One Identity Privileged Access Suite for Unix
Introducing Privilege Manager for Unix
What is Privilege Manager for Unix?
Benefits of Privilege Manager for Unix
How Privilege Manager for Unix Protects
How Privilege Manager for Unix Works
What's New in Privilege Manager 6.0
Introducing Privilege Manager for Sudo
Planning Deployment
Installation and Configuration
Download Privilege Manager for Unix Software Packages
Download Privilege Manager for Sudo Software Packages
Quick Start and Evaluation
Configure a Primary Policy Server
Upgrading Privilege Manager
Check the Server for Installation Readiness
Configure a Secondary Policy Server
Install PM Agent or Sudo Plugin on a Remote Host
TCP/IP Configuration
Firewalls
Hosts Database
Reserve Special User and Group Names
Applications and File Availability
Policy Server Daemon Hosts
Local Daemon Hosts
Sudo 1.8.1
Install the Privilege Manager Packages
Configure the Primary Policy Server for Privilege Manager for Unix
pmpolicy Server Configuration Settings
Verifying the Primary Policy Server
Recompile the whatis Database
Configure the Privilege Manager for Sudo Primary Policy Server
Join Hosts to Policy Group
Check PM Agent Host for Installation Readiness
Install a PM Agent on a Remote Host
Join the PM Agent to the Primary Policy Server
CheckSudo Plugin Host for Installation Readiness
Install a Sudo Plugin on a Remote Host
Join a Sudo Plugin to a Primary Policy Server
Remove Configurations
Package Removal and Installation
System Administration
Removing Privilege Manager
Server Package Installation
Agent Package Installation
Sudo Plugin Package Installation
Upgrading to Privilege Manager for Unix 6.0
Upgrade Considerations and Recommendations
Preparing the Privilege Manager for Unix Policy for Import
Configuring the Primary Policy Server with an Imported Policy
Joining the Agent to the Policy Group
Importing Event Logs into the new Database Format
Reporting Basic Policy Server Configuration Information
Checking the Status of the Master Policy
Checking the Policy Server
Checking Policy Server Status
Checking the Sudo Plugin Configuration Status
Checking the Privilege Manager for Unix PM Agent Configuration Status
Install Licenses
Listing Policy File Revisions
Viewing Differences Between Revisions
Backup and Recovery
Managing Security Policy
Security Policy Types
Specifying Security Policy Type
The Sudo Type Policy
Pmpolicy Type Policy
Editing the Policy Interactively
Modifying Complex Policies
Viewing the Security Profile Changes
The Privilege Manager for Unix Security Policy
Default Profile-Based Policy (pmpolicy)
Exploring Profiles
Customizing the Default Profile-Based Policy (pmpolicy)
Policy Scripting Tutorial
Advanced Privilege Manager for Unix Configuration
Install the Example Policy File
Create Test Users
Set Lesson Number Variable
Introductory Lessons
Lesson 1: Basic Policy
Lesson 2: Conditional Privilege
Lesson 3: Specific Commands
Lesson 4: Policy Optimization with List Variables
Lesson 5: Keystroke Logging
Lesson 6: Conditional Keystroke Logging
Lesson 7: Policy Optimizations
Advanced Lessons
Sample Policy Files
Main Policy Configuration File
Lesson 1 Sample: Basic Policy
Lesson 2 Sample: Conditional Privilege
Lesson 3 Sample: Specific Commands
Lesson 4 Sample: Policy Optimizations with List Variables
Lesson 5 Sample: Keystroke Logging
Lesson 6 Sample: Conditional Keystroke Logging
Lesson 7 Sample: Policy Optimizations
Lesson 8 Sample: Controlling the Execution Environment
Lesson 9 Sample: Flow Control
Lesson 10 Sample: Basic Menus
Privilege Manager Shells
Administering Log and Keystroke Files
Privilege Manager Shell Features
Forbidden Commands
Allowed Commands
