Modifying a Command

  1. On the home page of the console, click Command Control.

  2. In the navigation pane, click Commands.

  3. In the details pane, select the command you want to modify and click on the edit icon next to it.

  4. Configure the following fields:

    Name: Specify a different name for the command.

    Disabled: Select this check box to disable the command. A disabled command is dimmed.

    Description: Describe the purpose of this command.

    Rewrite: In the Rewrite field, define a command to be used in place of the commands listed in the Command field. You can also enter command arguments. Positional parameters can be used, as described in Using the Command Rewrite Functionality for Command Arguments. To use the Rewrite field to enable auditing of the command, see Configuring Auditing with the Rewrite Functionality

    Commands: Define one or more commands, one on each line. You can also enter command arguments. For example:

    vi *
/usr/bin/vi *

    To add a regular expression term to the list, prefix the regular expression with =~. For example,

    =~/^vi .*$/

    =~#/usr/bin/vi .*#

    You can copy and paste a list of commands from elsewhere. You can use the Sort button to sort the commands into alphabetical order.

    Sub Commands: From the list of command definitions you have already created, select the subcommands you want to include in this command definition. You can also add subcommands to a command definition by dragging and dropping them to the command definition in the navigation pane.

    Refer the following table to modify the command fields based on the endpoint access methods:

    Methods

    Command fields

    Unix/Linux

    pcksh

    Specify values for the fields Rewrite and Commands.

    For example:

    Rewrite: /usr/bin/pcksh -o audit 1 Commands: (Specify the commands in separate line)

    pcksh

    shell

    cpcksh

    Specify values for the fields Rewrite and Commands.

    For example:

    Rewrite: /usr/bin/pcksh -o audit 1 Commands: -cpcksh

    usrun

    Specify the commands that require privileged access in the Commands field.

    For example:

    Commands: *passwd

    Windows

    RDP Relay

    Specify <rdp>* in the Command field.

    Credential Provider

    Specify <NPAMCP>* in the Command field.

    Direct RDP

    Specify <rdpDirect>* in the Command field.

    Run as privileged user

    Specify the process or files that require privileged access in the Command field.

    For example, if you want to give privileged access to notepad, you can specify the value in following ways:

    Command:*notepad.exe*

    Command:*note*d.e*e*

    Command:*n........ex.*

    You can also provide the absolute path of the application. For example, C:\Windows\System32\notepad.exe. If the absolute path contains space, include the absolute path between quotes. For example, "C:\Program Files (x86)\WinSCP\WinSCP.exe".

  5. Click Finish.

Using the Command Rewrite Functionality for Command Arguments

The following table provides examples showing how the command rewrite functionality provided on the Modify Command page can be used with positional parameters to replace the submitted command and parameters. The examples use the echo command as the rewritten command to display the selected parameters on the screen.

Table 7-1 Command Rewrite Examples

Function

Rewrite

Submitted Command

Executed Command

Insert all arguments ($0 is not displayed)

echo $*

ls passwd shadow fstab

echo passwd shadow fstab

Insert argument ’r;n’

echo $3

ls passwd shadow fstab

echo fstab

Insert all but argument 'n' ($0 is not displayed)

echo ${^2}

ls passwd shadow fstab

echo passwd fstab

Insert arguments from 'n' to end

echo ${2-}

ls passwd shadow fstab

echo shadow fstab

Insert arguments from 0 to 'n'

echo ${-2}

ls passwd shadow fstab

echo ls passwd shadow

Insert arguments from 'm' to 'n'

echo ${1-2}

ls passwd shadow fstab

echo passwd shadow

Insert the total number of arguments

echo $#

ls passwd shadow fstab

echo 3

Insert contents of argument $#

echo ${$#}

ls passwd shadow fstab

echo fstab

Rewrite Example Using ufsdump

In this example, the administrator usually does a backup of the system by using the following command:

    ufsdump -0f /dev/rmt/0 /usr

Assume that new tape drive is installed on the host, and it must be used for the backup. In addition, the administrator must make sure that it is working correctly by using the -v flag to verify the tape.

You can ensure that the administrator doesn’t need to remember the changes by using the Rewrite field to create a command definition for the original command:

    $0 -v $1 /dev/rmt/1 ${$#}

When the administrator enters the original command, the following command runs instead:

    ufsdump -v -0f /dev/rmt/1 /usr

Configuring Auditing with the Rewrite Functionality

To enable auditing of the command, add the following to the Rewrite field:

-o audit <n>

Replace <n> with one of the following values:

  • 0: Disables auditing. It has the same effect as removing the audit setting from the Rewrite field.

  • 1: Enables auditing of all commands that are not built into the user's shell.

  • 2: Enables auditing of all commands, including commands that are built into the user's shell. This level of auditing can affect login times.