nodes must be connected This network must contain only the Vault Cluster
directly via a private network or machines in order to keep the Vault Cluster
cross-over cable. isolated and secure.

Privileged Access Security

Privileged Access Security System Requirements 18

Requirement Description

Shared storage that supports the CyberArk recommends using SAN with
SCSI3 protocol. Fibre channel, which is faster and more
reliable.
Use GPT and MBR disks, not dynamic
disks.

Quorum disk Do not use Multipath I/O.

NIC configuration You must use crossover cables for the private
network. NIC teaming in load balancing mode is
not allowed. Only an Active-Passive
configuration is allowed. For details on
configuring the NIC teaming, refer to
https://docs.microsoft.com/en-us/windows-
server/networking/technologies/nic-
teaming/create-a-new-nic-team.

Each Vault Cluster server must

have only one static IP, in the
same subnet as the virtual IP.

The clocks on both nodes must

be synchronized.

Privileged Access Security

19 PrivateArk Client

PrivateArk Client
The PrivateArk Client is the Windows interface for performing administrative operations
in the Privileged Access Security solution, such as user management.

Note:
CyberArk may choose not to provide maintenance and support services for the
PrivateArk Client with relation to any of the platforms and systems listed below which
have reached their formal End-of-Life date, as published by their respective vendors
from time to time. For more details, contact your CyberArk support representative.

Minimum requirements

Platform: Intel Pentium IV (or compatible) or later

Disk space: 10MB free disk space
Minimum memory: 256MB
Communication: TCP/IP connection to the Digital Vault server

Supported platforms
The PrivateArk Client is currently supported on the following platforms:
Windows 2016
Windows 2012 R2
Windows 10
Windows 2008 R2 with Service Pack 1 (64-bit)
Windows 2008 (32-bit)
Windows 7 with Service Pack 1 (32-bit and 64-bit)
Reports that are generated in the PrivateArk Client can either be saved to a text file, or to
any of the following Office applications:
Excel XP, Excel 2003, Excel 2007, Excel 2010

CyberArk component compatibility

The PrivateArk Client/WebClient v8.0 works with the Digital Vault Server, version 8.1 or
later.

Privileged Access Security

Privileged Access Security System Requirements 20

NT Authentication Agent

Note:
CyberArk may choose not to provide maintenance and support services for the
CyberArk NT Authentication Agent with relation to any of the platforms and systems
listed below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

Minimum requirements
Windows 2012 R2
Windows 2008 R2 with Service Pack 1
Windows 2003 with Service Pack 2 (32-bit)

CyberArk Vault Backup Utility

Note:
CyberArk may choose not to provide maintenance and support services for the
CyberArk Vault Backup Utility with relation to any of the platforms and systems listed
below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

Minimum requirements
Windows 2016
Windows 2012 R2
Windows 2008 R2 with Service Pack 1 English Edition
Windows 2003 with Service Pack 2 (32-bit)

Privileged Access Security

21 Remote Control Client

Remote Control Client

Note:
CyberArk may choose not to provide maintenance and support services for the
CyberArk Remote Control Client with relation to any of the platforms and systems listed
below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

Minimum requirements
Windows 2012 R2
Windows 2008 R2 with Service Pack 1
Windows 2003 with Service Pack 2 (32-bit)
Windows XP with Service Pack 3 (32-bit)

Privileged Access Security

Privileged Access Security System Requirements 22

Password Vault Web Access

Note:
CyberArk may choose not to provide maintenance and support services for the
Password Vault Web Access with relation to any of the platforms and systems listed
below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

Minimum system requirements

The Password Vault Web Access (PVWA) is a CyberArk component that enables you to
access and configure the Privileged Access Security solution over the Web. The PVWA
does not require a dedicated machine. However, it must be installed on a machine that is
accessible to the network.

Minimum requirements

Platform: Intel Pentium IV (or compatible) or later

Disk space: 15MB free disk space for installation, and additional space for log files
Minimum 2 GB
memory:
Communication: TCP/IP connection to the CyberArk Password Vault Server

Software: Windows 2016

Windows 2012R2
IIS 10.0 (Windows 2016)
IIS 8.5 (Windows 2012 R2)
.NET Framework 4.5.2 or 4.6.2
For Windows 2016, we recommend installing .Net Framework
4.7.1 with update KB4054856

Note:
Password Vault Web Access can be installed on virtual hosts such as VMWare, Hyper-
V and KVM.

Privileged Access Security

23 Password Vault Web Access

Supported browsers
PVWA v10 interface
The PVWA interface is supported on the following browsers:
Chrome 56 and higher
Internet Explorer 11.0 on Windows
Prerequisites:
In Internet Options à Security Settings à Downloads and select the
following:
File download à Enable
Font download à Enable
Microsoft Edge version 38 and higher

PVWA Classic interface

The PVWA interface for version 9 is supported on the following browsers:
Internet Explorer 8.0, 9.0, 10.0 and 11.0 on Windows

Note:
For IE 9.0, the PVWA requires IE 8 compatibility mode.
For IE 10.0, install hotfix KB2836943 on the PVWA server.

Chrome: Any version released in the last six months

Firefox: Any version released in the last six months on Windows and Linux/UNIX

Note:
Make sure that Firefox includes the Java plug-in.

Microsoft Edge version 38 and higher

Supported connections
■ PSM connections to remote machines are supported with IPv4 and IPv6 addresses.

Supported Ticketing Systems

The following ticketing systems are supported out-of-the-box:
■ ServiceNow Geneva, Helsinki, Istanbul, Jakarta, and Kingston
■ BMC Remedy v9.1
For details about configuring other ticketing systems, see the Privileged Access Security
Implementation Guide .

Privileged Access Security

Privileged Access Security System Requirements 24

Requirements on end-user machines

Required Component Version

RDP ActiveX Client 5.2 or later for environments set up to use an ActiveX
connection method for PSM connection)

CyberArk PSM codec For viewing high compression session recordings with an
external player (e.g. Windows Media Player). The
PSMCodec.exe is included in the PSM installation package
and is required to enable users to view PSM recordings with a
regular media player (not PSM Direct Playback).

JRE (Java Runtime JRE 1.4, or later (for SSH transparent connections)
Environment)

Adobe Flash player 10.0 browser add-on, or later (for PSM Direct Playback with
IE browser)

Note:
For PSM Connections make sure that your
CyberArk license includes the relevant a license for
an external tool that will support these connections.
Currently this external tool doesn’t support
connections when RD Gateway is configured in the
environment. For more information, refer to
Configuring PSM Connections in the Privileged
Access Security Implementation Guide.

Supported mobile devices

The following mobile devices support the Mobile PVWA on the Privileged Access
Security solution in the Classic interface:
iPhone smartphones
Blackberry smartphones
Android smartphones

Privileged Access Security

25 Password Vault Web Access

Supported languages
PVWA supports the following languages:

■ English ■ Japanese
■ French ■ Korean
■ Spanish ■ Simplified Chinese
■ German ■ Traditional Chinese
■ Russian ■ Brazilian Portuguese
■ Polish ■ Turkish

Note:
New functionality for which texts have not yet been translated will be shown in English.

CyberArk component compatibility

The PVWA works with the following CyberArk components:

Component Version

Digital Vault Server 10.8, 10.9

Central Policy Manager 10.8, 10.9

Privileged Session Manager 9.0.1 or later

Privileged Session Manager for 7.2.9 or later

SSHProxy

On-Demand Privileges Manager 6.0 or later

Credential Provider 4.5 or later

Privileged Access Security

Privileged Access Security System Requirements 26

Accounts Feed

Scan for Windows accounts

Discovery processes detect the following Windows accounts:
■ Local accounts
■ Domain accounts

Discovery processes detect the following dependencies:

■ Windows Services accounts
■ Scheduled Tasks accounts
■ IIS Application Pools accounts
■ IIS Directory Security (Anonymous Access) accounts
■ COM+ Applications accounts

Note:
When scanning a specified domain, the discovery automatically retrieves information
about discovered accounts that is stored in trusted domains, without requiring
additional permission. Specifically, the discovery only retrieves information about
Windows Services dependencies and Scheduled Tasks dependencies that derive from
trusted domains.

Supported Active Directory

■ Microsoft Active Directory 2008, 2012 and 2016

Note:
The Discovery does not support scanning Active Directory domain controllers

Credentials for scanning

Credentials for scanning

Scanning Location Required Credentials

Active Directory Read permissions in the OU to scan and all sub-

OUs

Target machines Domain Administrator, or

Equivalent Domain User:
■ User with read permissions on the
Active Directory
■ User with local administrative rights
for Windows on the target machine
■ User with permissions to logon

Privileged Access Security

27 Password Vault Web Access

Scanning Location Required Credentials

remotely to the target machine

Note:
In Windows Vista or newer, the domain
user must belong to the Administrators
group or to a group nested within the
Administrators group.
In older versions of Windows, the
domain user can be a member of any
privileged group

Supported target computers

Supported workstations
■ Windows Vista
■ Windows 7
■ Windows 8
■ Windows 10

Supported servers
■ Windows 2003
■ Windows 2008
■ Windows 2012
■ Windows 2016

Supported target computers for discovering dependencies

Supported servers:
■ Windows 2003
■ Windows 2008/2008R2 with Service Pack 1
■ Windows 2012/2012R2
■ Windows 2016

Note:
To discover Scheduled Tasks on Windows 2012, the CyberArk Scanner (CPM) must be
installed on Windows 2012.
To discover IIS Application Pools accounts, IIS Directory Security (Anonymous Access)
accounts and COM+ Applications accounts, IIS7.5 or 8.5 must be installed.

Privileged Access Security

Privileged Access Security System Requirements 28

Supported protocols
Protocols that are supported when accessing the Active Directory
■ LDAPS (default)

Note:
To support LDAPS in discoveries, this protocol must be configured in the Active
Directory

■ LDAP

Network protocols
■ Windows File and Print Sharing
■ Windows (WMI)
For details about how to enable the Windows (WMI) Protocol in your environment, see
Appendix G: Enabling WMI Ports on Windows Client Machines in the Privileged Access
Security Implementation Guide.
For more information about the ports that EPV uses to access remote machines, refer to
Standard Ports used for Accounts Discovery, page 90.

Scan for Unix accounts

Discovery processes detect the following Unix accounts:
■ Local accounts

Note:
Domain users that are used to authenticating to Unix machines (using AD Bridge
integration) are currently not discovered

■ SSH Keys and their trusts

Privileged Access Security

29 Password Vault Web Access

Credentials for Scanning Local Accounts

At least one of the following privileges

Privilege Enables user to retrieve …

root or user with uid=0 All account details

sudoers for the "cat The minimum details required to create a pending
/etc/passwd" command account (user name and address)

sudoers for the following All account details

commands:
cat "/etc/shadow"
cat "/etc/passwd"
cat "/etc/security/passwd"
(AIX)
cat "/etc/security/lastlog"
(AIX)
cat /etc/group
cat "/etc/sudoers"
lastlog | grep -v '*'
hostname –s
ls -d /etc/[A-Za-z]*[_-][rv]e
[lr]* | grep v
'lsb\|os\|system'
test -f "{0}"; echo $?

Credentials for scanning SSH Keys

Note:
In order to scan Unix machines for SSH keys, your CyberArk license must include
SSHKM. For more information, contact your CyberArk representative.

At least one of the following privileges

Privilege Enables user to retrieve …

user with uid=0 All account details

sudoers for the "cat /etc/passwd" command The minimum details required
to create a pending account
(user name and address)

sudoers for the following commands: All account details

Linux: uname, ls, test, cat, lastlog, getent,
grep, wc, find, xargs, ssh-keygen, echo, rm,
date, hostname, ifconfig
AIX: uname, ls, test, cat, lsdev, grep, wc, ssh-
keygen, echo, rm, istat, hostname, ifconfig

Privileged Access Security

Privileged Access Security System Requirements 30

Privilege Enables user to retrieve …

Solaris: uname, echo, test, cat, getent, grep,

psrinfo, wc, find, xargs, ssh-keygen, ls, rm,
truss, hostname, ifconfig All account details

Supported Unix platforms

■ RHEL 4-7.1
■ Solaris Intel and Solaris SPARC 9, 10, 11
■ AIX 5.3, 6.1, 7.1
■ ESXi 5.0, 5.1
■ SUSE 10
■ Fedora 18,19, 20
■ CentOS 6
■ Oracle Linux 5

Supported Sudo replacements solutions

■ CA Privileged Identity Manager/ControlMinder – This solution contains the sesudo
command.
■ Centrify Access Manager/DirectAudit - This solution contains the dzdo command.

Enable the Windows (WMI) protocol in your environment

Enable WMI protocol
1. Make sure the Windows Management Instrumentation service startup type is set
to Automatic.
2. For your operating system, do the following:
Windows 7 - In the firewall settings for your local or Group policy, under
Inbound Rules, make sure Windows Management Instrumentation
(WMI-In) is enabled and allowed for the Domain profile.
Windows Vista - In the firewall settings for your local or Group policy, click the
Exceptions tab and enable the Windows Management Instrumentation
(WMI) exception.

Privileged Access Security

31 Central Policy Manager

Central Policy Manager

Note:
CyberArk may choose not to provide maintenance and support services for the Central
Policy Manager with relation to any of the platforms and systems listed below which
have reached their formal End-of-Life date, as published by their respective vendors
from time to time. For more details, contact your CyberArk support representative.

Minimum system requirements

The Central Policy Manager (CPM) is a Privileged Access Security component and does
not require a dedicated machine. However, it must be installed on a machine that is
accessible to the network.

Minimum requirements

Platform: Intel Pentium IV (or compatible) or later

Disk space: 15MB free disk space for installation, and additional space for log
files

Minimum 4 GB
memory:

Communication: TCP/IP connection to the Digital Vault Server

Software: Windows 2016

Windows 2012 R2
.NET Framework 4.5.2 or 4.6.2

For specific system requirements of the different plug-ins of the Central Policy Manager,
see the Privileged Access Security Implementation Guide.

Note:
Central Policy Manager can be installed on virtual hosts such as VMWare, Hyper-V and
KVM.

CyberArk component compatibility

The Central Policy Manager works with the following CyberArk components:

Component Compatible Versions

Digital Vault server 10.8, 10.9

Password Vault Web Access 10.9

Privileged Session Manager 9.0.1 or later

Privileged Session Manager SSH Proxy 7.2.5 and later

Privileged Access Security

Privileged Access Security System Requirements 32

Component Compatible Versions

On-Demand Privileges Manager 6.0 and later

Credential Provider 4.5 or later

Automatic password management

This section lists the platforms on which the CPM supports automatic password
management and which are installed automatically with the CPM. For a complete list of
supported devices, refer to the CPM Supported Devices document.

Operating Systems
Automatic password management is supported on the following platforms on IPv4
and IPv6:

Platform Supported Versions

Windows Domain users ■ Windows 2016 Active Directory domain

■ Windows 2012/2012 R2 Active Directory domain
■ Windows 2008/2008 R2 with Service Pack 1
Active Directory domain
■ Windows 2003 server

Windows Local Accounts ■ Windows 2016 server - only local administrators

■ Windows 2012/2012 R2 server
■ Windows 2008/2008 R2 server with Service Pack
1
■ Windows 2003 server
■ Windows 10
■ Windows 8
■ Windows 7 with Service Pack 1
■ Windows Vista

Windows Local users with ■ Windows 2016 server

WMI ■ Windows 2012/2012 R2 server
■ Windows 2008 server
■ Windows 2003 server
■ Windows 10
■ Windows 8
■ Windows 7
■ Windows Vista

Windows Services ■ Windows:

■ Windows 2016 server
■ Windows 2012/2012 R2
■ Windows 2008/2008 R2 with Service Pack 1
■ Windows 2003
■ Windows 10
■ Windows 8

Privileged Access Security

33 Central Policy Manager

Platform Supported Versions

■ Windows 7 with Service Pack 1

■ Windows Vista
■ Microsoft SQL Server 2005/2008
■ Microsoft SQL Cluster Service 2005/2008

Windows Scheduled Tasks ■ Windows 2016 server

■ Windows 2012/2012R2
■ Windows 2008/2008R2 with Service Pack 1
■ Windows 2003
■ Windows 10
■ Windows 8
■ Windows 7 with Service Pack 1
■ Windows Vista

Note:
In order to manage Windows Scheduled
Tasks on Windows 7, Windows 2008
Server, and Windows Vista, the CPM must
be installed on Windows 2008 R2 with
Service Pack 1 or 2012 server.
In order to manage Windows Scheduled
Tasks on Windows 10, the CPM must be
installed on Windows 2012 server.

Windows IIS Application Application Pools on IIS 10.0 with “IIS 6

Pools management compatibility” role service
(Windows 2016)
Application Pools on IIS 8.5 with “IIS 6
management compatibility” role service
(Windows 2012R2)
Application Pools on IIS 8.0 with “IIS 6
management compatibility” role service
(Windows 2012)
Application Pools on IIS 7.0 with “IIS 6
management compatibility” role service
(Windows 2008)
Application Pools on IIS 6.0 (Windows 2003)

Windows IIS Directory ■ Windows 2016 server

Security (Anonymous ■ Windows 2012/2012 R2
Access) ■ Windows 2008/2008 R2 with Service Pack 1
■ Windows 2003

COM+ Applications ■ Windows 2016 server

■ Windows 2012/2012 R2
■ Windows 2008/2008 R2 with Service Pack 1
■ Windows 2003

Privileged Access Security

Privileged Access Security System Requirements 34

Platform Supported Versions

Unix passwords ■ Solaris Intel 9, 10, 11

■ Solaris Sparc 10, 11
■ Oracle Enterprise Linux 5 (32-bit and 64-bit), 6, 7
■ HP-UX 11.x

Note:
Automatic password management is only
supported on IPv4.

■ IBM AIX 5.3, 6.1, 7.1

■ RHEL 4-7.1

Note:
For higher versions, additional
customizations may be required.

■ Ubuntu 12.04, 16
■ Fedora 18, 22, 23, 27, 28
■ CentOS 6 (32-bit and 64-bit), 7
■ SUSE Linux 10, 11, 12
■ OpenSUSE 42
■ Cygwin

AS400 (iSeries) passwords ■ AS400 (iSeries) computers using OS/400 V5R2 or

later

Note:
Automatic password management is only
supported on IPv4.

OS/390 (Z/OS) passwords ■ OS/390 (Z/OS) machines for RACF users’

passwords

Note:
Automatic password management is only
supported on IPv4.

Databases
Automatic password management is supported on the following platforms on IPv4
and IPv6:

Platform Supported Components

Databases that support ■ All databases that support ODBC version 2.7 and
ODBC Connections higher

Privileged Access Security

35 Central Policy Manager

Platform Supported Components

Note:
For higher versions, additional customizations
may be required.

Oracle Database ■ Oracle Database v8i-v12c

passwords ■ Oracle ODBC driver (can be installed as part of the
Oracle Client installation V8i or later)

Note:
For higher versions, additional customizations
may be required.

Microsoft SQL Server ■ Microsoft SQL Server 7, 2010, 2012, 2014, 2016
passwords
Note:
For higher versions, additional customizations
may be required.

Sybase database ■ Sybase Adaptive Server Enterprise 12.5.2, 16

passwords
Note:
For higher versions, additional customizations
may be required.

MySQL Server ■ MySQL version 5 - 5.7

passwords

DB2 passwords ■ Windows platforms:

■ IBM DB2 on Windows 2003, WinNT
■ Unix platforms:
■ IBM DB2 on the following Unix platforms: Red
Hat Linux 8, Red Hat Enterprise Linux ES 3.0,
Sun Solaris 5.8, IBM AIX 5, HP-UX 11.x

Note:
For higher versions, additional customizations
may be required.

Informix passwords ■ Windows platforms:

■ IBM Informix on Windows 2003, WinNT
platforms
■ Unix platforms:
■ IBM Informix on the following Unix platforms:
Red Hat Linux 8, Red Hat Enterprise Linux ES

Privileged Access Security

Privileged Access Security System Requirements 36

Platform Supported Components

3.0, Sun Solaris 5.8, IBM AIX 5, HP-UX 11.x

Note:
For higher versions, additional customizations
may be required.

