Chat now with support
Chat with Support

Safeguard for Sudo 2.0 - Administrators Guide

One Identity Privileged Access Suite for Unix Introducing Privilege Manager for Unix Introducing Privilege Manager for Sudo Planning Deployment Installation and Configuration
Download Privilege Manager for Unix Software Packages Download Privilege Manager for Sudo Software Packages Quick Start and Evaluation Configure a Primary Policy Server Configure a Secondary Policy Server Install PM Agent or Sudo Plugin on a Remote Host Remove Configurations
Upgrading Privilege Manager System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager Variables Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures Privilege Manager Programs Installation Packages Unsupported Sudo Options Sudo Plugin Policy Evaluation About us

Reporting Basic Policy Server Configuration Information

System Administration > Reporting Basic Policy Server Configuration Information

To report basic information about the configuration of a policy server, enter

# pmsrvinfo

This command returns output similar to this:

Policy Server Configuration:
----------------------------
Privilege Manager version            : 5.6.0 (nnn)
Listening port for pmmasterd daemon  : 12345
Comms failover method                : random
Comms timeout(in seconds)            : 10
Policy type in use                   : sudo
Group ownership of logs              : pmlog
Group ownership of policy repository : pmpolicy
Policy server type                   : primary
Primary policy server for this group : myhost.example.com
Group name for this group            : MyPolicyGroup
Location of the repository           : file:
                           ////var/opt/quest/qpm4u/.qpm4u/.repository/sudo_repos/trunk
Hosts in the group                   : myhost.example.com

Checking the Status of the Master Policy

System Administration > Checking the Status of the Master Policy

The "master" copy of the policy file resides in a repository on the primary policy server. Each primary and secondary policy server maintains a "production" copy of the policy file or files. Use the pmpolicy utility to verify that the production copy is current with the master policy.

To compare the production policy file against the master policy on the primary server

  1. From the command line, enter:
    # pmpolicy masterstatus

    NOTE: If the files are in sync, the Current Revision number will match the Latest Trunk Revision number. If someone hand-edited the local copy without using pmpolicy utility commands to commit the changes, "Locally modified" will indicate "YES".

    If the production policy is not current with the master policy you can update the production policy with pmpolicy sync. (See pmpolicy for more information about the syntax and usage of the pmpolicy command.)

Checking the Policy Server

System Administration > Checking the Policy Server

When the policy server is not working as expected, use the pmsrvcheck command to determine the state of the server and its configuration.

To verify the policy server is running

  1. From the command line, enter:
    # pmsrvcheck

    This command returns output similar to this:

    testing policy server [ Pass ]

    If the policy server is working properly, the output returns 'pass', otherwise it returns, 'fail'.

    NOTE: See pmsrvcheck for more information about the syntax and usage of the pmsrvcheck command.

Checking Policy Server Status

System Administration > Checking Policy Server Status

The primary and secondary policy servers need to communicate with each other. Run the pmloadcheck command on a policy server host to verify that it can communicate with other policy servers in the policy group. The Sudo Plugin hosts also need to communicate with the policy servers in the policy group. Run pmpluginloadcheck on the remote hosts to verify that they can communicate with the policy servers in the group.

To determine if there any issues with policy servers in the policy group

From the Privilege Manager for Unix host command line, enter:

# pmloadcheck -r

-OR-

From the Privilege Manager for Sudo host command line, enter:

# pmpluginloadcheck -r

Both commands have output similar to this:

[0][root@sol10-x86 /]# pmloadcheck -r 
** Reporting current availability of each configured master... 
   * Host:myhost1.example.com (172.16.1.129) ... [ OK ] 
** Based on this data, the server list is currently ordered as: 
1.	myhosts.example.com 

NOTE: See pmpluginloadcheck for more information about the syntax and usage of this command.

Related Documents