Chat now with support
Chat with Support

Safeguard Authentication Services 6.0.1 - Administration Guide

Privileged Access Suite for UNIX Introducing One Identity Safeguard Authentication Services UNIX administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment Integrating with other applications Managing UNIX hosts with Group Policy
Safeguard Authentication Services Group Policy
Group Policy Concepts UNIX policies One Identity policies
Display specifiers Troubleshooting Glossary

Syslog policy

You can configure which entries go into the UNIX syslog configuration file. Syslog entries are appended to the log and cannot be overridden. However, if there is a duplicate entry, it is only added once to /etc/syslog.conf.

Adding a syslog entry

This section describes how to add a syslog entry.

To add a syslog entry

  1. Start Group Policy Editor.

  2. Select UNIX Settings > Safeguard Authentication Services > Client Configuration in the scope view.

  3. Double click Syslog.

    The Syslog Configuration Properties dialog opens.

  4. Click Add.

    The Syslog Rule dialog opens.

  5. In the Action field, type the syslog action target; enter a file path, a user list, or a host name depending on the type of action you select.

    • Regular File: Enter the absolute UNIX file path to the syslog.conf file. The path must start with a "/".

    • Remote Host: Enter a host name to send the data remotely over to the syslog daemon running on the other machine.

    • User List: Enter a comma delimited list of users. When you select the User List option, it enables the Find button. Click Find to open the Active Directory Select Users dialog.

  6. Select the type of action: Regular File, Remote Host, or User List.

  7. In the Selector section:

    • Choose a facility.

      The Facility is the type of message you want to log.

    • Choose a priority.

      When you select a syslog Priority, it selects that priority plus all priorities listed below it.

      NOTE: To log to a specific priority only on a Linux platform, click Edit and add "=" before the priority name.

    • Click Insert to append these selections to the rule.

  8. Append additional facilities and priorities, as necessary.

  9. Click OK to return to the Syslog Configuration Properties dialog.

  10. Check the Remove local configuration option if you want to replace the syslog file with the new settings. If you leave this option deselected, the new settings are appended to the current syslog file.

    NOTE: If you select the Remove local configuration option, it backs up the old configuration file before it deletes it and applies the new policy.

  11. Click OK.

Sudo policy

Sudo allows certain users to get elevated access to certain commands even if they do not have root access. The sudoers file contains a list of rules that control the behavior of sudo. The Sudo policy controls the rules defined in the sudoers file.

The Sudo policy allows you to add, edit, remove and re-order sudo rules. A sudo rule consists of three parts:

  1. The command or commands to run.

  2. The user the command should be 'run as'. Typically this is the root user.

  3. A list of users or groups that the rule applies to.

To use Active Directory groups in sudo rules, select the Resolve Active Directory group names in /etc/sudoers option. This option requires Sudo 1.8 on the UNIX host.

NOTE: The Sudo policy does not support all possible sudo configurations. If you need to handle more advanced scenarios you can use a file copy policy to place your base sudoers file and use a script policy to customize it.

Adding a Sudo rule

The Sudo policy allows you to add, edit, remove and reorder Sudo rules. This section describes how to add them.

To add a Sudo rule

  1. Start Group Policy Editor.

  2. Select UNIX Settings > Safeguard Authentication Services > Client Configuration in the scope view.

  3. Double-click Sudo.

    The Sudo Properties dialog opens.

  4. Click the Add or Edit button.

    The Sudo Rule dialog opens.

  5. In the UNIX Command group box, select All Commands if you want this rule to apply to all commands. Otherwise, specify the full UNIX path to the command. For security reasons, relative paths are not allowed. To deny access to the command, click the Disallow the specified command option and the user will be unable to execute the command with sudo.

  6. In the Run as User field, enter the UNIX name of a user. The command will run in the security context of the specified user. The default user is root. Select the Password required option if you want sudo to prompt the user for his password when the command is executed.

  7. In the Apply to Users and Groups box, specify the users and groups to which the rule will apply.

    If you want the rule to apply to all users, select the Allow all users to run this command option.

    Otherwise, enter a user or group name and select either User or Group to indicate whether the name is for a user or a group and click Insert. You can specify groups with Text Replacement Macros in the name. For example sudo-group-%%HOSTNAME%%. By defining a text replacement macro for %%HOSTNAME%% you can create one policy which will dynamically adjust the name on each machine when policy is applied.

    Or, click Browse to find an Active Directory user or group. The standard Select Users or Groups dialog opens. You can search for multiple objects by separating each name with a semicolon.

  8. Click OK to return to the Sudo Properties dialog.

  9. You can optionally specify the Path to visudo. Group Policy uses visudo to validate that the sudoers file can be parsed correctly by sudo. If visudo cannot validate the sudoers file, the policy is not applied. If you do not specify the path to visudo, Group Policy attempts to locate it automatically by searching in common locations. If it can not locate visudo, it can not apply the policy.

  10. Click OK to save this new configuration for the sudoers file.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating