Chat now with support
Chat with Support

Privilege Manager for Unix 7.1 - Administration Guide

Introducing Privilege Manager for Unix Planning Deployment Installation and Configuration Upgrade Privilege Manager for Unix System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager for Unix Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager for Unix Variables
Variable names Variable scope Global input variables Global output variables Global event log variables PM settings variables
Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures
Environment functions Hash table functions Input and output functions LDAP functions LDAP API example List functions Miscellaneous functions Password functions Remote access functions String functions User information functions Authentication Services functions
Privilege Manager for Unix programs Installation Packages

Reserve special user and group names

It is important for you to reserve the following special user and group names for Privilege Manager for Unix usage:

  • Users: questusr, pmpolicy
  • Groups: questgrp, pmpolicy, pmlog

The questusr account is a user service account created and used by Management Console for Unix to manage Privilege Manager for Unix policy and search event logs. It is a non-privileged account (that is, it does not require root-level permissions) that is used by the console to gather information about existing policy servers in a read-only fashion. The mangement console does not use questusr account to make changes to any configuration files. questgrp is the primary group (gid) for questusr.

The pmpolicy user is created on a primary or secondary server. It is a non-privileged service account (that is, it does not require root-level permissions) that is used to synchronize the security policy on policy servers.

The pmlog and pmpolicy groups are used to control access to log files and the security policy, respectively.

Applications and file availability

Since you can use Privilege Manager for Unix to run applications on remote machines, ensure that the applications and the files that they access are available from those machines. Typically, you can use a product such as NFS (supplied with most UNIX operating systems) to make users’ home directories and other files available in a consistent location across all computers.

Policy server daemon hosts

Privilege Manager for Unix requires that you choose a host to act as the policy server. This machine will run the pmmasterd daemon and must be available to manage requests for the whole network.

Run the policy server daemon on the most secure and reliable node. To maximize security, ensure the computer is physically inaccessible and carefully isolated from the network.

The policy server requires that the pmmasterd port (TCP/IP port 12345, by default) is available, and that PM Agent hosts joined to the policy server are able to communicate with the policy server on this network port.

You can run multiple policy servers for redundancy and stability. Privilege Manager for Unix automatically selects an available policy server if more than one is on the network. For now, choose one machine to run pmmasterd. See pmmasterd for more information.

Local daemon hosts

Each machine that runs requests using Privilege Manager for Unix must run a pmlocald daemon. Typically you will run pmlocald on all your machines. See pmlocald for more information.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating