立即与支持人员聊天
与支持团队交流

Privilege Manager for Unix 7.3 - Administration Guide

Introducing Privilege Manager for Unix Planning Deployment Installation and Configuration Upgrade Privilege Manager for Unix System Administration Managing Security Policy The Privilege Manager for Unix Security Policy Advanced Privilege Manager for Unix Configuration Administering Log and Keystroke Files InTrust Plug-in for Privilege Manager for Unix Troubleshooting Privilege Manager for Unix Policy File Components Privilege Manager for Unix Variables
Variable names Variable scope Global input variables Global output variables Global event log variables PM settings variables
Privilege Manager for Unix Flow Control Statements Privilege Manager for Unix Built-in Functions and Procedures
Environment functions Hash table functions Input and output functions LDAP functions LDAP API example List functions Miscellaneous functions Password functions Remote access functions String functions User information functions Authentication Services functions
Privilege Manager for Unix programs Installation Packages

Configure a secondary policy server

The primary policy server is always the first server configured in the policy server group; secondary servers are subsequent policy servers set up in the policy server group to help with load balancing. The "master" copy of the policy is kept on the primary policy server.

All policy servers (primary and secondary) maintain a production copy of the security policy stored locally. The initial production copy is initialized by means of a checkout from the repository when you configure the policy server. Following this, the policy servers automatically retrieve updates as required.

By adding one or more secondary policy servers, the work of validating policy is balanced across all of the policy servers in the group, and provides failover in the event a policy server becomes unavailable. Use pmsrvconfig with the -s option to configure the policy server as a secondary server.

Installing secondary servers

To install the secondary server

  1. From the command line of the host designated as your secondary policy server, log on as the root user.

  2. Change to the directory containing the qpm-server package for your specific platform.

    For example, on a 64-bit Red Hat Linux, run:

    # cd server/linux-x86_64
  3. Run the platform-specific installer. For example, run:

    # rpm --install qpm-server-*.rpm

    The Solaris server has a filename that starts with QSFTpmsrv.

    When you install the qpm-server package, it installs all three Privilege Manager for Unix components on that host:

    • Privilege Manager for Unix Policy Server

    • PM Agent (which is used by Privilege Manager for Unix)

    • Sudo Plugin (which is used by Safeguard for Sudo)

    You can only join a PM Agent host to a Privilege Manager for Unix policy server or a Sudo Plugin host to a sudo policy server. For more information about policy types, see Security policy types.

Configuring a secondary server

You use the pmsrvconfig -s <primary_policy_server> command to configure a secondary server. For more information about the pmsrvconfig command options, see pmsrvconfig.

To configure the secondary server

  1. From the command line of the secondary server host, run:

    # pmsrvconfig -s <primary_policy_server>

    where <primary_policy_server> is the hostname of your primary policy server.

    pmsrvconfig prompts you for the "Join" password from the primary policy server, exchanges ssh keys for the pmpolicy service user, and updates the new secondary policy server with a copy of the master (production) policy.

Once you have installed and configured a secondary server, you are ready to join the PM Agent to it. For more details, see Join hosts to policy group.

Synchronizing policy servers within a group

Privilege Manager for Unix generates log files containing event timestamps based on the local clock of the authorizing policy server.

To synchronize all policy servers in the policy group, use Network Time Protocol (NTP) or a similar method of your choice.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级