CyberArk PSM for SSH Installation Guide (2026 Complete Tutorial)

• May 18 2026

CyberArk PSM for SSH Installation Guide (2026 Complete Tutorial)

Introduction to CyberArk PSM for SSH

Modern enterprises heavily rely on Linux servers, Unix systems, network devices, cloud infrastructure, and SSH-based administrative access for daily operations. Securing privileged SSH sessions has become one of the most important requirements in cybersecurity and privileged access management.

This is where CyberArk Privileged Session Manager for SSH (PSM for SSH or PSMP) becomes critical.

CyberArk PSM for SSH enables organizations to:

■ Secure privileged SSH access
■ Monitor privileged Unix/Linux sessions
■ Isolate administrators from direct target access
■ Record and audit SSH sessions
■ Enforce least privilege access
■ Prevent credential exposure
■ Centralize SSH access control

PSM for SSH acts as a secure gateway between administrators and target systems.

In this detailed CyberArk PSMP installation guide, we will cover:

■ What is PSM for SSH
■ PSMP architecture
■ Pre-installation tasks
■ Linux package installation
■ Vault registration
■ vault.ini configuration
■ SELinux integration
■ LDAP integration
■ Credential file creation
■ Troubleshooting installation issues
■ PSMP environment in Vault
■ Hardening best practices
■ Uninstallation process
■ Real-time enterprise scenarios

If you are preparing for:

■ CyberArk implementation projects
■ PAM administration roles
■ CyberArk certifications
■ Linux privileged access management
■ Real-time enterprise deployments

then understanding PSM for SSH installation is extremely important.

You can also explore these advanced CyberArk architecture guides:

■ CyberArk Vault Deep Dive Architecture Guide
■ CyberArk Distributed Vaults Environment Explained
■ CyberArk Digital Vault Cluster Environment Guide
■ CyberArk Tutorial for Beginners

---

What is CyberArk PSM for SSH?

Understanding PSM for SSH

CyberArk Privileged Session Manager for SSH is a Linux-based session management solution that enables organizations to securely manage SSH access to target systems.

Instead of administrators connecting directly to Linux servers, they connect through the PSMP server.

This architecture provides:

■ Session isolation
■ Credential protection
■ Command auditing
■ Session recording
■ Centralized authentication
■ Secure privileged access

---

How PSM for SSH Works

Basic Workflow

The workflow is simple but highly secure.

Step 1: User Authentication

The user authenticates through CyberArk.

---

Step 2: Connection Through PSMP

The SSH session is routed through the PSM for SSH server.

---

Step 3: Credential Injection

CyberArk injects credentials securely without exposing passwords to end users.

---

Step 4: Session Monitoring

The session is monitored and optionally recorded.

---

Step 5: Secure Access to Target

The administrator accesses the Linux or Unix target securely.

---

CyberArk PSM for SSH Architecture

Components in PSMP Architecture

Component	Purpose
Vault	Stores privileged credentials
PVWA	Web portal access
PSMP	SSH session proxy
Target Systems	Linux/Unix devices
CPM	Password rotation
LDAP/Radius	Authentication integration

---

Why Organizations Use PSM for SSH

Organizations use PSMP because direct SSH access creates multiple security risks.

Common SSH Security Risks

Risk	Description
Shared root passwords	Multiple admins know credentials
No auditing	Difficult to track activities
Hardcoded SSH keys	Security exposure
No session recording	No compliance evidence
Privileged misuse	Insider threats

CyberArk solves these problems using centralized privileged session management.

---

PSM for SSH Installation Methods

CyberArk installs PSM for SSH in two stages.

---

Stage 1: Package Installation

The installation package is installed using:

RPM Installation

For:

■ Red Hat
■ Rocky Linux
■ SUSE Linux

---

DEB Installation

For:

■ Ubuntu

---

Stage 2: Vault Registration

After package installation:

■ Register PSMP to Vault
■ Configure environment
■ Start PSMP services

---

PSM for SSH Pre-Installation Tasks

Before installation, multiple prerequisites must be validated.

---

Verify Operating System Compatibility

The first step is validating OS compatibility.

CyberArk supports:

Linux Platform	Supported
Red Hat Enterprise Linux	Yes
Rocky Linux	Yes
SUSE Linux	Yes
Ubuntu	Yes

---

Verify Digital Signature of Installation Package

CyberArk RPM packages are digitally signed.

This protects packages against tampering.

---

Import CyberArk Public Key

rpm --import RPM-GPG-KEY-CyberArk

---

Verify Package Signature

rpm -K -v 

---

Verify PAM Component Compatibility

Ensure all CyberArk components are version compatible.

Important components include:

■ Vault
■ PVWA
■ CPM
■ PSM
■ PTA
■ PSMP

Version mismatch can create installation failures.

---

CyberArk License Requirements

Your CyberArk license must support PSMP.

The license defines:

User Type	Interface
PSMPServer	PSMPApp

Without the correct license:

PSM for SSH installation will fail

---

LDAP Integration with PSMP

Optional LDAP Integration

CyberArk supports LDAP integration for:

■ User provisioning
■ Group synchronization
■ Authentication

This simplifies enterprise user management.

---

Required Vault Permissions for Installation User

The Vault user performing installation must have:

■ Add Safes
■ Audit Users
■ Add/Update Users
■ Manage Server File Categories

---

PVWAConfig Safe Permissions

The user must also own:

PVWAConfig Safe

with:

■ List accounts
■ Retrieve accounts
■ View owners
■ Manage safe owners

---

Create Administrative User on PSMP Server

Administrative users are required for:

■ Maintenance
■ Troubleshooting
■ Local administration

These users bypass forwarding to target systems.

---

SELinux Configuration for PSMP

CyberArk strongly recommends enabling SELinux before installation.

---

Install Required SELinux Package

yum install -y policycoreutils-python-utils

This is mandatory on:

■ Red Hat
■ Rocky Linux

---

Prepare Installation Environment

Create Installation Directory

Example:

/opt/CARKpsmp

Copy all installation files into this directory.

---

Disable NSCD

CyberArk recommends disabling NSCD to avoid caching conflicts.

---

Stop NSCD

systemctl stop nscd.service nscd.socket

---

Disable NSCD

systemctl disable nscd.service nscd.socket

---

PSM for SSH Installation Process

Install RPM Package

Installation Command

rpm -i CARKpsmp-..rpm

---

Sudo Installation

sudo rpm -i CARKpsmp-..rpm

---

Install DEB Package

Ubuntu Installation

dpkg -i CARKpsmp-..deb

---

Helpful RPM Switches

Verbose Installation

-v

Displays detailed output.

---

Hash Display

-h

Displays installation progress.

---

Successful Installation Message

After installation:

Installation process was completed successfully

---

Configure vault.ini for PSMP

Purpose of vault.ini

The vault.ini file defines how PSMP communicates with the Vault.

---

Configure Vault Address

Example:

Address=1.1.1.102

---

High Availability Configuration

For DR or HA:

Address=1.1.1.102,1.1.1.232

PSMP automatically switches to the next Vault if connectivity fails.

---

Configure TLS Communication

CyberArk Vault version 14+ supports TLS.

---

Required Parameters

Parameter	Value
VaultCommunicationProtocol	TLS
TLSVersions	TLS_1_2
TLSPort	443
VaultCertificateStore	Certificate Path

---

Create Credential File for Installation

Use createcredfile utility.

---

Command Example

/opt/CARKpsmp/bin/createcredfile user.cred

You will be prompted for:

■ Username
■ Password
■ Entropy file usage

---

Security Recommendation

After creating credentials:

history -c

to clear shell history.

---

Register PSM for SSH with Vault

Run Setup Script

/opt/CARKpsmp/bin/psmp_setup.sh --finalize --vault-ini vault.ini --credfile user.cred

---

Successful Registration Message

PSM for SSH service instance registered in Vault and enabled

---

Important Log Files

If issues occur, review:

Log File	Purpose
psmp_install.log	Installation activities
EnvManager.log	Vault environment creation
psmp_setup.log	Setup execution
PSMPConsole.log	Runtime logs

---

Common PSMP Installation Issues

Missing Parameter File

Error

installation parameters file doesn't exist

---

Solution

Ensure:

/var/tmp/psmpparms

exists.

---

TCP Port 18923 Already in Use

Problem

Another process uses port 18923.

---

Solution

Use:

netstat -na

Then modify PSMP port configuration.

---

Root SSH Access Denied

CyberArk hardening disables remote root password authentication.

---

Allowed Methods

■ SSH key authentication
■ Maintenance user login

---

SELinux Connection Error

Example Error

PDKOS106E Failed to connect to the server domain socket

---

Cause

SELinux enabled after installation.

---

Solution

Enable PSMP SELinux support properly.

---

Restore PSM for SSH Connectivity

Sometimes PSMP loses Vault connectivity.

---

Common Causes

■ Network failures
■ Credential sync issues
■ Vault communication failures

---

Reset PSMP Credentials

Change passwords for:

■ appuser
■ gwuser
■ adbuser

Then recreate credential files.

---

Example Command for appuser

/opt/CARKpsmp/bin/createcredfile psmpappuser.cred

---

Post-Installation Tasks

Verify Services

RHEL8 Service Check

systemctl status psmpsrv-psmpadbserver

---

Delete Installation Files

Recommended cleanup:

■ user.cred
■ vault.ini

---

Integrate Radius Authentication

PSMP supports Radius integration for MFA-based authentication.

---

Harden the PSM for SSH Server

CyberArk automatically hardens:

■ Red Hat Linux

Manual hardening required for:

■ SUSE Linux

---

Enable SFTP Server

Edit:

sshd_config

Remove # from:

Subsystem sftp /usr/libexec/openssh/sftp-server

---

PSM for SSH Environment

Important Directories

Folder	Purpose
/opt/CARKpsmp	Application files
/etc/opt/CARKpsmp	Configuration
/var/opt/CARKpsmp	Logs and runtime

---

Safes Created During Installation

CyberArk automatically creates multiple Safes.

---

PSMPConf

Stores internal PSMP logic files.

---

PSMPLiveSessions

Stores live session data.

---

PSMPNotifications

Stores communication files.

---

PSMPADBUserProfile

Stores user profile configurations.

---

Vault Users Created During Installation

Users Created

■ PSMPAppUser
■ PSMPGWUser
■ ADBridge Users

---

PSMP Registration Tool

Registration Command

/opt/CARKpsmp/bin/envmanager "CreateEnv"

---

Recommended Best Practice

Use unique usernames:

PSMPAppUser_PSMP1
PSMPGWUser_PSMP1

to prevent overwriting installations.

---

Uninstalling PSM for SSH

Remove PSMP Environment from Vault

Command

/opt/CARKpsmp/bin/envmanager "TeardownEnv"

---

Remove Package from Linux

RPM Removal

rpm -e CARKpsmp

---

DEB Removal

dpkg -r carkpsmp

---

Real-Time Enterprise Example

Banking Industry Scenario

A financial organization manages:

■ 5000+ Linux servers
■ Multiple SSH administrators
■ Root-level privileged access

Without PSMP:

■ Shared root passwords existed
■ No session auditing
■ Compliance failures occurred

After CyberArk PSMP deployment:

■ SSH sessions were monitored
■ Credentials were hidden
■ Full auditing enabled
■ MFA integrated
■ Regulatory compliance improved

---

Best Practices for CyberArk PSMP

Recommended Best Practices

■ Use TLS communication with Vault
■ Enable SELinux before installation
■ Use unique PSMP usernames
■ Regularly rotate credentials
■ Integrate MFA authentication
■ Harden Linux operating system
■ Disable unnecessary services
■ Monitor PSMP logs regularly
■ Configure HA Vault addresses
■ Backup vault.ini configuration

---

Conclusion

CyberArk PSM for SSH is one of the most critical components for securing privileged SSH access in enterprise environments.

It provides:

■ Secure session isolation
■ Credential injection
■ Session monitoring
■ Centralized privileged access
■ Compliance reporting
■ Advanced SSH auditing

Understanding:

■ PSMP installation
■ vault.ini configuration
■ Credential file creation
■ Vault registration
■ SELinux integration
■ Hardening procedures
■ Troubleshooting methods

is essential for every CyberArk engineer and administrator.

As Linux infrastructure continues growing across cloud, DevOps, and enterprise environments, PSM for SSH remains a core security requirement for privileged access management.

---

Learn CyberArk with Real-Time Hands-On Training

Master:

■ CyberArk Vault
■ CPM
■ PSM
■ PSM for SSH
■ DR Architecture
■ Distributed Vaults
■ Linux Integrations
■ Plugin Development
■ Troubleshooting
■ Automation & APIs

through practical implementation-focused training.

Explore more advanced CyberArk guides:

👉 Enroll in CyberArk Full Training Program

Explore more advanced CyberArk guides:

■ CyberArk Vault Deep Dive Guide
■ Distributed Vaults Explained
■ Cluster Vault Architecture Guide
■ CyberArk Beginner Tutorial