Ad Hoc access lets you open a session to a device that is not registered in Segura™. You select a registered credential, enter the address and port of the device, and start the session. Segura™ records and audits the session like any other proxy session.
Ad Hoc access is available only with Proxy 2.0. Earlier proxy versions do not offer it. For more information, contact Segura™ support team.
Use Ad Hoc access to reach devices that change often, such as short-lived servers, without registering each one first.
Key concepts
| Term | Meaning |
|---|---|
| Ad Hoc session | A session to a destination that you enter when you start the session, instead of a device registered in Segura™. |
| Ad Hoc destination | The host and port you enter for an Ad Hoc session. They override the host and port of the device linked to the credential. |
| Credential | The registered credential that signs in to the destination. Its Access Policy decides which controls apply to the session. |
| Network Connector | An optional route to network segments that Segura™ does not reach directly. |
Where you can start an Ad Hoc session
Ad Hoc sessions are available on three surfaces. All three apply the same rules to domain credentials. The table shows where they differ.
| Item | Web Proxy | RDP Proxy | Terminal Proxy |
|---|---|---|---|
| Where to start | Ad Hoc Connection screen | Ad Hoc Destination tab in the RDP Proxy lobby | adhoc command |
| Protocols | RDP, SSH | RDP | SSH, SSH with X11 forwarding, Telnet |
| Domain credentials | Yes | Yes | Yes |
| Local credentials | Yes | No | No |
| Network Connector | Optional | Optional | Optional |
| RemoteApp automation | Yes | No | No |
For the steps on each surface, see Start an Ad Hoc session with Web Proxy, Connect to a remote device with RDP Proxy via Proxy 2.0, and Start an Ad Hoc session with Terminal Proxy.
Enable Ad Hoc access
Ad Hoc access is turned off by default. One parameter turns it on for all three surfaces: Enable Ad Hoc access on Web, RDP and Terminal Proxy?, on the Remote session tab of the global system parameters. The parameter applies only to Proxy 2.0. For details, see System parameters - Remote Session.
When the parameter is off, no surface shows an Ad Hoc entry point, and the proxies refuse Ad Hoc sessions. Turning it off does not end sessions in progress. Segura™ records each change in the audit trail, with the author and the previous and new values.
How it works
Destination and route
You start an Ad Hoc session with a credential you are allowed to use in sessions. The host and port you enter take precedence over those of the device linked to the credential.
The Network Connector is optional. If you do not select one, the session uses the default Network Connector of your account. Without a default, the session connects directly.
When you select a Network Connector, enter an IP address as the destination. The Network Connector reaches the destination by IP address only and does not resolve hostnames. If the selected Network Connector fails, the session does not start. Segura™ does not try another connector.
Access Policy controls
Before an Ad Hoc session opens, Segura™ applies the Access Policy of the credential. The same credential produces the same result in an Ad Hoc session and in a regular session. The policy can require:
- A justification.
- Approval through the approval workflow.
- A valid ITSM ticket, entered as the governance code.
- Access only within an allowed period.
The policy can also offer emergency access. Emergency access records the requester, the approver, and the reason. It never skips session recording or the audit trail.
For a destination that is not registered, the justification and the approval apply only to the host you entered. Approving access to one host does not grant access to any other. The approver sees that host, marked as (Ad Hoc), in the request.
Remote-session MFA applies to Ad Hoc sessions as it does to regular sessions.
Incident Lockdown
Incident Lockdown evaluates the device that the session reaches, if that device is registered in Segura™. A host that is not registered is outside Incident Lockdown. Users with permission for the Emergency panel remain exempt.
Audit
Every Ad Hoc session is recorded. In the Remote session report, the Device column shows the host and port you entered, followed by (Ad Hoc). The Ad Hoc filter lists only Ad Hoc sessions, or only regular sessions.
The audit trail records the Network Connector used by each Ad Hoc session. The Remote session report does not show it.
Limitations
- Ad Hoc access is available only with Proxy 2.0.
- Local credentials work only on Web Proxy. RDP Proxy and Terminal Proxy accept domain credentials only.
- Telnet is available only on Terminal Proxy.
- SFTP and SCP are not available for Ad Hoc sessions.
- Terminal Proxy does not accept IPv6 destinations.
- Segura™ does not retry a failed session through another Network Connector.
- Just-in-time credentials cannot be used for Ad Hoc sessions on Web Proxy.
When to use it
- To reach a device that is not registered in Segura™, such as a short-lived server.
- To connect to a registered device on a host or port different from the one registered for the credential's device.
- To reach a device in a network segment that only a Network Connector reaches.