Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Privilege Manager for Unix 7.1 - Administration Guide

Table of Contents

Introducing Privilege Manager for Unix

What is Privilege Manager for Unix Benefits of Privilege Manager for Unix How Privilege Manager for Unix protects

Partition root safely Create an indelible audit trail Encryption

How Privilege Manager for Unix works

Policy configuration file (pmpolicy security policy) Policy group

Planning Deployment

System requirements

Supported platforms Reserve special user and group names Required privileges

Estimating size requirements Privilege Manager for Unix licensing Deployment scenarios

Single host deployment Medium business deployment Large business deployment Enterprise deployment

Installation and Configuration

Downloading Privilege Manager for Unix software packages Quick start and evaluation

Installing the Management Console Uninstalling the Management Console

Configure a Primary Policy Server

Checking the server for installation readiness

TCP/IP configuration Firewalls Hosts database Reserve special user and group names Applications and file availability Policy server daemon hosts Local daemon hosts

Installing the Privilege Manager for Unix packages

Modifying PATH environment variable

Configuring the primary policy server for Privilege Manager for Unix

pmpolicy server configuration settings Verifying the primary policy server configuration Recompile the whatis database

Join hosts to policy group

Joining PM Agent to a Privilege Manager for Unix policy server

Agent configuration settings Swap and install keys

Configure a secondary policy server

Installing secondary servers Configuring a secondary server

Synchronizing policy servers within a group

Install PM Agent on a remote host

Checking PM Agent host for installation readiness Installing a PM Agent on a remote host Joining the PM Agent to the primary policy server Verifying PM Agent configuration Load balancing on the client

Remove configurations

Uninstalling the Privilege Manager for Unix software packages

Upgrade Privilege Manager for Unix

Before you upgrade Upgrading Privilege Manager for Unix packages

Upgrading the server package Upgrading the PM Agent package

Removing Privilege Manager for Unix packages

Removing the server package Removing the PM Agent package

System Administration

Reporting basic policy server configuration information Checking the status of the master policy Checking the policy server Checking policy server status Checking the PM Agent configuration status Installing licenses

Displaying license usage

Listing policy file revisions Viewing differences between revisions Backup and recovery

Managing Security Policy

Security policy types Specifying security policy type pmpolicy type policy Modifying complex policies Viewing the security profile changes

The Privilege Manager for Unix Security Policy

Default profile-based policy (pmpolicy)

Policy profiles Profile-based policy files Profile selection Profile variables

Exploring profiles Customizing the default profile-based policy (pmpolicy)

Customization example - pf_forbidusers list

Policy scripting tutorial

Install the example policy file Create test users Set Lesson number variable Introductory lessons

Lesson 1: Basic policy Lesson 2: Conditional privilege Lesson 3: Specific commands Lesson 4: Policy optimization with list variables Lesson 5: Keystroke logging Lesson 6: Conditional keystroke logging Lesson 7: Policy optimizations

Advanced lessons

Lesson 8: Controlling the execution environment Lesson 9: Flow control Lesson 10: Basic menus

Sample policy files

Main policy configuration file Lesson 1 Sample: Basic policy Lesson 2 Sample: Conditional privilege Lesson 3 Sample: Specific commands Lesson 4 Sample: Policy optimizations with list variables Lesson 5 Sample: Keystroke logging Lesson 6 Sample: Conditional keystroke logging Lesson 7 Sample: Policy optimizations Lesson 8 Sample: Controlling the execution environment Lesson 9 Sample: Flow control Lesson 10 Sample: Basic menus

Advanced Privilege Manager for Unix Configuration

Privilege Manager for Unix shells

Privilege Manager for Unix shell features Forbidden commands Allowed commands Allowed piped commands Check shell built-in commands Read-only variable list Running a shell in restricted mode Additional shell considerations

Configuring Privilege Manager for Unix for policy scripting

Configuration prerequisites Configuration file examples

Example 1: Basics Example 2: Accept or reject requests Example 3: Command constraints Example 4: Lists Example 5: I/O logging, event logging, and replay Example 6: More complex policies Example 7: Use variables to store constraints Example 8: Control the run-time environment Example 9: Switch and case statements Example 10: Menus

Use the while loop Use parallel lists Best practice policy guidelines Multiple configuration files and read-only variables Mail Environmental variables NIS netgroups Specify trusted hosts

Configuring firewalls

Privilege Manager for Unix port usage Restricting port numbers for command responses Configuring pmtunneld Configuring Network Address Translation (NAT)

Configuring Kerberos encryption Configuring certificates

Enable configurable certification

Configuring alerts Configuring Pluggable Authentication Method (PAM)

Utilizing PAM authentication Authenticate PAM to client

Administering Log and Keystroke Files

Controlling logs Local logging

Event logging Keystroke (I/O) logging

Keystroke (I/O) logging policy variables

Central logging with Privilege Manager for Unix Controlling log size with Privilege Manager for Unix Viewing the log files using a web browser Viewing the log files using command line tools Listing event logs Backing up and archiving event and keystroke logs

InTrust Plug-in for Privilege Manager for Unix

InTrust Plug-in requirements Installing InTrust Plug-in components InTrust Plug-in installation prerequisites Configuring the policy server for the InTrust Plug-in Installing the InTrust Knowledge Pack

InTrust Knowledge Pack objects

Installing the InTrust Reporting Pack Configuring the InTrust data collection Viewing InTrust reports Generating reports

Gathering InTrust data

Troubleshooting

Displaying profile-based policy debug information Enabling program-level tracing Load balancing and policy updates Policy servers are failing

Privilege Manager for Unix Policy File Components

Lexical and syntactic productions Data types Operators and expressions

Privilege Manager for Unix Variables

Variable names Variable scope Global input variables

alertkeymatch argc argv bkgd client_parent_pid client_parent_uid client_parent_procname clienthost command cwd date day dayname domainname env false FEATURE_LDAP FEATURE_VAS gid group groups host hour masterhost masterversion minute month nice nodename optarg opterr optind optopt optreset optstrictparameters pid pmclient_type pmclient_type_pmrun pmclient_type_sudo pmshell pmshell_builtin pmshell_cmd pmshell_cmdtype pmshell_exe pmshell_interpreter pmshell_prog pmshell_script pmshell_uniqueid pmversion ptyflags requestlocal requestuser rlimit_as rlimit_core rlimit_cpu rlimit_data rlimit_fsize rlimit_locks rlimit_memlock rlimit_nofile rlimit_nproc rlimit_rss rlimit_stack samaccount selinux status submithost submithostip thishost time true ttyname tzname uid umask unameclient unamemaster uniqueid use_rundir use_rungroup use_rungroups use_runshell user year

Global output variables

alertkeyaction alertkeysequence disable_exec eventlog eventloghost execfailedmsg iolog iolog_encrypt iolog_errmax iolog_opmax iologhost log_passwords logomit logstderr logstdin logstdout notfoundmsg passprompts pmshell_allow pmshell_allowpipe pmshell_checkbuiltins pmshell_forbid pmshell_readonly pmshell_reject pmshell_restricted preserve_clienthost profile_keepenv profile_setenv profile_unsetenv profile_use_runuser rejectmsg runargv runbkgd runchroot runcksum runclienthost runcommand runconfirmuser runcwd runenablerlimits runenv rungroup rungroups runhost runnice runpaths runptyflags runrlimit_as runrlimit_core runrlimit_cpu runrlimit_data runrlimit_fsize runrlimit_locks runrlimit_memlock runrlimit_nofile runrlimit_nproc runrlimit_rss runrlimit_stack runtimeout runumask runuser runutmpuser subprocuser tmplogdir

Global event log variables

alertdate alerttime event exitdate exitstatus exittime

PM settings variables

Privilege Manager for Unix Flow Control Statements

accept, reject break continue do-while for loop for loop function if-else include procedure / function readonly readonlyexcept return switch while