Remote Access
Automatic password management is supported on the following platforms:

Platform Supported Versions

HP iLO accounts: iLO v2.0, 3.0 and 4.0

Dell DRAC passwords: DRAC 5-8

Security Appliances

Platform Supported Versions

CheckPoint Firewall-1 NG passwords: CheckPoint Firewall-1

NetScreen Firewall passwords: NetScreen version 5.3.or 2.0

Note:
For higher
versions,
additional
customizations
may be
required.

RSA Authentication Manager Accounts RSA Authentication Manager

8.1, 8.2

Network Devices

Platform Supported Versions

Cisco Router Cisco Routers that support IOS 12.3 or later through Telnet, for
passwords: the following modes:
■ regular user
■ enable
■ terminal

Note:
For higher versions, additional customizations may
be required.

Privileged Access Security

37 Central Policy Manager

Platform Supported Versions

Cisco PIX Cisco PIX machines, version 6.3 or later, for the following
passwords: modes:
■ enable
■ terminal

Note:
For higher versions, additional customizations may
be required.

Directories

Platform Supported Versions

Novell eDirectory Passwords: Novell eDirectory version

8.7.1 SMP or later

SunOne Directory Passwords: SunOne Directory Server

version 5.2

Applications

Application Supported Versions

Digital Vault passwords: Digital Vault v4.0 or later

SAP Application Server

Cloud Services
■ Amazon Web Services (AWS)
■ Microsoft Azure

Others
■ Passwords stored in Windows Registry

Privileged Access Security

Privileged Access Security System Requirements 38

SSH Key Manager

Note:
CyberArk may choose not to provide maintenance and support services for the
CyberArk SSH Key Manager with relation to any of the platforms and systems listed
below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

The SSH Key Manager (SSHKM) supports SSH Keys lifecycle management and helps
organizations eliminate risks that are inherent in using SSH Keys. In addition, it enables
organizations to meet their audit requirements by simplifying and automating SSH Keys
management. The SSH Key Manager is built on top of the Privileged Account shared
Platform Technology and benefits from the suite infrastructure, including the Digital
Vault, Master Policy, integrations and more. The SSH Key Manager doesn’t have a
dedicated component to install; it requires the installation of the CPM and PVWA and a
relevant license.

CyberArk component compatibility

The SSHKM is compatible with the following CyberArk components:

Compatible
Component
Version

Digital Vault server version 9.10 or later

Central Policy Manager version 9.9.5 or later

Password Vault Web Access version 9.10 or later

Privileged Session Manager version 9.0.1 or later

Privileged Session Manager SSH Proxy versions 7.2.5 or

later

On-Demand Privileges Manager versions 6.0 or later

Credential Provider version 4.5 or later

Automatic SSH key rotation

The SSH Key Manager (SSHKM) supports automatic management of SSH Keys and
their trusts on the following Unix platforms. For a complete list of supported devices, refer
to the Supported Devices document.

Privileged Access Security

39 SSH Key Manager

Operating systems
Compatible
Operating System
Versions

RHEL 4-7.1

AIX 5.3, 6.1, 7.1

Solaris Intel and Solaris SPARC 9, 10, 11

ESXi 5.0, 5.1, 6.0, 6.5

SUSE 10

OpenSUSE 42

Fedora 18,19, 20, 24, 26,

27, 28

CentOS 6, 7

Oracle Linux 5, 6, 7

HP-UX 11.x

Ubuntu 12.04, 16

FreeBSD 11

Credentials for scanning SSH keys

To scan SSH keys and their trusts, the user performing the scan requires at least one of
the following privileges:

Enables user to
Privilege
retrieve …

user with uid=0 All account details

sudoers for the "cat /etc/passwd" command The minimum details

required to create a
pending account (user
name and address)

sudoers for the following commands:Linux: uname, ls, test, cat, All account details
lastlog, getent, grep, wc, find, xargs, ssh-keygen, echo, rm,
date, hostname, ifconfigAIX: uname, ls, test, cat, lsdev, grep,
wc, ssh-keygen, echo, rm, istat, hostname, ifconfigSolaris:
uname, echo, test, cat, getent, grep, psrinfo, wc, find, xargs,
ssh-keygen, ls, rm, truss, hostname, ifconfig

Privileged Access Security

Privileged Access Security System Requirements 40

Managing local copies of private SSH keys

The SSHKM manages local copies of private SSH Keys on the following platforms, in
addition to all the platforms listed above:
■ Fedora 18-23 (32 and 64-bit)
■ SUSE 12 (64-bit)

Privileged Access Security

41 Privileged Session Manager®

Privileged Session Manager®

Note:
CyberArk may choose not to provide maintenance and support services for the
CyberArk Privileged Session Manager® with relation to any end-user client machine or
target platforms which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

The Privileged Session Manager® (PSM) is a CyberArk component that enables you to
initiate, monitor, and record privileged sessions and usage of administrative and
privileged accounts. The PSM does not require a dedicated machine. However, it must
be installed on a machine that is accessible to the network.

Note:
To achieve optimal concurrency it is recommended to install PSM on a dedicated
machine.

Minimum system requirements

The minimum requirements for the PSM are as follows:

Platform: Intel Pentium IV (or compatible) or later

Disk space: 20GB free disk space for installation, and additional 20GB space for
temporary workspace
Minimum 8 GB
memory:
Communication: TCP/IP connection to the Digital Vault Server
Software: Windows 2016
Windows 2012R2
.NET Framework 4.5.2 - 4.7.2
Remote Desktop Services (RDS) Session Host

Note:
Make sure you have the required number of RDS CALs to
enable you to access the RDS server. For more information, refer
to Connecting to the PSM server with Microsoft Remote Desktop
Services (RDS) Session Host in the Privileged Access Security Installation
Guide.

Remote Desktop Gateway (optional)

Before installing PSM, make sure that the Users group has the

Privileged Access Security

Privileged Access Security System Requirements 42

Allow Logon Locally Windows permission in the local security

policy. This ensures that the PSMShadowUsers group created
during PSM installation will have the required permissions.
Alternatively, you can set this local security policy permission for
the PSMShadowUsers group directly after PSM installation.

PSM supported connections

PSM supports connections to remote machines using IPv4 and IPv6 addresses with the
following platforms out-of-the-box. Additional platforms can be supported and monitored
using the PSM Universal Connector. For more information, refer to the Privileged Access
Security Implementation Guide.

Platform Additional Information

Unix, Linux and Network for Support using the following protocols:
any SSH-based devices SSH (including file-transfer capabilities)
Telnet

Windows RDP (including file-

transfer capabilities) Note:
Connections to and from Windows 2003
and earlier Windows versions are not
supported.

Windows Remotely Anywhere

AS400 (iSeries)

OS/390 (Z/OS)

Web-based interfaces, client,

and custom applications

PSM for Databases PSM can monitor Oracle DBA sessions through the
following DBA tools:
Toad
SQL*Plus
To monitor Oracle DBA sessions, install the following
software on the PSM machine:
Toad for Oracle Base Edition v10.5.1.3 , v10.6.1.3
and v12.10(32 bit)
Toad Admin Module v10.5.1.3 and 10.6.1.3
PSM can monitor Microsoft SQL Server DBA sessions
through the following DBA tools:
SQL Server Management Studio 2008,2012, 2016,
and 2017

PSM for Virtualization PSM can monitor VMWare administration session

through the following tools:
vSphere Client to connect to vSphere / ESX hosts
vSphere Client to connect to vCenter

Privileged Access Security

43 Privileged Session Manager®

Platform Additional Information

To monitor VMWare administrator sessions, install the

following software on the PSM machine:
vSphere Client v4.0, v4.1, v5.0, and v6.0

Storage requirement for PSM recordings

The Privileged Session Manager stores the session recordings on the Digital Vault
server or an external storage device. For details on storing recordings on an external
device, see the Privileged Access Security Implementation Guide.
The estimated storage requirement is approximately 50-250 KB for each minute of a
recording session. The recording size is affected by the type of session recording
(console vs. GUI recording) as well as by the type and number of activities that are
performed during the session.
For example, 250 GB of storage will be sufficient for recording 10 hours of activities per
day retained for 5 years.
To more accurately establish a recording size for your session recordings, we
recommend checking the size of an average session recording in your customer
environment.

CyberArk component compatibility

The PSM is compatible with the following CyberArk components:

Component Compatible Versions

Digital Vault server versions 7.2.7 and higher

Password Vault Web Access versions 7.2.7 and higher

Privileged Session Manager SSH Proxy versions 7.2.9 and higher

CPM Any CPM that is compatible with the above

Digital Vault server and Password Vault Web
Access. For more information, refer to
CyberArk Component Compatibility for those
components.

Privileged Access Security

Privileged Access Security System Requirements 44

HTML5 Gateway
A Web server, such as Tomcat, that can support Java 1.6 or above

Note:
The PSM Gateway supports Tomcat v 7 or above.

Hardware specifications
Small + Mid-range Mid-range + Large
Very large implementation
implementation implementation
(101-200 concurrent
(1-50 concurrent RDP/SSH (51-100 concurrent
RDP/SSH sessions)
sessions) RDP/SSH sessions)

2 core processors (Intel 4 core processors (Intel 8 core processors (Intel

compatible) compatible) compatible)
4 GB RAM 8 GB RAM 16GB RAM

Note:
Tests are based on 40% SSH and 60% RDP concurrent sessions running with full HD
resolution.
These requirements are based on a dedicated machine for HTML5 Gateway.

Privileged Access Security

45 Privileged Session Manager for SSH

Privileged Session Manager for SSH

Note:
CyberArk may choose not to provide maintenance and support services forPSM for
SSH with relation to any end-user client machine or target platforms which have
reached their formal End-of-Life date, as published by their respective vendors from
time to time. For more details, contact your CyberArk support representative.

PSM for SSH is a CyberArk component that enables you to secure, control and monitor
privileged access to Linux and Unix systems, network devices and any other SSH-based
devices. PSM for SSH requires a dedicated machine which is accessible to the network.

