Chat now with support

Live-Hilfe anfordern
Registrierung abschließen

Anmelden

Preisinformationen anfragen

Vertrieb kontaktieren

Safeguard for Sudo 7.1.1 - Administration Guide

Inhaltsnavigation

Introducing Safeguard for Sudo

Features and benefits of Safeguard for Sudo How Safeguard for Sudo works

Planning Deployment

System requirements

Supported platforms Reserve special user and group names Required privileges

Estimating size requirements Safeguard licensing Deployment scenarios

Single host deployment Medium business deployment Large business deployment

Installation and Configuration

Download Safeguard for Sudo software packages Quick start and evaluation

Installing the Management Console Uninstalling the Management Console

Configure a Primary Policy Server

Checking the server for installation readiness

TCP/IP configuration Firewalls Hosts database Reserve special user and group names Policy server daemon hosts Check Sudo version

Installing the Safeguard packages

Adding directories to PATH environment

Configuring the Safeguard for Sudo Primary Policy Server

Safeguard for Sudo Server Configuration Settings

Join hosts to policy group

Joining Sudo Plugin to Policy Server Swap and install keys

Configure a secondary policy server

Installing secondary servers Configuring a secondary server

Synchronizing policy servers within a group

Install Sudo Plugin on a remote host

Checking Sudo Plugin Host for installation readiness Installing a Sudo Plugin on a remote host Joining a Sudo Plugin to a primary policy server Verifying Sudo Plugin configuration Load balancing on the client

Remove configurations

Uninstalling the Safeguard software packages Uninstalling Safeguard for Sudo on macOS

Upgrade Safeguard for Sudo

Before you upgrade Upgrading Safeguard packages

Upgrading the server package Upgrading the Sudo Plugin package

Removing Safeguard packages

Removing the server package Removing the Sudo Plugin package

System Administration

Reporting basic policy server configuration information Checking the status of the master policy Checking the policy server Checking policy server status Checking the Sudo Plugin configuration status Installing licenses

Displaying license usage

Listing policy file revisions Viewing differences between revisions Backup and recovery

Managing Security Policy

Security policy types Specifying security policy type The sudo type policy Viewing the security profile changes

Administering Log and Keystroke Files

Configuring keystroke logging for Safeguard for Sudo policy

Validating Sudo commands

Event logging Keystroke (I/O) logging

Viewing the log files using a web browser Viewing the log files using command line tools Listing event logs Backing up and archiving event and keystroke logs

Troubleshooting

Enabling sudo policy debug logging Enabling tracing for Sudo Plugin Join fails to generate a SSH key for sudo policy Join to policy group failed on Sudo Plugin Load balancing and policy updates Policy servers are failing Sudo command is rejected by Safeguard for Sudo Sudo policy is not working properly

Safeguard Variables

Global input variables

argc argv client_parent_pid client_parent_uid client_parent_procname clienthost command cwd date day dayname domainname env false gid group groups host hour masterhost masterversion minute month nice nodename optarg opterr optind optopt optreset optstrictparameters pid pmclient_type pmclient_type_pmrun pmclient_type_sudo pmversion ptyflags requestlocal requestuser rlimit_as rlimit_core rlimit_cpu rlimit_data rlimit_fsize rlimit_locks rlimit_memlock rlimit_nofile rlimit_nproc rlimit_rss rlimit_stack samaccount selinux status submithost submithostip thishost time true ttyname tzname uid umask unameclient uniqueid user year

Global output variables Global event log variables

event exitdate exitstatus exittime

PM settings variables

Safeguard programs

pmcheck pmjoin_plugin pmkey pmlicense pmloadcheck pmlog pmlogadm pmlogsearch pmlogsrvd pmlogxfer pmmasterd pmplugininfo pmpluginloadcheck pmpolicy pmpolicyplugin pmpoljoin_plugin pmpolsrvconfig pmremlog pmreplay

Navigating the log file

pmresolvehost pmserviced pmsrvcheck pmsrvconfig pmsrvinfo pmsum pmsysid

Installation Packages

Package locations Installed files and directories

Unsupported Sudo Options

Unsupported command line sudo options Behavioral change Unsupported Sudoers policy options Unsupported Sudoers directives

Safeguard for Sudo Policy Evaluation

time

Safeguard Variables > Global input variables > time

Description

Type string READONLY

time contains the time the request was submitted in the form HH:MM:SS.

Related Topics

true

Safeguard Variables > Global input variables > true

Description

Type integer READONLY

true is a read-only constant with a value of 1.

Related Topics

ttyname

Safeguard Variables > Global input variables > ttyname

Description

Type string READONLY

ttyname contains the name of the TTY device from which the user submitted a request.

tzname

Safeguard Variables > Global input variables > tzname

Description

Type string READONLY

Description

The time zone variable, tzname, contains the name of the time zone on the server at the time the event was read from the event log by pmlog. The time zone may be overridden using the TZ environment variable when running pmlog.

Note that tzname is accessible from pmlog but not in the policy script evaluation.

Example

# pmlog -p `sprintf("%s %s %s, %s, %s", date, time, tzname, event, uniqueid)’ 
2013-03-14 10:51:59 MDT, Accept, 0b1c7ff3447ac074b4795be2dcd59f6429c8624b 
2013-03-14 10:51:59 MDT, Accept, a6cfad1ba6eb64bf9a17d5295b2bb29daa7fbb33 
2013-03-14 10:51:59 MDT, Accept, fa742929679bc6c88eadd25ff85d75361f1d28b2 
2013-03-14 10:51:59 MDT, Accept, 97ffdb433819c5feab6ec26b528f60dfb18c3d34 
2013-03-15 07:02:47 MDT, Accept, d84ac9052265912eb13d32f80584d1ae097e4ce5 
2013-03-19 09:41:59 MDT, Accept, b228110f32525c2092d2a46d0327e55f2dfc1d39

The actual values may vary by platform. In this sample output, the value of tzname is "MDT".

The following example shows the use of the TZ variable acting on the output:

TZ=Europe/Paris pmlog -p `sprintf( "%s %s %s, %s", date, time, tzname, event )’ 
2013-03-14 17:51:59 CET, Accept, 0b1c7ff3447ac074b4795be2dcd59f6429c8624b 
2013-03-14 17:51:59 CET, Accept, a6cfad1ba6eb64bf9a17d5295b2bb29daa7fbb33 
2013-03-14 17:51:59 CET, Accept, fa742929679bc6c88eadd25ff85d75361f1d28b2 
2013-03-14 17:51:59 CET, Accept, 97ffdb433819c5feab6ec26b528f60dfb18c3d34 
2013-03-15 14:02:47 CET, Accept, d84ac9052265912eb13d32f80584d1ae097e4ce5 
2013-03-19 16:41:59 CET, Accept, b228110f32525c2092d2a46d0327e55f2dfc1d39

Related Topics

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen

© ALL RIGHTS RESERVED. Feedback Nutzungsbedingungen Datenschutz Cookie Preference Center