Privilege Manager for Unix Built-in Functions and Procedures

Environment functions

getenv getlistsetting getnumericsetting getstringsetting getyesnosetting keepenv policygetenv policysetenv policyunsetenv setenv unsetenv

Hash table functions

hashtable_add hashtable_create hashtable_enum hashtable_import hashtable_lookup

Input and output functions

fprintf input inputnoecho print printf printnnl printvars readdir readfile sprintf syslog

ldap_ bind ldap_count_entries ldap_dn2ufn ldap_explode_dn ldap_first_attribute ldap_first_entry ldap_get_attributes ldap_get_dn ldap_get_values ldap_next_attribute ldap_next_entry ldap_open ldap_search ldap_unbind

LDAP API example List functions

append insert join length lsubst range replace search split splitSubst

Miscellaneous functions Password functions

getgrouppasswd getstringpasswd getuserpasswd

Remote access functions

remotefileexists remotegroupinfo remotegrouplist remotesysinfo remoteusergroups remoteuserinfo remoteuserlist

String functions

match pad strindex strlen strsub sub subst substr

User information functions

getfullname getgroup getgroups gethome getshell

Authentication Services functions

vas_auth_user_password vas_host_in_ADgrouplist vas_host_is_member vas_user_get_groups vas_user_in_ADgrouplist vas_user_is_member

Privilege Manager for Unix programs

pmbash pmcheck pmclientd pmclientinfo pmcp pmcsh pmincludecheck pminfo pmjoin pmkey pmksh pmless pmlicense pmlist pmloadcheck pmlocald pmlog pmlogadm pmlogsearch pmlogsrvd pmmasterd pmmg pmpasswd pmpolicy pmpolicyconvert pmpolsrvconfig pmremlog pmreplay

Navigating the log file

pmresolvehost pmrun pmscp pmserviced pmsh pmshellwrapper pmsrvcheck pmsrvconfig pmsrvinfo pmstatus pmsum pmsysid pmtunneld pmumacs pmverifyprofilepolicy pmvi

Installation Packages

Package locations Installed files and directories

pmshell_reject

Description

Type string READ/WRITE

The pmshell_reject string is displayed by the Privilege Manager for Unix shell programs (pmsh, pmcsh, pmksh, and pmbash) for any shell subcommands rejected because they are listed in pmshell_forbid. The default is "Request Rejected".

Example

pmshell_reject = "Your request has been rejected by the shell";

Related Topics

pmshell_restricted

pmshell_checkbuiltins

pmshell_restricted

pmshell_restricted

Description

Type integer READ/WRITE

If pmshell_restricted is set to true, then the Privilege Manager for Unix shell program is run as a restricted shell. This means that the user cannot:

change directory
change the PATH, SHELL, or ENV variables
run any command that is not found in the PATH
run any command identified by full pathname
Overwrite any existing files using output redirection (such as, echo "" > /etc/passwd)

These restrictions are applied without any further authorization by the policy server. The default for this variable is false.

This variable is applicable to the pmsh, pmcsh, pmksh, and pmbash programs.

Example

if (user != "root") 
{ 
   pmshell_restricted = true; 
}

Related Topics

pmshell_checkbuiltins

preserve_clienthost

Description

Type integer READ/WRITE

The clienthost variable normally matches the host name on which the pmrun client was run. To preserve the host name of the login host instead, set the preserve_clienthost variable to true.

Example

print("User has logged in from host:%s\n", clienthost);

profile_keepenv

Description

Type list READ/WRITE

A list of values specified by the keepenv() call. profile_keepenv tracks the values set from the latest keepenv() function call. Do not modify this variable directly; the keepenv() function updates this list.

Example

# add "HOME" to the keepenv list if not already in the list 
if ("HOME" !in profile_keepenv) 
   keepenv(append(profile_keepenv,"HOME"));

Related Topics

profile_unsetenv

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center