> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/getting-started/deployment-guide/privileged-access-deployment-prerequisites.md).

# Privileged access deployment prerequisites

If you are deploying PAM, the following apply in addition to sections 2 and 3.

{% hint style="info" %}
**Gateway placement.** Deploy the SECUREpass Session Gateway in a DMZ or a subnet reachable by administrative traffic. All privileged connections are mediated through this gateway — no agents are installed on target systems.
{% endhint %}

{% hint style="info" %}
**Recording storage.** Provision a dedicated volume of at least 1 TB for session recordings, expandable according to retention. Recordings are written in an encrypted proprietary format. Set the retention period against your compliance standard — commonly 90, 180 or 365 days.
{% endhint %}

## Target reachability

Each class of target has its own prerequisites:

| Target                                           | Requirements                                                                                                                                                |
| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Windows Server 2016, 2019, 2022                  | RDP (TCP 3389) reachable from the gateway; domain connectivity verified; gateway IP whitelisted; WinRM over HTTPS enabled (5986); admin credentials vaulted |
| RHEL, Ubuntu, CentOS, Debian, SUSE, Solaris, AIX | SSH (TCP 22) reachable from the gateway; root or sudo credentials vaulted; gateway trusted key added; host reachability verified                            |
| Oracle, PostgreSQL, MySQL, MSSQL, MariaDB        | Listener ports (1521, 3306, 5432, 1433) reachable from the gateway; service account credentials onboarded; TLS-enabled connections optional                 |

{% hint style="warning" %}
**Firewall.** Allow inbound 443, 22, 3389 and the database ports you need. Restrict outbound connections to your SIEM, email and MFA integrations.
{% endhint %}