Privilege Manager for Unix 7.0 - Administration Guide

Partition root safely Create an indelible audit trail Encryption

Policy configuration file (pmpolicy security policy) Policy group

Supported platforms Reserve special user and group names Required privileges

Single host deployment Medium business deployment Large business deployment Enterprise deployment

Installing the Management Console Uninstalling the Management Console

Checking the server for installation readiness Installing the Privilege Manager for Unix packages Configuring the primary policy server for Privilege Manager for Unix Join hosts to policy group

Installing secondary servers Configuring a secondary server

Checking PM Agent host for installation readiness Installing a PM Agent on a remote host Joining the PM Agent to the primary policy server Verifying PM Agent configuration Load balancing on the client

Uninstalling the Privilege Manager for Unix software packages

Upgrading the server package Upgrading the PM Agent package

Removing the server package Removing the PM Agent package

Displaying license usage

Policy profiles Profile-based policy files Profile selection Profile variables

Customization example - pf_forbidusers list

Install the example policy file Create test users Set Lesson number variable Introductory lessons Advanced lessons Sample policy files

Privilege Manager for Unix shell features Forbidden commands Allowed commands Allowed piped commands Check shell built-in commands Read-only variable list Running a shell in restricted mode Additional shell considerations

Configuration prerequisites Configuration file examples Use the while loop Use parallel lists Best practice policy guidelines Multiple configuration files and read-only variables Mail Environmental variables NIS netgroups Specify trusted hosts

Privilege Manager for Unix port usage Restricting port numbers for command responses Configuring pmtunneld Configuring Network Address Translation (NAT)

Enable configurable certification

Utilizing PAM authentication Authenticate PAM to client

Event logging Keystroke (I/O) logging

InTrust Knowledge Pack objects

Gathering InTrust data

alertkeymatch argc argv bkgd client_parent_pid client_parent_uid client_parent_procname clienthost command cwd date day dayname domainname env false FEATURE_LDAP FEATURE_VAS gid group groups host hour masterhost masterversion minute month nice nodename optarg opterr optind optopt optreset optstrictparameters pid pmclient_type pmclient_type_pmrun pmclient_type_sudo pmshell pmshell_builtin pmshell_cmd pmshell_cmdtype pmshell_exe pmshell_interpreter pmshell_prog pmshell_script pmshell_uniqueid pmversion ptyflags requestlocal requestuser rlimit_as rlimit_core rlimit_cpu rlimit_data rlimit_fsize rlimit_locks rlimit_memlock rlimit_nofile rlimit_nproc rlimit_rss rlimit_stack samaccount selinux status submithost submithostip thishost time true ttyname tzname uid umask unameclient unamemaster uniqueid use_rundir use_rungroup use_rungroups use_runshell user year

alertkeyaction alertkeysequence disable_exec eventlog eventloghost execfailedmsg iolog iolog_encrypt iolog_errmax iolog_opmax iologhost log_passwords logomit logstderr logstdin logstdout notfoundmsg passprompts pmshell_allow pmshell_allowpipe pmshell_checkbuiltins pmshell_forbid pmshell_readonly pmshell_reject pmshell_restricted preserve_clienthost profile_keepenv profile_setenv profile_unsetenv profile_use_runuser rejectmsg runargv runbkgd runchroot runcksum runclienthost runcommand runconfirmuser runcwd runenablerlimits runenv rungroup rungroups runhost runnice runpaths runptyflags runrlimit_as runrlimit_core runrlimit_cpu runrlimit_data runrlimit_fsize runrlimit_locks runrlimit_memlock runrlimit_nofile runrlimit_nproc runrlimit_rss runrlimit_stack runtimeout runumask runuser runutmpuser subprocuser tmplogdir

alertdate alerttime event exitdate exitstatus exittime

getenv getlistsetting getnumericsetting getstringsetting getyesnosetting keepenv policygetenv policysetenv policyunsetenv setenv unsetenv

hashtable_add hashtable_create hashtable_enum hashtable_import hashtable_lookup

fprintf input inputnoecho print printf printnnl printvars readdir readfile sprintf syslog

ldap_ bind ldap_count_entries ldap_dn2ufn ldap_explode_dn ldap_first_attribute ldap_first_entry ldap_get_attributes ldap_get_dn ldap_get_values ldap_next_attribute ldap_next_entry ldap_open ldap_search ldap_unbind

append insert join length lsubst range replace search split splitSubst

atoi authenticate_pam authenticate_pam_toclient basename comparehosts datecmp dirname feature_enabled fileexists, access getopt getopt_long getopt_long_only glob ingroup innetgroup innetuser, inusernetgroup lineno mktemp osname quote rand stat strftime system timebetween tolower toupper uname

getgrouppasswd getstringpasswd getuserpasswd

remotefileexists remotegroupinfo remotegrouplist remotesysinfo remoteusergroups remoteuserinfo remoteuserlist

match pad strindex strlen strsub sub subst substr

getfullname getgroup getgroups gethome getshell

vas_auth_user_password vas_host_in_ADgrouplist vas_host_is_member vas_user_get_groups vas_user_in_ADgrouplist vas_user_is_member

Navigating the log file