SWOT PAM Technical Architecture & Network Ports

In-depth technical reference documenting the Zero-Trust proxy boundary, service topology, inbound/outbound firewall port matrices, encryption model, and high availability design.

1. System Topology & Proxy Data Flow

SWOT PAM operates as an intelligent Air-Gap Bastion & Proxy Layer positioned between client operators and internal corporate infrastructure. Direct network paths from operator workstations to production targets are prohibited.

Figure 3.1 — Telemetry Core

Radial SOC Engine: Visualizes the multi-tier proxy architecture routing SSH, RDP, and Database streams. Click to zoom

Microservice Responsibilities:

API Server (Node.js/Express): Central REST API, WebSockets, JWT session validation, policy evaluation, and event dispatch.
Web Client UI (React + Vite): Fast, responsive SPA providing administrative controls, access hubs, and web terminals.
SSH Proxy (Go / ssh2): Terminates client SSH connections on port 2222, injects vault credentials, logs keystrokes, and forwards to targets.
SwotPam IronRDP Gateway (Rust / IronRDP): High-performance RDP gateway handling port 33890 native mstsc connections and RemoteApp token injection.
DB Proxy (TypeScript / pg / oracledb): Intercepts wire-level database queries (Postgres 5454, Oracle 1521), enforcing SQL blocklists and logging queries.
DB GUI Proxy (CloudBeaver / Adminer): In-browser visual database workspace on port 9095.
PostgreSQL Database (v15+): Encrypted central state store holding users, policies, audit chains, and vault metadata.

2. Inbound & Outbound Firewall Port Matrix

Configure your network firewalls and cloud Security Groups (AWS Security Groups, Azure NSGs) according to the following canonical port table:

Port	Protocol	Direction	Service Name	Purpose / Description
`5000 / 443`	TCP / HTTPS	Inbound	Web Client UI	Web browser console access for administrators and users.
`8080`	TCP / HTTP(S)	Inbound	API Server	REST API endpoints and primary WebSocket connection gateway.
`2222`	TCP / SSH	Inbound	SSH Proxy Gateway	Native terminal SSH proxy connections (`ssh -p 2222`).
`33890`	TCP / RDP	Inbound	Native RDP Gateway	Windows Remote Desktop (`mstsc.exe`) proxy connections.
`5454`	TCP	Inbound	PostgreSQL Proxy	Native PostgreSQL client connections (DBeaver, pgAdmin, psql).
`1521`	TCP	Inbound	Oracle DB Proxy	Native Oracle client connections (SQL*Plus, SQL Developer).
`9095`	TCP / HTTP	Internal	DB GUI Proxy	In-browser visual database manager (reverse-proxied via UI).
`5432`	TCP	Internal	PAM PostgreSQL	Primary internal application database (never expose publicly).
`22`	TCP / SSH	Outbound	Target Linux Servers	Outbound SSH connections from PAM proxy to managed hosts.
`3389`	TCP / RDP	Outbound	Target Windows Servers	Outbound RDP connections from PAM gateway to managed Windows machines.
`5432 / 1521`	TCP / SQL	Outbound	Target DB Instances	Outbound connections from PAM DB proxy to target databases.

3. Security Architecture & Cryptography

SWOT PAM is engineered with multi-layered defensive controls ensuring that secrets and session data cannot be compromised even in the event of partial host intrusion:

Secret Store Encryption

AES-256-GCM: All passwords, API tokens, and private keys stored in the Central Vault are encrypted using AES-256 in Galois/Counter Mode with unique 96-bit initialization vectors (IVs) per record.
Master Key Separation: The master encryption key (SSH_CREDENTIAL_ENCRYPTION_KEY) is supplied via environment configuration and never stored in the database.
One-Time Token Injection: RDP and SSH sessions inject credentials into the target protocol handshake in memory; credentials are never written to disk or transmitted to the client browser.

Tamper-Evident Audit Trails (Hash Chaining)

Every logged event (login, command execution, vault reveal, policy edit) contains a SHA-256 cryptographic hash computed over the event payload concatenated with the preceding row's hash:

Cryptographic Chain Algorithm

Current_Hash = SHA256(Previous_Hash + Event_ID + Timestamp + User_ID + Action + Payload)

Any unauthorized modification or deletion of past database audit records breaks the mathematical chain and is immediately flagged by the Audit Integrity Worker.

4. High Availability & Scale-Out Architecture

For mission-critical enterprise environments, SWOT PAM scales horizontally:

Stateless Proxies: The API server, SSH proxy, and RDP gateway instances are stateless and can be scaled out behind an external Network Load Balancer (AWS NLB, Azure Load Balancer, or F5 BIG-IP).
Shared Database: Deploy the primary database on a managed PostgreSQL cluster (AWS RDS Multi-AZ, Azure Flexible Server) with automated read replicas and failover.
Centralized Recording Storage: Configure RECORDING_STORAGE_BACKEND=s3 to store session recordings and audit videos in an Amazon S3 or MinIO bucket with immutable Object Lock (WORM).