Accessing the PPC CLI

The Protegrity Provisioned Cluster (PPC) CLI provides a command-line interface for managing policies, users, and log forwarding. Access is established over SSH using the private key generated during the PPC installation.

The deployment includes a CLI container that provides command-line access to the Protegrity Management CLI using SSH, on both Linux and Windows.

Prerequisites

To access the PPC CLI, ensure that the following prerequisites are met:

  • SSH key: The private key generated during bootstrap at ~/.ssh/<cluster_name>_user_svc, matches the public key configured in the pty-cli pod. Here, <cluster_name> is the cluster name provided during installation.

  • Network access: Ensure you have network connectivity to the cluster’s ingress Load Balancer.

  • FQDN resolution: Resolve the PPC FQDN specified during installation to the ingress Load Balancer.

    • AWS: Use Route 53 to resolve the PPC FQDN to the internal Load Balancer. For more information, refer to Prerequisites.
    • Azure: Map the ingress FQDN to the Load Balancer IP in the hosts file, same as Web UI access.

Connect over SSH

From the .ssh/ directory, run the following command:

ssh -i ~/.ssh/<cluster_name>_user_svc -p 22 ptyitusr@<user-provided-fqdn>

To skip host-key checking on first connect, run the following command:

ssh -i ~/.ssh/<cluster_name>_user_svc \
    -o StrictHostKeyChecking=no \
    -o UserKnownHostsFile=/dev/null \
    -p 22 ptyitusr@<user-provided-fqdn>

Copy the private key file (~/.ssh/<cluster_name>_user_svc) to a directory on the local Windows machine, then use one of the following clients:

  • Using Windows SSH Client (Windows 10/11 with OpenSSH):

    ssh -i C:\path\to\<cluster_name>_user_svc -p 22 ptyitusr@<user-provided-fqdn>

  • Using PuTTY:

    • Host Name: <user-provided-fqdn>
    • Port: 22
    • Connection Type: SSH
    • Under Connection > SSH > Auth, browse and select your private key file (.ppk format)
    • Username: ptyitusr

Login to CLI Manager

Once connected, the Protegrity CLI welcome banner is displayed. Enter the following parameters when prompted:

  • Username: Application username
  • Password: Application password

For more information about the default credentials, refer to the Release Notes.

Note: Logging in to the CLI Manager using SSO credentials is not supported. Use the application username and password to log in to the CLI Manager. If the password is already changed using the Web UI, then use the updated credentials to login to the CLI Manager.

Reset default credentials

When logging in to the PPC for the first time using the temporary credentials, the Reset your temporary password screen appears.

Ensure that the password must contain the following:

  • Minimum of 14 characters
  • At least 1 uppercase character
  • At least 1 lowercase character
  • At least 1 digit
  • At least 1 special character
  • Cannot reuse any of the last 5 passwords

Perform the following steps to reset the temporary password:

  1. Enter new password when prompted for New Password.
  2. Re-enter new password when prompted for Confirm New Password.
    A Password reset successful. message appears.

The password is successfully updated.

Supported CLI commands

The CLI supports three main command categories:

  • pim: Policy Information Management commands for data protection policies.
  • admin: User, role, permission, group, and email management commands.
  • insight: Log forwarding to external SIEM and syslog servers.

Note: Ensure that at least one additional backup administrator user is configured with the same administrative privileges as the primary admin user.
If the primary admin account is locked or its credentials are lost, restoring the system from a backup is the only recovery option.

Last modified : October 28, 2026