> For the complete documentation index, see [llms.txt](https://docs.mirketsecurity.com/mirket-help-center/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mirketsecurity.com/mirket-help-center/mirket-help-center/mirket-on-premise-platform/mirket-on-premise-reference-architecture-and-security-guide.md).

# Mirket On Premise – Reference Architecture & Security Guide

### 1. Architectural Overview

Mirket On Premise  is designed as a centralized privileged access control point.

Core principle:

* Users must **not access target systems directly**
* All privileged access must be performed **through Mirket On Premise** 
* Direct RDP and SSH access must be restricted at network level

***

### 2. High-Level Architecture

```
User → HTTPS (443) → Mirket Server → RDP / SSH → Target Servers
```

Flow:

1. Users access the Mirket web interface via HTTPS.
2. Authentication and authorization are enforced.
3. PAM initiates the RDP or SSH connection to the target system.
4. Sessions are proxied and recorded through PAM.

***

### 3. User Access

* Users access Mirket Server only via **HTTPS (TCP 443)**.
* A valid TLS certificate must be configured.
* Multi-Factor Authentication (MFA) should be enforced.
* Mirket Server should be deployed in a secure network segment or DMZ.

***

### 4. Blocking Direct Access

#### Firewall-Level Restrictions

The following controls must be implemented:

* Direct RDP (TCP 3389) access from user networks to Windows servers must be blocked.
* Direct SSH (TCP 22) access from user networks to Linux servers must be blocked.

Only the **Mirket PAM server IP address** should be allowed to access:

* RDP (3389)
* SSH (22)

***

### 5. Lateral Movement Prevention

To prevent horizontal lateral movement between servers:

#### Windows Servers

Windows Firewall should be configured so that:

* RDP (3389) inbound connections are allowed **only from the Mirket PAM IP address**
* All other RDP sources must be blocked

***

#### Linux Servers

Linux firewall (iptables / ufw) should be configured so that:

* SSH (22) access is allowed **only from the Mirket PAM IP address**
* All other SSH connections must be denied

***

### 6. Network Segmentation

Recommended segmentation:

* User Network
* PAM Network (Control Zone)
* Server Network (Privileged Zone)

There must be no direct connectivity from user networks to target servers.

Mirket Server acts as the controlled access bridge between users and privileged systems.

***

### 7. Additional Security Recommendations

* Enforce MFA for all privileged users.
* Enable session recording for RDP and SSH sessions.
* Use credential vaulting and password injection (users should not see raw credentials).
* Implement Role-Based Access Control (RBAC).
* Regularly patch and harden the Mirket server.
* Restrict exposed ports to the minimum required.

***

### 8. Security Model Summary

| Layer      | Control                             |
| ---------- | ----------------------------------- |
| Network    | RDP/SSH allowed only from Mirket IP |
| Identity   | MFA enforcement                     |
| Session    | Proxy-based access + recording      |
| Credential | Secure vault + injection            |
| Monitoring | Logging and auditing                |