Install a proxy service on another server

The Netwrix Privilege Secure for Access Management (Privilege Secure) proxy brokers connections to managed systems between security zones. Users don't connect from their desktops to the managed systems. This arrangement avoids leaving credentials on desktops and avoids opening ports into secure networks. The application server includes a proxy. You can install the Proxy Service on another server to add a service node. You must also install it on any server that runs another remote service. See Install services on additional servers.

Before you begin

• Find the NPS.ProxyService.exe installer in the Extras folder of the product zip file. See Installation package contents.
• Check the host requirements in Additional service node and proxy server requirements, and the ports in Ports.
• Set the antivirus exclusions. See Exclusions for Antivirus (AV) & Endpoint Software.
• Sign in to both servers as an administrator.

The examples use these placeholders. Replace them with your values.

Placeholder	Meaning
<nps-server>	FQDN of the application server
<nps-server-ip>	IP address of the application server
<proxy-server>	FQDN of the remote proxy server
<proxy-server-ip>	IP address of the remote proxy server
<proxy-install-dir>	Folder where the Proxy Service is installed on the remote server

Install the Proxy Service

1. Copy NPS.ProxyService.exe to the remote server.
2. Right-click the installer and select Run as administrator. The setup wizard opens.
3. Accept the license terms.
4. To change the install location, click Options, click Browse, select a folder, and click OK.
5. Click Install.
6. When the installation completes, click Close.

The installer places the Proxy Service in the ProxyService folder under C:\Program Files\Stealthbits\PAM, so sbpam-proxy.exe is in C:\Program Files\Stealthbits\PAM\ProxyService. The installer adds Windows Firewall rules for ports 4422, 4489, and 6520 to 6525.

Open services.msc and confirm the Proxy Service is running and set to start automatically.

Register the remote Proxy Service

Registration has two parts. On the application server, you describe the server in sbpam_node.json and get the certificate authority hash. On the remote server, you describe that server and register it with the hash.

Prepare the application server

Run these commands as administrator on the application server.

1. Create the file C:\ProgramData\Stealthbits\PAM\ProxyService\sbpam_node.json with the names and addresses the proxy advertises:

   {
     "advertise": ["<nps-server>", "<nps-server-ip>"],
     "tag": []
   }

2. If the certificate file already exists, delete it so Privilege Secure regenerates it with the new values:

   del C:\ProgramData\Stealthbits\PAM\tls\certs\sbpam-node.crt

3. Get the certificate authority hash:

   "C:\Program Files\Stealthbits\PAM\ProxyService\sbpam-proxy.exe" register ca-hash

4. Copy the hash that the command returns. You need it on the remote server.

Register the remote server

Run these commands as administrator on the remote proxy server.

1. Create C:\ProgramData\Stealthbits\PAM\ProxyService\sbpam_node.json with the remote server's values:

   {
     "advertise": ["<proxy-server>", "<proxy-server-ip>"],
     "tag": []
   }

2. If sbpam-node.crt exists at C:\ProgramData\Stealthbits\PAM\tls\certs, delete it.

3. In a command prompt that you opened as an administrator, register the server:

   "<proxy-install-dir>\sbpam-proxy.exe" register -s <nps-server-ip> -u <domain>\<nps-admin> -H <ca-hash>

   For example:

   "C:\Program Files\Stealthbits\PAM\ProxyService\sbpam-proxy.exe" register -s 203.0.113.10 -u example\nps-admin -H <ca-hash>

   • -s is the application server address.
   • -u is a Privilege Secure administrator in domain\user format.
   • -H is the hash from the application server.

   If the -s address has no port, the command connects on port 6520.

   Instead of a username and password, you can register with a bootstrap join token. Add -t <join-token> to the command, or set the SBPAM_JOIN_TOKEN environment variable. Get the token from the console. With a token, the command skips the user name and password prompts.

   "C:\Program Files\Stealthbits\PAM\ProxyService\sbpam-proxy.exe" register -s 203.0.113.10 -t <join-token>

The Proxy Service is now registered. Confirm it appears on the Service Nodes page of the console.

Allow legacy SSH algorithms

To connect to older SSH devices, such as legacy Cisco devices, see Configure SSH algorithms.

Change the proxy settings

To change the SSH or RDP proxy behavior, the connection string separators, or the proxy log, see Proxy settings reference.