Allowed Piped Commands
Check Shell Built-in Commands
Read-Only Variable List
Running a Shell in Restricted Mode
Additional Shell Considerations
Configuring Privilege Manager for Policy Scripting
Configuration Prerequisites
Configuration File Examples
Configuring Firewalls
Example 1: Basics
Example 2: Accept or Reject Requests
Example 3: Command Constraints
Example 4: Lists
Example 5: I/O Logging, Event Logging and Replay
Example 6: More Complex Policies
Example 7: Use Variables to Store Constraints
Example 8: Control the Run-Time Environment
Example 9: Switch and Case Statements
Example 10: Menus
Use the While Loop
Use Parallel Lists
Best Practice Policy Guidelines
Multiple Configuration Files and Read-Only Variables
Mail
Environmental Variables
NIS Netgroups
Specify Trusted Hosts
Privilege Manager Port Usage
Restricting Port Numbers for Command Responses
Configuring pmtunneld
Configuring Network Address Translation (NAT)
Configuring Kerberos Encryption
Configuring Certificates
Configuring Alerts
Configuring Pluggable Authentication Method (PAM)
Configuring Keystroke Logging for Privilege Manager for Sudo Policy
Controlling Logs
Local Logging
Central Logging with Privilege Manager for Unix
Controlling Log Size with Privilege Manager for Unix
Viewing the Log Files Using a Web Browser
Viewing the Log Files Using Command Line Tools
Listing Event Logs
Backing up and archiving event and keystroke logs
InTrust Plug-in for Privilege Manager
InTrust Plug-in Requirements
Installing InTrust Plug-in Components
InTrust Plug-in Installation Prerequisites
Configuring the Policy Server for the InTrust Plug-in
Installing the InTrust Knowledge Pack
Installing the InTrust Reporting Pack
Configuring the InTrust Data Collection
Viewing InTrust Reports
Generating Reports
Troubleshooting
Displaying Sudo Policy Debug Information
Displaying Profile-Based Policy Debug Information
Enabling Program-level Tracing
Join Fails to Generate a SSH Key for Sudo Policy
Join to Policy Group Failed on Sudo Plugin
Load Balancing and Policy Updates
Policy Servers are Failing
Sudo Command is Rejected by Privilege Manager for Unix
Sudo Policy Is Not Working Properly
Privilege Manager for Unix Policy File Components
Privilege Manager Variables
Variable Names
Variable Scope
Global Input Variables
Privilege Manager for Unix Flow Control Statements
alertkeymatch
argc
argv
client_parent_pid
client_parent_uid
client_parent_procname
clienthost
command
cwd
date
day
dayname
domainname
env
false
FEATURE_LDAP
FEATURE_VAS
gid
group
groups
host
hour
masterhost
masterversion
minute
month
nice
nodename
pid
pmclient_type
pmclient_type_pmrun
pmclient_type_sudo
pmshell
pmshell_builtin
pmshell_cmd
pmshell_cmdtype
pmshell_exe
pmshell_interpreter
pmshell_prog
pmshell_script
pmshell_uniqueid
pmversion
ptyflags
requestlocal
requestuser
samaccount
status
submithost
submithostip
thishost
time
true
ttyname
tzname
uid
umask
unameclient
uniqueid
use_rundir
use_rungroup
use_rungroups
use_runshell
user
year
Global Output Variables
alertkeyaction
alertkeysequence
disable_exec
eventlog
eventloghost
execfailedmsg
iolog
iolog_encrypt
iolog_errmax
iolog_opmax
iologhost
log_passwords
logomit
logstderr
logstdin
logstdout
notfoundmsg
passprompts
pmshell_allow
pmshell_allowpipe
pmshell_checkbuiltins
pmshell_forbid
pmshell_readonly
pmshell_reject
pmshell_restricted
preserve_clienthost
profile_keepenv
profile_setenv
profile_unsetenv
profile_use_runuser
rejectmsg
runargv
runchroot
runcksum
runclienthost
runcommand
runconfirmuser
runcwd
runenv
rungroup
rungroups
runhost
runnice
runpaths
runptyflags
runtimeout
runumask
runuser
runutmpuser
subprocuser
tmplogdir
Global Event Log Variables
