https://docs.cyberark.com/pam-self-hosted/14.0/en/content/pas%20inst/following-installation-of-psmp.htm

CyberArk’s hardening instructions for SUSE (manual hardening) explicitly require:

Updating the SSH daemon configuration in /etc/ssh/sshd_config (for example, removing SFTP subsystem definitions and setting multiple hardening-related attributes such as disabling forwarding features).

Ensuring the credential file for the PSM for SSH gateway user ( psmpgwuser.cred ) has the required permissions 640 (default path shown as /etc/opt/CARKpsmp/Vault/psmpgwuser.cred).

Those map directly to A and C .

The basic network requirements to deploy a CyberArk Privilege Management Central Policy Manager (CPM) server include Port 1858 to the Privilege Cloud Vault service backend and Port 443 to the Privilege Cloud Portal . Port 1858 is necessary for communication with the CyberArk Vault, facilitating essential interactions like password retrieval and updates. Port 443 is required for secure web traffic to and from the Privilege Cloud Portal, ensuring that all management tasks performed through the web interface are secure and encrypted. These ports must be properly configured to allow for the efficient and secure operation of the CPM within the Privilege Cloud infrastructure.

CyberArk’s official connector guidance (CyberArk Identity / Identity Administration—used with Privilege Cloud Shared Services for AD user authentication) says that for trusted domains in a single forest , you use this model when the domain controllers have a two-way, transitive trust relationship with the domain controller the connector is joined to.

It also clarifies that a single connector can be used for the entire domain tree or forest in that trusted-domain model, and authentication requests are handled according to AD trust relationships within the forest/tree.

https://docs.cyberark.com/identity/latest/en/content/coreservices/connector/userauthmultdomain.htm

To correctly change the default PSM recordings folder path on the Privilege Cloud Connector, the sequence of steps should be:

Create a corresponding folder in the new location. Before making changes to configuration files, ensure the new directory for PSM recordings is created. This is where all session recordings will be stored moving forward.

In the Basic_psm.ini file, set RecordingsDirectory with the new path. Update the Basic_psm.ini file to reflect the new path for the recordings. This step is crucial as it directs the PSM to start using the newly created directory for all future session recordings.

Restart the PSM service. After updating the path in the configuration file, restart the PSM service to apply the changes. This ensures that all new sessions are recorded in the new specified location.

Run the PSMHardening script. Once the service is restarted and the new settings are in place, run the PSMHardening script. This script ensures that all security measures are re-applied to the new recordings directory, maintaining the security integrity of the session recordings.

Following these steps in the given order will successfully change the recording directory for PSM sessions on the Privilege Cloud Connector, ensuring a smooth transition to the new storage location with all necessary security measures intact.

To retrieve the previous password for an account that had its password changed by the CPM, you should look under the Versions tab within the account ' s overview page. This tab maintains a history of password changes, including previous passwords, along with other historical data points that allow for tracking changes over time. This feature is critical for auditing and rollback purposes in environments where knowing past credentials is necessary for troubleshooting or compliance.

CyberArk states that users can authenticate to the Vault through PSM for SSH using:

CyberArk password authentication (i.e., CyberArk authentication),

LDAP , and

RADIUS (including challenge-response) .

Windows, SAML, and OIDC are not listed as direct PSM for SSH authentication methods in the PSM for SSH authentication configuration (Privilege Cloud / PSM for SSH uses the configured PSM for SSH authentication methods such as Password/LDAP/RADIUS)

To properly arrange the steps for failing over to a passive Central Policy Manager (CPM) in CyberArk, the sequence should be as follows:

Validate that the active CPM ' s services are stopped and set to manual. Before enabling the passive CPM, ensure that the services on the active CPM are stopped. This prevents any conflicts or data corruption by making sure that only one CPM is active at a time. Setting the services to manual ensures they do not restart automatically, which is crucial during a failover scenario.

On the passive CPM, confirm details in the Vault.ini configuration file, reset the password to the CPM user, and recreate the credential file. This step involves making sure the passive CPM has the correct configuration to seamlessly take over operations. Adjustments in the Vault.ini file may be necessary to ensure it is pointing to the correct Vault and network settings. Resetting the password and recreating the credential file are critical to secure the login and authentication process for the newly active CPM.

Enable the CPM services on the passive CPM. Once the passive CPM is correctly configured and ready, enable its services to begin handling the tasks and responsibilities of the primary CPM. This action effectively switches the role from passive to active, enabling the passive CPM to function as the new operational manager.

Review logs to confirm the passive CPM services are running as expected. Finally, review the system and application logs to confirm that the now-active CPM is operating correctly and that all services have started without errors. This step is vital for verifying that the failover process was successful and that the system is stable.

Following this ordered sequence ensures a smooth transition of roles from the active CPM to the passive CPM, minimizing downtime and potential disruptions in the privileged access management operations.