CyberArk PSM for SSH Upgrade Guide 2026: Complete Step-by-Step Privileged Session Manager for SSH Upgrade Process

• July 16 2026

CyberArk PSM for SSH Upgrade Guide 2026: Complete Step-by-Step Privileged Session Manager for SSH Upgrade Process

Estimated Reading Time: 12–15 Minutes

Privileged access to Linux and Unix systems remains one of the most critical areas of enterprise security. Organizations running CyberArk Privileged Access Manager (PAM) rely on Privileged Session Manager for SSH (PSM for SSH) to securely isolate, monitor, and record SSH sessions without exposing privileged credentials to end users.

As organizations adopt newer versions of CyberArk PAM, upgrading PSM for SSH becomes an essential maintenance activity to ensure compatibility, security compliance, and supportability across the entire CyberArk ecosystem.

This guide walks through the complete CyberArk PSM for SSH upgrade process, including prerequisites, installation preparation, standard upgrades, upgrading from Idaptive/Idira SSHD mode, post-upgrade validation, SELinux considerations, and credential updates.

Why Upgrade CyberArk PSM for SSH?

---

What is CyberArk PSM for SSH?

CyberArk PSM for SSH acts as a secure proxy between administrators and target Unix/Linux systems. Instead of connecting directly to servers, users authenticate through the PSM for SSH server, allowing organizations to:

• Record privileged SSH sessions.
• Enforce centralized access policies.
• Eliminate direct credential exposure.
• Enable session monitoring and auditing.
• Support enterprise compliance initiatives.

In large environments, PSM for SSH is often deployed alongside Vault, PVWA, CPM, and traditional Windows-based PSM components to provide comprehensive privileged access coverage.

---

Before Upgrading PSM for SSH

Before initiating the upgrade process, verify all prerequisites and validate the existing environment.

 

 

 

 

 

 

 

---

Important OpenSSH Notice

CyberArk administrators should pay special attention to changes introduced in OpenSSH 7.1 and later.

---

Verify Operating System Support

PSM for SSH supports multiple Linux distributions. Prior to upgrading, ensure your operating system is supported.

Always verify support against the CyberArk compatibility matrix before proceeding.

---

Verify Package Digital Signature

CyberArk RPM packages are digitally signed to prevent tampering.

Import the CyberArk public key:

rpm --import RPM-GPG-KEY-CyberArk

Validate the package:

rpm -K -v CARKpsmp-.rpm

Verifying package signatures is considered a best practice in production environments and should be included in all enterprise change procedures.

---

Licensing Requirements

PSM for SSH installations require a valid CyberArk license.

Without a valid license, PSM for SSH installation and upgrades cannot be completed successfully.

---

Required Vault Permissions

The Vault user performing the installation or upgrade should possess the following permissions:

Additionally, the account must be an owner of the PVWAConfig Safe with:

• List Accounts
• Retrieve Accounts
• View Owners
• Manage Safe Owners

---

Enable SELinux Before Installation

CyberArk recommends enabling SELinux before installing or upgrading PSM for SSH.

Install the required package:

yum install -y policycoreutils-python-utils

If SELinux is enabled after installation, additional post-installation activities may be required.

---

Prepare the Installation Environment

Create a dedicated directory for installation files.

mkdir -p /opt/CARKpsmp

Copy the following into the directory:

---

Disable NSCD

CyberArk recommends disabling NSCD to prevent unexpected authentication behavior.

Stop the service:

systemctl stop nscd.service nscd.socket

Disable it permanently:

systemctl disable nscd.service nscd.socket

---

Standard PSM for SSH Upgrade Procedure

Log in to the PSM for SSH server as the root user.

RPM-Based Systems

rpm -Uvh CARKpsmp--.x86_64.rpm

Ubuntu/Debian Systems

dpkg -i CARKpsmp-..deb

---

Finalize the Vault Environment

Create the credential file:

/opt/CARKpsmp/bin/createcredfile user.cred

Run the finalize command:

/opt/CARKpsmp/bin/psmp_setup.sh --finalize --credfile user.cred

Upon successful completion:

• PSM for SSH services start automatically.
• Vault objects are updated.
• Configuration changes are applied.

