立即与支持人员聊天
与支持团队交流

Safeguard Authentication Services 5.0.3 - Administration Guide

Privileged Access Suite for Unix Introducing One Identity Safeguard Authentication Services Unix administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment Integrating with other applications Managing Unix hosts with Group Policy
Safeguard Authentication Services Group Policy
Group Policy Concepts Unix policies One Identity policies
Display specifiers Troubleshooting Glossary

Privilege Manager for Unix policy

Privilege Manager for Unix controls which users are able to gain root access on Unix hosts. It is similar to sudo with more advanced features and functionality. You can use Group Policy to control Privilege Manager for Unix settings on hosts that are also running Safeguard Authentication Services.

Privilege Manager for Unix policy files

One Identity Privilege Manager for Unix uses policy files to define the rules governing which users are able to run which commands as root. The policy files are defined using syntax defined by Privilege Manager for Unix. When the policy files are applied on the Unix host, the Group Policy agent validates the new set of policy rules to ensure that there are no syntax or logical errors in the rules. If the policy rules do not validate, the Group Policy agent logs an error and does not apply the policy files. This ensures that an oversight or other error does not break the security infrastructure already in place.

BEST PRACTICE: As a best practice, always test your policy configuration prior to applying it by means of Group Policy.

If you add a file named pm.conf, this file overrides the default root policy file. The Group Policy agent updates the list of files included from the root policy file to included all of the configured files. If the validation step fails after updating the included files, the policy is not applied.

For more information about the syntax of Privilege Manager for Unix policy files, refer to the documentation included with One Identity Privilege Manager for Unix.

Configuring Privilege Manager policy files

To configure Privilege Manager policy files

  1. In the Group Policy Object Editor, navigate to Unix Settings | Quest Privilege Manager.
  2. Double-click Privilege Manager Policy Files.

    The Privilege Manager Policy Files Properties dialog opens.

  3. Click Add to browse for a Privilege Manager policy file. You can browse the local host or a remote host running SSH.
  4. Once you have added all of the policy files, you can reorder them using the Up and Down buttons.
  5. You can edit the contents of the policy file directly by either double-clicking the item in the list or clicking Edit File.

    Privilege Manager policy files are evaluated when group policy is applied. If a Privilege Manager policy file contains errors it is not applied.

  6. Click OK to save settings and close the Privilege Manager Policy Files Properties dialog.

Privilege Manager Configuration policy

The Privilege Manager Configuration policy manages the pm.settings file, which contains configuration options for One Identity Privilege Manager for Unix. The Group Policy agent applies the configuration to the pm.settings file.

Since the Group Policy agent is based on Active Directory and Kerberos, setting the Kerberos setting to "yes" causes the Group Policy agent to fully configure all other Kerberos settings automatically. For this reason, the additional Kerberos-related settings are not displayed in the Settings dialog.

For more information about the Privilege Manager configuration settings, refer to the documentation included with One Identity Privilege Manager for Unix.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级