If you are configuring Safeguard Authentication Services on VMware ESX Server vSphere (ESX 4.0) you must decide if you want to use the ESX interface for managing access control, or if you want to use standard Safeguard Authentication Services methods for managing who is allowed access to the machine by means of the users.allow and users.deny files.
By default, ESX has its own access control list stored in /etc/security/access.conf. After joining a domain, this file does not have any Safeguard Authentication Services users in it; thus, no Safeguard Authentication Services users will have access to the machine. If you do not modify the ESX access control list to allow specific Safeguard Authentication Services users, you must allow all users in /etc/security/access.conf and begin managing access control through the Safeguard Authentication Services users.allow and users.deny files.
Safeguard Authentication Services allows you to not only use UNIX-enabled groups in sudo access control rules, One Identity provides the sudo_vas group provider module in Safeguard Authentication Services to allow you to use non-UNIX-enabled Active Directory groups in sudo access control rules.
Note: This feature requires Sudo 1.8. If you are upgrading from One Identity Sudo 1.7, you must move the sudoers file from /etc/opt/quest/sudo/sudoers to /etc/sudoers.
sudo_vas uses Safeguard Authentication Services to determine group membership. Once you enable sudo_vas, sudo uses it to resolve groups that are not known to the local system by means of the Name Service Switch (NSS).
Note: Refer to the sudo_vas man page for more information on the sudo add-on features provided by Safeguard Authentication Services.
You enable sudo_vas by running vastool configure sudo. This command configures sudo to allow access control based on Active Directory groups that are not UNIX-enabled. The vastool configure sudo command inserts the group_plugin line into the sudoers file, which ensures it uses the correct path and remains valid.
NOTE: When using the sudo_vas group_plugin option with Safeguard for Sudo, the path to the sudo_vas group_plugin must be the same on all servers and any system with a joined Safeguard for Sudo plugin. This means you may need to create a symbolic link to the library on those systems for Safeguard for Sudo to resolve those Active Directory groups when handling offline mode requests. The symbolic link must refer to the actual path for the sudo_vas group_plugin library on that system.
The group_plugin line looks similar to:
Defaults group_plugin="/opt/quest/lib/libsudo_vas.so"
The location of the configuration file (sudoers file) is determined automatically if visudo is in your PATH.
Generally, you can enable the sudo_vas module by running:
vastool configure sudo
Alternatively, you can provide the path to visudo with the -V option, or the path to a sudoers file with the -f option by running one of the following:
vastool configure sudo is not run automatically as part of vastool join. You must run vastool configure sudo explicitly if you intend to use non-UNIX-enabled groups in your sudo configuration.
NOTE: For more information about enabling sudo_vas, see the vastool man page.
Group Policy supports the ability to distribute trusted certificates. Certificates in the "Trusted Root Certification Authorities" and "Intermediate Certification Authorities" group policies (located at <Policy_Object_Name>/Computer Configuration/Windows Settings/Security Settings/Public Key Policies/) are automatically copied to the UNIX host. After group policy has applied them, the certificates are located at /var/opt/quest/vas/certs/CA/ and are automatically copied into Keychain on macOS.
Refer to the following link for the procedure to add a trusted root certification authority to a Group Policy object: http://technet.microsoft.com/en-us/library/cc738131%28v=ws.10%29.aspx