If issues occur, review:

/var/opt/CARKpsmp/temp/psmp_setup.log

---

Restart Services

If SELinux is enabled:

systemctl restart sshd

On the PVWA server:

iisreset

Alternatively, wait for the PVWA configuration refresh interval to complete.

---

Upgrading from Idaptive (Idira) SSHD Mode

Organizations upgrading from Idaptive SSHD mode should perform additional cleanup activities.

Remove the Parameter

Edit:

/var/tmp/psmpparms

Remove:

InstallCyberArkSSHD

---

Reinstall OpenSSH

yum erase openssh openssh-server openssh-clients

yum install openssh openssh-server openssh-clients

---

Remove Legacy Users

Delete the following accounts:

Example:

userdel -r PSMConnect

Also remove associated home directories.

---

Remove Legacy Groups

Delete:

groupdel PSMConnectUsers

Finally, perform the upgrade:

rpm -U CARKpsmp-.rpm

---

Validate Services After Upgrade

Verify PSM for SSH services are running.

RHEL 7 / SUSE

service psmpsrv status

RHEL 8+

systemctl status psmpsrv-*

Review logs:

---

Enable SFTP Support

During hardening, the SFTP subsystem may be disabled.

Edit:

/etc/ssh/sshd_config

Uncomment:

Subsystem sftp /usr/libexec/openssh/sftp-server

Restart SSHD after making changes.

---

Repairing a PSM for SSH Installation

If installation corruption or package issues occur, use the force upgrade option:

rpm -Uvh --force CARKpsmp--.x86_64.rpm

This can be particularly useful in lab environments or during interrupted upgrades.

---

Reset PSM for SSH Credentials

If upgrading from versions earlier than 12.2, administrators may need to recreate credential files.

Affected accounts include:

Example:

./CreateCredFile psmpappuser.cred Password \
-Username  \
-Password  \
-OSUsername root \
-AppType PSMPApp \
-ExePath /opt/CARKpsmp/bin/psmpserver \
-EntropyFile

Modern CyberArk versions automatically perform these updates when:

• UpdateCredFile = Yes
• UpdateCredFile = Inferred
• ADBridgeUpdateCredFile = Yes
• ADBridgeUpdateCredFile = Inferred

---

Best Practices for Production Upgrades

---

Final Thoughts

CyberArk PSM for SSH upgrades are relatively straightforward when proper planning and prerequisite validation are performed. Paying close attention to OpenSSH changes, SELinux configurations, credential updates, and service validation ensures a smooth and secure upgrade experience.

For enterprise deployments, always document rollback procedures, validate compatibility across all PAM components, and execute upgrades during approved maintenance windows.

---

📖 Read the Complete CyberArk Upgrade Handbook

CyberArk PAM Self-Hosted Upgrade Guide 2026 – Complete Vault, DR, Cluster & Distributed Upgrade Handbook

Whether you are a CyberArk Engineer, PAM Architect, or Security Consultant, this comprehensive guide explains how real enterprise CyberArk upgrades are planned and executed safely in production environments.

Additional Upgrade Guides

• CyberArk PVWA Upgrade Guide 2026 – Complete Step-by-Step Upgrade Process
• CyberArk CPM Upgrade Guide 2026 – Complete Step-by-Step Central Policy Manager Upgrade Process
• CyberArk PSM Upgrade Guide 2026 – Complete Step-by-Step Privileged Session Manager Upgrade Process
• CyberArk PAM Self-Hosted Upgrade Guide 2026 – Complete Vault, DR, Cluster & Distributed Upgrade Handbook

---

Continue Your CyberArk Learning Journey

Advance your CyberArk skills with hands-on, enterprise-focused training:

• CyberArk Full Training Program
• CyberArk Instructor-Led Training
• CyberArk Privilege Cloud (CPC) Self-Paced Online Training

SecApps Learning helps cybersecurity professionals build real-world CyberArk expertise through enterprise-grade labs, instructor-led training, certification preparation, and production-focused upgrade workshops.