Minimum system requirements

The minimum requirements for PSM for SSH are as follows:

Platform: Intel Pentium IV (or compatible) or later

Disk space: 20 GB free disk space for installation, and additional 20 GB space for
temporary workspace
Minimum 2 GB
memory:

Communication: TCP/IP connection to the Digital Vault Server

Operating ■ Red Hat Enterprise Linux 6.x versions (6.4 and above) and 7.x
System: versions.
■ CentOS Linux 6.x versions (6.4 and above) and 7.x versions.

Note:
Security patches, and OS vendor recommended minor 6.x
or 7.x RHEL and CentOS upgrades can be applied on the
server without reinstalling PSM for SSHP.

■ SUSE Linux Enterprise Server 11 SP4 or 12

Privileged Access Security

Privileged Access Security System Requirements 46

PSM for SSH supported protocols

■ Unix, Linux and Network devices using the following protocols:
■ SSH (including SSH-Tunneling)
■ Telnet

Supported SSH clients on the end-user machine

■ PSM for SSH allows access from any SSH client that can connect to an OpenSSH
7.7 server.

Note:
OpenSSH 7.7 requires that Open SSL V1.01 or above be installed.

Supported connections
■ PSM for SSH supports connections to remote machines using IPv4 and IPv6
addresses.

Storage requirement on the Digital Vault server

PSM for SSH stores the session recordings on the Digital Vault server. The estimated
storage requirement is approximately 1-5 KB for each minute of a recording session. The
recording size is affected by the number of activities that are performed during the
session.
For example, 5 GB of storage will be sufficient for recording 10 hours of activities per day
retained for 5 years.

CyberArk component compatibility

PSM for SSH is compatible with the following CyberArk components:

Component Supported Versions

Digital Vault Version 7.2.7 and higher

Server

Password Vault Versions 7.2.7 and higher

Web Access

Privileged Versions 7.2.7 and higher

Session Manager

CPM Any CPM that is compatible with the above Digital Vault server
and Password Vault Web Access.

Privileged Access Security

47 Privileged Session Manager for SSH

AD Bridge capabilities
AD Bridge connections are supported on the following platforms:

Platform Supported Versions

AIX 5.3, 6.1, 7.1

CentOS 6.4

Fedora 18

RHEL 4, 5, 6, 7

Solaris Intel 5.9, 5.10, 5.11

Solaris Sparc 5.9, 5.10, 5.11

SUSE 10.x, 11.x, 12.x, 13.x

HP-UX 11.x

Debian 8.2

Ubuntu 14.04

The following CyberArk component versions are required:

Component Required Versions

Digital Vault Server Version 9.1 and higher

Password Vault Web Access Versions 9.1 and higher

Privileged Session Manager Versions 9.1 and higher

Privileged Access Security

Privileged Access Security System Requirements 48

Privileged Session Manager for Cloud

Privileged Session Manager for Cloud (PSM for Cloud) enables organizations to secure,
control and monitor privileged access to cloud applications.

General
PSM for Cloud is delivered in the form of an OVA image, suitable for import into a
hypervisor host. The OS installed in the image is Ubuntu 16.04 LTS.
Licensing
If you are using the older CyberArk licensing model, you must obtain a separate
license to use PSM for Cloud. For more information, contact your CyberArk
sales representative.
If you are using the newer CyberArk Core PAS licensing model, you must have
a Core PAS user seat available per PSM for Cloud account.
You can utilize your existing Core PAS user seats, or purchase additional seats
for additional users.

Minimum system requirements

The minimum requirements for the PSM for Cloud are:

Hardware Requirement

CPU Four cores, Intel Xeon E5645 or comparable

RAM 16 GB

Disk 256 GB

Network requirements

IP A static IP assignment is required for the proxy appliance. Assign the IP in one
assignment of the following ways:
Allocating a Static IP
Use a DHCP server. Make sure that the DHCP server is configured to
serve a static, non-changing IP address to the appliance

Privileged Access Security

49 Privileged Session Manager for Cloud

DNS entries Reverse proxy: If the product is configured to use the reverse proxy,
your organization's DNS server must be configured to resolve all host
names under the reverse proxy domain with the appliance's IP address.
Use a wildcard DNS A record entry to achieve this.
For example, if the reverse proxy domain is psmc.organization.com,
add
*.psmc.organization.com
to return the appliances' IP addresses.
Explicit proxy: If the product is configured to use the explicit proxy, it is
recommended to add an A record in the DNS for the appliance's IP
address.

Certificate The proxy requires a CA or intermediate certificate to generate and sign TLS
for signing certificates for all resources (web applications) accessed through it. This
downstream certificate must be trusted by the end stations.
traffic
Tip:
The certificate should be a .crt file, and the key should be a .pem
or .key file.

Alternatively, if you are using only a reverse proxy for all your applications, you
can issue and use a certificate for the domain *.psmc.organization.com.
This should match the DNS A record entry domain.

Firewall and Inbound: The following ports must be accessible on the appliance:
ports 80 - HTTP for reverse proxy, accessed by end users
443 - HTTPS for reverse proxy, accessed by end users
8080 -Explicit proxy, accessed by end users
9000 - PSM for Cloud Portal & Kibana, accessed by administrators only
22 - Remote access to host OS, accessed by administrators only
Outbound: The following ports are used by the appliance for outside
communication:
53 - Both TCP and UDP, used for DNS
80 - HTTP. Destination: all protected services
443 - HTTPS. Destination: all protected services
1858 - CASOS. Destination: all the Vault instances
Other. If your application is accessed by a port other than those
mentioned above, make sure that it is open for outbound communication.

Privileged Access Security

Privileged Access Security System Requirements 50

Privileged Threat Analytics

PTA Server System Requirements

You will receive the PTA installation package from your CyberArk support
representative. The PTA installation package includes all operating system and third-
party updates.

Supported Platforms
PTA can be installed on the following platforms:
■ VMWare Player 6.x and above
■ VMWare Workstation 10.x and above
■ VMWare ESX/i 5.5 and above
■ Microsoft Hyper-V

Note:
Microsoft Hyper-V can be installed on Windows Server 2008R2, Windows Server
2012R2, or Windows Server 2016.

Supported Operating Systems

PTA as a software can be installed on the following operating systems:
CentOS 7.2 minimal - CentOS 7.6 minimal
RedHat 7.2 minimal - RedHat 7.6 minimal

Minimum Server Requirements

The minimum requirements for installing PTA on a machine are as follows:
■ 8 Core-CPU
■ 16 GB RAM memory
■ 500 GB hard disk storage thin provisioned
■ 1 network card
■ VMXNET3 for VMWare
■ Qlogic BCM5709C Gigabit Ethernet for Microsoft Hyper-V

Supported Browsers
Users viewing PTA data displayed in the Security module of PVWA UI can use the
PVWA supported browsers shown in Password Vault Web Access, page 22.
The classic PTA interface supports the following browsers:
■ Internet Explorer 11.0
■ Chrome - latest version
■ Firefox - latest version

Privileged Access Security

51 Privileged Threat Analytics

Network Requirements
IP Requirements
PTA requires an IP in one of the following forms:
■ Static Address: A static IP address.
■ DHCP: If the organization has a DHCP server which dynamically allocates IP
addresses, verify with the organization’s IT that the PTA machine’s IP address is
locked.
DNS Requirements
■ DNS: A DNS address record that maps the host name PTAServer to the IP
address of the PTA machine. The DNS configured in PTA must recognize all the
machines from which PTA will receive syslog messages. PTA requires both the
Forward (A record) and Reverse (PTR record) lookup.

PTA Port Usage

The PTA image must be installed on a dedicated machine that has access to the Vault, or
to the primary Vault in a distributed Vault environment, and also to either the
organizational SIEM solution, or UNIX inspected machines for syslogs.
Use the following tables as guidelines for PTA port usage.
■ PTA Port Redirection Rules, page 51
■ PTA Port Usage: Incoming Fixed Ports, page 52
■ PTA Port Usage: Incoming Optional Ports, page 52
■ PTA Port Usage: Outgoing Fixed Ports, page 53
■ PTA Port Usage: Outgoing Optional Ports, page 53

Note:
All blocked communication is logged to /var/log/iptables.log .

PTA Port Redirection Rules

Use the following table for the PTA port re-directional rules.

Source Destination
# Protocol Description
Port Port

1. TCP 80 8080 Redirect HTTP/S default ports to the

Tomcat Web Server web ports
2. TCP 443 8443

Privileged Access Security

Privileged Access Security System Requirements 52

PTA Port Usage: Incoming Fixed Ports

The port numbers in the following table are fixed and cannot be changed.

# Protocol Port Description

1. TCP 80 Allow incoming HTTP communication for the

PTA web
2. TCP 8080 This is redirected to HTTPS by the Tomcat Web
Server

3. TCP 443 Allow incoming HTTPS communication for the

PTA web and REST APIs using TLS1.2 with
4. TCP 8443 strong ciphers

5. TCP 22 Allow remote access to the machine (SSH), for

both secure telnet and SFTP

6. UDP 67,68 Allow incoming data from the DHCP server

7. TCP 27017 Allow incoming replication to the Secondary

PTA Server from the Primary PTA Server in a
disaster recovery environment

8. ICMP Echo Allow standard ICMP pings to this server

Request
Note:
Only echo-request is allowed

9. - - Allow all local traffic within the server

10. - - Allow replying to an already established session

11. - - All other communication is logged and

rejected / dropped

PTA Port Usage: Incoming Optional Ports

The port numbers in the following table can be changed to different port numbers
according to the customer’s environment.

# Protocol Port Description

1. TCP 514, Allow incoming syslog messages (could be configured for

11514 authorized sources only for specific IP addresses)

2. UDP 514,
11514

3. TCP 6514, Allow incoming secure syslog messages for the

7514 PTA Windows Agent connection

Privileged Access Security

53 Privileged Threat Analytics

PTA Port Usage: Outgoing Fixed Ports

The port numbers in the following table are fixed and cannot be changed.

