Return
-
Title
What needs to be done to change the IP address on a Privilege Manager server? -
Description
What needs to be done to change the IP address on a Privilege Manager server? -
Resolution
FIrst, make sure that the IP ranges can talk to each other and that there aren't any firewalls between the two. If there are any firewalls, make sure they are configured to allow Privilege Manager traffic before making any other changes.It's not really a good idea to change the IP address of a policy server once it's been configured. Instead, it would be better to unconfigure the policy server(s), change their IPs and then reconfiguring the policy server(s). Once the policy server(s) are up with their new IP addresses, all of the sudo plugin hosts will need to be rejoined to the policy group.Note that for Privilege Manager for Sudo the plugin hosts will still be able to use sudo commands while the policy server(s) are down, because they will still have an offline copy of the sudoers policy from before the servers were unconfigured. Of course, the policy cannot be updated until the primary policy server is back on-line, so you should try to ensure that the primary policy server is not down for an extended period of time.When you run the "pmsrvconfig -u" command it will warn you that the agents will be disabled when the policy server is unconfigured, however this message only applies to Privilege Manager for Unix agents because they require a server for policy evaluation. Privilege Manager for Sudo plugins can run without a server for a period of time, because they are capable of evaluating a cached copy of the policy locally.