Chat now with support
Chat with Support

One Identity Management Console for Unix 2.5.2 - Administration Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Management Console for Unix Installing Management Console for Unix Preparing Unix hosts Working with host systems Managing local groups Managing local users Active Directory integration Authentication Services integration Privilege Manager integration
Getting started Configure a primary policy server Configure a secondary policy server Install PM agent or Sudo plugin on a remote host Security policy management
Opening a policy file Edit panel commands Editing PM policy files Reviewing the Access and Privileges by User report Reviewing the Access and Privileges by Host report
Event logs and keystroke logging
Reporting Setting preferences
User preferences System preferences
Security Troubleshooting tips
Auto profiling issues Active Directory Issues Auditing and compliance Cannot create a service connection point Check Authentication Services agent status commands not available CSV or PDF reports do not open Database port number is already in use Elevation is not working Hosts do not display Import file lists fakepath Information does not display in the console License information in report is not accurate Out of memory error Post install configuration fails on Unix or Mac Privilege Manager feature issues Profile task never completes questusr account was deleted Readiness check failed Recovering from a failed upgrade Reports are slow Reset the supervisor password Running on a Windows 2008 R2 domain controller Service account login fails Setting custom configuration settings Single Sign-on (SSO) issues JVM memory tuning suggestions Start/stop/restart Management Console for Unix service Toolbar buttons are not enabled UID or GID conflicts
System maintenance Command line utilities Web services Database maintenance About us

Reset the supervisor password

The supervisor is the only account that has rights to change the supervisor account password in System Settings.

You entered the password for the supervisor account when you initially configured Management Console for Unix. See Set Supervisor Password dialog for details.

The easiest way to change the supervisor password, is to log into the console as the supervisor, navigate to System Settings | General | Change Password and modify it there. If you have forgotten the current supervisor account, you can reset the supervisor password by making changes to the configuration file. However, you must have administrator rights on the computer to access the file.

To reset the supervisor password

  1. Locate the custom.cfg file.

    See Setting custom configuration settings for more information about customizing configuration settings for the mangement console.

  2. Add the following line to the end of the file:
    -Dforce.supervisor.password.reset=new_password

    where new_password is the new password.

  3. Save the custom.cfg file.
  4. Restart the Management Console for Unix service.
  5. Log onto the mangement console as supervisor and provide the new password.
  6. Remove the line added in Step 2 from the custom.cfg file and save the configuration file.

Note: If you leave the -Dforce.supervisor.password.reset parameter in the custom.cfg file, the mangement console will reset the specified password each time you start the service.

Running on a Windows 2008 R2 domain controller

When running Management Console for Unix on a Windows 2008 R2 Domain Controller, you must change your User Account Control Settings.

To change your User Account Control Settings

  1. From the Start menu, navigate to Control Panel | User Account | User Accounts | Change User Account Control settings.

  2. On the User Account Control Settings dialog, adjust the notification level to Never notify and click OK.

Service account login fails

There could be several reasons why you might receive an error message saying you could not log in with the user service account:

  • Account does not exist
  • Account has been disabled
  • Account has invalid gid or login shell
  • SSH server is not running
  • SSH keys are not configured properly
  • SSH server is not configured to allow login by means of SSH key
  • SElinux may be disallowing access to SSH server files needed for SSH key authentication

To troubleshoot your login failure,

  • Check your SSH server configuration to verify that public key authentication is enabled. (Refer to your SSH server configuration instructions for details.)
  • Test SSH key authentication with another user.
  • Reconfigure or disable SELinux.

Note: Configuring a service account on a host with Security-Enhanced Linux (SELinux) enabled might fail due to the enhanced security-related restrictions on the system. Contact Technical Support at https://support.oneidentity.com/ for instructions on how to either reconfigure or disable SELinux.

Setting custom configuration settings

When you start the Management Console for Unix service, it reads Java Virtual Machine (JVM) system properties from a configuration file.

You can set custom configuration settings by adding system properties, one per line, to the custom.cfg file, in the form:

-Dproperty=value.

The custom.cfg file is in the application data directory:

  • On Windows:
    %SystemDrive%:\ProgramData\Quest Software\Management Console for Unix\resources
  • On Unix/Linux:
    /var/opt/quest/mcu/resources

Here are some general tips for adding system properties to the custom.cfg file:

  • All system property declarations must be on its own line:
    -Xms512m 
    -Xmx512m
  • Do not enter multiple entries on a single line like this:
    -Xms512m -Xmx512m
  • A line preceded by a # character specifies a commented line and will be ignored.
  • The system property declarations are case sensitive. Be sure to enter lines to the custom.cfg file carefully.
  • Restart the console service to enable the system property declarations.

The following topics give you details about setting custom system properties:

Related Documents