Chat now with support
Chat with Support

Safeguard for Sudo 2.0 - Administrators Guide

One Identity Privileged Access Suite for Unix Introducing Privilege Manager for Unix Introducing Privilege Manager for Sudo Planning Deployment Installation and Configuration
Download Privilege Manager for Unix Software Packages Download Privilege Manager for Sudo Software Packages Quick Start and Evaluation Configure a Primary Policy Server Configure a Secondary Policy Server Install PM Agent or Sudo Plugin on a Remote Host Remove Configurations
Upgrading Privilege Manager System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager Variables Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures Privilege Manager Programs Installation Packages Unsupported Sudo Options Sudo Plugin Policy Evaluation About us

pmpoljoin_plugin

Privilege Manager Programs > pmpoljoin_plugin
Syntax
pmpoljoin_plugin -j <primaryserver> [-u <localuser][-b][-p] -d [-f] [-b] -v | -h | -[-z on|off[:<pid>]]
Description

(Privilege Manager for Sudo only.) Adjunct program to the pmjoin_plugin script. pmpoljoin_plugin is called by the pmjoin_plugin script when configuring a Sudo Plugin host to setup up the required read-only access to the policy repository, so that the client can operate in off-line mode.

Options

pmpoljoin_plugin has the following options:

Table 80: Options: pmpoljoin_plugin
Option Description
-b

Run the script in non-interactive mode.

Default: run in interactive mode.

-d Unconfigure the client.
-f Do not prompt for confirmation when unconfiguing the client.
-h Show this usage
-j

Join this client to the selected primary server.

Configures a client license on this host if it does not already have a server license; creates a pmclient user and configures read-only access to the repository for this user, using the pmpolicy account on the primary server.

-q Read pmpolicy user's password from stdin.
-u

The pmclient user account that will manage the production copy. This user will be created if it does not exist.

Default: pmclient

-v Print product version.

pmpolsrvconfig

Privilege Manager Programs > pmpolsrvconfig
Syntax
pmpolsrvconfig -p <policygroupname> [-b][-i <path>][-o][-r <dir>] 
                 [-t sudo|pmpolicy] [-u <policyuser][-w <userpasswd>]  
                 [-g <policygroup>][-l <loggroup>] -s <host> [-b][-q] [-q] 
                  -a <user> [-b][-q] [-q] 
                  -d [-f] 
                  -e <host> [-f] 
                  -x [-f] 
                  -v 
                  -h 
                  -[-z on|off[:<pid>]]
Description

The pmpolsrvconfig program is normally run by pmsrvconfig script, not by the user, to configure or un-configure a primary or secondary policy server. But, you can use it to grant a user access to a repository.

Options

pmpolsrvconfig has the following options:

Table 81: Options: pmpolsrvconfig
Option Description
-a <user>

Provide the selected user with access to the existing repository. If the user does not exist, it is created. The host must first have been configured as a policy server.

This user will be added to the pmpolicy group to grant it read/write access to the repository files, and to the pmlog group to grant it read access to the log files.

On a secondary policy server, an ssh key will also be generated to provide access to the pmpolicy user account on the primary policy server. The "join" password is required to copy this ssh key to the primary policy server.

-b

Run the script in batch mode (that is, no user interaction is possible).

Run in interactive mode by default.

-d

Unconfigure the policy server, and delete the repository if this is a primary server.

If you do not specify the -f option, then it prompts you to confirm the action.

-e Remove the selected host from the server group.
-f Force the unconfigure/delete action (that is, no user interaction required) Default: prompt for confirmation for -x option.
-g

Policy group ownership for the repository. If this group does not exist, it is created.

Default: pmpolicy

-h Print help.
-i

Import the selected policy into the repository. If this is a directory, the entire contents of the directory will be imported.

Default: /etc/sudoers.

-l <loggroup>

pmlog group ownership for the keystroke and audit logs

Default: pmlog

-o

Overwrite the repository if it already exists.

Default: do not overwrite if the repository already exists.

-p <policygroupname> Configure a primary policy server for the selected group name.
-q Read the pmpolicy user's password from stdin.
-r <dir>

Create the repository in the selected directory.

Default: /var/opt/quest/qpm4u/.qpm4u/.repository

-s <host> Configure a secondary policy server. You must supply the primary policy server host name. The secondary policy server retrieves the details of the policy group from the primary policy server. It creates the policygroup and loggroup groups to match those on the primary policy server and configures the policyuser user to grant it ssh access to the repository on the primary server. The "join" password is required to copy this ssh key to the primary policy server.
-t sudo|legacy

Security policy type, either Sudo or pmpolicy.

Default: sudo policy type

-u <policyuser>

The policy user account that manages the production copy. If this user does not exist, it is created and added to both the policygroup and loggroup groups. This user owns the repository on the primary policy server and provides remote access to the repository files to the secondary policy servers.

Default: pmpolicy

-v Print product version.
-w <userpassword>

Optional value to set new user's password for -a option.

Default: no password is configured.

-x

Unconfigure the policy server. If you do not specify the -f option, you are prompted to confirm the action.

NOTE: This does not remove the repository.

