OT/ICS Session Manager Connection

OT/ICS Session Manager sessions use an SSH tunnel to forward TCP traffic from the operator's local machine through Kron PAM to the target device.

Example Command:

ssh -N -L [Local_Port]:[Target_IP]:[Target_Port] [PAM_User]@[PAM_IP] -p [PAM_SSH_Port]

· Local Port: The port on the user's machine used to access the application.

· Target IP/Port: The destination address in the OT/IT environment.

· PAM Gateway: The Kron PAM server acting as the proxy.

After the tunnel is authenticated, connect the application to localhost:[Local_Port].

When a connection approval workflow covers the session, the tunnel opens as usual, but Kron PAM blocks forwarded connections until a valid approval or connection reservation allows access. See "Requiring Managerial Approval for OT/ICS Sessions".

If multitenancy is enabled, include the tenant in the user name, for example ssh -L [Local_Port]:[Target_IP]:[Target_Port] [PAM_User]@[Tenant]@[PAM_IP] -p [PAM_SSH_Port].

When multi-factor authentication covers the session, Kron PAM requests a one-time password before it forwards traffic to the target device. See "Using MFA for OT/ICS Sessions".