Chat now with support
Chat with Support

Safeguard for Sudo 2.0 - Administrators Guide

One Identity Privileged Access Suite for Unix Introducing Privilege Manager for Unix Introducing Privilege Manager for Sudo Planning Deployment Installation and Configuration
Download Privilege Manager for Unix Software Packages Download Privilege Manager for Sudo Software Packages Quick Start and Evaluation Configure a Primary Policy Server Configure a Secondary Policy Server Install PM Agent or Sudo Plugin on a Remote Host Remove Configurations
Upgrading Privilege Manager System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager Variables Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures Privilege Manager Programs Installation Packages Unsupported Sudo Options Sudo Plugin Policy Evaluation About us

Unsupported Sudoers Directives

Unsupported Sudo Options > Unsupported Sudoers Directives
Table 104: Unsupported Sudoers directives
Sudoers Directive Description / Explanation
#include & #includedir

Privilege Manager for Sudo does not support these options.

Because these options use absolute paths they can point outside the policy repository making it impossible to sync the policy files that are included among the policy servers.

NOTE: You can use #include and #includedir to include files and directories, so long as you keep them in a separate directory from the working copy, but you need to know that the included files/directories will not be under revision control.

Sudo Plugin Policy Evaluation

Sudo Plugin Policy Evaluation

Privilege Manager for Sudo enhances traditional sudo by providing centralized services for policy evaluation, as well as event and keystroke logging. Privilege Manager for Sudo provides continuity of service in the event of a network or server outage by means of off-line policy evaluation.

Sudo off-line policy evaluation is available when using the Sudo Plugin joined to a policy server that evaluates a sudoers policy. The off-line policy evaluation feature is not available when using the Privilege Manager for Unix clients.

How It Works

The Sudo Plugin package provides a cache service by installing a client version of the policy server daemon (pmmasterd) on the Plugin host. When you configure and join the host to a policy server, it sets up the policy management subsystem, and checks out the cache’s copy of the security policy from the central repository on the primary policy server.

When you run a sudo command, it sends the initial Sudo Plugin request to the cache service running on the Plugin host. In most cases, the cache service forwards the request to a central policy server on the network. However, if the cache service does not receive a timely response from a central policy server, it services the request locally, performing an off-line evaluation of the cached policy and storing the event and keystroke logs in a temporary holding location on the Plugin host (under /var/opt/quest/qpm4u/offline/). You can configure the time period before an off-line policy evaluation occurs by adding the offlineTimeout setting in the /etc/opt/quest/qpm4u/pm.settings file. offlineTimeout defaults to 1500 milliseconds (1.5 seconds). To modify that setting, specify the timeout period in milliseconds as an integer value. For example, to set a timeout of 5 seconds (5000 milliseconds), enter the following into the pm.settings file:

offlineTimeout 5000

Setting offlineTimeout to 0 in the pm.settings file, forces the cache service to always perform off-line (local-only) policy evaluation for sudo requests.

Once an off-line policy evaluation has occurred, the pmloadcheck daemon periodically checks to see if any policy server has come back online. Upon returning to an online state, the pmloadcheck daemon initiates a log file transfer to copy the logs to a temporary quarantine area on the policy server (/var/opt/quest/qpm4u/quarantine). The policy server validates the integrity of the log files in the quarantine and processes them, appending events to the central log store.

Determining Off-line Events

When off-line policy evaluation occurs, the cache service’s pmmasterd process writes a message to the pmmasterd.log file located in either /var/log or /var/adm, depending on your operating system, and is configurable in the /etc/opt/quest/qpm4u/pm.settings file.

Once processed into a policy server’s central event store, you can identify off-line events by examining the offlinesession event variable (pmlog –c "offlinesession==1") or the masterhost variable which is set to the Plugin host’s hostname.

Off-line Policy Cache Updates

At regular intervals and whenever a request is sent to a central policy server for online evaluation, the pmloadcheck daemon checks the revision number of the cached policy. You can also use the pmpolicyplugin utility to display the revision status of the cached policy or to request an update. (See pmpolicyplugin for more information about this utility.)

About us

About us

Contacting us

For sales or other inquiries, visit www.quest.com/company/contact-us.aspx or call +1 949 754-8000.

Technical support resources

Technical support is available to One Identity customers with a valid maintenance contract and customers who have trial versions. You can access the Quest Support Portal at https://support.quest.com.

The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. The Support Portal enables you to:

  • Submit and manage a Service Request
  • View Knowledge Base articles
  • Sign up for product notifications
  • Download software and technical documentation
  • View how-to-videos
  • Engage in community discussions
  • Chat with support engineers online
  • View services to assist you with your product
Related Documents