Admin session recording 7.2.2

This feature allows live monitoring of active privileged sessions between the FortiPAM user and target server. This feature allows FortiPAM admins to monitor user sessions and actions in real time and to force any ongoing sessions to disconnect. When FortiPAM triggers monitoring, the FortiClient PAM agent performs screen capture and uploads it to FortiPAM.

FortiClient uses the Fortivrs deamon to encode the recording videos in livestream format and upload it to the PAM server for native secrets. When the web secrets launch, the FortiPAM browser extension encodes the browser recording video in livestream format and uploads it to the PAM server.

Fortivrs and the browser extension keep the backward compatibility and follow the PAM server control flag to enable or disable the livestream recording.

The following assumes that PAM is already enabled and configured in EMS.

To configure admin session recording:

1. Configure admin session recording in FortiPAM:
   1. Log in to FortiPAM as an administrator.
   2. Go to System > Settings.
   3. Enable Live Recording.
   4. Go to User Management > User Definition.
   5. Create a standard user.
   6. Go to Secrets > Secret List > Create > Personal and select the created user.
   7. Go to Create and configure a PuTTy secret on the PAM server.
   8. Enable Session Recording. Click Submit.
2. Install FortiClient with the PAM agent and register to EMS. In Settings > Advanced, ensure that PAM is enabled. Ensure that the FortiPAM password filler extension is installed in the browser.
3. Log in to FortiPAM as the standard user from the endpoint.
4. Launch the PuTTy secret through web SSH. The web SSH session establishes and the recording begins.

   

5. Log in to FortiPAM as an administrator.
6. Go to Monitoring > Active Sessions. You can only monitor the livestream for active sessions.
7. Select the PuTTy livestream session.
8. Click Monitor to view the livestream. You can minimize or close the livestream window to have the livestream run in the background. FortiPAM terminates the active session when you click Disconnect.