One Identity Privileged Access Suite for Unix
Introducing One Identity Management Console for Unix
What's New in Management Console for Unix 2.5
What Are the Core Features of the Console?
How Management Console for Unix Works
Installing Management Console for Unix
System Requirements
Installing the Management Console
Preparing Unix Hosts
Working with Host Systems
Installing and Uninstalling the Console on Windows
Installing the Console From the Windows Command Line
Installing and Uninstalling the Console on Unix
Installing and Uninstalling the Console on Mac
Installing and Uninstalling the Console From the Mac Command Line
Launching the Management Console
Setup Management Console for Unix
Configure the Console for Active Directory Logon
Setup Console Access by Role
Identify Console
Set Supervisor Password Dialog
Summary Dialog
Management Console for Unix Log On Page
Getting Started Tab
Upgrade Quest Identity Manager for Unix
Upgrade Management Console for Unix
Install Software on Host(s)
Using the Console Search Options
Filter All Hosts View Content
Review Host Properties
Remove Host(s) from Management Console
SSH to Host
Import SSH Host Key
Managing Local Groups
Add Local Group
Search for Groups
Modify Group Properties
Add Users to a Local Group
Remove User from Local Group
Delete Local Group
Review the Local Unix Groups Report
Managing Local Users
Add Local User
Search for Users
Modify User Properties
Modify Multiple User's Properties
Reset Local User's Password
System Users
Delete Local User
Review the Local Unix Users Report
Active Directory Integration
Enable Active Directory Features
Add an Active Directory Group Account
Add an Active Directory User Account
Search for Active Directory Objects
View or Modify Active Directory User Properties
View or Modify Active Directory Group Properties
Authentication Services Integration
Install Authentication Services
Configure Active Directory for Authentication Services
View the Authentication Services Agent Columns
Set Authentication Services Software Path
Check Host for AD Readiness
Install Authentication Services Software Packages
Join Host(s) to Active Directory
Configure Host Access Control
Check QAS Agent Status
Privilege Manager Integration
Check QAS Agent Status Manually
Check QAS Agent Status Automatically
View the QAS Status Errors
View the QAS Status Heartbeat Errors
Add AD User to a Local Group
Mapping Local Users to Active Directory Users
Test the Mapped User Login
Configuring the Console to Recognize Unix Attributes in AD
Unix-Enable an Active Directory Group
Unix-Enable an Active Directory User
Test the Active Directory User Login
Getting Started
Configure a Primary Policy Server
Reporting
Setting Preferences
Check Policy Server Readiness
Install the Privilege Manager Packages
Configure the Primary Policy Server
Join the Host to a Policy Group
Configure a Secondary Policy Server
Install PM Agent or Sudo Plugin on a Remote Host
Managing Security Policy
Open Policy Files
Edit Panel Commands
Editing PM Policy Files
Event Logs and Keystroke Logging
Default Roles (or Profiles)
Modify Privilege Manager Role Properties
Add a New Privilege ManagerPrivilege Manager Role
Add a New Privilege Manager Restricted Shell Role
Add New Privilege Manager Role Based on an Existing Role
Save Policy Files
Delete Privilege Manager Role
Change Policy Version
Review Policy Changes
Manage Role Defaults
Modifying PM Policy Files With the Text Editor
Review the Access & Privileges by User Report
Review the Access & Privileges by Host Report
User Preferences
System Settings
Security
General System Settings
Duplicate SSH Host Keys
Set Session Timeout
Mark Host System Users Automatically
Console Information Settings
Change Supervisor Account Password
Set Custom Privilege Elevation Commands
