Griffin PAM
Privileged access for SSH and RDP with vault, JIT, recording, and audit.
On-prem · SSH + browser RDP · Docker Compose
The gap
Privileged SSH and RDP land directly on hosts with little session evidence, weak approval, and scattered credentials.
What we shipped
An on-prem PAM control plane with vaulted credentials, gated sessions, SSH command policy, and recorded access.
Overview
Griffin PAM is an on-prem privileged access platform: AD/LDAP identity, credential vault, SSH session gateway, browser RDP via Guacamole, approval/JIT workflows, SSH command control, and hash-chained audit. Deployed as a Docker Compose stack.
Who it is for
Security and platform teams that need controlled privileged sessions without sending operators straight to production hosts.
What Griffin PAM does
- Local users plus AD/LDAP authentication, groups, and RBAC
- Asset inventory with tags/groups and AES-GCM credential vault
- SSH access via CLI session gateway and in-browser terminal
- Browser RDP via Guacamole with visual session recording
- Approval workflow, JIT grants, and optional ticket checks
- SSH command policy: allow, log, alert, block, hold, rewrite
- SFTP/SCP with file-transfer policies
- Session kill, live watch, idle timeout
- Hash-chained audit log with search; Splunk HEC and webhook fanout
- TOTP MFA on PAM login
- Docker Compose on-prem stack
Architecture
A control plane evaluates who may reach which asset. SSH traffic goes through a session gateway with local command evaluation. Browser RDP is proxied through Guacamole and can be recorded visually.
- Operator authenticates to Griffin PAM (local or AD/LDAP, optional TOTP).
- Access policy decides allow/deny, time windows, JIT, or ticket requirements.
- SSH sessions terminate on the gateway; commands are classified and scored before forward.
- Browser RDP sessions go through Guacamole; visual recordings are stored as Guacamole session files.
- Session events and a hash-chained audit trail capture actor, asset, and outcome.
Security and recording
Credential vault
Privileged secrets are stored encrypted (AES-GCM). Plaintext passwords are not kept in the database.
Session recording today
SSH uses asciinema-format terminal recordings. Browser RDP uses Guacamole visual recordings with a configurable size cap.
Recording retention (roadmap)
Recordings land on a dedicated volume today. Automatic retention, compression, and deletion policies are designed next — document your own retention until product policy ships.
What we do not claim yet
No OIDC/SAML/passkeys on PAM login. No automatic full-text search inside recordings. Windows account rotation and SSH key rotation are not supported in this pass. Native RDP gateway recording is event JSONL, not visual playback.
Deployment
- Docker Compose: API, dual SSH gateways, RDP gateway, Guacamole, Postgres, Redis, nginx
- On-prem only in the current packaging — not a multi-tenant SaaS
Roadmap (honest)
- Recording retention, compression, and deletion policy
- Stronger native RDP gateway maturity beyond browser Guacamole path
Status
Griffin PAM — on-prem privileged access with SSH/RDP sessions, vault, JIT, and audit.
Stack
- SSH
- RDP
- AD/LDAP
- Vault
- JIT
- Recording
- Docker
Also in the catalog
Ask about this product
Email the company inbox, or reach Mostafa Mizani and Nima Sefatian directly. Tell us which product you want to deploy or extend.