One Identity Management Console for Unix 2.5.2 - Administration Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Management Console for Unix Installing Management Console for Unix Preparing Unix hosts Working with host systems Managing local groups Managing local users Active Directory integration Authentication Services integration Privilege Manager integration
Getting started Configure a primary policy server Configure a secondary policy server Install PM agent or Sudo plugin on a remote host Security policy management
Opening a policy file Edit panel commands Editing PM policy files Reviewing the Access and Privileges by User report Reviewing the Access and Privileges by Host report
Event logs and keystroke logging
Reporting Setting preferences
User preferences System preferences
Security Troubleshooting tips
Auto profiling issues Active Directory Issues Auditing and compliance Cannot create a service connection point Check Authentication Services agent status commands not available CSV or PDF reports do not open Database port number is already in use Elevation is not working Hosts do not display Import file lists fakepath Information does not display in the console License information in report is not accurate Out of memory error Post install configuration fails on Unix or Mac Privilege Manager feature issues Profile task never completes questusr account was deleted Readiness check failed Recovering from a failed upgrade Reports are slow Reset the supervisor password Running on a Windows 2008 R2 domain controller Service account login fails Setting custom configuration settings Single Sign-on (SSO) issues JVM memory tuning suggestions Start/stop/restart Management Console for Unix service Toolbar buttons are not enabled UID or GID conflicts
System maintenance Command line utilities Web services Database maintenance About us

Disabling SSL/TLS encryption

SSL is enabled by default. A self-signed certificate is installed but you should replace it with a valid certificate for your organization. While not recommended, it is possible to disable SSL/TLS encryption entirely.

To disable SSL/TLS encryption

  1. Add the following line to the custom.cfg file:

    -Dssl.enabled=false

    Note: All HTTPS traffic will be redirected to the HTTP port.

  2. Update any browser bookmarks to specify the HTTP port number.

Customizing HTTP and SSL/TLS ports

To customize HTTP and SSL/TLS ports

  1. Add the following lines to the custom.cfg file:

    -Dmcu.port.https=<port>
    -Dmcu.port.http=<port>

    where <port> is any port number not already in use on the machine hosting the server and -Dmcu.port.https is for SSL ports and -Dmcu.port.http is for non-SSL port.

    Note: The Command Line utilities and Web Services do not work unless you connect with the non-secure (http) port which allows the utility to discover the secure port.

    For more information about the Command Line utilities and Web Services, refer to these links:

    See Setting custom configuration settings for general information about customizing configuration settings for the mangement console.

Changing allowed ciphers

The cipher suites used by Jetty SSL are provided by the JVM. See Java Cryptography Architecture Oracle Providers Documentation.

The ciphers are used in preference order. If a vulnerability is discovered in a cipher (or if it is considered too weak to use), it is possible to include or exclude it in the Jetty configuration without the need to update the JVM.

For more information, see Disabling/Enabling Specific Cipher Suites. The jetty.server.dumpAfterStart property, described at the end of that topic is a useful aid for diagnosing Jetty configuration in general and SSL/TLS configuration in particular.

Active Directory

Note: When you are logged on as an Active Directory user, you can access information about Active Directory users, groups and computers. See Active Directory configuration for details.

This information is protected by using your credentials to securely connect to Active Directory using the GSS/SASL security layer for the LDAP protocol. Only the information that is visible to the Active Directory account to which you are logged on is available. While some of this information may be cached on the server, it is only available to the user that originally requested it, ensuring that the access control rules for Active Directory objects are honored by the Management Console for Unix server.

The mangement console may request Active Directory credentials when you perform tasks, such as the Check for AD Readiness or when you configure the Active Directory settings for a host. In this case, the credentials are not stored on the server, but are only used for the selected task.

Documents connexes