---
title: "Getting Started with Terminal Gateway & PAM Web TTY"
description: "**MikroWizard PAM Web TTY & Terminal Gateway: End-to-End Setup & Operations Guide** Document Category: Getting Started & Privileged Access Management | Target Audience: Network Administrators, SecOps Teams, & NOC Engineers | Reference Device: CHR-Tower01 (MikroTik RouterOS 7.17) | Applies to:…"
url: "https://mikrowizard.com/docs/getting-started-terminal-gateway-pam-web-tty/"
updated: "2026-08-26"
category: "Devices, Users & Permissions"
---

# Getting Started with Terminal Gateway & PAM Web TTY

**MikroWizard PAM Web TTY & Terminal Gateway: End-to-End Setup & Operations Guide**

 Document Category: Getting Started & Privileged Access Management | Target Audience: Network Administrators, SecOps Teams, & NOC Engineers | Reference Device: CHR-Tower01 (MikroTik RouterOS 7.17) | Applies to: MikroWizard v2.0+ (Pro & Enterprise)

## 1. Overview & Architecture Prerequisites

The **MikroWizard Terminal Gateway** delivers zero-client, browser-based **Privileged Access Management (PAM) Web TTY** access to network infrastructure. Sessions run through high-performance `xterm.js` terminals over encrypted WebSockets (Ports **8200** and **8201**), eliminating the need for local desktop SSH clients (like PuTTY or SecureCRT) and avoiding public SSH port exposure.

- **Zero Port Exposure**: Terminal Gateway multiplexes connections behind reverse proxies—no open SSH ports needed on WAN.
- **Pre-Execution Guardrails**: Inspects and blocks unauthorized CLI commands before they hit routers.
- **Immutable Audit Logging**: Automatically records sessions into Asciinema v2 (`.cast`) format for compliance and review.
- **Multi-User Live Collaboration**: Allows sharing sessions in real-time with granular **Owner**, **Collaborator**, and **Observer** roles.

## Step 1: Add or Verify Your Device in Inventory

First, verify that your target device is registered in MikroWizard.

In our **demonstration** environment, the primary router **`CHR-Tower01`** (MikroTik Cloud Hosted Router running RouterOS 7.17) is already configured and ready.

1. In the left sidebar menu, click **Devices** (`/#/devices`).
2. Locate **`The device`** in the inventory table to verify its IP address (here is `192.168.1.101`), group assignment (`Default`), and active connectivity status.
3. *To add a new MikroTik or Generic Linux device*: Click the blue **+ Bulk Add** or **Add Device** button in the top-right toolbar(switch between mikrotik and non mikrotik tabs), enter device credentials, IP/port, and protocol settings, then click **Save**.

![MikroWizard Devices Inventory showing CHR-Tower01](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step1_devices_inventory.png)
Figure 1: Devices Inventory showing CHR-Tower01 active and ready for management

## Step 2: Install & Verify Terminal Gateway Addon

To use PAM Web TTY features, verify that your MikroWizard license has active **PAM Seats**. an make sure you installed the pam terminal gatway addon.

 Installation Guide: For complete architectural details and firewall guidelines, refer to the full installation guide: [Installing Terminal Gateway Locally (Same Server)](https://mikrowizard.com/docs/installing-terminal-gatway-addon/#h-5-installing-terminal-gateway-locally-same-server).

Run the automated 1-line installer in your server terminal:

## Step 3: Create Your First Terminal Security Policy

Security policies act as zero-trust guardrails that inspect commands in real time. Follow these steps to build your first policy:

1. In the left sidebar menu, click **Security & Policies** (`/#/policies`).
2. Review existing policies in the table. Click the blue **+ New Policy** button located at the top-right of the table.
3. In the **New Security Policy** modal, fill in the configuration fields:
   - **Policy Name**: e.g. `Default NOC Guardrails`.
   - **Description**: e.g. `Blocks destructive commands and prevents accidental device resets.`
   - **Policy Type**: Select `Command Guardrail`.
   - **Defense Level**: Select `Level 1 (Token/Regex)`, `Level 2 (Shell Hook)`, or `Level 3 (Kernel ptrace/seccomp)`.
   - **Action Behavior**: Select default action (`Block`, `Warn`, `Log`, `Terminate`, or `Require Approval`).
   - **Command Rules (Regex)**: Define rules such as `/system reset-configuration.*`, `/system reboot.*`, `export hide-sensitive=no.*`, and `rm -rf /.*`.
4. Click the blue **Save Policy** button to register the policy.

![MikroWizard Policies Table](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step3_policies_table.png)
Figure 2: Security & Policies console listing active command guardrails

![MikroWizard New Policy Builder Modal Dialogue](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step3_create_policy_modal.png)
Figure 3: Policy Builder modal with regex matcher configuration and action behavior selection

| Rule Matcher (Regex) | Action | Target Scope | Description |
| --- | --- | --- | --- |
| `/system reset-configuration.*` | **Block** | MikroTik RouterOS | Stops factory resets and prevents configuration loss. |
| `/system reboot.*` | **Warn** | MikroTik RouterOS | Requires operator confirmation before rebooting production nodes. |
| `export hide-sensitive=no.*` | **Block** | MikroTik RouterOS | Prevents unmasked credential dumping in terminal. |
| `rm -rf /.*` | **Terminate** | Linux Hosts | Terminates destructive recursive deletion commands instantly. |

## Step 4: Grant PAM / Terminal Access in User Management

By default, operator accounts cannot open live Web TTY sessions unless explicitly granted privilege:

1. In the left sidebar menu, click **Users** (`/#/users`).
2. Locate the target operator or engineer row (e.g. `engineer`) in the user list.
3. Click the **Edit** button (pencil icon) on the right side of the row.
4. In the **Edit User Account** modal dialogue, scroll down to the **Permissions** section.
5. Locate and toggle ON the **PAM / Terminal Access** switch (`p_connection_manager`).
6. Click the blue **Save Changes** button to apply the updated privilege profile.

![MikroWizard User Management Console](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step4_users_table.png)
Figure 4: User Management table displaying registered operators and role assignments

![MikroWizard Edit User Modal with PAM Terminal Access Permission Toggle](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step4_edit_user_pam_permission.png)
Figure 5: Edit User modal with PAM / Terminal Access toggle enabled

## Step 5: Assign the Policy to Preferred Device Group

To enforce your security policy across devices, assign it to the target Device Group in the user permissions matrix:

1. In the sidebar menu, click **Device Groups** (or navigate to Manage Users → **Device Groups** tab).
2. Locate the group containing **`CHR-Tower01`** (e.g., the `Default` or `Core Routers` group).
3. In the **Terminal Policy** column, click the **Edit** button (pencil icon).
4. In the Policy Assignment modal/dropdown, select your newly created policy (`Default NOC Guardrails`).
5. Click the **Update** button to bind the policy to all devices in the group.

![MikroWizard Device Groups Hierarchy and Permissions Table](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step5_device_groups_table.png)
Figure 6: Device Groups table showing group hierarchy, device counts, and policy bindings

![MikroWizard Assign Terminal Policy to Device Group Modal Dialogue](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step5_assign_policy_modal.png)
Figure 7: Modal dialogue for assigning terminal security policies to device groups

## Step 6: Connect to Device Terminal via Connection Manager

Now that permissions and policies are bound, launch your in-browser Web TTY session:

1. In the left sidebar menu, click **Connection Manager** (`/#/connection-manager`).
2. Locate **`CHR-Tower01`** in the active device table.
3. Click the black **Terminal Button** () on the `CHR-Tower01` row.
4. The browser instantly establishes an authenticated WebSocket session to the Terminal Gateway, rendering the full-color `xterm.js` interface, RouterOS banner, and interactive prompt (`[admin@CHR-Tower01] >`).

![MikroWizard Connection Manager Table showing CHR-Tower01](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step6_connection_manager_table.png)
Figure 8: Connection Manager table showing CHR-Tower01 with quick-connect Terminal and WebFig action buttons

![MikroWizard In-Browser Web TTY Terminal Session on CHR-Tower01](https://mikrowizard.com/wp-content/uploads/2026/08/mw_tutorial_step6_live_terminal_session.png)
Figure 9: Live in-browser Web TTY terminal session on CHR-Tower01 with active prompt and guardrails

### Live Session Capabilities & Features:

- **Instant Guardrail Blocking**: Type a restricted command (e.g. `/system reset-configuration`) to verify that the policy engine halts execution and displays an access violation warning.
- **Live Multi-User Collaboration**: Click the **Share Session** button in the terminal header to invite colleagues with role enforcement (**Owner**, **Collaborator**, or **Observer**).
- **Asciinema (.cast) Session Playback**: All keystrokes, outputs, and window resizes are automatically preserved on disk and can be replayed in **PAM → Session History**.

## Summary & Troubleshooting

| Issue / Symptom | Probable Cause | Resolution |
| --- | --- | --- |
| **Terminal button disabled or missing** | User account lacks PAM / Terminal Access privilege | In **Users** (`/#/users`), edit the user and toggle ON **PAM / Terminal Access**. |
| **WebSocket connection failed (502 / 404)** | Terminal Gateway service is stopped or token mismatched | Check container status with `docker ps | grep terminal-gateway` and verify token in `server-conf.json`. |
| **Policy not blocking commands** | Policy not assigned to the device's group | Navigate to **Device Groups**, edit the **Terminal Policy** column, and select the active policy. |

You are now fully configured to use **MikroWizard Terminal Gateway and PAM Web TTY**. For advanced workflows, explore automated credential vault rotation, multi-tenant RBAC, and WebFig reverse proxying.