Configure Privilege Manager for Unix Policy Mode |
Configure host as primary or secondary policy group server: |
primary |
Enter secondary, then supply the primary server host name. |
Set Policy Group Name: |
<FQDN name of policy server> |
Enter Policy Group Name of your choice. |
Policy mode:
For more information about policy types, see Security policy types.
Sets policymode in pm.settings. (Policy "modes" are the same as policy "types" in the console.) |
sudo |
Enter pmpolicy |
Configure Security Policy |
Initialize the security policy? |
YES |
Enter No |
Configure Privilege Manager for Unix Daemon Settings |
Policy server command line options:
Sets pmmasterdopts in pm.settings. |
-ar |
Enter:
-
-a to send job acceptance messages to syslog.
-
-e <logfile> to use the error log file identified by <logfile>.
-
-r to send job rejection messages to syslog.
-
-s to send error messages to syslog. none to assign no options.
-a, -r, and -s override syslog no option; -e <logfile> overrides the pmmasterdlog <logfile> option. |
Enable remote access functions?
Sets clients in pm.settings. |
NO
Does not make system information on this host available to policy servers located on other hosts. |
Enter Yes to allow remote policy servers to connect to this primary policy server for remote I/O logging, or to access functions in the policy file.
Entering Yes allows you to list remote hosts. |
If Yes, list of remote hosts allowed to connect to this policy server? |
NO |
Enter Yes, then add remote hosts to list. |
Configure host as a PM Agent? |
NO |
Enter Yes, then configure command line options. |
If Yes, configure command line options for the agent daemon? |
pmlocaldopts is not set |
Enter:
-
-s to send error messages to syslog.
-
-e <logfile> to use the error log file identified by <logfile>.
-
-m to only accept connections from the policy server daemon on the specified host. (Use Multiple -m options to specify more than one host.)
-
none to assign no options.
These command-line options override the syslog and pmmasterdlog options configured in the pm.settings file. |
Configure pmlocald on this host? |
NO |
Enter Yes |
Configure policy server host components to communicate with remote hosts through firewall? |
NO |
Enter Yes |
Configure pmtunneld on this host? |
NO |
Enter Yes |
Define host services?
You must add service entries to either the /etc/services file or the NIS services map. |
YES
Adds services entries to the /etc/services file. |
Enter No |
Communications Settings for Privilege Manager for Unix |
Policy server daemon port number:
Sets masterport in pm.settings. |
12345 |
Enter a port number for the policy server to communicate with agents and clients. |
Specify a range of reserved port numbers for this host to connect to other defined Privilege Manager for Unix hosts across a firewall?
Sets setreserveportrange in pm.settings. |
NO |
Enter Yes, then enter a value between 600 and 1023:
-
Minimum reserved port. (Default is 600.)
-
Maximum reserved port. (Default is 1023.) |
Specify a range of non-reserved port numbers for this host to connect to other defined Privilege Manager for Unix hosts across a firewall?
Sets setnonreserveportrange in pm.settings. |
NO |
Enter Yes, then enter a value between 1024 and 65535:
-
Minimum non-reserved port. (Default is 1024.)
-
Maximum non-reserved port. (Default is 31024.) |
Allow short host names?
Sets shortnames in pm.settings. |
YES |
Enter No to use fully-qualified host names instead. |
Configure Kerberos on you
Sets kerberos in pm.settings.r network? |
NO |
Enter Yes, then enter:
-
Policy server principal name. (Default is host.)
-
Local principal name. (Default is host.)
-
Directory for replay cache. (Default is /var/tmp.)
-
Path for the Kerberos configuration files [krbconf setting]. (Default is /etc/opt/quest/vas/vas.conf.)
-
Full pathname of the Kerberos keytab file [keytab setting]. (Default is /etc/opt/quest/vas/host.keytab.) |
Encryption level:
For more details, see Encryption.
Sets encryption in pm.settings. |
AES |
Enter one of these encryption options:
|
Enable certificates?
Sets certificates in pm.settings. |
NO |
Enter Yes, then answer:
Generate a certificate on this host? (Default is NO.)
Enter Yes and specify a passphrase for the certificate.
Once configuration of this host is complete, swap and install keys for each host in your system that need to communicate with this host. For more details, see Swap and install keys. |
Activate the failover timeout? |
YES |
Enter Yes, then assign the failover timeout in seconds: (Default is 10.) |
Failover timeout in seconds:
Sets failovertimeout in pm.settings. |
10 |
Enter timeout interval. |
Configure Privilege Manager for Unix Logging Settings |
Send errors reported by the policy server and local daemons to syslog? |
YES |
Enter No |
Policy server log location:
Sets pmmasterdlog in pm.settings. |
/var/log/pmmasterd.log |
Enter a location. |
Install Privilege Manager for Unix Licenses |
XML license file to apply: |
(use the freeware product license) |
Enter enter location of the .xml license file.
Enter Done when finished. |
Password for pmpolicy user:
For more information about pmpolicy service account, see Configuring the primary policy server for Privilege Manager for Unix. |
|
Enter <password>
NOTE:: This password is also called the "Join" password. You will use this password when you add secondary policy servers or join remote hosts to this policy group. |