One Identity Privileged Access Suite for Unix
Introducing One Identity Management Console for Unix
What's New in Management Console for Unix 2.5
What Are the Core Features of the Console?
How Management Console for Unix Works
Installing Management Console for Unix
System Requirements
Installing the Management Console
Preparing Unix Hosts
Working with Host Systems
Installing and Uninstalling the Console on Windows
Installing the Console From the Windows Command Line
Installing and Uninstalling the Console on Unix
Installing and Uninstalling the Console on Mac
Installing and Uninstalling the Console From the Mac Command Line
Launching the Management Console
Setup Management Console for Unix
Configure the Console for Active Directory Logon
Setup Console Access by Role
Identify Console
Set Supervisor Password Dialog
Summary Dialog
Management Console for Unix Log On Page
Getting Started Tab
Upgrade Quest Identity Manager for Unix
Upgrade Management Console for Unix
Install Software on Host(s)
Using the Console Search Options
Filter All Hosts View Content
Review Host Properties
Remove Host(s) from Management Console
SSH to Host
Import SSH Host Key
Managing Local Groups
Add Local Group
Search for Groups
Modify Group Properties
Add Users to a Local Group
Remove User from Local Group
Delete Local Group
Review the Local Unix Groups Report
Managing Local Users
Add Local User
Search for Users
Modify User Properties
Modify Multiple User's Properties
Reset Local User's Password
System Users
Delete Local User
Review the Local Unix Users Report
Active Directory Integration
Enable Active Directory Features
Add an Active Directory Group Account
Add an Active Directory User Account
Search for Active Directory Objects
View or Modify Active Directory User Properties
View or Modify Active Directory Group Properties
Authentication Services Integration
Install Authentication Services
Configure Active Directory for Authentication Services
View the Authentication Services Agent Columns
Set Authentication Services Software Path
Check Host for AD Readiness
Install Authentication Services Software Packages
Join Host(s) to Active Directory
Configure Host Access Control
Check QAS Agent Status
Privilege Manager Integration
Check QAS Agent Status Manually
Check QAS Agent Status Automatically
View the QAS Status Errors
View the QAS Status Heartbeat Errors
Add AD User to a Local Group
Mapping Local Users to Active Directory Users
Test the Mapped User Login
Configuring the Console to Recognize Unix Attributes in AD
Unix-Enable an Active Directory Group
Unix-Enable an Active Directory User
Test the Active Directory User Login
Getting Started
Configure a Primary Policy Server
Reporting
Setting Preferences
Check Policy Server Readiness
Install the Privilege Manager Packages
Configure the Primary Policy Server
Join the Host to a Policy Group
Configure a Secondary Policy Server
Install PM Agent or Sudo Plugin on a Remote Host
Managing Security Policy
Open Policy Files
Edit Panel Commands
Editing PM Policy Files
Event Logs and Keystroke Logging
Default Roles (or Profiles)
Modify Privilege Manager Role Properties
Add a New Privilege ManagerPrivilege Manager Role
Add a New Privilege Manager Restricted Shell Role
Add New Privilege Manager Role Based on an Existing Role
Save Policy Files
Delete Privilege Manager Role
Change Policy Version
Review Policy Changes
Manage Role Defaults
Modifying PM Policy Files With the Text Editor
Review the Access & Privileges by User Report
Review the Access & Privileges by Host Report
User Preferences
System Settings
Security
General System Settings
Duplicate SSH Host Keys
Set Session Timeout
Mark Host System Users Automatically
Console Information Settings
Change Supervisor Account Password
Set Custom Privilege Elevation Commands
Console Roles and Permissions System Settings
Active Directory System Settings
Privilege Manager System Settings
Configure a Service Account
Unconfigure a Service Account
Activate Policy Groups
Deactivate Policy Groups
Software & Licenses
Authentication Services System Settings
Management Console for Unix Server and Console
Troubleshooting Tips
Authenticating the Supervisor User
Authenticating Active Directory Users Using Windows Integrated Authentication
Authenticating Active Directory Users Using a Username and Password
Installing a Production Certificate
Active Directory
Managed Unix Hosts
Generating a Custom SSL/TLS Certificate and Key Pair for Management Console for Unix
Import Certificate to Trusted Domains on Windows and Mac
Import Certificate to Trusted Domains on Unix or Linux
Disabling SSL/TLS Encryption
Customizing HTTP and SSL/TLS Ports
Change Allowed Ciphers
Managing SSH Host Keys
Known_hosts File Format
Handling Changes to SSH Host Keys
Detecting Multiple Hosts With the Same Key
Caching Unix Host Credentials
Database Security
Summary of Security Recommendations
Auto Profile Issues
Active Directory Issues
System Maintenance
Command Line Utilities
Active Directory Connectivity Issues
Unable to Configure Active Directory
Active Directory is Disabled
Active Directory Tasks Are Disabled
Auditing and Compliance
Cannot Create a Service Connection Point
Check Authentication Services Agent Status Commands Not Available
