Chat now with support
Chat with Support

Safeguard for Sudo 2.0 - Administrators Guide

One Identity Privileged Access Suite for Unix Introducing Privilege Manager for Unix Introducing Privilege Manager for Sudo Planning Deployment Installation and Configuration
Download Privilege Manager for Unix Software Packages Download Privilege Manager for Sudo Software Packages Quick Start and Evaluation Configure a Primary Policy Server Configure a Secondary Policy Server Install PM Agent or Sudo Plugin on a Remote Host Remove Configurations
Upgrading Privilege Manager System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager Variables Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures Privilege Manager Programs Installation Packages Unsupported Sudo Options Sudo Plugin Policy Evaluation About us

pmincludecheck

Privilege Manager Programs > pmincludecheck
Syntax
pmincludecheck [-v][-p <path>][-f][-o]
Description

pmincludecheck is used by the pmsrvconfig script on the primary server only. When configuring a primary server in pmpolicy mode, if you do not have a policy file to import into the repository, then pmincludecheck initializes the policy from the current set of default policy files provided in the installation.

Options

pmincludecheck has the following options:

Table 57: Options: pmincludecheck
Option Description
-v Displays the version number of Privilege Manager for Unix and exits.
-p Sets policyDir to the specified path.
-f Sets policyDir to the specified file.
-o Forces rewrite of the current policy file, which archives and replaces the current policy file.

pminfo

Privilege Manager Programs > pminfo

NOTE: pminfo is obsolete in version 5.6 or higher and is included for backwards compatibility only.

Syntax
pminfo -v | [ -s | -d | -r [ -m <master> ] ]
Description

(Privilege Manager for Unix only.) The pminfo program allows the local host to register with Privilege Manager. If your Privilege Manager policy server has a host license, this registration is mandatory; agents cannot communicate successfully with the policy server until registration is completed and the policy server has allocated a license slot for the agent.

During registration, information about the local host configuration is sent to the Privilege Manager policy server. This includes a list of the agent's IP addresses.

To view the information that will be sent to the Privilege Manager policy server, run pminfo with the -s option.

The pminfo program located on an agent identifies itself to the policy server using the agent's fully qualified host name and a unique registration data string.

If the host name or IP address(s) of the agent are changed, then the agent must re-register with the policy server.

Options

pminfo has the following options:

Table 58: Options: pminfo
Option Description
-d Unregister the local host from Privilege Manager.
-m Specify a single policy server host to register with. By default, pminfo attempts to register with all policy servers configured in etc/opt/quest/pm.settings.
-r Register the local host with Privilege Manager.
-s Dump the local host registration information to stdout.
-v Displays the version number of Privilege Manager for Unix and exits.
Files
  • Privilege Manager for Unix configuration file: /etc/opt/quest/qpm4u/policy/pm.conf
  • Privilege Manager for Unix communication parameters: /etc/opt/quest/qpm4u/pm.settings
Related Topics

pmlicense

pmmasterd

pmjoin

Privilege Manager Programs > pmjoin
Syntax
pmjoin –h | --help [-abitv] [-d variable=value] [policy_server_host] [-bv] -u --unjoin
         [--accept] [--batch] [--define variable=value] [--interactive] [--tunnel] 
         [--verbose] policy_server_host ...
Description

(Privilege Manager for Unix only.) Use the pmjoin command to join a PM Agent to the specified policy server. When you join a policy server to a policy group, it enables that host to validate security privileges against a single common policy file located on the primary policy server, instead of on the host. You must run this configuration script after installing the PM Agent package to allow this agent to communicate with the server(s) in the group.

Options

pmjoin has the following options:

Table 59: Options: pmjoin
Option Description
-a | --accept Accept the End User License Agreement (EULA), /opt/quest/qpm4u/pqm4u_eula.txt.
-b | --batch Run in batch mode, will not use colors or require user input under any circumstances.
-d variable=value | --define variable=value Specify a variable for the pm.settings file and its associated value.
-h | --help Print this help message.
-i | --interactive Run in interactive mode, prompting for configuration parameters instead of using the default values.
-t | --tunnel Configure host to allow Privilege Manager connections through a firewall.
-u | --unjoin Unconfigure a Privilege Manager agent.
-v | --verbose Display verbose output while configuring the host.
Examples

See Join PM Agent to a Privilege Manager for Unix Policy Server for usage examples.

Files
  • Directory when pmjoin logs are stored: /opt/quest/qpm4u/install
Related Topics

pmrun

pmlocald

pmmasterd

pmpolicy

pmsrvconfig

pmjoin_plugin

Privilege Manager Programs > pmjoin_plugin
Syntax

pmjoin_plugin -h | --help [-abioqv] 
                [-d variable=value] [policy_server_host] [-bv] –u
                [--accept] [--batch] [--define variable=value] [--interactive] 
                [--io-plugin-only][--pipestdin][--verbose] policy_server_host ... 
                [--batch] [--verbose] –unjoin

Description

(Privilege Manager for Sudo only.) Run the pmjoin_plugin command to after installing the Sudo Plugin package (qpm-plugin) on a remote host to allow it to communicate with the server(s) in the policy group.

Options

pmjoin_plugin has the following options:

Table 60: Options: pmjoin_plugin
Option Description
-a | --accept Accept the End User License Agreement (EULA), /opt/quest/qpm4u/pqm4u_eula.txt.
-b | --batch Runs in batch mode, does not use colors or require user input.
-d variable=value | --define variable=value Specifies a variable for the pm.settings file and its associated value.
-h | --help Displays usage information.
-i | --interactive Runs in interactive mode, prompting for configuration parameters instead of using the default values.
-o | --io-plugin-only Configures only the I/O logging plugin (io_plugin) without the use of the Sudo Plugin (policy_plugin) .
-q | --pipestdin Pipes password to stdin if password is required.
-u | --unjoin Unjoins a Sudo Plugin host from the policy server.
-v | --verbose Displays verbose output while configuring the host.

Files
  • Directory when pmjoin_plugin logs are stored: /opt/quest/qpm4u/install
  • Sudo Plugin configuration file: /etc/sudo.conf
Related Topics

pmjoin

pmlocald

pmmasterd

pmpolicy

pmsrvconfig

Related Documents