Console Roles and Permissions System Settings
Active Directory System Settings
Privilege Manager System Settings
Configure a Service Account
Unconfigure a Service Account
Activate Policy Groups
Deactivate Policy Groups
Software & Licenses
Authentication Services System Settings
Management Console for Unix Server and Console
Troubleshooting Tips
Authenticating the Supervisor User
Authenticating Active Directory Users Using Windows Integrated Authentication
Authenticating Active Directory Users Using a Username and Password
Installing a Production Certificate
Active Directory
Managed Unix Hosts
Generating a Custom SSL/TLS Certificate and Key Pair for Management Console for Unix
Import Certificate to Trusted Domains on Windows and Mac
Import Certificate to Trusted Domains on Unix or Linux
Disabling SSL/TLS Encryption
Customizing HTTP and SSL/TLS Ports
Change Allowed Ciphers
Managing SSH Host Keys
Known_hosts File Format
Handling Changes to SSH Host Keys
Detecting Multiple Hosts With the Same Key
Caching Unix Host Credentials
Database Security
Summary of Security Recommendations
Auto Profile Issues
Active Directory Issues
System Maintenance
Command Line Utilities
Active Directory Connectivity Issues
Unable to Configure Active Directory
Active Directory is Disabled
Active Directory Tasks Are Disabled
Auditing and Compliance
Cannot Create a Service Connection Point
Check Authentication Services Agent Status Commands Not Available
CSV or PDF Reports Do Not Open
Database Port Number Is Already in Use
Elevation Is Not Working
Hosts Do Not Display
Import File Lists Fakepath
Information Does Not Display in the Console
Java Applet Failures
License Info in Report is not Accurate
Out of Memory Error
Post Install Configuration Fails on Unix or Mac
Privilege Manager Feature Issues
Join to Policy Group Failed
Join to Policy Group Option is Not Available
Preflight Fails Because the Policy Server Port is Unavailable
Policy Editor Is Not Available
Policy Editor Runs Slow
Policy Change Report Reports Newlines
Profile Task Never Completes
questusr Account was Deleted
Readiness Check Failed
Recovering From a Failed Upgrade
Reports Are Slow
Reset the Supervisor Password
Running on a Windows 2008 R2 Domain Controller
Service Account Login Fails
Setting Custom Configuration Settings
Single Sign-on (SSO) Issues
Configure a Firefox Web Browser for SSO
Configure an IE Web Browser for SSO
Disable Single Sign-on (SPNEGO/HTTP Negotiation)
Disable SSPI for Single Sign-on
Enable SSO for Remote Browser Clients
JVM Memory Tuning Suggestions
Start/Stop/Restart Management Console for Unix Service
Tool Bar Buttons Are Not Enabled
UID or GID Conflicts
MCU PowerShell Cmdlets and Unix CLI Commands
MCU PowerShell Cmdlets
Unix CLI Commands
Mac CLI Commands
Examples of Using Command Line Utilities
Web Services
Database Maintenance
Connect to the Console
Add Host to the Console
Create Local Group Across all Managed Hosts
Add a Local User to a Group on Each Managed Host
Add Localuser to a Group on All Linux Machines
Get a User on a Specific Computer
Find a UID on a Computer
Remove All Credentials Stored in the Console for a Specific Host
Set a Local User's Password
View a Group’s Membership
Command Line Utilities
Command Line Utilities
Management Console for Unix provides Unix command line utilities and Windows Powershell cmdlets that enable you to script common local Unix user and group management tasks. For example, you can write a script to reset a local Unix user's password across multiple Unix systems.
MCU PowerShell Cmdlets and Unix CLI Commands
PowerShell modules provide a "scriptable" interface to many mangement console tasks. Using Management Console for Unix PowerShell commands, you can manage group membership, change user passwords, or connect to the Management Console for Unix Web service.
