Chat now with support

Privilege Manager for Sudo 6.1 Common Documents - Administration Guide

콘텐츠 탐색

One Identity Privileged Access Suite for Unix Introducing Privilege Manager for Sudo

Features and benefits of Privilege Manager for Sudo How Privilege Manager for Sudo works

Planning Deployment

System requirements

Supported platforms Reserve special user and group names Required privileges

Estimating size requirements Privilege Manager licensing Deployment scenarios

Single host deployment Medium business deployment Large business deployment

Installation and Configuration

Download Privilege Manager for Sudo software packages Quick start and evaluation

Installing the Management Console Uninstalling the Management Console

Configure a Primary Policy Server

Checking the server for installation readiness

TCP/IP configuration Firewalls Hosts database Reserve special user and group names Policy server daemon hosts Sudo 1.8.x

Installing the Privilege Manager packages

Adding directories to PATH environment

Configuring the Privilege Manager for Sudo Primary Policy Server

Privilege Manager for Sudo Server Configuration Settings

Join hosts to policy group

Joining Sudo Plugin to Policy Server Swap and install keys

Configure a secondary policy server

Installing secondary servers Configuring a secondary server

Synchronizing policy servers within a group

Install Sudo Plugin on a remote host

Checking Sudo Plugin Host for installation readiness Installing a Sudo Plugin on a remote host Joining a Sudo Plugin to a primary policy server Verifying Sudo Plugin configuration Load balancing on the client

Remove configurations

Uninstalling the Privilege Manager software packages Uninstalling Privilege Manager for Sudo on macOS

Upgrade Privilege Manager for Sudo

Before you upgrade Upgrading Privilege Manager packages

Upgrading the server package Upgrading the Sudo Plugin package

Removing Privilege Manager packages

Removing the server package Removing the Sudo Plugin package

System Administration

Reporting basic policy server configuration information Checking the status of the master policy Checking the policy server Checking policy server status Checking the Sudo Plugin configuration status Installing licenses

Displaying license usage

Listing policy file revisions Viewing differences between revisions Backup and recovery

Managing Security Policy

Security policy types Specifying security policy type The sudo type policy Viewing the security profile changes

Administering Log and Keystroke Files

Configuring keystroke logging for Privilege Manager for Sudo policy

Validating Sudo commands

Event logging Keystroke (I/O) logging

Viewing the log files using a web browser Viewing the log files using command line tools Listing event logs Backing up and archiving event and keystroke logs

Troubleshooting

Enabling sudo policy debug logging Enabling tracing for Sudo Plugin Join fails to generate a SSH key for sudo policy Join to policy group failed on Sudo Plugin Load balancing and policy updates Policy servers are failing Sudo command is rejected by Privilege Manager for Sudo Sudo policy is not working properly

Privilege Manager Variables

Global input variables

argc argv client_parent_pid client_parent_uid client_parent_procname clienthost command cwd date day dayname domainname env false gid group groups host hour masterhost masterversion minute month nice nodename pid pmclient_type pmclient_type_pmrun pmclient_type_sudo pmversion ptyflags requestlocal requestuser samaccount status submithost submithostip thishost time true ttyname tzname uid umask unameclient uniqueid user year

Global output variables

disable_exec eventlog iolog logstderr logstdin logstdout

Global event log variables

event exitdate exitstatus exittime

PM settings variables

Privilege Manager programs

pmcheck pmjoin_plugin pmkey pmlicense pmloadcheck pmlog pmlogadm pmlogsearch pmlogsrvd pmlogxfer pmmasterd pmplugininfo pmpluginloadcheck pmpolicy pmpolicyplugin pmpoljoin_plugin pmpolsrvconfig pmremlog pmreplay

Navigating the log file

pmresolvehost pmserviced pmsrvcheck pmsrvconfig pmsrvinfo pmsum pmsysid

Installation Packages

Package locations Installed files and directories

Unsupported Sudo Options

Unsupported command line sudo options Behavioral change Unsupported Sudoers policy options Unsupported Sudoers directives

Privilege Manager for Sudo Policy Evaluation

requestlocal

Description

Type integer READONLY

Indicates if the request is local. requestlocal is always set to true for sudo commands.

requestuser

Description

Type string READONLY

requestuser is initialized to the selected user name if you select the sudo –u option. It is a request to set the runuser for the session to the selected user name. The administrator can decide whether to honor the request in the policy file. By default, this variable is set to the value of the user variable.

samaccount

Description

Type string READONLY

The user's sAMAccountName for the submit user if Authentication Services is configured and the client is able to determine the sAMAccountName. Otherwise this variable is set to an empty string.

Related Topics

status

Description

Type integer READONLY

status contains the exit status of the most recent command run by the system function.

관련 문서

© 2019 One Identity LLC. ALL RIGHTS RESERVED. Feedback 이용 약관 개인정보 보호정책