Chat now with support
Chat with Support

Privilege Manager for Unix 6.1.1 - Administration Guide for Unix

One Identity Privileged Access Suite for Unix Introducing Privilege Manager for Unix Planning Deployment Installation and Configuration Upgrade Privilege Manager for Unix System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager Variables Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures Privilege Manager programs Installation Packages

Read-only variable list

Use the pmshell_readonly list variable to define a list of environment variables in the policy file to be read-only in the shell. You can not change read-only variables during a shell session.

Running a shell in restricted mode

Set pmshell_restricted=1 to configure the shell to run in restricted mode. Restricted mode applies these restrictions to the shell:

  • A user cannot change the directory.
  • A user cannot change the value of these parameters: PATH, SHELL, or ENV. You must set these up using the secure profile (if the user is running a login shell), or by setting these variables in the policy file.
  • A user cannot run any command that is identified by an absolute or relative pathname, including absolute paths defined in shell aliases. The user can only run shell built-in commands or executable files that are in the read-only PATH. For example, the following commands are not allowed:
    • /usr/bin/ls
    • ./script.sh
    • alias ll='/bin/ls -F'

    The commands ls and script.sh are allowed if /usr/bin and . are in the PATH; the command ll would not be allowed because the substituted command is an absolute path.

  • A user cannot use I/O redirection with the ">" or "<" characters.

    For example, the following command will fail:

    echo "hello" > /tmp/file
  • A user cannot run in privileged mode (if supported by the shell).

If the shell is run as a login shell for a user, then during the login process, the relevant system and user profiles are loaded for that particular shell. During this sequence, the shell checks the ownership and permissions of each startup file loaded.

Any restrictions configured for the shell are not applied while loading a secure profile; that is, a file owned by root and only writable by root. Any restrictions configured for the shell are only applied if the profile is not secure. For example, if PATH is configured as a read-only variable in the policy file, and the built-in command cd is forbidden, then the PATH initialization in the secure system profile /etc/profile is allowed without restriction or authorization, but any attempt to change the PATH variable or to run the cd command in the insecure user’s personal profile, or during the interactive login session will be forbidden.

Additional shell considerations

The order in which the restrictions are applied to the shell are:

  1. forbidden commands list
  2. allowed commands list
  3. allowed pipe list, if the input is a pipe

The shell, and the commands run from within it, run as the selected runuser and rungroup for the shell program. Once the shell is running, you cannot change the runuser or rungroup for authorized commands within the shell. To run an individual shell command as a different user, run the pmrun <cmd>.

You can change the arguments to a command running within a shell, the environment variables, and the priority for a command. For example, if you configure the shell to authorize built-in commands, then you can prevent a user from changing to any directory other than the user’s home directory by removing all except the first argument from the cd command. For example:

if (runcommand=="cd")
{
   len=length(runargv);
   runargv=replace(runargv,1,len);
}

The exec command is always forbidden if an attempt is made to run it from the top-level interactive shell process, as this would overlay the existing controlled Privilege Manager shell with an unrestricted shell. For example, an attempt to run this command from an interactive shell is forbidden:

exec /bin/sh

A Privilege Manager-enabled shell requires two connections to the policy server host. One is used for keystroke logging by the shell program itself, and one is used for authorizing commands to be run during the shell session.

Example
allowed_pmshells = { "pmsh", "pmcsh", "pmksh" };
# pmshell only defined if a shell or cmd within a shell
if (defined pmshell)
{
   # Configure Privilege Manager Shells
   if ( pmshell_cmd == 0) {
      if ( pmshell_prog in allowed_pmshells ) {
         print("Starting Privilege Manager Shell");

         pmshell_restricted=0;
            # Restricted Shell: 0=disable|1=enable
         pmshell_checkbuiltins=0;
            # Force checking of Shell BuiltIns: 0=disable|1=enable
      pmshell_allow={"ls", "man"};
            # list of commands to accept without further authorization.
      accept;
   }
   else {
      reject "You are not authorized to run this shell";
   }
}
# Authorize all commands executed from within a shell
else {
   # Define list of commands allowed to run as the root user.
   privileged_cmds = { "/sbin/service", "/usr/bin/kill", "/usr/bin/id" };
      if ( command in privileged_cmds ) {
         runuser = "root";
         rungroup = "root";
      }
      print("Executing command as user: " + runuser);
      accept;
   }
}

Configuring Privilege Manager for policy scripting

If you have successfully completed the Privilege Manager installation and you are new to Privilege Manager for Unix, One Identity recommends that you work through the semi-interactive lessons in Policy scripting tutorial. This will help familiarize you with the basic functionality of Privilege Manager.

Related Documents