Security Enhanced Linux (SELinux) allows users and administrators more control over access control.
To configure:
- Join the domain.
- After the join, run /opt/quest/bin/vastool configure selinux.
When complete, Safeguard Authentication Services works with the SELinux VAS module which contains a Red Hat Enterprise Linux SELinux policy for Authentication Services.
NOTE: The installation dependencies for the SELinux VAS module are:
- RHEL 6 & equivalent and higher
- policycoreutils-python (audit2allow)
- policycoreutils (semodule, restorecom)
- selinux-policy-devel (RHEL7) | selinux-policy (RHEL6)
NOTE: After installing the vasd-selinux policy, user home directories that were created prior to the policy being installed might have the incorrect SELinux security context label.
Workaround:
Run the following command to restore the home directories to their default file contexts:
$ /opt/quest/libexec/vas/selinux/configure_selinux.sh restore <*/home*>
where /home is the path to the users' home directories that need the correct SELinux context label. If no path is provided, /home is used by default.
vastool can automatically update the SELinux configuration files on your system.
To modify the SELinux configuration
- To configure SELinux to use the SELunix module, run the following command as root:
vastool configure selinux
- To remove the SELinux module configuration, run the following command as root:
vastool unconfigure selinux
Debug logging configuration depends on your platform and the subsystem you are troubleshooting. Some issues can span multiple subsystems.
Safeguard Authentication Services vasd daemon
To enable Safeguard Authentication Services daemon debug output, set the debug-level setting in the [vasd] section of vas.conf. Unless instructed otherwise by Technical Support, the recommended level is 5 for investigating issues. Refer to the vas.conf man page for details on debug log settings.
vasd logs events to syslog using the DAEMON facility. vasd dynamically picks up the change for both enabling and disabling without requiring a restart.
Authentication
Note: For both PAM and LAM, regardless of debug level, Safeguard Authentication Services outputs a success or failure message to AUTH (AUTHPRIV on Linux or macOS), for example:
<syslog prefix>: pam_vas: Authentication <succeeded> for <Active Directory> user:
<user1> account: <user1@example.com> service: <sshd> reason: <N/A> Access Control
Identifier(NT Name):<EXAMPLE1\user1>
The message indicates if the authentication was successful or failed, was disconnected, what type of account, if failed a general message as to why, what service if PAM, and the NT style name of the account used to authenticate against.
PAM
To enable PAM debug output, you must set the debug option for the Safeguard Authentication Services PAM module in the pam.conf file. This consists of adding debug trace to each pam_vas3 line in the appropriate files for the system. For more information, refer to the pam.conf man page for your platform.
When you enable debug output, Safeguard Authentication Services logs PAM output authentication events to syslog using the AUTH facility (AUTHPRIV on macOS and Linux). Normally this does not require a restart of an application to start debugging.
Note: On HP-UX, Oracle Solaris, and AIX, you can obtain additional PAM debug information by running touch /etc/pam_debug. This enables PAM library level debugging. To disable it, remove the "touched" file.
LAM
If you are using LAM for authentication on AIX, you can enable authentication debug output by running:
touch /var/opt/quest/vas/.qas_auth_dbg
When you enable this debug option, Safeguard Authentication Services logs LAM authentication events to /tmp/qas_module.log.
Identity
This includes debugging NSS on Linux, HP-UX, and Oracle Solaris and LAM identification on AIX. To enable full debugging of the Safeguard Authentication Services identity library for the operating system, run the following:
touch /var/opt/quest/vas/.qas_id_dbg
This enables debug globally for the system. Disable it by removing the "touched" file. Enabling and disabling applies within 30 seconds.
You can also enable debugging for a single application to send output to stderr by defining the environment variable QAS_ID_DBG_STDERR. For example, in a Bourne shell, enter:
QAS_ID_DBG_STDERR=1 getent passwd
The output includes a line that lists input, result, and time spent in the call. Enable only this line by running:
touch /var/opt/quest/vas/.qas_id_call
You can also use the environment variable, QAS_ID_CALL_STDERR to log the result line of the above debug.
This output is useful for profiling the volume/type of calls the Safeguard Authentication Services identity interface is receiving.
Output is written to the /tmp/qas_module.log file for both options.
Note: The /tmp/qas_module.log file is world writable making it possible for any user to write output to it. Thus, One Identity recommends that you change the permissions once debug is disabled.
vastool
Safeguard Authentication Services command line tools accept a -d parameter to indicate the level of debug output (1-5) you want to print to the console. To see more output, specify a higher value to the -d parameter. For example, to see extra diagnostic information when you join the domain, enter:
/opt/quest/bin/vastool -u administrator -d5 join example.com
Note: When you have debug enabled, it can affect performance.
With the Windows 2003 R2 schema, you can access netgroup data based on RFC 2307 stored in Active Directory through the Safeguard Authentication Services name service module. Safeguard Authentication Services caches the netgroup information locally. This netgroup support is built in to the name service module and does not require the Safeguard Authentication Services LDAP proxy service to be running.
Note: Netgroup data through the Safeguard Authentication Services name service module is only supported on Linux, Oracle Solaris, HP-UX, and AIX.
