Host Groups

Host groups contain hosts that are allowed, or not allowed, to submit or run commands that the rules control. You can add host groups to the rule conditions to control whether the rule is processed, depending on the host that is submitting a command or the host specified to run a command. You can also use host groups as script entities.

Command Control has two default host groups. Do not modify these groups.

All Hosts: Use this group to match against any host that have been registered with the Framework. Use the Hosts console to view the hosts that are included has matches for this group.

Submit Host: Use this group to match against the host from which the privileged request was made. This is useful if you want to ensure that a rule only authorizes access to the host from which the privileged request was made. This ensures that a user cannot use the -h option in usrun to gain access to other hosts.

You can search for a specific host in a host group by using suitable regular expressions, strings, or wild cards in the command. For example, the wildcards that you can use in the command could be vi * or /usr/bin/vi *.

To add a regular expression term to the list, prefix the regular expression with =~. For example,

=~/^vi .*$/

=~\w+\.netiq\.com

The following sections explain how to manage host groups:

Adding a Host Group

  1. On the home page of the console, click Command Control.

  2. In the navigation pane, click Account Groups, then click Host Groups.

  3. In the details pane, click Add. To add a host group to a category, select the category and click Add.

  4. Specify a name for the host group.

  5. Click Add.

    Host groups are represented by the icon.

  6. To configure the host group, refer Modifying a Host Group.

Modifying a Host Group

  1. On the home page of the console, click Command Control.

  2. In the navigation pane, click Account Groups, then click Host Groups.

  3. In the details pane, select the host group you want to modify, then click the edit icon next to the host group name.

  4. Configure the following fields:

    Name: Specify a name for the group.

    Disabled: Select this check box to disable the group. A disabled host group is dimmed.

    Description: Describe the purpose of this host group.

    Hosts: Add or change the hosts you want to include in this group. You can type the host names, one on each line, or paste them from elsewhere. You can use the Sort button to sort the list of hosts into alphabetical order.

    Host Groups: From the list of groups you have already defined, select the host groups you want to include as subgroups of this host group. You can also add subgroups to a host group by dragging and dropping the groups to the host group in the navigation pane.

  5. Click Modify. You can use this host group in rule conditions or as a script entity.

Deleting a Host Group

  1. On the home page of the console, click Command Control.

  2. In the navigation pane, click Account Groups, then click Host Groups.

  3. In the details pane, select the host group you want to delete, then click the delete icon next to the host group name.

    To select multiple host groups, click Delete Multiple and select the host groups from the list.

  4. Click Delete. The selected host groups are deleted and are also removed from any account group, rule conditions, and script entities in which they have been defined.