Privileged Access Management

PAM is a production-grade privileged access platform in the same category as CyberArk, HashiCorp Boundary, or Teleport — built to replace static SSH keys with short-lived certificates, recorded sessions, and auditable just-in-time access.

A public demo is coming soon. Until then, this page covers what the system does and the stack behind it.

I am preparing an interactive demo of the control plane, terminal gateway, and certificate-based SSH flow. Check back shortly — or reach out via the contact page if you want an early walkthrough.

Short-lived SSH certificates

An internal SSH Certificate Authority issues time-bound credentials instead of relying on long-lived static keys, shrinking the blast radius of stolen credentials.

Session recording & audit

PTY capture records interactive sessions for replay. Audit trails include tamper-detection so compliance review is not trust-on-faith.

JIT provisioning

Users are provisioned on target hosts just-in-time for approved access windows, then cleaned up — no permanent local accounts left behind.

Identity & passwordless auth

Okta SSO plus WebAuthn/FIDO2 integrate enterprise identity with phishing-resistant authentication for operators.

Agent-based host enforcement

Host agents enforce certificate trust and access policy on targets. A WebSocket terminal gateway brokers browser and CLI sessions through the control plane.

Control plane

Next.js + TypeScript web app for policy, approvals, session visibility, and operator workflows. PostgreSQL for durable state; Redis for ephemeral session and job coordination.

Workers & CLIs

Background workers handle audit publishing, session intelligence, and notifications. Operator tooling includes a Go CLI (pamssh) and a Node.js access CLI with streamlined installers.

Deployment

Production deployment uses Docker Compose, PM2 process management, and agent rollout for host enforcement — built as infrastructure, not a demo script.

Next.js · TypeScript · PostgreSQL · Redis · SSH2 · WebAuthn/FIDO2 · Okta/OIDC · Go · WebSockets · Docker Compose · PM2

PAM sits inside a broader self-hosted security and platform stack I operate: Wazuh for SIEM/telemetry, Step-CA for internal PKI, WireGuard admin for remote access, honeypot sensors for attack signal, and an AI platform for private model workflows — plus this portfolio and its admin CMS.

Those systems are complementary operators of the same production environment: identity, network, detection, and application delivery under one roof.

This project bridges systems administration, security engineering, and full-stack development. It is the kind of control plane enterprises buy from CyberArk or Teleport — implemented end-to-end as a production system with certificates, recording, identity, and host agents.