# Protocol Port Description

1. TCP 514 Allow sending syslog messages in port 514

2. UDP 514

3. TCP 80 Allow an outgoing HTTP connection to CyberArk

PVWA for a specific IP address

4. TCP 443 Allow an outgoing HTTPS connection to CyberArk

PVWA for a specific IP address

5. ICMP Echo Allow standard ICMP pings from this server

Request
Note:
Only echo-request is allowed

6. UDP 53 Allow outgoing DNS requests

7. UDP 123 Allow outgoing NTP requests

8. TCP 27017 Allow outgoing replication from the Primary

PTA Server to the Secondary PTA Server in a
disaster recovery environment

9. - - Allow all local traffic within the server

10. TCP/UDP Broadcast Allow broadcast (255.255.255.255) for outgoing

DHCP requests

11. - - Allow replying to an already established session

12. - - All other communication is logged and rejected

/ dropped

PTA Port Usage: Outgoing Optional Ports

The port numbers in the following table can be changed to different port numbers
according to the customer’s environment.

# Protocol Port Description

1. TCP 25 Allow sending SMTP (email) messages for specific IP

address
2. TCP 587

3. TCP 3268, LDAP for specific IP address

389

4. TCP 3269, LDAPS for specific IP address

636

5. TCP/UDP 1858 Allow outgoing connection to the CyberArk Vault for

specific IP address

5. TCP 22 Allow outgoing connection to the PTA Network Sensor for

Privileged Access Security

Privileged Access Security System Requirements 54

# Protocol Port Description

a specific IP address
Enable outgoing SSH connection in a disaster recovery
environment

6. TCP/UDP <port> Outbound connection (SIEM integration) for specific port

and IP address

Domain Requirements
LDAP/S Requirements
LDAP: PTA can integrate with LDAP to:
■ Broaden and increase the accuracy of PTA detections
■ Enable LDAP authentication to the classic PTA interface
In order to integrate PTA with LDAP, define a group name in PTA which has the same
name as the group sAMAccountName, which appears in Active Directory.

Note:
To integrate with LDAP over SSL, create a dedicated security Base-64 encoded X.509
certificate.
LDAP login and query permission are required for the bind user.
Currently, PTA only integrates with Microsoft Active Directory LDAP.

Golden Ticket Detection

■ PTA supports detection of Golden Ticket attacks for domains.
■ The domains should be on Windows Server 2008 and above, with Function level
2003 and above.
■ This applies both to domains and sub-domains.

Certificate Requirements
It is highly recommended that you use your organization's SSL certificate. Otherwise, you
can use the self-signed certificate created during PTA installation.
If you use your organization's SSL certificate:
■ The SSL Certificate requires a Base-64 encoded X.509 SSL certificate
■ The SSL Certificate requires both Server authentication and Client authentication
Enhanced Key Usage values
■ The SSL Certificate Chain requires a Base-64 encoded X.509 SSL certificate
■ The SSL Certificate Issuer Chain requires a Base-64 encoded X.509 SSL certificate
■ The Signature Algorithm of the SSL Certificate cannot be RSASSA-PSS.

Privileged Access Security

55 Privileged Threat Analytics

CyberArk Vault / PAS Compatibility

Note:
PTA does not support the CASOS over TLS protocol.

Integration Required Version

Integrate the Vault with SIEM and PTA CyberArk Vault version
7.2.5 or higher

Support automatic threat containment using PAS CyberArk Vault version

integration, for Overpass the Hash attack and Suspected 9.3 or higher
Credential Theft security events

Support automatically adding Unmanaged Privileged CyberArk Vault version

Accounts to the pending accounts queue 9.7 or higher
For AWS accounts,
CyberArk Vault version
10.8 or higher

Configure Golden Ticket detection CyberArk Vault version

9.8 or higher

Support the Privileged Session Management integration CyberArk Vault and

PVWA version 9.8 or
higher

Note:
Privileged
Session
Management
integration
works with
lower
versions of
CyberArk
Vault, but
without the
ability to
report
Privileged
Session
Analysis
results to
PVWA.

Support a distributed Vault environment CyberArk Vault version

9.9.5 or higher

Support sending PTA alerts to the Vault CyberArk Vault version

9.10 or higher

Support the reconcile password for Suspicious Password CyberArk Vault version
Change 9.10 or higher

Privileged Access Security

Privileged Access Security System Requirements 56

Integration Required Version

Support automatic session termination CyberArk Privileged

Access Security suite
version 10.1 or higher

Supported Input Data Formats

Following are general guidelines for the data sent to PTA:
■ PTA supports UTF-8 formatted data.
■ Windows: The integration with Windows is based on authentication events 4624,
4723, and 4724. PTA supports these event types, which is supported in Windows
2003 and higher.

Note:
In order for PTA to monitor activity of privileged accounts in Windows machines,
Windows security events 4624, 4723, and 4724 from each monitored Windows
machine must be forwarded to the SIEM and from the SIEM to PTA.

■ Unix: When collecting syslogs directly from Unix machines, PAM Unix is supported.
PAM Unix is supported by multiple Unix flavors, such as Red Hat Linux, HP-UX, and
Solaris.
Supported PAM Unix events include accepted public key, accepted password, and
session open.
■ Database: Oracle logon events are supported.
■ Network Sensor: Traffic is received from domain controllers in the environment.
■ Vault: Specific events are accepted. Supported device types are operating system
and database. You can also install a generic plugin to monitor additional accounts for
additional platforms. For details, see the Privileged Access Security Implementation
Guide.
■ Applications: Successful logon events are accepted when you install a generic
plugin. For details, see the Privileged Access Security Implementation Guide.

Privileged Access Security

57 Privileged Threat Analytics

PTA Windows Agents System Requirements

■ Server authentication requires that a third-party certificate or your company's
certificate is installed on your PTA Server machine.

Note:
Create a dedicated Base-64 encoded X.509 SSL certificate.

■ Client authentication requires a SHA-256 certificate issued for the Domain

Controller with the Microsoft Enhanced RSA and AES Cryptographic
Provider CSP enabled for the Template. This CSP is disabled by default.

Note:
Create a dedicated Base-64 encoded X.509 SSL certificate.

■ PTA Windows Agent works with the following Windows servers:

■ Windows 2008 R2 64-bit
■ Windows 2012 R2 64-bit
■ Windows 2016 64-bit

PTA Agent Port Usage: Outgoing Ports

The port numbers in the following table can be changed to different port numbers
according to the customer’s environment.

# Protocol Port Description

1. TCP 6514, Allow outgoing secure syslog messages for the

7514 PTA Windows Agent connection

PTA Agent Port Usage: Outgoing Ports

The port numbers in the following table can be changed to different port numbers
according to the customer’s environment.

# Protocol Port Description

1. TCP 6514, Allow outgoing secure syslog messages for the

7514 PTA Windows Agent connection

Privileged Access Security

Privileged Access Security System Requirements 58

PTA Network Sensors System Requirements

The PTA Network Sensor software includes all operating system and third-party
updates. The software can be installed on the following:

Hardware See Reference

Physical Refer to one of the following requirements lists:

server: ■ PTA Network Sensor: Physical Hardware Requirements: Standard
Configuration (Recommended), page 58
■ PTA Network Sensor: Physical Hardware Requirements: Lighter
Configurations, page 59

VM: Support VMware ESXi version 5.5 and higher, hardware version 8
and higher.
Support Microsoft Hyper-V

Refer to one of the following requirements lists:

■ PTA Network Sensor: VM Requirements: Standard Configuration
(Recommended), page 59
■ PTA Network Sensor: VM Requirements: Lighter Configurations, page
60

PTA Network Sensor: Physical Hardware Requirements: Standard

Configuration (Recommended)
PTA Network Sensor software requires the following:

Note:
These are the minimum mandatory requirements. You must follow these requirements
when installing the PTA Network Sensor.

Physical
Requirement
Hardware

OS CentOS 7.2 - CentOS 7.6 64-bit "minimal installation"

RAM 8GB

CPU 8 cores

Hard Disk 250GB

Storage (SSD is recommended).

Management A NIC with a static IP address.

NIC

Traffic The physical or virtual network interface that listens to the network traffic.
Monitoring Must have a static IP address.
NIC

NICs In order to optimize the PTA Network Sensor performance, it is

recommended to install an Intel NIC with one of the following chipsets:

Privileged Access Security

59 Privileged Threat Analytics

Physical
Requirement
Hardware

■ 82540, 82545, 82546

■ 82571..82574, 82583, ICH8..ICH10, PCH..PCH2
■ 82575..82576, 82580, I210, I211, I350, I354, DH89xx
■ 82598..82599, X540, X550
■ X710, XL710

PTA Network Sensor: Physical Hardware Requirements: Lighter

Configurations
In lighter environments, PTA Network Sensor software requires the following:

Note:
These are the minimum mandatory requirements. You must follow these requirements
when installing the PTA Network Sensor.

Physical
Requirement
Hardware

OS CentOS 7.2 - CentOS 7.6 64-bit "minimal installation"

RAM 4GB

CPU 4 cores

Hard Disk 80GB

Storage (SSD is recommended).

Management A NIC with a static IP address.

NIC

Traffic The physical or virtual network interface that listens to the network traffic.
Monitoring Must have a static IP address.
NIC

NICs In order to optimize the PTA Network Sensor performance, it is

recommended to install an Intel NIC with one of the following chipsets:
■ 82540, 82545, 82546
■ 82571..82574, 82583, ICH8..ICH10, PCH..PCH2
■ 82575..82576, 82580, I210, I211, I350, I354, DH89xx
■ 82598..82599, X540, X550
■ X710, XL710

PTA Network Sensor: VM Requirements: Standard Configuration

(Recommended)
IMPORTANT: Only the below configurations are supported!
PTA Network Sensor software requires the following VM requirements:

Privileged Access Security

Privileged Access Security System Requirements 60

Note:
These are the minimum mandatory requirements. You must follow these requirements
when installing the PTA Network Sensor.

Virtual
Requirement
Machine

RAM 8GB

CPU 8 cores

Hard Disk 40GB

Storage (SSD is recommended).

VM ■ Use the ESXi or Hyper-V host setup to define the PTA Network
Sensor VM as High Priority.
■ Configure promiscuous mode or port mirroring on the ESXi or
HyperV host.

VM Network VMXNET3
Driver

NICs Any NIC

Note:
It is recommended to run the PTA Network Sensor in the Standard recommended
configuration, in order to allow PTA to scale up to the expected network traffic load.

PTA Network Sensor: VM Requirements: Lighter Configurations

IMPORTANT: Only the below configurations are supported!
In lighter environments, PTA Network Sensor software requires the following VM
requirements:

Note:
These are the minimum mandatory requirements. You must follow these requirements
when installing the PTA Network Sensor.

Virtual
Requirement
Machine

RAM 4 GB

CPU 4 cores

Hard Disk 40 GB
Storage (SSD is recommended).

VM ■ Use the ESXi or Hyper-V host setup to define the PTA Network

Privileged Access Security

61 Privileged Threat Analytics

Virtual
Requirement
Machine

Sensor VM as High Priority.

■ Configure promiscuous mode or port mirroring on the ESXi or
HyperV host.

VM Network VMXNET3
Driver

NICs Any NIC

Note:
It is recommended to run the PTA Network Sensor in the Standard recommended
configuration, in order to allow PTA to scale up to the expected network traffic load.

PTA Network Sensor Port Usage

The port numbers in the following table can be changed to different port numbers
according to the customer’s environment.

# Protocol Port Description

1. TCP 22 Allow incoming connection to the PTA Network Sensor

Privileged Access Security

Privileged Access Security System Requirements 62

Application Identity Management

Note:
CyberArk may choose not to provide maintenance and support services for CyberArk's
Application Identity Management with relation to any of the platforms and systems listed
below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

Credential Provider
The Credential Provider is currently supported on the following platforms:

Platform Latest Version

AIX 10.5

Solaris 10.5

Linux 10.5

Ubuntu Linux 7.20.110

Windows 10.5

zLinux 6.0

HP-UX 4.5

This section contains documentation for the latest releases of the Credential Provider,
including the latest releases of all Application Password SDKs. Please remember that
the Credential Provider is supported on different platforms, as described in the table
above, and the information in this document is relevant to the most recent released
version for each platform. For more information about previous versions, refer to the
Application Identity Management Implementation Guide for that version.

Note:
This section does not contain documentation for the Credential Provider on HP-UX. The
Credential Provider on HP-UX is currently released as controlled availability only as
v4.5. For more information, contact your CyberArk representative.

Credential Provider (v10.5) on AIX

The Credential Provider for AIX is supported on the following platforms:
AIX 6.1, and 7.1 TL1, TL2, and TL3 (64-bit)

Credential Provider(v10.5) on Solaris

The Credential Provider for Solaris is supported on the following platforms:

Privileged Access Security

63 Application Identity Management

Solaris Intel 11 (SunOS 5.11)

Solaris Intel 10 (SunOS 5.10 64-bit)
Solaris SPARC 10, 11 64-bit (SunOS versions 5.10 and 5.11 64-bit)

Note:
Solaris 9 (both Intel and SPARC) are no longer supported as they have reached their
End of Life. Customers using this OS may continue using Credential Provider v9.6.

Credential Provider (v10.5) on Linux

The Credential Provider for Linux is supported on the following platforms:
RHEL-Intel 5, 6 and 7 (32/64-bit)
RHEL-Power PC 7.1 (Little Endian) 64-bit
SUSE-Intel 11 and 12 (64-bit)
SUSE-Power PC 12 (Little Endian) 64-bit
CentOS-Intel 5, 6, and 7 (32/64-bit)
Fedora 13 and 14 (32-bit)

Credential Provider (v7.20.110) on Ubuntu Linux

The Credential Provider for Ubuntu Linux is supported on the following platforms:
Ubuntu 12.04 LTS 64-bit

Credential Provider (v10.5) on Windows

The Credential Provider for Windows is supported on the following platforms:
Windows Server 2019
Windows Server 2016
Windows Server 2012 and Windows Server 2012 R2
Windows Server 2008R2 (64 bit)

Note:
Windows 2003 is no longer supported. Customers using this OS may continue using
Credential Provider v9.7.1.

For developer endpoints:

Windows 10
Windows 8.x
Windows 7

Credential Provider (v6.0) on zLinux

The Credential Provider for zLinux is supported on the following platforms:
SUSE zLinux 10 and 11 (64-bit) – This platform is only supported for AIM

Privileged Access Security

Privileged Access Security System Requirements 64

Credential Provider on HP-UX

The Credential Provider for HP-UX is currently supported on the following platforms:
HP-UX 11.23 PA-Risc
HP-UX on Itanium 11i v3 (11.31)

Note:
The Credential Provider on HP-UX is currently released as controlled availability only
as v4.5. For more information, contact your CyberArk representative.

Credential Provider Compatibility

Credential
Provider Works with Supports
version

10.5 Digital Vault v7.x, v8.x ,v9.x, and v.10.x Application

Password SDK
v5.5, v6.0, v7.0,
v7.1, v7.2, v9.5 and
10.5

9.9.5 Digital Vault v7.x, v8.x ,v9.x, and v.10.x Application

Password SDK
v5.5, v6.0, v7.0,
v7.1, v7.2 and v9.5

9.7 Digital Vault v7.x, v8.x ,v9.x, and v.10.x Application

Password SDK
v5.5, v6.0, v7.0,
v7.1, v7.2 and v9.5

7.2 Digital Vault v7.x, v8.x ,v9.x, and v.10.x GA versions for
Application
Password SDK
v4.5, v5.0, v5.5,
v6.0, v7.0, v7.1 and
v7.2.

7.1 Digital Vault v7.x, v8.x ,v9.x, and v.10.x GA versions for
Application
Password SDK
v4.5, v5.0, v5.5,
v6.0, v7.0, and v7.1.

7.0 Digital Vault v7.x, v8.x ,v9.x, and v.10.x GA versions for
Application
Password SDK
v4.5, v5.0, v5.5,
v6.0, and v7.0

6.0 Digital Vault v7.x and v8.x. GA versions for

Privileged Access Security

65 Application Identity Management

Credential
Provider Works with Supports
version

Application
Password SDK
v4.5, v5.0, v5.5, and
v6.0.

Application Password SDKs

The Application Password SDK is supported on a machine where the Credential
Provider is installed. It is supported in the following application environments:

Latest CP
SDK Platform Notes
version

C/C++ AIX 10.5 32-bit and 64-bit

modules

Solaris 10.5 32-bit and 64-bit

modules

Linux 10.5 32-bit and 64-bit

modules

Windows 10.5 32-bit and 64-bit

modules

zLinux 6.0 64-bit module

HP-UX (Risc) 4.5 32-bit module

HP-UX 4.5 64-bit module

(Itanium)

Java (v1.5.x and higher) AIX 10.5

Solaris 10.5

Linux 10.5

Windows 10.5

zLinux 6.0

HP-UX 4.5
(Risc/Itanium)

Privileged Access Security

Privileged Access Security System Requirements 66

Latest CP
SDK Platform Notes
version

CLI (Command Line AIX 10.5

Interface)
Solaris 10.5

Linux 10.5

Windows 10.5

zLinux 6.0

HP-UX 4.5
(Risc/Itanium)

.NET Framework (4.5.2) Windows 10.5

COM Windows 9.9.5 32-bit and 64-bit

modules

This section contains documentation for the latest release of all Application Password
SDKs. The Credential Provider is supported on different platforms, as described in the
table above, while the information in this document is relevant to the most recent
released version for each platform. For details about previous versions of Application
Password SDKs, see the Application Identity Management Implementation Guide for
that version.
For information about upgrading from an existing PVToolkit implementation to the
Credential Provider, contact your CyberArk support representative.

Application Password SDK Compatibility

The Application Password SDK supports the same version of [[[Undefined variable
project_variables.CP-full]]] and later versions.

Application Server Credential Provider

This topic describes system requirements for the Application Server Credential Provider.
The Application Server Credential Provider is an additional component that securely and
automatically manages application server credentials that are stored inside data source
XML files. Using this component, you do not need to perform any code changes to
applications in order to store your passwords securely in the Digital Vault, and you can
perform automatic password replacement with no need to restart the Application Server,
thus eliminating downtime.
This version of the Credential Provider includes the following versions of the Application
Server Credential Provider:

Latest ASCP JDBC Driver Latest ASCP Credential

Platform
Proxy Version Mapper Version

WebSphere - V7.1

WebLogic V10.1 V5.5 p1

Privileged Access Security

67 Application Identity Management

Latest ASCP JDBC Driver Latest ASCP Credential

Platform
Proxy Version Mapper Version

JBoss V10.1 V7.2

Tomcat V5.5 -

WebSphere - V9.8
Liberty

ASCP JDBC Driver Proxy supported platforms

The ASCP JDBC Driver Proxy is supported on the following platforms:

Application
JBoss WebLogic Tomcat
Server

AS Version AS 5 11g 6.0

EAP 4.3 (with Java version 1.6 12c 7.0
or later) 8.0
EAP 6.4
EAP 7.1

Datasources local-tx-datasource Generic Non-

xa datasource pool
ed
Pool
ed
XA

Databases Oracle Oracl Orac

msSQL e le
DB2 msS msS
QL QL
DB2 DB2
terad
ata
MyS
ql

Connection types Driver Drive Driv

XA r er
XA XA

ASCP Credential Mapper supported platforms

The ASCP Credential Mapper is supported on the following platforms for the above
environments:

Platform Details

IBM Applications that utilize direct JNDI to lookup a datasource cannot be

WebSphere configured to use the Application Server Credential Provider.

Privileged Access Security

Privileged Access Security System Requirements 68

Platform Details

7.x, 8.0, To use ASCP on WebSphere for version 7.x with fix PK75609 or
8.5, and 9.0 version 8.x, additional configuration is required. For more information,
refer to step 7 in WebSphere Application Server Classic.

Oracle The Application Server Credential Provider for DataSources is

WebLogic supported on WebLogic 9.x, 10.x, 11g (10.3.x) and 12c (12.x)
The WebLogic ASCP for DataSources supports both XA and non-XA
datasources. However, non-XA is only supported on WebLogic
versions 10.3.4 to 12.1.1.0 if the following patch is installed:
https://support.oracle.com/epmos/faces/SearchDocDisplay?_
adf.ctrl-state=16sjrf5ib1_9&_afrLoop=207399673504010#CAUSE

JBoss AS Instructions for JBoss AS 7.x and JBoss EAP 6.x are identical.
4.x, 5.x, 6.x
and 7.x,
EAP 6.x,
and WildFly
8 and 9

Tomcat
6.0, 7.0 and Note:
8.0 The Tomcat ASCP data source does not currently support the
org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory factory
when used with:
Non-pooled data source connections to Oracle
Pooled or XA data source connections to Oracle or MySQL

To use a non-pooled, pooled or XA data source connection to Oracle,

we recommend using either the OracleFactory or the “Tomcat JDBC”
data source.
To use a Pooled or XA data source connection to MySQL, we
recommend using either the MySQLFactory or the “Tomcat JDBC”
data source.

Required Java versions

All ASCPs require JRE 1.5.x or higher

Supported environments
The Application Server Credential Provider is currently supported in the following
environments:
Solaris
Linux
Windows
AIX
For more details about the specific operating systems, refer to Credential Provider
above.

Privileged Access Security

69 Application Identity Management

Application Server Credential Provider compatibility

The CyberArk Application Server Credential Provider requires the following component
to be installed on the same machine:
Credential Provider, version 6.0 or later

Central Credential Provider System Requirements

The Central Credential Provider is supported on the following platforms:
Windows Server 2016
Windows Server 2012 and Windows Server 2012 R2
Windows Server 2008R2 (64 bit)

Note:
Windows 2003 is no longer supported. Customers using this OS may continue using
Credential Provider v9.7.1.

CyberArk Compatibility
The Central Credential Provider works with the Digital Vault, v7.x, v8.x, v9.x. and v10.x

Prerequisites
To authenticate applications using Windows domain users, the Central Credential
Provider must be in the same domain as the requesting application machines.
Alternatively, the requesting application domain must be trusted by the Central
Credential Provider domain. For more information about authenticating applications
with the Windows domain users, refer to Authenticate Applications on the Central
Credential Provider.
Make sure Windows has IIS 6, 7.5, or 10 installed and supports IIS 6.0 compatibility
mode.

Client Requirements
The Central Credential Provider works with application on any operating system,
platform or framework that can invoke REST or SOAP web service requests.

.NET Framework
Support for v. 4.5.2

Privileged Access Security

Privileged Access Security System Requirements 70

On-Demand Privileges Manager

The On-Demand Privileges Manager (OPM) enables you to run privileged UNIX
commands in an audited and controlled way. The On-Demand Privileges Manager must
be installed on each managed UNIX system.

Note:
CyberArk may choose not to provide maintenance and support services for CyberArk's
On-Demand Privileges Manager with relation to any of the platforms and systems listed
below which have reached their formal End-of-Life date, as published by their
respective vendors from time to time. For more details, contact your CyberArk support
representative.

Supported platforms
The OPM is currently supported on the following platforms:

Platform Latest Version

AIX V10.4

Solaris V10.4

Linux V10.4

HPUX V9.9

Windows V10.4

OPM Supported Platforms Supported Platforms

OPM on AIX (v10.4) ■ AIX 6.1 and 7.1 TL1, TL2, and TL3
(64-bit)

Note:
The AIX version must include
the Linux Toolbox for AIX.
This is built-in for AIX.

OPM on Solaris (v10.4) ■ Solaris Intel 10 and 11 (SunOS 5.10

and 5.11 64-bit)
■ Solaris SPARC 10 and 11 64-bit
(SunOS versions 5.10 and 5.11 64-bit)

OPM on Linux (v10.4) RedHat 5, 6 and 7 (32/64-bit)

SUSE-Intel/ppc64le 11, 12 (ppc =
powerpc)
SUSE 12 on IBM Power8 (Little
Endian) 64-bit

Privileged Access Security

71 On-Demand Privileges Manager

OPM Supported Platforms Supported Platforms

Fedora 24, 25 and 26 (32-bit)

CentOS 6 and 7 (32/64-bit)
Oracle 5, 6 and 7

OPM on HPUX (v9.9) Itanium/RISC v11.23 and higher

Windows Windows platforms are supported through

CyberArk Endpoint Privilege Manager.
For details, see the Endpoint Privilege
Manager Implementation Guide

Privileged Access Security

Privileged Access Security System Requirements 72

OPM Compatibility
OPM Version Compatible Digital Vault Versions

v10.x v7.x, v8.x, v9.x and v10.x

v9.x v7.x, v8.x, v9.x and v10.x

v7.2 v7.x, v8.x and v9.x

v7.1 v7.x, v8.x and v9.x

v7.0 v7.x, v8.x and v9.x

v6.0 v7.x, v8.x and v9.x

AD Bridge capabilities
AD Bridge connections are supported on the following platforms:
■ RedHat Linux
■ CentOS
■ AIX
■ Solaris
The following CyberArk component versions are required:
■ Digital Vault Server, version 9.8 or later
■ Password Vault Web Access, version 9.8 or later
■ OPM, version 9.8 or later

CyberArk Pluggable Authentication Module

The OPM Pluggable Authentication Module (OPM-PAM) is supported on the following
platforms:
■ RedHat Linux
■ CentOS
■ AIX
■ Solaris
PAM Supported Platforms Supported Platforms

PAM on AIX (v10.4) ■ AIX 6.1 and 7.1 TL1, TL2, and TL3 (64-
bit)

Note:
The AIX version must include the
Linux Toolbox for AIX. This is
built-in for AIX.

PAM on Solaris (v10.4) ■ Solaris Intel 10 and 11 (SunOS 5.10 and

5.11 64-bit)

Privileged Access Security

73 On-Demand Privileges Manager

PAM Supported Platforms Supported Platforms

■ Solaris SPARC 10 and 11 64-bit (SunOS

versions 5.10 and 5.11 64-bit)

PAM on Linux (v10.4) RedHat 5, 6 and 7 (32/64-bit)

SUSE-Intel/ppc64le 11, 12 (ppc =
powerpc)
SUSE 12 on IBM Power8 (Little Endian)
64-bit
Fedora 24, 25 and 26 (32-bit)
CentOS 6 and 7 (32/64-bit)
Oracle 5, 6 and 7

The OPM-PAM has the following dependencies:

■ The On-Demand Privileges Manager (OPM) must be installed on the machine.
The OPM-PAM works with the following CyberArk components:
■ CyberArk Digital Vault version 9.8 and higher
■ OPM version 9.8 and higher

Privileged Access Security

Privileged Access Security System Requirements 74

Password Upload Utility

The Password Upload utility uploads multiple password objects to the Digital Vault,
making the Privileged Access Security implementation process quicker and more
automatic.

Note:
CyberArk may choose not to provide maintenance and support services for CyberArk's
Password Upload Utility with relation to any of the platforms and systems listed below
which have reached their formal End-of-Life date, as published by their respective
vendors from time to time. For more details, contact your CyberArk support
representative.

Supported platforms
The Password Upload utility can be run on the following platforms:
Windows 2008 R2 (64-bit)
Windows 7 (64-bit)
Windows 2003 (32-bit)
Windows XP (32-bit)

CyberArk components
The Password Upload utility requires the following CyberArk components:
PrivateArk Command Line Interface (PACLI), version 4.1 or later – PACLI must be
installed in the same folder as the Password Upload utility or in a folder specified in
the Path.

CyberArk component compatibility

The Password Upload utility runs with the following CyberArk components:
Digital Vault server, version 4.1 or later

Privileged Access Security

75 CyberArk SDKs

CyberArk SDKs
The CyberArk SDKs enable Privileged Access Security users and applications/scripts to
access the Digital Vault server from any location, in an extremely intuitive command line
environment.

Note:
CyberArk may choose not to provide maintenance and support services for CyberArk's
SDKs with relation to any of the platforms and systems listed below which have reached
their formal End-of-Life date, as published by their respective vendors from time to time.
For more details, contact your CyberArk support representative.

Minimum requirements
The minimum requirements for all the SDK interfaces are as follows:

Disk space: 10MB free disk space

Minimum memory: 32MB
Communication: TCP/IP connection to the Digital Vault Server

CyberArk Component compatibility

The CyberArk SDKs work with the Digital Vault server, version 4.5 and above.

Digital Vault server SDK

The Digital Vault Server SDK (PACLI) can be used on any Privileged Access Security
implementation.

CyberArk Command Line Interface (PACLI)

PACLI v7.2 is currently supported on the following platforms:
■ Windows 2012 R2
■ Windows 2008 R2 (64-bit)
■ Windows 7 (64-bit)
■ Windows 2003 (32-bit)

Privileged Access Security

 76

Authentication

The Privileged Access Security solution supports a variety of authentication methods on

its different interfaces:
This list may be updated frequently as additional authentication methods are supported.
Please contact CyberArk Customer Support for updated information.
For more details about any of these authentication methods, see the Privileged Access
Security Installation Guide .

Privileged Access Security

Privileged Access Security System Requirements 77

Password Vault Web Access

Authentication methods
Password
Windows
Radius
PKI
RSA SecurID
LDAP
Oracle SSO
SAML
Additional third-party authentication servers can be easily customized.

Authentication methods with additional password authentication

Windows with additional password authentication
PKI with additional password authentication
RSA SecurID with additional password authentication
Oracle SSO with additional password authentication

Mobile PVWA authentication methods

Password
Radius
RSA SecurID
LDAP

PrivateArk Client
Authentication methods
Password
Windows
Radius
PKI
LDAP

Central Policy Manager

Authentication methods
Password
Password with a certificate on a hardware token
Radius
PKI on Windows

Privileged Access Security

78 Password Upload Utility

Password Upload Utility

Authentication methods
Password
Password with a certificate on a hardware token
Radius
PKI on Windows

Digital Vault Server SDK (PACLI)

Authentication methods
Password
Password with a certificate on a hardware token
Radius
PKI on Windows
RSA SecurID (only PACLI, as secondary authentication)

Privileged Access Security SDK

Authentication methods
Password
Radius
SAML
PSM for SSH with SSH keys

Privileged Access Security

 79

Network Ports Overview

The Privileged Access Security components communicate through a variety of ports

which ensure that all their communication is secure and according to the patented
CyberArk protocol.

