Navigate to the address of the PrivX server and log in as superuser.

In the PrivX GUI, navigate to the Settings→Users page and click Add User.

You will be presented with the New User view.

In the New User view, provide the required information about the user. Click Save to save the user.

You should now be able to see your new local user back on the Settings→Users page.

In the PrivX GUI, navigate to the Settings→Roles page, and click Add Role.

You will be presented with a form for providing information about the new role.

Provide a name for the new role. Also add users to the role by defining rules. To define a new rule for the role, click Add Rule. In this example, we add a rule to include all local users who have the user name (cn) alice into the role:

Leave the other role settings as they are.

Click Save to finalize role creation. Your new role should be visible back on the Settings→Roles page.

To verify the users belonging to the role, click List Members:

Log into the PrivX GUI as the test user we created previously (in the section called “Creating Local Users and Roles”).

Navigate to the Connections→Available Hosts page. The hosts you can connect to are listed under Available hosts.

Expand a connection entry to display its available services. In this example, we click the SSH-server service to connect to our test host.

Accept the SSH host key if prompted. Authenticate to the host by providing the password of the target account (not the PrivX account password). You should now be successfully connected to the host.

Create a host-deployment script. To do this, access the PrivX GUI as superuser, then go to the Settings→Deployment→Deploy and Configure SSH Target Hosts page.

Select Configure using a deployment script, provide a name for the script, then click Add Script. Download the deploy.py script when prompted to.

Upload the host-deployment script to the target host. You may do this via the PrivX GUI by connecting to the target host (similarly as in the section called “Connecting to Target Hosts”), and then by navigating to the File Transfers tab.

Execute the host-deployment script as root on the target host.

In the command, use --principals to specify the target accounts and the roles that are allowed to access them. Also add the --standalone option if target host was not added previously using a scan script.

For example, allowing both the target accounts root and johndoe to be accessed by members of Example Role and privx-admin (replace /path/to/deploy.py with the path of the host-deployment script, note that role names with spaces need to be quoted):

# python /path/to/deploy.py --standalone --principals \
root="Example Role",privx-admin:johndoe="Example Role",privx-admin

Configure PrivX to scan the AD server for users. To do this, log into PrivX as superuser (or other privx-admin user). Then on the Settings→Directories page, click Add Directory.

Provide the required AD settings.

Save the directory settings. PrivX automatically connects to the AD server to add any users found with the given settings.

You may verify the AD status back on the Settings→Directories page. After PrivX finishes adding users from the AD, the connection status should display OK, along with the number of users added.

To list the users added from the AD, perform a List Users action on the AD entry.

To grant AD users access to hosts and services, add them to roles (similarly as in the section called “Creating Local Users and Roles”). For example, you can add an additional rule to the Example Role that was created earlier.

AD users may then log into the PrivX GUI and establish SSH/RDP connections. The allowed connection targets are determined by the role(s) assigned to the AD users.

In your AWS, add a policy to allow host scans. To do this, access your AWS and navigate to IAM→Policies, then create a policy with the following JSON:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        }
    ]
}

Create an IAM user with permissions to use the host-scan policy. This can be done on the IAM→Users page.

The IAM user must have Programmatic access, and be attached with the host-scan policy.

Note the Access key ID and the Secret access key of the user. These are required later for configuring PrivX against AWS.

Configure PrivX to scan and add the AWS hosts.

Log into PrivX as superuser (or other privx-admin user). On the Settings→Directories page, click Add Directory.

Fill in the basic information of the directory. To allow PrivX to detect AWS hosts, add the Access key ID and the Secret access key of the IAM user.

You can selectively filter hosts using the Fetch hosts with tag option found under the Advanced directory settings.

Save the directory settings. PrivX begins importing hosts from AWS.

After a moment, you may verify the directory status back on the Settings→Directories page. The Connection should be in the OK state, and list the number of instances found on AWS.

To list the imported hosts, click List Hosts.

You may then Edit hosts to add services and account mappings to them, similarly as in the section called “Adding Target Hosts”.