-z Enable/disable debug tracing, and optionally send SIGHUP to a running process. (Refer to Enabling Program-level Tracing before using this option.)

pmremlog

Syntax
pmremlog -v | -z on|off[:<pid>] 
pmremlog -p pmlog|pmreplay|pmlogtxtsearch [-o <outfile>] 
pmremlog [-h <host>] [-b] [-c] -- <program args>
Description

The pmremlog command provides a wrapper for the pmlog and pmreplay utilities to access the event (audit) and keystroke (I/O) logs on any server in the policy group. Anyone in the pmlog group can execute this utility on the primary policy server.

NOTE: pmlogtxtsearch is a command located in /opt/quest/libexec.

Options

pmremlog has the following options:

Table 82: Options: pmremlog
Option Description
-b Disables interactive input and uses batch mode.
-c Displays output in CSV, rather than human-readable format.
-h Specifies a host in the policy server group to access.
-o Saves the pmlog output to a file.
-p Specifies program to run.
-v Displays Privilege Manager for Unix version number.
-z Enables/disables debug tracing. (Refer to Enabling Program-level Tracing before using this option.)
Examples

To view the audit log on the primary policy server, enter:

pmremlog –p pmlog -- -f /var/opt/quest/qpm4u/pmevents.db

To view the audit events for user "fred" on secondary policy server "host1"”, save the pmlog output to a file, and display the result of the pmremlog command in CSV format, enter:

pmremlog –p pmlog -c –o /tmp/events.txt -h host1 -- --user fred

To view the stdout from keystroke log, "id_host1_x3jfuy", on secondary policy server, "host1", enter:

pmremlog –p pmreplay –h host1 -- -o -f /var/opt/quest/qpm4u/iologs/id_host1_x3jfuy

To retrieve the contents of keystroke log, "id_host1_x3jfuy", from secondary policy server "host1", formatted for the pmreplay GUI, save the output to a temporary file and display the result of the pmremlog command in CSV format, enter:

pmremlog –p pmreplay –h host1 -c –o /tmp/replay -- -zz -f /var/opt/quest/qpm4u/iologs/id_host1_x3jfuy

pmreplay

Syntax
pmreplay -V 
pmreplay -[t|s|i] -[Th] <filename> 
pmreplay -[e][I][o] -[EhKTv] <filename> 
pmreplay -z on|off[:<pid>]
Description

Use the pmreplay command to replay a log file to review what happened during a specified privileged session. The program can also display the log file in real time.

When using Privilege Manager for Sudo, enable keystroke logging by configuring the log_input and log_output variables. Please consult your sudoers manual for more information about configuring keystroke logging.

When using Privilege Manager for Unix, enable keystroke logging by configuring the iolog variable. If you are using the default profile policy, please consult global_variable.conf for details about configuring keystroke logging.

pmreplay can distinguish between old and new log files. If pmreplay detects that a log file has been changed, a message displays to tell you that the integrity of the file cannot be confirmed. This also occurs if you run pmreplay in real time and the Privilege Manager for Unix session that generated the events in the log file is active; that is, the pmrun session has not completed or closed yet. In this case, the message does not necessarily indicate that the file has been tampered with.

The name of the I/O log is a unique filename constructed with the mktemp function using a combination of policy file variables, such as username, command, date, and time.

NOTE: Privilege Manager sets the permissions on the I/O log file so that only root and users in the pmlog group can read it. That way, ordinary users cannot examine the contents of the log files. You must be logged in as root or be a member of the pmlog group to use pmreplay on these files. You may want to allow users to use Privilege Manager to run pmreplay.

By default pmreplay runs in interactive mode. Enter '?' to display a list of the interactive commands you can use to navigate through the file.

For example, replay a log file interactively by typing:

pmreplay /var/opt/quest/qpm4u/iolog/demo/dan/id_20130221_0855_gJfeP4 

the results will show a header similar to this:

 Log File : /var/opt/quest/qpm4u/iolog/demo/dan/id_20130221_0855_gJfeP4 Date : 2013/02/21 Time : 08:55:17 Client : dan@sala.abc.local Agent : root@sala.abc.local Command : id Type ’?’ or ’h’ for help

Type ? or h at any time while running in interactive mode to display the list of commands that are available.

Options

pmreplay has the following options:

Table 83: Options: pmreplay
Option Description
-e Dump the recorded standard error.
-E Include vi editing sessions when used with -K.
-h When used with -o or -I, prints an optional header line. The header is always printed in interactive mode.
-i Replays the recorded standard input.
-I Dumps the recorded standard input, but converts carriage returns to new lines in order to improve readability.
-K When used with -e, -I, and -o, removes all control characters and excludes vi editing sessions. Use with -E to include vi editing sessions.
-o Dumps the recorded standard output.
-s Automatically replays the file in "slideshow" mode. Use + and - keys to vary the speed of play.
-t Replays the file in tail mode, displaying new activity as it occurs.
-T Displays command timestamps.
-v Prints unprintable characters in octal form (\###)
-V Displays Privilege Manager for Unix version number.
-z Enables/disables debug tracing. (Refer to Enabling Program-level Tracing before using this option.)

Exit codes

pmreplay returns these codes:

1: File format error – Cannot parse the logfile. 
2: File access error – Cannot open the logfile for reading 
4: Usage error – Incorrect parameters were passed on the command line 
8: Digest error – The contents of the file and the digest in the header do not match
Related Documents