Chat now with support
Chat with Support

Safeguard Authentication Services 4.1.3 - Management Console for Unix Administration Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Management Console for Unix Installing Management Console for Unix Preparing Unix Hosts Working with Host Systems Managing Local Groups Managing Local Users Active Directory Integration Authentication Services Integration Privilege Manager Integration Reporting Setting Preferences Security Troubleshooting Tips
Auto Profile Issues Active Directory Issues Auditing and Compliance Cannot Create a Service Connection Point Check Authentication Services Agent Status Commands Not Available CSV or PDF Reports Do Not Open Database Port Number Is Already in Use Elevation Is Not Working Hosts Do Not Display Import File Lists Fakepath Information Does Not Display in the Console Java Applet Failures License Info in Report is not Accurate Out of Memory Error Post Install Configuration Fails on Unix or Mac Privilege Manager Feature Issues Profile Task Never Completes questusr Account was Deleted Readiness Check Failed Recovering From a Failed Upgrade Reports Are Slow Reset the Supervisor Password Running on a Windows 2008 R2 Domain Controller Service Account Login Fails Setting Custom Configuration Settings Single Sign-on (SSO) Issues JVM Memory Tuning Suggestions Start/Stop/Restart Management Console for Unix Service Tool Bar Buttons Are Not Enabled UID or GID Conflicts
System Maintenance Command Line Utilities Web Services Database Maintenance

Setting Custom Configuration Settings

When you start the Management Console for Unix service, it reads Java Virtual Machine (JVM) system variables from a configuration file.

You can set custom configuration settings by adding system variables, one per line, to the custom.cfg file, in the form:

-Dproperty=value.

The custom.cfg file is in the application data directory:

  • On Windows XP/2003 Server:
    %SystemDrive%:\Documents and Settings\All Users\Application Data\Quest Software\Management Console for Unix\resources
  • On Windows 2008 Server/Vista/7:
    %SystemDrive%:\ProgramData\Quest Software\Management Console for Unix\resources
  • On Unix/Mac:
    /var/opt/quest/mcu/resources

Here are some general tips for adding system variables to the custom.cfg file:

  • All system variable declarations must be on its own line:
    -Xms512m 
    -Xmx512m
  • Do not enter multiple entries on a single line like this:
    -Xms512m -Xmx512m
  • A line preceded by a # character specifies a commented line and will be ignored.
  • The system variable declarations are case sensitive. Be sure to enter lines to the custom.cfg file carefully.
  • Restart the console service to enable the system variable declarations.

The following topics give you details about setting custom system variables:

Customize Auto-Task Settings

Management Console for Unix uses a heartbeat to verify that the:

  • host system is still properly configured to send updates
  • current QAS status is accurate

You can customize the heartbeat interval for the automatic QAS Status update. However, if you change the heartbeat interval you must reconfigure automatic QAS agent status for all hosts previously configured.

To customize heartbeat interval

  1. Locate the custom.cfg file.

    (See Setting Custom Configuration Settings for more information about customizing configuration settings for the mangement console.)

  2. Add the following property:

    -Dmcu.QasStatusHeartbeatsPerDay=n

    where n is the number of times per day. (The default is 6 times a day.)

    Valid values are: 1,2,3,4,6,8,12, and 24 times a day.

    The actual time of day that heartbeats are sent vary from host to host.

  3. Save the custom.cfg file.

  4. Restart the Management Console for Unix service.

Enable Debug Log

Technical Support may request that you enable and generate some debug logs for troubleshooting purposes.

To enable the debug log

  1. Stop the Management Console for Unix service

    (See Start/Stop/Restart Management Console for Unix Service for details.)

  2. Open the custom.cfg file for editing.

    (See Setting Custom Configuration Settings for general information about customizing configuration settings for the mangement console.)

  3. Add these system variables to the custom.cfg file:
    -Dlog4j.configuration=log4j-debug.xml

    AND

    -Djcsi.kerberos.debug=true
  4. Save the custom.cfg file.
  5. Start the Management Console for Unix service.

    By default, the debug logs are saved in the application data directory at:

    • On Windows XP/Windows Server 2003:
      %SystemDrive%:\Documents And Settings\All Users\Application Data\Quest Software\Management Console for Unix\logs
    • On Windows Vista/Windows 7:
      %SystemDrive%:\ProgramData\Quest Software\Management Console for Unix\logs
    • On Unix/Mac platforms:
      /var/opt/quest/mcu

Single Sign-on (SSO) Issues

Management Console for Unix uses the host computer's Active Directory credentials to publish its address to the Control Center, perform single sign-on, and to validate a user's log on. On a Microsoft Windows server, the host computer's credentials are available by means of the Windows SSPI, but this limits Management Console for Unix to managing hosts in the same forest to which the Windows server is joined.

If you wish to use Management Console for Unix to manage a foreign domain or forest from a Windows server, then you must disable SSPI. (See Disable SSPI for Single Sign-on.) However disabling SSPI will disable single sign-on capabilities.

Note: To perform single sign-on, you must

  • Configure Management Console for Unix for Active Directory.
  • Join your Management Console for Unix server to an Active Directory domain.

    If your Management Console for Unix server is on a Linux platform, you must have Authentication Services installed to join Active Directory.

  • Join the client host (where the browser is located) to the Active Directory domain.
  • Login to the browser host using an Active Directory account.

On a Unix server, Management Console for Unix looks for the host computer's credentials by searching for a Kerberos keytab file in the following default locations:

  • /etc/opt/quest/vas/HTTP.keytab
  • /etc/opt/quest/vas/host.keytab

To override the default location, set the console.keytab system property in the custom.cfg configuration file, as follows:

-Dconsole.keytab=<PropertyValue>

(See Setting Custom Configuration Settings for more information about overriding the default configuration settings.)

If Management Console for Unix cannot find host computer credentials, it will run without host credentials by relying on a correctly configured DNS to find foreign domain controllers. This means that Management Console for Unix will be unable to publish its address to the Control Center, perform single sign-on, or fully validate passwords used when logging on.

Note: When you install Management Console for Unix2.5 on Windows 8, Windows SSPI is automatically turned off because single sign-on does not currently work on Windows 8.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating