cpcksh is used to audit the complete user’s session. With NetIQ Privileged Access Manager, you can change a user’s login shell to cpcksh (/usr/bin/cpcksh), then configure a Command Control rule to authorize cpcksh and enable session capture. When the users log in, the commands are captured and audited through NetIQ Privileged Access Manager.
This method of integration provides the most auditing functionality. By changing the user’s shell to the cpcksh client instead of the pcksh client, Command Control can be configured to capture the user’s complete session, in addition to all other audit and control features.When the user logs in to the server, the session is started with the cpcksh client, which executes as a normal Korn shell. A request is sent to the Command Control Manager for authorization.
Functions and aliases that can replace normal system commands are read from /etc/profile.pcksh. When the user issues a command that needs privileges to run, it is executed through the Command Control system.
To get complete session capture using cpcksh, the administrator must make appropriate configurations in Privileged Access Manager.
To access cpcksh for complete session capture perform the following,
Log into the UNIX or Linux system as a non-privileged user.
Use the tool provided in the UNIX or Linux environment to set the user login shell to
/usr/bin/cpcksh
Perform the required operation and all these user actions are audited and can be viewed in Command Control Reports.
Consider a scenario where the administrator has to provide a privileged session and complete session when a non-privileged user logs in.
For this scenario, the administrator must perform the following configuration in the command control:
Register the agent to Privileged Access Manager
Add a pcksh command cpcksh_cmd with the following field values:
Description: Explain the purpose of this command. For example, When a user's shell is set to /usr/bin/cpcksh and the user logs in, a Command Control request is sent with a submitting command of -cpcksh to indicate login. The user's login shell is rewritten to /usr/bin/pcksh. The Command Control Audit level is set to 1, which enables an additional level of audit to use with the Command Risk.
Rewrite: /usr/bin/pcksh -o audit 1
Commands:
-cpcksh
Create a user group cpcksh_usrgrp with the following field values:
Description: Explain the purpose of the user group. For example, Defines the user accounts that can use the cpcksh command.
Users: Specify the usernames of the users on the Linux and UNIX hosts that have thepermission to use the usrun pcksh command.
Add a rule cpcksh_rule with the following field values:
Description: Explain the purpose of the rule. For example, Authorizes the matching of submit users who have /usr/bin/cpcksh as their defined login shell. It authorizes their session and enables session capture, when they are still running as their original login ID.
Session Capture: Select On.
Authorize: Select Yes, then select Stop if authorized from the drop-down menu. These settings allow subsequent commands to be executed without authorization checks whenever the user has had one command authorized.
Drag and drop the command cpcksh_cmd and user group cpcksh_usrgrp to the rule cpcksh_rule.
After the administrator has configured the authorization rule in Privileged Access Manager, the non-privileged Linux or UNIX user can gain privileged session as following:
Log into the Linux or UNIX system as a non-privileged user.
Use the tool provided in the UNIX or Linux environment to set the users’ shell to the following:
/usr/bin/cpcksh
Perform the required action in the Linux or UNIX system.
All the user actions in this privileged session are audited and the administrator can view these reports in the admin console.