Admin passwords in a spreadsheet. A contractor who still has SSH access six months after the project ended. A DROP TABLE in production that nobody can attribute. If any of that sounds familiar, you have a privileged access problem, and the tool category built for it is PAM: Privileged Access Management.
This post explains what a PAM actually does, how it differs from a password manager, an IAM or a SIEM, which regulations ask for it, and what to look for if you want a free, self-hosted one.
What a PAM does
Privileged accounts (root, Administrator, postgres, service accounts, SSH keys, cloud credentials) are the accounts an attacker wants: with them you can stop systems, encrypt data or erase your tracks. They are also the accounts most often shared between staff, contractors and scripts.
A PAM sits between people and systems so that:
- nobody needs to know those passwords,
- every access is justified, approved and time-limited,
- there is evidence of what was done.
The building blocks
| Block | What it does |
|---|---|
| Credential vault | Stores passwords, SSH keys, tokens and cloud credentials encrypted. Ideally the user never sees them. |
| Just-in-time (JIT) access | Access is granted for a limited time, after a request with a reason and approval by someone else. |
| Session proxy / gateway | Sits in the middle of SSH, RDP, database or Kubernetes connections and injects the credential without handing it over. |
| Recording and monitoring | Records sessions, indexes commands and lets you watch them live or cut them. |
| Command policies | Blocks or alerts on dangerous commands or SQL statements. |
| Credential rotation | Changes passwords and keys periodically or after each use. |
| Audit trail | Logs every access, approval and secret use in a way that cannot be altered. |
PAM vs password manager vs IAM vs SIEM
- A password manager stores credentials but usually shows them to the user and does not control or record what happens next.
- An IAM or directory (Active Directory, Entra ID, Okta) manages identities and sign-in; it does not control the session inside the server.
- A SIEM collects and correlates logs to detect incidents. It receives PAM events, but it does not control access.
- A PAM decides and controls privileged access and keeps the evidence. In practice you use it together with your directory and your SIEM.
Which regulations ask for it
- NIS2 (article 21) and Implementing Regulation (EU) 2024/2690: access control, management of privileged rights and activity logging.
- DORA and Delegated Regulation (EU) 2024/1774: identity management and access control for financial entities.
- ISO/IEC 27001:2022: controls 8.2 (privileged access rights), 8.5 (secure authentication) and 8.15 (logging).
- In Spain, the ENS (RD 311/2022): op.acc access-control measures and op.exp.8 activity logging.
No tool certifies compliance on its own; it provides the technical measures and the evidence.
Choosing a PAM: a checklist
- Where does it run: on your servers or as the vendor's SaaS?
- Which protocols: SSH, RDP, VNC, databases, Kubernetes, cloud?
- Does the user ever see the credential, or is it injected?
- Browser access without installing anything?
- Licensing: per user, per target, per server or flat?
- Is the audit trail tamper-evident, and can you forward it to your SIEM?
- How many components does it take to install and upgrade?
Free self-hosted options
There are three families:
- Open source projects such as JumpServer (GPLv3). Large community; some connectors (native RDP, database and VNC proxies) are Enterprise-only.
- Free editions of commercial products such as Teleport Community Edition. Since v16 its binaries are free for companies under 100 employees and under US$10M in annual recurring revenue.
- Self-hosted PAMs with an unlimited Community edition, where you pay for high availability and support rather than per user.
Full disclosure: we build one of the third kind, SIEM Compliance PAM. It is a single Linux binary with data in PostgreSQL: AES-256-GCM vault (master key in a file, HSM, HashiCorp Vault or AWS KMS), just-in-time access with approval and Jira/ServiceNow change tickets, SSH/PostgreSQL/MySQL/Kubernetes proxies, browser terminal, SQL client and recorded RDP/VNC desktop, command and SQL policies, password rotation, LDAP/OIDC/SCIM and FIDO2/TOTP, and a SHA-256 hash-chained audit trail with RFC 3161 timestamps. The Community edition is free with no limit on users, targets or sessions; the subscription (1,200 EUR/year per installation) adds multi-node high availability, SLA support and updates.
If you want to try it: download without registration. Comparisons with CyberArk, Teleport and JumpServer are on our site.
Whatever you pick, the first step is the same: list every privileged account you have, and who can use it. You will probably be surprised.
Top comments (0)