Ensure that each host on your network knows the names and IP addresses of all other hosts. This information is stored either in the /etc/hosts file on each machine, or in NIS maps or DNS files on a server. Whichever you use, ensure all host names and IP addresses are up-to-date and available.
Privilege Manager for Unix components must be able to use forward and reverse lookup of the host names and IP addresses of other components.
It is important for you to reserve the following special user and group names for Privilege Manager for Sudo usage:
The questusr account is a user service account created and used by Management Console for Unix to manage Privilege Manager policy and search event logs. It is a non-privileged account (that is, it does not require root-level permissions) used by the console to gather information about existing policy servers in a read-only fashion. The mangement console does not use questusr account to make changes to any configuration files. questgrp is the primary group (gid) for questusr.
The pmpolicy user is created on a primary or secondary server. The pmclient user is created on a Sudo Plugin host.
questusr, pmpolicy, and pmclient are all non-privileged service accounts (that is, they do not require root-level permissions). The pmpolicy and pmclient users are used to synchronize the security policy on policy servers and on Sudo Plugin hosts (offline policy cache), respectively.
The pmlog and pmpolicy groups are used to control access to log files and the security policy, respectively.
Since you can use Privilege Manager for Unix to run applications on remote machines, ensure that the applications and the files that they access are available from those machines. Typically, you can use a product such as NFS (supplied with most UNIX® operating systems) to make users’ home directories and other files available in a consistent location across all computers.
Privilege Manager for Unix requires that you choose a host to act as the policy server. This machine will run the pmmasterd daemon and must be available to manage requests for the whole network.
Run the policy server daemon on the most secure and reliable node. To maximize security, ensure the computer is physically inaccessible and carefully isolated from the network.
The policy server requires that the pmmasterd port (TCP/IP port 12345, by default) is available, and that PM Agent or Sudo Plugin hosts joined to the policy server are able to communicate with the policy server on this network port.
You can run multiple policy servers for redundancy and stability. Privilege Manager for Unix programs automatically select an available policy server if more than one is on the network. For now, choose one machine to run pmmasterd (See pmmasterd for more information.)
© 2020 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy
