> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Syteca PAM Connection Manager for Linux
> Use the pacm command-line tool to list, inspect, and connect to Secrets directly from a Linux SSH or terminal session — no desktop GUI required.
The **Syteca PAM Connection Manager for Linux** (**PACM**) lets users work with [Secrets](/docs/pam/secrets/view-manage-secrets) directly from Linux SSH and terminal sessions — the same experience as the [Desktop Connection Manager](/docs/pam/access/desktop-connection-manager), but entirely within the terminal, using a single `pacm` command. A user can list the Secrets available to them, view Secret details, request access, and connect to a target system, all without leaving the terminal.
**Use this when you need to:**
* Give Linux/SSH-based administrators PAM access without a GUI or a Windows jump server.
* Let users on a Linux Endpoint browse, request, and use Secrets entirely from the command line.
* Extend recorded, credential-less privileged access to environments that are Linux-first.
Only **SSH/Network Device** (password- or key-based) and **Telnet** Secrets are supported for connection.
Using the PAM Connection Manager requires a **Password Management (PAM) seat license**. See [Assigning PAM seat licenses](/docs/administration/licensing/assign-pam-seat-licenses).
## 1. Prerequisites
Before a user can connect to a Secret with PACM, the following must be in place on the Linux computer running the Connection Manager:
* **For Telnet Secrets:** a Telnet Client installed and configured.
* **For key-based Unix SSH Secrets:** PuTTYgen installed.
If a required component is missing, the connection doesn't happen — see [Connection errors](#connection-errors) below for the exact message.
Additional conditions:
* The **Enable the Syteca PAM Connection Manager** option must be enabled on the Linux Endpoint (see below).
* The user must have a **PAM seat license** assigned.
* The user must have the **Owner**, **Editor**, or **PAM User** permission for each Secret they want to view or use.
* An unlimited number of users can use the Connection Manager on the same Linux Endpoint at the same time.
## 2. Enable the PAM Connection Manager on a Linux Endpoint
PACM is enabled per Linux Endpoint, from the Management Tool.
On the **Endpoints** page, open the Linux Endpoint for editing.
In the **Endpoint Mode** section of the **Editing Endpoint** page, select **Enable the Syteca PAM Connection Manager**.
Save the changes.
**Unchecked by default.** If a Linux Endpoint belongs to an Endpoint group and inherits its settings, and the group has this option enabled, the Endpoint inherits it too.
## 3. Launch the Connection Manager
Run the following command in a Linux SSH or local terminal session:
```bash theme={"system"}
pacm
```
A local Linux user accesses Secrets using the credentials of a [secondary user](/docs/administration/clients/parameters/secondary-user-authentication) (an internal Syteca user or an Active Directory user assigned as the secondary user).
If the option is enabled and a PAM seat license is assigned, the Connection Manager launches with a confirmation message.
| Condition | Message shown |
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| Option disabled on the Endpoint | `Connection Manager is not enabled on this Endpoint.` `Please contact your administrator to gain access to use secrets` |
| No PAM seat license, or no permission to any Secret | `A Password Management seat license is required. Please contact your System Administrator.` |
### Error messages
| Situation | Message |
| ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- |
| Unknown command or unsupported parameters | `Error: Unknown command: ` |
| Launched in a Linux graphical (UI) session instead of SSH/local terminal | `Error: PACM must be run from an SSH session or a local terminal session.` |
| Unexpected internal error (for example, Syteca Server is stopped) | `Error: An internal error occurred while processing the request. Please try again later.` |
## 4. View available commands
```bash theme={"system"}
pacm help
```
## 5. List available Secrets
```bash theme={"system"}
pacm list
```
Shows every **SSH** (password- or key-based) and **Telnet** Secret you have **Owner**, **Editor**, or **PAM User** permission for. Each Secret is shown as:
```text theme={"system"}
ID:
Secret Name:
Host:
Secret Type:
Details:
Password Checkout:
Restrictions:
Record user activity while the secret is in use:
```
Multiple Secrets are separated by an empty line. If none are shared with the secondary user: `No secrets available.`
### Filter the list
```bash theme={"system"}
pacm list --filter
```
* Matches the **ID**, **Secret Name**, **Host**, **Secret Type**, and **Details** fields — a Secret is included if the filter value matches at least one field.
* Matches as a **substring**, not a full match (`--filter test` matches `test-db`, `testware`, `secret-test`).
* **Case-insensitive.**
* Only a single `--filter` per command.
| Filter by | Command |
| ----------- | ---------------------------------- |
| ID | `pacm list --filter 123` |
| Secret Name | `pacm list --filter test` |
| Host | `pacm list --filter rhel` |
| Type | `pacm list --filter SSH` |
| Details | `pacm list --filter "Checked out"` |
If nothing matches: `No secrets available.`
### Paginate the list
```bash theme={"system"}
pacm list --offset --limit
```
* `--offset` — number of records to skip.
* `--limit` — maximum number of records to display.
Invalid values (negative or non-numeric) produce: `Error: Invalid pagination parameters.`
## 6. Connect to a Secret
```bash theme={"system"}
pacm connect
```
With the required permission (**Owner**, **Editor**, or **PAM User**), this starts an SSH or Telnet session using the specified Secret.
* Connect by **Secret name** or by **ID**.
* Secret name matching is case-insensitive (`Test-Server` matches `test-server`).
* Press **Ctrl+C** to close a connection established via a Secret.
### Entering the secondary user password
You may be prompted for the secondary user's password before connecting:
* **Not requested** if you logged in to the Endpoint session, or entered a password to connect to another Secret, **less than 5 minutes ago**.
* **Requested** if more than 5 minutes have passed.
```text theme={"system"}
Enter your Secondary user password:
```
You get **3 attempts**. Each failed attempt shows `Sorry, try again.` After 3 failures: `3 incorrect password attempts`, and the connection is terminated.
### Access restrictions and approval
Behavior depends on the Secret's restriction settings:
| Restriction | Behavior |
| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Access already approved, or "Access without restrictions" | Connects immediately, no restrictions. |
| "Allow access without approval during work hours" — during hours | Connects immediately. 10 minutes before the approved window ends: `Access to this computer is allowed only until
| Condition | Message shown |
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| Option disabled on the Endpoint | `Connection Manager is not enabled on this Endpoint.`
## 5. List available Secrets
```bash theme={"system"}
pacm list
```
Shows every **SSH** (password- or key-based) and **Telnet** Secret you have **Owner**, **Editor**, or **PAM User** permission for. Each Secret is shown as:
```text theme={"system"}
ID: 
### Filter the list
```bash theme={"system"}
pacm list --filter