PM Settings Variables
accept
break
continue
do-while
for loop
for loop
function
if-else
include
procedure / function
readonly
readonlyexcept
reject
return
switch
while
Privilege Manager for Unix Built-in Functions and Procedures
Environment Functions
Hash Table Functions
Input and Output Functions
LDAP Functions
Privilege Manager Programs
ldap_ bind
ldap_count_entries
ldap_dn2ufn
ldap_explode_dn
ldap_first_attribute
ldap_first_entry
ldap_get_attributes
ldap_get_dn
ldap_get_values
ldap_next_attribute
ldap_next_entry
ldap_open
ldap_search
ldap_unbind
LDAP API Example
List Functions
Miscellaneous Functions
atoi
authenticate_pam
authenticate_pam_toclient
basename
comparehosts
datecmp
dirname
feature_enabled
fileexists
glob
ingroup
innetgroup
innetuser
lineno
mktemp
osname
quote
rand
stat
strftime
system
timebetween
tolower
toupper
uname
Password Functions
Remote Access Functions
remotefileexists
remotegroupinfo
remotegrouplist
remotesysinfo
remoteusergroups
remoteuserinfo
remoteuserlist
String Functions
User Information Functions
Authentication Services Functions
pmcheck
pmclientd
pmclientinfo
pmcp
pmcsh
pmincludecheck
pminfo
pmjoin
pmjoin_plugin
pmkey
pmksh
pmless
pmlicense
pmlist
pmloadcheck
pmlocald
pmlog
pmlogadm
pmlogsearch
pmlogsrvd
pmlogxfer
pmmasterd
pmmg
pmpasswd
pmplugininfo
pmpluginloadcheck
pmpolicy
pmpolicyconvert
pmpolicyplugin
pmpoljoin_plugin
pmpolsrvconfig
pmremlog
pmreplay
pmresolvehost
pmrun
pmserviced
pmsh
pmshellwrapper
pmsrvcheck
pmsrvconfig
pmsrvinfo
pmstatus
pmscp
pmsum
pmsysid
pmtunneld
pmumacs
pmverifyprofilepolicy
pmvi
Installation Packages
Unsupported Sudo Options
Unsupported Command Line Sudo Options
Behavioral Change
Unsupported Sudoers Policy Options
Unsupported Sudoers Directives
Sudo Plugin Policy Evaluation
About us
remotegroupinfo
Privilege Manager for Unix Built-in Functions and Procedures > Remote Access Functions > remotegroupinfo
Syntax
list remotegroupinfo ( string hostname, string groupname )
Description
remotegroupinfo returns the group ID and a list of members of the specified group from the remote host.
|
|
NOTE: The remote host must be configured to run either pmmasterd or pmclientd to respond to this function. |
Example
#print the bin group info from the runhost print(remoteuserinfo(runhost,"bin"))
remotegrouplist
Privilege Manager for Unix Built-in Functions and Procedures > Remote Access Functions > remotegrouplist
Syntax
list remotegrouplist ( string hostname )
Description
remotegrouplist returns the full list of group names and the associated group IDs located on the remote host.
|
|
NOTE: The remote host must be configured to run either pmmasterd or pmclientd to respond to this function. |
Example
#print the remote groups on runhost print(remotegrouplist(runhost))
remotesysinfo
Privilege Manager for Unix Built-in Functions and Procedures > Remote Access Functions > remotesysinfo
Syntax
list remotesysinfo ( string hostname )
Description
remotesysinfo returns the full uname output from the remote system.
|
|
NOTE: The remote host must be configured to run either pmmasterd or pmclientd to respond to this function. |
Example
#print the runhost's uname info print(remotesysinfo(runhost))
remoteusergroups
Privilege Manager for Unix Built-in Functions and Procedures > Remote Access Functions > remoteusergroups
Syntax
list remoteusergroups ( string hostname, string username )
Description
remoteusergroups returns a list of groups that the specified user belongs to on the remote system.
|
|
NOTE: The remote host must be configured to run either pmmasterd or pmclientd to respond to this function. |
Example
# print root's groups on the runhost print(remoteusergroups(runhost,"root"))