Targets and privileged accounts

A target is a server or service (for example a Linux server or a database). Each target has privileged accounts people can request.

How do I register a target?

1. Open «PAM» › «Targets» and choose «Add target».
2. Fill in:

3. Save. Use «Filter by name or tag» to find targets.

How do I attach the appliance and confirm the host key?

Before the first session, the target needs the Edge appliance that reaches it and a confirmed SSH host key: the list shows «Host key not confirmed» or «Host key confirmed». Select the target; its accounts pane opens with «Edge appliance and host key».

1. In «Edge appliance», choose the appliance by name (or «None (direct connection)») and choose «Save appliance»: «The Edge appliance of srv-db-01 was saved.»
2. Choose «Read the host key». The appliance connects to the target: «The appliance is reading the host key. Refresh in a few seconds.» Without an appliance you see «Choose and save the Edge appliance that reaches this target first.»
3. After «Refresh», the fingerprints appear under «Read by the appliance on 22/10/2026 10:15:», in the SHA256:… form.
4. «Compare each fingerprint with the server's own, for example with ssh-keygen -lf on its host key file.»
5. Tick «I compared the fingerprint and it matches the server's» and choose «Confirm host key»: «Host key confirmed: the appliance now trusts only this key for srv-db-01.»

If the fingerprints differ, do not confirm: someone may be between the appliance and the server.

How do I add an account?

1. On the target, choose «Add account».
2. Fill in «User name», «Mode» («Vaulted» or «Ephemeral»), «Credential» (password, SSH key or API token) and «Connector» (for example «Linux password», «SSH key», «Windows local account», «MySQL», «PostgreSQL» or «HTTP connector»).
3. An ephemeral account needs a «Managing account (ephemeral accounts)»: the system creates a temporary account per lease and removes it at the end.
4. Set the credential and assign an access profile. Without a profile nobody can request the account.

Deleting a target

With dual control on, deleting a target waits for a second administrator.