Unfortunately, disconnecting a Privilege Secure session inside a remote connection manager will lead to deprovisionig it. How you guys handle this scenario to improve administrator adoption and overall usability?
You could start the session in the WebUI first and then use the direct connect to attach to the existing session. Since the direct connect didn’t start the session it won’t close it at the end. This is a work-around, there is also the ability to turn the “DisconnectSession” off in the NPS server settings.
This is a per Proxy Service setting (so if you have more than proxy, you will need to update the files on all servers).
It is also set per protocol (SSH/RDP)
In the ProxyService configuration files sbpam_ssh.json and sbpam_rdp.json found in the following directory: C:\ProgramData\Stealthbits\PAM\ProxyService
NOTE the above files may not exist, to create the defaults run the following command from a command prompt running as Administrator: "'C:\Program Files\Stealthbits\PAM\ProxyService\sbpam-proxy.exe' cfg -c sbpam_ssh
‘C:\Program Files\Stealthbits\PAM\ProxyService\sbpam-proxy.exe’ cfg -c sbpam_rdp
Either add or update the DisconnectSession setting to false (it is true by default).
If you had to create the default, then your sbpam_ssh.json file should look like this:
{
"listenaddress": "0.0.0.0:4422",
"DisconnectSession": false
}
and your sbpam_rdp.json file should look like this:
{
"limitcolordepth": false,
"listenaddress": "0.0.0.0:4489",
"startuptimeout": "30s",
"twofactorseparator": ",",
"DisconnectSession": false
}
If you are unsure if your JSON file is syntactically correct, you can run the following command in PowerShell to validate it:
Get-Content C:\ProgramData\Stealthbits\PAM\ProxyService\sbpam_rdp.json | ConvertFrom-Json
If you have valid JSON you will see:
limitcolordepth : False
listenaddress : 0.0.0.0:4489
startuptimeout : 30s
twofactorseparator : ,
DisconnectSession : False
However if you did like I did when testing this out and forgot your comma after "twofactorseparator", you will see this!
ConvertFrom-Json : Invalid object passed in, ':' or '}' expected. (126): {
"limitcolordepth": false,
"listenaddress": "0.0.0.0:4489",
"startuptimeout": "30s",
"twofactorseparator": ","
"DisconnectSession": false
}
At line:1 char:32
+ Get-Content .\sbpam_rdp.json | ConvertFrom-Json
+ ~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [ConvertFrom-Json], ArgumentException
+ FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.ConvertFromJsonCommand
