TigerTrust’s PAM engine (TigerAccess ) is a Go implementation modelled on Teleport. It ships four binaries built from one module — you install the ones your role needs.
Unlike CLM (one agent), PAM has different components for the server side , admin operators , end users , and machines . Install per role.
The four PAM binaries Binary Role Runs on Analogue tigeraccess-serverSession broker + proxy daemon A hardened host or K8s pod in your infrastructure Teleport teleport tash-adminAdmin CLI — resources, roles, joins Operator workstations Teleport tctl tashEnd-user CLI — ssh, kube, db, rdp Developer / SRE workstations Teleport tsh tbotMachine-identity bot — short-lived creds for services Any host that needs to auth as a machine Teleport tbot
The server owns the runtime channel work: it opens SSH, K8s exec, DB proxy, RDP, and web-app sessions, records keystrokes, streams events for playback, mediates joins for live moderation, and mints short-lived credentials via tbot.
1. Install the PAM server (proxy) tigeraccess-server is the only PAM component that accepts inbound connections. Deploy it on a host that can reach:
Your TigerTrust auth-service (backend API) — outbound HTTPS
The resources it will proxy — SSH, DB, K8s, RDP, HTTP endpoints
systemd (Linux)
Docker
Kubernetes
curl -sSf https://releases.tigertrust.io/tigertrust-pam/server | \ TT_API_URL = https://api.tigertrust.io \ TT_WORKSPACE_ID=wsp_xxx \ TT_JOIN_TOKEN=jt_xxx \ sh sudo systemctl enable --now tigeraccess-server
docker run -d --name tigeraccess-server \ -p 3080:3080 -p 3022:3022 -p 3025:3025 \ -e TT_API_URL=https://api.tigertrust.io \ -e TT_WORKSPACE_ID=wsp_xxx \ -e TT_JOIN_TOKEN=jt_xxx \ ghcr.io/tigertrust/tigeraccess-server:latest
helm repo add tigertrust https://charts.tigertrust.io helm upgrade --install tigeraccess-server tigertrust/tigeraccess \ --namespace tigeraccess --create-namespace \ --set apiUrl=https://api.tigertrust.io \ --set workspaceId=wsp_xxx \ --set joinToken=jt_xxx
Ports opened by the server:
Port Purpose 3080Web UI + REST 3022SSH proxy 3025Auth service (mTLS between server and admin tools) 3028DB proxy (Postgres, MySQL, Mongo) 3026Kubernetes API proxy
The PAM server must be network-reachable by end users and by resources it brokers to. Do not expose the auth port (3025) beyond tash-admin operators.
Enroll resources (SSH hosts, K8s clusters, DBs, RDP) Resources join the server using a join token minted via tash-admin:
tash-admin tokens add --type=node --ttl=15m # → jt_yyy # On the resource host: curl -sSf https://releases.tigertrust.io/tigertrust-pam/node | \ TT_JOIN_TOKEN = jt_yyy sh
The joined host runs a lightweight PAM node agent that dials back to tigeraccess-server — no inbound ports on the target.
2. Install tash (end-user CLI) Developers use tash for ssh, kube, db, and rdp sessions.
Homebrew (macOS/Linux)
apt (Debian/Ubuntu)
Windows (Scoop)
brew install tigertrust/tap/tash tash login --proxy=pam.tigertrust.example
sudo apt-get install tash tash login --proxy=pam.tigertrust.example
scoop bucket add tigertrust https: // github.com / tigertrust / scoop scoop install tash tash login -- proxy = pam.tigertrust.example
tash ssh alice@web-01 # brokered SSH with recording tash kube login prod-cluster # short-lived kubeconfig tash db login postgres-primary # short-lived DB creds tash rdp windows-jump-01 # RDP session with recording
3. Install tash-admin (admin CLI) tash-admin manages resources, roles, access lists, and joins. Install on operator workstations; requires pam_admin on the workspace.brew install tigertrust/tap/tash-admin # or: apt-get install tash-admin tash-admin login --proxy=pam.tigertrust.example tash-admin resources ls tash-admin roles ls tash-admin sessions join sess_xxx # live moderation
4. Install tbot (machine-identity bot) tbot runs on machines (CI runners, workload pods, batch jobs) that need short-lived credentials.# systemd sudo tbot install --token=jt_machine_xxx --proxy=pam.tigertrust.example sudo systemctl enable --now tbot # Kubernetes kubectl apply -f https://releases.tigertrust.io/tigertrust-pam/tbot.yaml
tbot writes rotating credentials to a destination — a file, a Kubernetes secret, or an SPIFFE workload API socket — that your workload consumes without ever handling long-lived secrets.5. (Optional) Install the Kubernetes operator The TigerAccess Operator reconciles TigerAccessRole, TigerAccessResource, and TigerAccessAccessList CRDs against the backend — GitOps for PAM.
kubectl apply -f https://releases.tigertrust.io/tigertrust-pam/operator.yaml
See the tigeraccess-operator README for CRD schemas and reconciliation details.
PAM overview How resources, roles, sessions, and approvals fit together.
Sessions Brokering, recording, live moderation, and playback.
Access requests Just-in-time elevation with approvals.
Roles and bindings Label-based access control across all resource kinds.