Privileged Access Security

Privileged Access Security System Requirements 80

Network Port Definitions for CyberArk Components

The following tables list the network port definitions for each component in relation to the
other Privileged Access Security components and managed devices.

Part 1:

Target

Source Vault DR CPM PVWA

Vault û TCP/1858 [1] û û

Disaster TCP/1858 [1] û û û

Recovery Vault
(DR)

Central Policy TCP/1858 [1] TCP/1858 [1] û TCP/443

Manager (CPM)

Password Vault TCP/1858 [1] TCP/1858 [1] û û

Web Access
(PVWA)

Privileged TCP/1858 [1] TCP/1858 [1] û û

Session
Manager (PSM)

Privileged TCP/1858 [1] TCP/1858 [1] û TCP/443

Session
Manager for
SSH (PSM for
SSH)

Privileged TCP/1858 [1] TCP/1858 [1] û û

Session
Manager for
Cloud (PSM for
Cloud

Credential TCP/1858 [1] TCP/1858 [1] û û

Provider

On-Demand TCP/1858 [1] TCP/1858 [1] û û

Privileges
Manager (OPM)

User TCP/1858 [1]; TCP/1858 [1]; TCP/3389 TCP/80

(Administrator) opt. Remote opt. Remote TCP/443
Administration Administration TCP/3389
[2] [2]

________________________________
û – Not relevant
[1] Default port. This can be changed, e.g. to TCP/443.

Privileged Access Security

81 Network Port Definitions for CyberArk Components

[2] Remote Administration Boards, e.g. like HP iLO, IBM RSA, Dell DRAC, etc., for
virtualized environments allow access to VM Server.
[3] Refer to Standard Ports and Protocols, page 85.
[4] Depending on devices managed through direct access (Administrators'
Workstations to target devices).

Part 2:

Target

SMTP Manage/Acce
Credenti Server ss Target
OP
Source PSM al (for Event Devices, e.g.
M
Provider Notificatio Server,
n) Router, …

Vault û û û TCP/25 û

Disaster û û û TCP/25 û
Recovery
Vault (DR)

Central û û û û See footnotes

Policy below [3]
Manager
(CPM)

Password û û û û û
Vault Web
Access
(PVWA)

Privileged û û û û TCP/3389 or
Session TCP/22
Manager
(PSM)

Privileged û û û û TCP/22 [1]

Session
Manager for
SSH(PSM
for SSH)

Privileged û û û û TCP/80,
Session TCP/443
Manager for
Cloud (PSM
for Cloud)

Privileged TCP/33 û û û û
Session 89
Manager
HTML5
gateway

Privileged Access Security

Privileged Access Security System Requirements 82

Target

SMTP Manage/Acce
Credenti Server ss Target
OP
Source PSM al (for Event Devices, e.g.
M
Provider Notificatio Server,
n) Router, …

Credential û û û û û
Provider

On-Demand û û û û û
Privileges
Manager
(OPM)

User TCP/44 û û û TCP/22,

(Administrat 3 TCP/3389,
or) TCP/33 etc. [4]
89

_________________________________
û – Not relevant
[1] Default port. This can be changed, e.g. to TCP/443.
[2] Remote Administration Boards, e.g. like HP iLO, IBM RSA, Dell DRAC, etc., for
virtualized environments allow access to VM Server.
[3] Refer to Standard Ports and Protocols, page 85.
[4] Depending on devices managed through direct access (Administrators'
Workstations to target devices).

Privileged Access Security

83 Network Port Definitions for Third Party Components

Network Port Definitions for Third Party Components

The following tables list the network port definitions for various third party components
that communicate with the Privileged Access Security components.

Part 1:

Optional Target

Source LDAP/S RADIUS RSA SecurID

Vault TCP/389 or UDP/1812 UDP/5500

TCP/636 UDP/1813 UDP/5560
TCP/5500
TCP/5560

Disaster Recovery Vault (DR) TCP/389 or UDP/1812 UDP/5500

TCP/636 UDP/1813 UDP/5560
TCP/5500
TCP/5560

Central Policy Manager (CPM) û û û

Password Vault Web Access û û û

(PVWA)

Privileged Session Manager û û û

(PSM)

Privileged Session Manager for û û û

SSH (PSM for SSH)

Privileged Session Manager for û û û

Cloud (PSM for Cloud)

Credential Provider û û û

On-Demand Privileges Manager û û û

(OPM)

User (Administrator) û û û

Privileged Access Security

Privileged Access Security System Requirements 84

Part 2:

Optional Target

Source Backup Syslog NTP SNMP

Vault Depending on TLS/514 UDP/123 UDP/161

backup TCP/514 UDP/162
software used UDP/514

Disaster Recovery Depending on TLS/514 UDP/123 UDP/161

Vault (DR) backup TCP/514 UDP/162
or software used UDP/514
Satellite Vault

Central Policy û û UDP/123 û

Manager (CPM)

Password Vault Web û û UDP/123 û

Access (PVWA)

Privileged Session û û UDP/123 û

Manager (PSM)

Privileged Session û û UDP/123 û

Manager for SSH
(PSM for SSH)

Privileged Session û û û û
Manager for Cloud
(PSM for Cloud)

Credential Provider û û û û

On-Demand û û û û
Privileges Manager
(OPM)

User (Administrator) û û û û

Privileged Access Security

 85

Standard Ports and Protocols

The Privileged Access Security solution uses standard ports and protocols to
communicate with different devices.
In this section:
Standard CPM Ports and Protocols
Standard Ports used for Accounts Discovery
Standard Vault Ports and Protocols
Standard PVWA Ports and Protocols

Privileged Access Security

Privileged Access Security System Requirements 86

Standard CPM Ports and Protocols

The following table lists the standard ports used by the CPM to communicate with the
different devices whose passwords it manages automatically.

Operating Systems

Device Protocol Port

Windows Domain Windows 139

Accounts
Windows 445

Windows Desktop Windows 135

Accounts
Windows 445

Windows If the 'VerifyMachine

NameBeforeAction' parameter is set to
‘Yes’:
135
High ports

Windows Local Windows 139

Accounts
Windows 445

Windows If the 'VerifyMachine

NameBeforeAction' parameter is set to
‘Yes’:
135
High ports

Windows Local Windows 135

Accounts over WMI
Windows 445

Windows High ports

Windows Services Windows 135

Windows 445

Windows High ports

Windows Scheduled Windows 2003 445

Tasks

Windows Windows 135

IIS Application Pools
Windows 445

Windows 49154

Privileged Access Security

87 Standard CPM Ports and Protocols

Device Protocol Port

COM+ Applications Windows 135

Windows 445

Windows High ports

Windows IIS Windows 135

Directory Security
(Anonymous Windows 445
Access)

Windows High ports

UNIX SSH 22

Telnet 23

AS400 iSeries Access 449 and 8476

for Windows

OS/390 FTP 21

SSH 22

Telnet 23

ESXi HTTP 80

HTTPS 443

Databases

Device Protocol Port

ODBC Can be changed, Can be changed,

depending on the depending on the
database database

Oracle Proprietary protocol 1521

MSSql Proprietary protocol 1433

MySql Proprietary protocol 3306

Sybase Proprietary protocol 5000

DB2 Windows 2003 445

Unix SSH 22

Unix Telnet 23

Informix Windows 2003 445

Unix SSH 22

Unix Telnet 23

Privileged Access Security

Privileged Access Security System Requirements 88

Device Protocol Port

Windows Registry Windows 135

Windows 445

Windows High ports

Remote Access

Device Protocol Port

HP iLO SSH 22

Telnet 23

Dell DRAC SSH 22

Security Appliances

Device Protocol Port

CheckPoint Firewall-1 NG OPSEC 18190

RSA Authentication Manager SSH 22

Accounts
HTTPS 443

Netscreen

Device Protocol Port

Netscreen SSH 22

Telnet 23

Network Devices

Device Protocol Port

CISCO SSH 22

Telnet 23

Privileged Access Security

89 Standard CPM Ports and Protocols

Directories

Device Protocol Port

Novell eDirectory LDAP plain 389

protocol

LDAP secured 636

protocol

SunOne Directory LDAP plain 389

protocol

LDAP secured 636

protocol

Applications

Device Protocol Port

CyberArk CyberArk 1858 (can be changed)

SAP 3342

LDAP (for auto-detection processes)

Device Protocol Port

LDAP Plain 389

SSL 636

Privileged Access Security

Privileged Access Security System Requirements 90

Standard Ports used for Accounts Discovery

The CyberArk CPM Scanner uses the following ports to discover accounts and SSH
keys on remote machines:

Port Use case

22 To connect to target machines using SSH.

This port can be configured by the SSHPort parameter in the
CACPMScanner.exe.config file.

88 Used for KDC services (only relevant to domain controllers).

This port must be accessible both through network-based and host-based
firewalls.

135, 137, To connect to target machines using NetBIOS ports.

138, 139 These ports must be accessible on host-based firewalls.

389 To connect to target machines using the LDAP service (only relevant to
domain controllers).
This port must be accessible both through network-based and host-based
firewalls.

636 To connect to target machines using the LDAPS service (only relevant to
domain controllers).
This port must be accessible both through network-based and host-based
firewalls.

445 To connect to target machines using SMB/TCP.

This port must be accessible on host-based firewalls.

4431 To discover SSH keys on Windows machines without Cygwin.

This port is not configurable.

49154 This port is used to view and administrate Scheduled Tasks on the
remote machine.

49155, 49156 This port is used to get the list of services from the remote machine.

Privileged Access Security

91 Standard Vault Ports and Protocols

Standard Vault Ports and Protocols

The following table lists the standard ports and protocols used by the Vault to
communicate with different devices.

Device Protocol Port

Remote Control CyberArk Protocol 9022

LDAP Plain 389

SSL 636

Standard PVWA Ports and Protocols

The following table lists the standard ports and protocols used by the PVWA to
communicate with different devices.

Device Protocol Port

HTTPS TLS 443

LDAP Plain 389

SSL 636

Privileged Access Security