Defender 5.11 - Administration Guide

Defender PAM logging

The Defender PAM logs the RADIUS server responses for all failed authentication attempts to the system logger at the Info level. To do that the Defender PAM uses the auth or authpriv facility, depending on platform.

You can enable trace level logging for troubleshooting purposes.

To enable trace level logging

1. Make sure the /tmp/pam_def.ini file exists on your system. The file must specify a location to a log file as well as a trace level.

   Example:

   filename=/tmp/pam_defender_trace.log
level=0xffffffff

2. Append the debug argument to the auth entries for the Defender PAM in the system PAM configuration.

Auth arguments

The following table lists the arguments you can append to the auth entries for the Defender PAM in the system PAM configuration.

Delegating Defender roles, tasks, and functions

Defender provides a scalable approach to the administration of access rights, enabling you to delegate specific Defender roles, tasks, and functions to the users or groups you want.

The Defender Administration Console provides a wizard you can use to search for and select one or multiple user accounts, and then choose which Defender roles or tasks you want these accounts to perform.

Besides delegating roles or tasks, you can delegate specific Defender functions, for example, appoint selected user accounts as service accounts for the Defender Security Servers or Defender Management Portal, or grant full control over particular Defender objects, such as Access Nodes, Defender Security Servers, licenses, RADIUS payloads, or security tokens.

• Steps to delegate roles, tasks, and functions
• Roles
• Service accounts
• Advanced control
• Full control
• Using control access rights

Steps to delegate roles, tasks, and functions

You can delegate Defender roles, tasks, or functions to specific users or groups by using the Defender Delegated Administration Wizard.

To delegate Defender roles, tasks, or functions

1. On the computer where the Defender Administration Console is installed, open the Active Directory Users and Computers tool (dsa.msc).
2. In the left pane (console tree), expand the appropriate domain node, and click to select the Defender container.
3. On the menu bar, select Defender | Delegate Control.

   Step through the wizard.

4. In the Users and Groups step, add the user accounts or groups to which you want to delegate Defender roles, tasks, or functions. Click Next.
5. In the Tasks to Delegate step, select the check boxes next to the Defender roles, tasks, or functions you want to delegate. Click Next.

For more information, see:

• Roles
• Service accounts
• Advanced control
• Full control

6. Follow the steps in the wizard to complete delegating the roles, tasks, or functions.

   The wizard does not modify any standard Active Directory permissions. Rather, it modifies permissions on the Defender attributes in the Active Directory schema.