Connecting with Instant Approval

Prerequisite: A connection approval workflow must cover the session, and instant approval must remain enabled. Keep the SSH tunnel interactive so that you can respond to gateway shell prompts.

To connect when no reservation exists:

1. Open the SSH tunnel:

ssh -L [Local_Port]:[Target_IP]:[Target_Port] [PAM_User]@[PAM_IP] -p [PAM_SSH_Port]

2. Connect the application to localhost:[Local_Port]. Kron PAM blocks the forwarded connection and writes the following messages:

KronPAM: [SECURITY] Managerial approval required for TCP Proxy connection. Checking existing reservation...

KronPAM: [SECURITY] Tunnel blocked. Managerial approval required for TCP Proxy connection.

KronPAM: [ACTION REQUIRED] Press ENTER to proceed to approval step.

3. Press ENTER. Kron PAM creates a connection approval request and returns the approval ID.

4. Ask the approver to approve the request from My Approvals, or by email.

5. After the approver approves the request, retry the connection. Kron PAM allows the new forwarded connection. Many clients retry failed connections automatically, so you might not need to retry manually.

When instant approval is disabled and no valid reservation exists, Kron PAM writes the following message and closes the tunnel session:

KronPAM: [ACTION REQUIRED] Instant approval is disabled. Reservation required to proceed. Closing session.

If the approver rejects the request or the request expires, Kron PAM keeps the forwarded connection blocked. Obtain a new approval before you retry access.