> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/privileged-access-pam-setup/connecting-target-systems.md).

# Connecting target systems

A target is anything a privileged user connects to through SECUREpass — a Linux or Windows server, a database, a cloud resource, or a network device. Until a target is onboarded here, SECUREpass cannot mediate access to it, vault its credentials, or record what happens on it.

## How the connection works

Nothing connects directly. Every privileged session runs through the SECUREpass Access Gateway, which sits between the user and the target, and does four things on every connection:

* **Mediates the protocol** — SSH, RDP, database, SAP and web admin sessions all proxy through it.
* **Injects the credential** — the vaulted password reaches the target without the user ever seeing it.
* **Enforces policy** — clipboard, file transfer, concurrent sessions, command filtering, dual control.
* **Records the session** — for later playback and forensic search.

Because the gateway mediates, **no agent is installed on the target**. What the target needs is reachability from the gateway and a credential that works.

That is also why onboarding matters more than it looks — the settings chosen when a target is added are the controls that apply to every session on it from then on.

## The pattern is the same for every target type

Whatever you are onboarding, the flow runs through the same four steps.

{% stepper %}
{% step %}

## Details

What the target is and how to reach it: name, address, connection type, port and status. The PAM security policy for the target is set here too — session recording, dual control, clipboard, file transfer, concurrent sessions and idle timeout.
{% endstep %}

{% step %}

## Local accounts

The privileged accounts that exist on the target. These are the credentials SECUREpass vaults and injects.
{% endstep %}

{% step %}

## Assign roles

Who may reach this target, expressed as roles rather than named individuals.
{% endstep %}

{% step %}

## Authentication

What the user must present before a session on this target is allowed to start.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Test the connection before finishing. A target that saves but does not connect will fail at the moment someone needs it.
{% endhint %}

## Where each type is managed

All four live under **Manage Resources**, each on its own page.

| Page                   | What it covers                                                       |
| ---------------------- | -------------------------------------------------------------------- |
| Manage systems         | Onboarding Linux servers over SSH and Windows servers over RDP       |
| Manage databases       | Onboarding database instances and their privileged accounts          |
| Managing a database    | Editing, testing and removing a database target once it is onboarded |
| Manage cloud resources | Onboarding cloud accounts and the resources under them               |
| Manage network devices | Onboarding switches, routers and firewalls                           |