CSV or PDF Reports Do Not Open
Database Port Number Is Already in Use
Elevation Is Not Working
Hosts Do Not Display
Import File Lists Fakepath
Information Does Not Display in the Console
Java Applet Failures
License Info in Report is not Accurate
Out of Memory Error
Post Install Configuration Fails on Unix or Mac
Privilege Manager Feature Issues
Join to Policy Group Failed
Join to Policy Group Option is Not Available
Preflight Fails Because the Policy Server Port is Unavailable
Policy Editor Is Not Available
Policy Editor Runs Slow
Policy Change Report Reports Newlines
Profile Task Never Completes
questusr Account was Deleted
Readiness Check Failed
Recovering From a Failed Upgrade
Reports Are Slow
Reset the Supervisor Password
Running on a Windows 2008 R2 Domain Controller
Service Account Login Fails
Setting Custom Configuration Settings
Single Sign-on (SSO) Issues
Configure a Firefox Web Browser for SSO
Configure an IE Web Browser for SSO
Disable Single Sign-on (SPNEGO/HTTP Negotiation)
Disable SSPI for Single Sign-on
Enable SSO for Remote Browser Clients
JVM Memory Tuning Suggestions
Start/Stop/Restart Management Console for Unix Service
Tool Bar Buttons Are Not Enabled
UID or GID Conflicts
MCU PowerShell Cmdlets and Unix CLI Commands
MCU PowerShell Cmdlets
Unix CLI Commands
Mac CLI Commands
Examples of Using Command Line Utilities
Web Services
Database Maintenance
Connect to the Console
Add Host to the Console
Create Local Group Across all Managed Hosts
Add a Local User to a Group on Each Managed Host
Add Localuser to a Group on All Linux Machines
Get a User on a Specific Computer
Find a UID on a Computer
Remove All Credentials Stored in the Console for a Specific Host
Set a Local User's Password
View a Group’s Membership
Database Location and Files
Database Location
Management Console for Unix database files are located in the following locations:
- On Unix/Mac: /var/opt/quest/mcu/db
- On Windows XP/2003 Server: %SystemDrive%:\Documents and Settings\All Users\Application Data\Quest Software\Management Console for Unix\db
- On Windows 2008 Server/Vista/7: %SystemDrive%:\ProgramData\Quest Software\Management Console for Unix\db
Database Files
The data for each database consists of multiple files located in the same directory. All the database files start with the same name as defined by the value in the jdbc.url key. For Management Console for Unix, the database consists of the following files by default:
| File | Description |
|---|---|
| console.lck | This file is used to determine if the database is in use. If console.lck exists, the server is currently running. This file is deleted once the database is properly shutdown. DO NOT BACKUP THIS FILE. |
| console | This file contains the extra SQL statements that have modified the console database since the last checkpoint (something like the 'Redo-log' or 'Transaction-log', but just text.) For a normal shutdown this file is deleted once the database has completely shutdown. |
| console.properties | This file contains general settings about the database including the console.properties entry 'modified'. If [modified=yes], the database is either running or was not closed correctly (because the close algorithm sets 'modified' to 'no' at the end). |
| console.script | This file contains the SQL statements that make up the database up to the last checkpoint. |
Database Backup Procedure
It is best to perform a backup when the HSQLDB is not running. use normal backup methods, such as archiving the files in a compressed bundle.
To backup a database
- Shutdown the HSQLDB server. (See Start/Stop/Restart Management Console for Unix Service for details about starting and starting the Management Console for Unix Service.)
- Copy the following files to a backup location: console.properties and console.script.
- Once the HSQLDB server is stopped, replace the files in the database directory (see Database Location and Files above) with the ones you previously backed up.
- Once you have replaced the files, start the HSQLDB server.
|
|
Note: If a backup immediately follows a checkpoint, then the console file can also be excluded, reducing the significant files to console.properties and console.script. You can backup the files while the HSQLDB server is running, but make sure that a shutdown or checkpoint is NOT performed during the backup. If you perform a backup while the server is running, you will need to backup the console file, as well. This file will be deleted once the server is shutdown. |
Database States
Use the following information to determine if the database was shutdown successfully.
State after shutting down the HSQLDB server:
- The console.script file contains the information in the database, excluding data for text tables.
- The console.properties file contains the entry [modified=no].
- There is no console file.
Aborted database state (may happen by sudden power outage, Ctrl+C in Windows)
- The console.properties file still contains the entry [modified=yes].
- The console.script file contains a snapshot of the database at the last checkpoint and is OK.
- The console file contains all the information to restore all the changes since the snapshot. As a result of abnormal termination, this file may be partially corrupt.