Management Console for Unix provides the following PowerShell Cmdlets and Unix CLI commands, grouped according to service:
| PowerShell Cmdlet | Unix CLI Command | Description |
|---|---|---|
| Administrative Services | ||
| Connect-QmcuService | connect-qmcuservice | Connect to the Management Console for Unix Web Service specified by DNS name or IP address. |
| Disconnect-QmcuService | disconnect-qmcuservice | Disconnects from the Management Console for Unix Web Service. |
| Get-QmcuConnection | get-qmcuconnection | Lists the computer connection information. |
| Remove-QmcuComputerCredential | remove-qmcucomputercredential | Removes specified host credentials from the mangement console cache. |
| Set-QmcuComputerCredential | set-qmcucomputercredential | Caches specified host credentials on the management console. |
| Computer Services | ||
| Find-QmcuComputer | find-qmcucomputer | Finds hosts managed by the console matching a specified search criteria. |
| Find-QmcuGroup | find-qmcugroup | Finds local group information matching specified search criteria. |
| Find-QmcuUser | find-qmcuuser | Finds local user information matching specified search criteria. |
| Get-QmcuComputer | get-qmcucomputer | Lists hosts managed by the mangement console. |
| Get-QmcuGroup | get-qmcugroup | Lists local group information for the specified host. |
| Get-QmcuUser | get-qmcuuser | Lists local user information for the specified host. |
| New-QmcuComputer | new-qmcucomputer | Adds a host to the mangement console. |
| New-QmcuGroup | new-qmcugroup | Creates a new local group on the specified host. |
| New-QmcuUser | new-qmcuuser | Creates a new local user on the specified host. |
| Remove-QmcuComputer | remove-qmcucomputer | Removes a host from the mangement console. |
| Remove-QmcuGroup | remove-qmcugroup | Removes a local group from the specified host. |
| Remove-QmcuUser | remove-qmcuuser | Removes a local user from the specified host. |
| Update-QmcuComputer | update-qmcucomputer | Updates a specified host's profile. |
| Group Services | ||
| Add-QmcuGroupMember | add-qmcugroupmember | Adds local user(s) to the specified local group. |
| Get-QmcuGroupMember | get-qmcugroupmember | Lists all local users in a specified group. |
| Remove-QmcuGroupMember | remove-qmcugroupmember | Removes specified local user(s) from specified local group. |
| User Services | ||
| Add-QmcuGroupMembership | add-qmcugroupmembership | Adds the specified local user to the specified group(s). |
| Get-QmcuGroupMembership | get-qmcugroupmembership | Lists all local groups of which the specified local user is a member. |
| Remove-QmcuGroupMembership | remove-qmcugroupmembership | Removes the specified local user from the specified group(s). |
| Set-QmcuUserPassword | set-qmcuuserpassword | Sets the password for the specified local user. |
| Functions | ||
| Get-QmcuBanner | Displays the MCU powershell console "Welcome" banner which gives basic instructions for viewing the Management Shell cmdlets. | |
| Import-QmcuModule | Updates the Powershell module path and imports the MCU module. | |
MCU PowerShell Cmdlets
Installing MCU PowerShell Cmdlets
Viewing MCU PowerShell Cmdlet Help Information
Installing MCU PowerShell Cmdlets
If the MCU Powershell console option is not available from the Start menu, under Programs | Quest Software | Management Console for Unix, then run the setup wizard, as follows:
To install the Management Console for Unix Powershell console
- From the root of the distribution media, navigate to console | client | windows.
- Double-click the "Quest_MCU_Powershell_cmdlets" .msi file to start the setup wizard.
Note: For information about the QmcuWebserviceExamples.zip file also contained in this directory, see Web Services Examples.
- At the Welcome dialog, click Next.
- Accept the license agreement and click Next.
- At Ready to Install dialog, click Install.
- At Completed dialog, click Finish.
- To access a customized PowerShell console, from the Start menu, navigate to All Programs | Quest Software | Management Console for Unix and click MCU Powershell console.
To uninstall the MCU Powershell console
- From the Start menu, navigate to Control Panel | Programs | Programs and Features | Uninstall a program.
- Right-click Management Console for Unix Powershell Cmdlets and choose Uninstall.
- Click Yes, to confirm the action.