Privileged
Remote Access
Without VPN
Secure, credential-injected RDP, SSH, and web sessions to any server or desktop — clientless, MFA-enforced, and fully recorded. No jump servers required.
PRA Architecture Overview
PRA Connector
Lightweight agent deployed inside your network perimeter. Establishes outbound-only encrypted tunnel to the PRA cloud broker — no inbound firewall rules needed.
Access Zones
Logical groupings of resources (servers, subnets, applications) mapped to connectors. Each zone enforces its own policy, MFA requirements, and session recording rules.
Credential Injection
Credentials are fetched from the Secret Server vault at session time and injected transparently. Users never see or handle passwords — eliminating credential theft risk.
PRA vs Traditional VPN + Jump Server
| Dimension | ✦ Delinea PRA | ⚠ VPN + Jump Server |
|---|---|---|
| Client Requirement | ✓ Browser only — zero agent install | ✗ VPN client + RDP/SSH client required |
| Credential Exposure | ✓ Injected silently — user never sees password | ✗ Users must manually enter (and often know) credentials |
| Lateral Movement Risk | ✓ Zero-trust per session — no network broadcast | ✗ VPN grants broad network access; jump server is pivot point |
| MFA Enforcement | ✓ Mandatory before every session, per-zone policy | ~ VPN may have MFA; jump server often does not |
| Session Recording | ✓ Full video + keystroke capture, tamper-proof | ✗ Requires additional tooling; often not enforced |
| Access Granularity | ✓ Per-server, per-account, time-limited | ✗ Subnet or host-level at best |
| Audit Trail | ✓ Who, what, when — searchable playback | ~ Log files only — no visual replay |
| Attack Surface | ✓ No inbound ports; no exposed RDP/SSH | ✗ Jump server = high-value target with open ports |
| Deployment Complexity | ✓ Connector + cloud config; minutes to deploy | ✗ VPN infrastructure + jump server hardening required |
| Scalability | ✓ Cloud-native; add connectors as you grow | ✗ Jump servers become bottlenecks |
Zero Trust Per Session
Every session is independently authenticated and authorized. No standing network access is granted. Sessions are bound to specific accounts and targets — access expires the moment the session ends.
No Exposed Attack Surface
The PRA Connector makes outbound-only connections. No RDP (3389) or SSH (22) ports exposed to the internet. The target systems remain unreachable except through PRA.
Credential Isolation
Secrets are retrieved from vault at session initiation and never cached on client endpoints. Rotating credentials does not break user workflows.
Broad Network Exposure
VPN access typically grants users access to an entire network segment — far more than needed for a single administrative task. This violates least-privilege principles.
Jump Server as Crown Jewel
Attackers who compromise a jump server gain a highly privileged position with direct access to all downstream systems. Single point of failure for enterprise access.
Credential Sprawl
Users often save credentials locally or reuse passwords. Credential rotation requires manual update of saved configs. High risk of password spray and credential stuffing attacks.
2. Authenticate with SSO + MFA
3. Browse/search for target system
4. Click Launch Session
5. RDP/SSH/Web session opens in browser tab
6. Work without ever entering credentials
7. Close tab — session ends, recorded automatically
2. Wait for VPN tunnel to establish
3. Open RDP/SSH client application
4. Enter jump server IP + credentials
5. From jump server, connect to target system
6. Enter target credentials again
7. Work; disconnect manually from both hops
Configuring Access Zones & Jump Points
Access Zones define logical security boundaries that group resources and apply unified policy. Each zone is associated with one or more PRA Connectors and enforces its own MFA, recording, and authorization rules.
*.delinea.app.
No inbound ports required. For redundancy, assign two or more connectors per zone.
wget https://downloads.delinea.app/pra-connector/latest/pra-connector.deb
sudo dpkg -i pra-connector.deb
sudo pra-connector configure --enrollment-token <TOKEN>
sudo systemctl enable --now pra-connector
• MFA Policy — Require TOTP, push, or FIDO2 before session launch
• Recording Policy — Enable video recording and/or keystroke logging
• Protocol Allowlist — Restrict to RDP only, SSH only, or both
• Idle Timeout — Auto-terminate sessions after N minutes of inactivity
• IP Restrictions — Limit access to specific user source IP ranges
Supported target types: Windows Server (RDP) Linux/Unix (SSH) Web Applications Network Devices
Jump Points act as protocol proxies within an Access Zone, brokering RDP and SSH connections from the PRA cloud to internal targets. They replace traditional jump servers while providing full session control.
🐧 Linux Jump Point — Runs SSH proxy daemon; targets Unix/Linux systems
☁️ Cloud Jump Point — Fully managed by Delinea; for SaaS/cloud targets
🌐 Web Jump Point — Chromium-based headless proxy for web applications
• Can reach target systems on RDP/SSH ports
• Minimum: 2 vCPU, 4 GB RAM per 50 concurrent sessions
• Recommend 2+ for HA within each zone
• Windows Server 2016+ or Ubuntu 20.04+
✔ PRA Cloud Connection: CONNECTED (relay.us-east-1.delinea.app:443)
✔ Zone Registration: PROD-DMZ (connector: pra-conn-01)
✔ RDP Proxy: LISTENING (internal, port 3389 inbound disabled)
✔ SSH Proxy: LISTENING (internal, port 22 inbound disabled)
ℹ Active Sessions: 7 / 50 (14% capacity)
ℹ Last Health Beacon: 2s ago
admin@pra-jumppoint-01 $ _
Privileged accounts are stored in Secret Server and linked to PRA target systems. At session time, PRA fetches the current credential and injects it — the user is never involved in credential handling.
Approvals can be routed via email, Slack, or ServiceNow ticket integration.
Clientless sessions run entirely inside the browser using HTML5 canvas rendering of RDP/SSH output. No Java, no ActiveX, no native client — just a URL.
Browser-Based RDP
RDP sessions stream as compressed video frames to the browser canvas. Keyboard and mouse events are relayed back. Supports clipboard sync, file transfer via HTML5 drag-drop, and multi-monitor spanning.
Browser-Based SSH
Full xterm.js terminal emulator in the browser. Supports ANSI colors, terminal resize, and paste. SSH key injection supported — no need for password auth on target systems.
Web Application Access
Chromium headless proxy allows PRA to auto-fill credentials into internal web applications — including legacy apps that cannot integrate with SSO. Supports form-fill, NTLM, and Basic auth injection.
https://company.delinea.app/pra/launch
?target=WIN-PROD-DB01
&protocol=rdp
&zone=PROD-DMZ
&account=svc_dba_prod
# SSH Session Direct Launch
https://company.delinea.app/pra/launch
?target=linux-app-01.corp
&protocol=ssh
&zone=CORP-Servers
✔ Credentials injected from vault at session time
✔ MFA prompt triggered automatically
Enforcing MFA Before Session Initiation
Delinea PRA enforces MFA at the session layer — not just at login. Even if a user is already authenticated to the portal, launching a session to a sensitive system triggers a fresh MFA challenge, providing defense-in-depth against stolen session tokens.
Portal Auth
Session
Target + Account
Challenge
Per-Zone Policy
Injection
From Vault
Launched
Recorded
TOTP (Authenticator App)
Works with Google Authenticator, Microsoft Authenticator, Authy. 6-digit codes, 30-second window. Supported on all zones; lowest friction for regular users.
Push Notification
Duo Security or Delinea Mobile push. User taps Approve on phone. Integrates with number matching to prevent MFA fatigue attacks.
FIDO2 / Hardware Key
YubiKey, Windows Hello, Touch ID. Strongest assurance level; recommended for production systems. Phishing-resistant by design.
{
"require_mfa": true,
"mfa_methods": [
"fido2", "push", "totp"
],
"mfa_per_session": true,
"mfa_grace_period_min": 0,
"step_up_for_accounts": [
"domain_admin",
"root", "Administrator"
],
"deny_on_mfa_fail": true
}
Grace Period = 0
Setting mfa_grace_period_min to 0 ensures MFA is required for every session launch, regardless of recent authentications. Recommended for production and sensitive zones.
MFA Fatigue Protection
Enable number matching on push notifications. Users must type the displayed number into their phone app — preventing blind approval of attacker-triggered sessions.
Session Recording & Audit
All PRA sessions can be recorded as tamper-proof video with synchronized keystroke logging and metadata. Recordings are stored encrypted and are fully searchable — enabling rapid incident response and compliance reporting.
Video Session Recording
Full pixel-accurate video of every RDP and SSH session. Frame-level compression stores hours of recording in minimal storage. Playback available directly in admin console.
Keystroke Logging
Every keystroke captured and timestamped — fully searchable by keyword. Find any session where a specific command was run or file was accessed, even without watching video.
Tamper-Proof Storage
Recordings are signed with cryptographic hashes. Any modification to the recording file invalidates the signature — providing court-admissible evidence of privileged activity.
Full-Text Search
Search keystroke logs across all sessions. Query by user, target, date range, or typed content. Results link directly to the exact timestamp in the video recording.
Real-Time Session Monitoring
Admins can view live sessions in progress and send instant messages to the user, or forcibly terminate a session if suspicious activity is detected.
SIEM & SOAR Integration
Session metadata and keystroke events stream to Splunk, Microsoft Sentinel, or any CEF/syslog SIEM. Trigger automated playbooks on detection of privileged command execution.
GET /api/v2/pra/sessions/search
{
"query": "net user /add",
"date_from": "2025-01-01",
"zones": ["PROD-DMZ"],
"include_video_link": true
}
# Response includes video timestamp deep-link
→ 3 sessions found
→ Video links with exact frame offset
sudo su, rm -rf, or net localgroup administrators is typed. Alerts route to admin email, PagerDuty, or ServiceNow.Hands-On Lab Exercise
Configure PRA for a Production Web Server Fleet
Estimated time: 20–30 minutes · Requires: PRA Tenant + Secret Server access
In this lab you will configure a complete PRA deployment for a hypothetical production web server fleet (PROD-WEB zone). Complete each task and check it off as you go — your progress is tracked.
Knowledge Check
Test your understanding of Delinea PRA. Select the best answer for each question.