The Defender Settings policy provides one-time password authentication. Install Defender on UNIX or Linux to use two-factor authentication to secure critical resources. To access a host running Defender, you must enter a one-time password in addition to the account password.
Configure the Defender Settings policy to enable PAM authentication. The Group Policy agent on UNIX configures Defender based on the existing Defender access nodes in Active Directory. This allows you to configure which users to prompt for a one-time password as well as which Defender server the agents can communicate with. For more information on configuring Defender access nodes, see the One Identity Defender documentation.
This section describes how to enable one-time password authentication for UNIX.
To enable one-time password authentication for UNIX
-
In the Group Policy Object Editor, navigate to UNIX Settings > Quest Defender.
-
Double-click the Defender Settings policy in the right-hand pane.
-
Click Enable Defender PAM authentication.
-
Configure Defender to require a one-time password for specific login services, or all login services.
A login service is any process that authenticates a user to a UNIX host. You configure login services for PAM in the pam.conf file. By default, sshd and ssh are automatically configured since this is the most typical scenario. You can specify additional services. The name of the service must correspond to the service name in PAM.conf. On some platforms the service names may differ, in that case, specify all service names for all platforms where you have installed Defender.
NOTE: To prompt for a one-time password for all services, select Require Defender PAM authentication for all services.
-
Click OK to save your settings and close the Defender Settings Properties dialog.
Privilege Manager for Unix controls which users are able to gain root access on UNIX hosts. It is similar to sudo with more advanced features and functionality. You can use Group Policy to control Privilege Manager for Unix settings on hosts that are also running Safeguard Authentication Services.
One Identity Privilege Manager for Unix uses policy files to define the rules governing which users are able to run which commands as root. The policy files are defined using syntax defined by Privilege Manager for Unix. When the policy files are applied on the UNIX host, the Group Policy agent validates the new set of policy rules to ensure that there are no syntax or logical errors in the rules. If the policy rules do not validate, the Group Policy agent logs an error and does not apply the policy files. This ensures that an oversight or other error does not break the security infrastructure already in place.
TIP: As a best practice, always test your policy configuration prior to applying it by means of Group Policy.
If you add a file named pm.conf, this file overrides the default root policy file. The Group Policy agent updates the list of files included from the root policy file to included all of the configured files. If the validation step fails after updating the included files, the policy is not applied.
For more information about the syntax of Privilege Manager for Unix policy files, see the One Identity Privilege Manager for Unix documentation.
