Privilege Manager for Unix 7.2.1 - Administration Guide

A description of the profile.

EXAMPLE:

pf_profiledescription = "This is a description of this profile."

Set to true to enable the profile.

EXAMPLE:

pf_enableprofile = true;

Enables tracing/debugging output at different levels:

• 1: show reason for reject
• 2: verbose output
• 3: show debug trace

EXAMPLE:

pf_tracelevel = 1;

Set to true to enable keystroke logging.

EXAMPLE:

pf_enablekeystrokelogging = true;

The directory in which to store I/O logs. A unique file is created in this directory for each keystroke logging session.

EXAMPLE:

pf_iologdir = "/var/opt/quest/qpm4u/iolog/";

Set to false to avoid writing passwords to the keystroke log. The password detection is determined by the pf_passprompts list.

EXAMPLE:

pf_logpasswords = false;

A list of strings interpreted as password prompts in stdout.

EXAMPLE:

pf_passprompts = {"[pP]assword[ :]*"};

Set to true to enable PAM authentication. By default, the submit user is authenticated on the master host using the sshd service.

EXAMPLE:

pf_enableauthentication = true;

Set to true to require authentication on the client. If set to false, users are authenticated on the server, not on the client.

EXAMPLE:

pf_authenticateonclient = true;

Authentication is only required if pf_enableauthentication = true.

Identifies the PAM service to use when authenticating to PAM.

EXAMPLE:

pf_pamservice = "sshd";

Configures the prompt to use with PAM.

EXAMPLE:

pf_pam_prompt = "Password: ";

Specifies the paths from which commands are permitted to run. Empty lists are ignored. If not empty, this variable is passed to the agent for authorization at the point where the command is about to be run; the agent will then reject a command unless it is run from one of these paths.

For a shell profile, this restriction is applied to the shell program itself, and to commands run from within the shell.

EXAMPLE:

pf_authpaths = {

   # no path restrictions

};

Commands authorized to run; commands not in the list are rejected.

Considerations:

• If you specify a fully qualified path in pf_authcmds, you must specify the fully qualified path in the requested command.
• glob is used to match the path, so be careful when using wild cards in the path.
• You can precede an entry with an optional NOEXEC flag to ensure that the run command is blocked from forking any child processes. Put the flag at the beginning of the string and enclose the flag with '[]'.

EXAMPLE:

pf_authcmds = {

"/usr/bin/id *"

};

Set to true to allow commands to run on a different host when running pmrun with the -h option .

EXAMPLE:

pf_enableremotecmds = false;

Specifies the list of commands accepted by pmmasterd when run from within the shell. pmmasterd authorizes listed commands and they produce an event in the audit log. If pf_shellcommandsaccept is not empty, any matching command is accepted; all others are rejected.

Considerations:

• Only configure pf_shellcommandsreject or pf_shellcommandsaccept.
• If both lists are empty, then all commands are accepted.
• Only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_shellcommandsaccept = {

};

Specifies the list of commands rejected by pmmasterd when run from within the shell. pmmasterd authorizes listed commands and they produce an event in the audit log. If pf_shellcommandsreject is not empty, any matching command is be rejected; all others are accepted.

Considerations:

• Only configure pf_shellcommandsreject or pf_shellcommandsaccept.
• If both lists are empty, then all commands are accepted.
• Only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_shellcommandsreject = {

};

Set to true to use shell builtins just like commands.

This only applies to pmksh, pmcsh, and pmsh.

EXAMPLE:

pf_checkbuiltins = true;

Message to display when a user attempts to run a forbidden command.

This only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_shellreject = "You are not permitted to run this command";

Defines the list of pre-authorized commands allowed by the shell without further authorization by the master. The shell interprets each item in this list as a regular expression. Listed commands do not result in an audit event in the event log.

This only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_shellallow = {

"(^|/)(exit|pwd|echo)$",

};

Defines the list of pre-authorized commands allowed by the shell without further authorization by the master, but only in the case where std input is from a pipe (for example, ls | more). The shell interprets each item in this list as a regular expression. Listed commands do not result in an audit event in the eventlog.

This only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_shellallowpipe = {

"(^|/)(awk|more|grep)$",

   # allow pipe to innocuous common commands

};

Hosts where commands can run. If not empty, you can submit commands from any host in this list.

EXAMPLES:

pf_authsubmithosts = {"host1"};

   # allow cmds from host host1 only

pf_authsubmithosts = {"*.one.two"};

   # allow cmds from *.one.two only

pf_authsubmithosts = {ALL};

   # allow cmds from all hosts

SAFEHOSTS = {"*.one.two"};

pf_authsubmithosts = {SAFEHOSTS};

   # allow cmds from *.one.two only

Active Directory host groups where commands can run. If not empty, you can submit commands from any host in this list. You can specify an Active Directory domain name as part of the arguments; for example, as <domain>/<name>, <domain>\\<name>, or <name>. If a domain is not specified, then it uses the default joined domain.

These lists do not support wild cards.

EXAMPLES:

pf_authrunhostsad = { "TESTDOM1/testhosts1", "TESTDOM2/dbhosts1"};

   # match any member of either AD group

pf_authrunhostsad = { "testhosts1" };

   # match members in the specified AD group in the default joined domain

pf_authrunhostsad = {

};

   # match no AD groups

Hosts where commands can be submitted. If not empty, you can submit commands from any host in this list.

EXAMPLES:

pf_authsubmithosts = {"host1"};

   # allow cmds from host host1 only

pf_authsubmithosts = {"*.one.two"};

   # allow cmds from *.one.two only

pf_authsubmithosts = {ALL};

   # allow cmds from all hosts

SAFEHOSTS = {"*.one.two"};

pf_authsubmithosts = {SAFEHOSTS};

   # allow cmds from *.one.two only

Active Directory host groups where commands can be submitted. If not empty, you can submit commands from any host in this list. You can specify a domain name as part of the arguments; for example, as <domain>/<name>, <domain>\\<name>, or <name>. If a domain is not specified, then it uses the default joined domain.

These lists do not support wild cards.

EXAMPLES:

pf_authsubmithostsad = { "TESTDOM1/testhosts1", "TESTDOM2/dbhosts1"};

   # match any member of either AD group

pf_authsubmithostsad = { "testhosts1" };

   # match members in the specified AD group

   # in the default joined domain

pf_authsubmithostsad = {

};

   # match no AD groups

Hosts where members are forbidden to run commands. If not empty, you can submit commands from any host NOT in this list.

EXAMPLES:

pf_forbidrunhosts = {"fred"}; i

   # allow cmds to all hosts except fred

pf_forbidrunhosts = {"*.one.two"};

   # allow cmds to all hosts except *.one.two

BADHOSTS = {"*.one.two"};

pf_forbidrunhosts = {BADHOSTS};

   # allow cmds to all hosts except *.one.two

Active Directory host groups where members are forbidden to run commands. If not empty, you can submit commands from any host NOT in this list. You can specify a domain name as part of the arguments; for example, as <domain>/<name>, <domain>\\<name>, or <name>. If a domain is not specified, then it uses the default joined domain.

These lists do not support wild cards.

EXAMPLES:

pf_forbidrunhostsad = { "TESTDOM1/testhosts1", "TESTDOM2/dbhosts1"};

   # match any member of either AD group

pf_forbidrunhostsad = { "testhosts1" };

   # match members in the specified AD group in the default joined domain

pf_forbidrunhostsad = { };

   # match no AD groups

Hosts where members are forbidden to submit commands. If not empty, you can submit commands from any host NOT in this list.

EXAMPLES:

pf_forbidsubmithosts = {"host1"};

   # allow cmds from all hosts except host1

pf_forbidsubmithosts = {"*.one.two"};

   # allow cmds from all hosts except *.one.two

BADHOSTS = {"*.one.two"};

pf_forbidsubmithosts = {BADHOSTS};

   # allow cmds from all hosts except *.one.two

Identifies the list of users that match this profile.

EXAMPLES:

pf_authusers = {

};

   # No users assigned to this profile

pf_authusers = { "jsmith", "dbrown"};

   # match either user

pf_authusers = { ALL};

   # match all users

DBUSERS={"TESTDOM1/fred", "TESTDOM2/john"};

   # allow cmds from /bin,/usr/bin,/tmp

pf_authusers = { "jsmith*", DBUSERS};

   # match fred, john & jsmith*

Identifies the runas user.

EXAMPLE:

pf_authuser = user;

The runas user can be:

• Any valid user name on the agent, such as:

  pf_authuser = "fred";

     # run command as fred

• A user variable or empty string ("") to run the command as the submit user; that is, set runuser=user (the default)

  pf_authuser = user;

     # run command as submit user

  pf_authuser = "";

     # run command as submit user

• The requestuser variable to run the command as the user selected using the pmrun -u user option.

  pf_authuser = requestuser;

     # run command as the requested user

You can assign users to this profile by group membership on the client or server host, or by assigning individual user names. By default the group membership is verified against the submit user's group information passed on from the client host by pmrun. You can configure it to verify the group membership on the master host instead, using the pf_useservergroupinfo variable.

EXAMPLES:

pf_authgroups = { "admins", "dbas"};

   # match any member of either group

pf_authgroups = { ALL};

   # match all groups

DBGROUPS = {"db*"};

pf_authgroups = { DBGROUPS, "root"};

   # match all db* groups and root

If accepted, the request runs with the specified group as the rungroup.

EXAMPLE:

pf_authgroup = use_rungroup;

The rungroup can be:

• Any valid group name on the agent, such as:

  pf_authgroup ="fred";

     # run command as group fred

• A group variable or empty string ("") to run the command as the submit group; that is, set rungroup=group (the default)

  pf_authgroup = group;

     # run command as submit group

  pf_authgroup = "";

     # run command as submit group

• The use_rungroup constant to defer setting the rungroup to pmlocald; pmlocald will obtain the runuser's primary group and use that.

  pf_authgroup = use_rungroup;

     # run command as runuser's group on the agent

Set to true to check that the user is a member of one of the pf_authgroups on the master host, otherwise check the user's group membership on the client host.

EXAMPLE:

pf_useservergroupinfo = false;

Set to true to enforce the time restrictions in the restrictionHours list.

EXAMPLE:

pf_enabletimerestrictions = true;

Start and End time of allowed time period. Set to "*" or empty string to disable time restrictions. Use 24-hour format, with no leading zero.

EXAMPLES:

pf_restrictionhours = {"8:00", "18:00};

   # 8am - 8pm

pf_restrictionhours = {"22:00", "07:00};

   # 10pm - 7am

pf_restrictionhours = {"", ""};

   # no restrictions

pf_restrictionhours = {"*", "*"};

   # no restrictions

Configures the actual date restrictions applied if pf_enabletimerestrictions is set to true. Specify Start and End dates using yyyy/mm/dd format.

EXAMPLES:

pf_restrictiondates = {"2012/01/01", ""};

   # no expiry

pf_restrictiondates = {"", "2012/01/01"};

   # no start date

pf_restrictiondates = {"2012/01/01", "2012/12/31"};

   # check start and end date

pf_restrictiondates = {"", ""};

   # no restrictions

pf_restrictiondates = {"*", "*"};

   # no restrictions

List of allowed shells. Do not specify full paths. This list is not compared with the runcommand, instead it is compared with the special pmshell_prog variable set by a Privilege Manager for Unix shell.

Only applies to pmksh, pmcsh, pmsh, pmbash, and pmshellwrapper.

EXAMPLE:

pf_allowshells ={"pmksh", "pmcsh", "pmsh", "pmshellwrapper"};

Set to true to run the shell in restricted mode.

This means:

• user cannot change directory
• user cannot change PATH, ENV, SHELL
• user can only run programs in PATH
• no absolute/relative paths allowed
• user cannot use io redirection with the '>' or '<' characters

Only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_restricted = true;

List of environment variables to treat as read-only. In restricted mode, the PATH, ENV, and SHELL variables are always read-only.

Only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_shellreadonly = {};

Defines the initial directory where the shell program will be run. The default is to use the runuser's home directory. This is particularly relevant for shells running in restricted mode, where the user cannot change the directory.

This only applies to pmksh, pmcsh, pmsh, and pmbash.

EXAMPLE:

pf_shellcwd = use_rundir;