The Command Control database can be protected through the use of the Transactions feature, which automatically locks the database when you start making changes and prevents other Framework users from making any changes. You must then commit the transaction to save the changes and release the lock, and you are prompted by customized questions to provide information that can be viewed in the Compliance Auditor. You can cancel the transaction at any time.
To use this feature, you must first enable it and create a customized Commit Transactions page, then you can use the feature and commit the changes you have made.
You can configure the Command Control Manager to use the Transactions feature when configuring Command Control rules.
You can also configure the Commit Transaction page that can be used for committing a transaction. The data entered on the Commit Transaction page is displayed in Compliance Auditor.
To configure this feature:
On the home page of the console, click Command Control.
In the command control pane, click Command Control.
In the details pane, click Transaction Settings.
Select the Enable Transaction check box to enable the use of Command Control transactions.
Click Add.
Specify a name for the field that you want to be displayed when a user commits a transaction. For example, to request the user’s name when committing a transaction, specify the value as Name.
Select Text if you want the user to enter one line of text, or select TextArea if you want the user to be able to enter several lines of text.
Select required if you want to force the user to enter text in this field. The Finish button on the Commit Transaction page does not become available until the user has entered text in this field.
Repeat Step 5 through Step 8 for any other fields you want to display when the user commits the transaction.
Select Finish.
On the home page of the console, click Command Control.
Make the configuration changes you want.
A message appears next to Command Control in the navigation pane to indicate that the Command Control database is locked, by whom, and when it was locked.
In the command control pane, click Command Control, then in the details pane, click Commit Transaction.
Complete the fields as set up on the Transaction Settings page, then click Finish.
Alternatively, if you do not want to keep the changes you have made, select Cancel Transaction in the details pane and select Yes to confirm. Any changes you have made since the database was locked are removed.
When you have finished changing the Command Control database, you must commit the transaction to save the changes and release the lock on the database. The Commit Transaction page can be customized to request whatever information you require when a transaction is committed.
To commit a transaction:
On the home page of the console, click Command Control.
In the command control pane, click Command Control.
In the details pane, click Commit Transaction.
To create a backup of the Command Control database enable the Create Backup checkbox to restore it in future and, then specify a reason for the backup in the text box.
Complete the customized fields according to company policies.
Click Finish.
The backup option allows you to create snapshots of the command control database and restore these snapshots at future date. You can back up and restore from the Framework Manager console, but you need to use the command line to remove a backed-up snapshot. For information about the command line options, see Section 11.2.2, Backing Up and Restoring a Command Control Configuration.
On the home page of the console, click Command Control.
In the Command Control pane, click Command Control.
In the details pane, click Backup and Restore.
To back up the database, specify a reason for the backup, then click Backup.
To restore a previous version of the database, select the version, then click Restore.
The current version is overwritten by the selected version.
Click Close.
The following information is recorded for each backed-up version:
Date: The date and time the backup was performed.
Administrator: The user that performed the backup.
Reason: The reason for performing the backup. This is optional information, but recommended.
All Command Control audit records contain the following information:
Submit details such as, the submitting username, hostname, and primary group.
Target details such as, the run username and the run hostname.
Command details, which include the original command requested and the actual command run.
Authorization status, either yes or no.
Session capture status, either yes or no.
Audit ID, which is the unique ID used to group audit events for the user’s session.
Codeset, which is the character encoding used for localization.
Terminal details such as tty name, terminal dimensions, and type.
The Audit Settings option allows you to modify this default record and add the following:
Encryption of sensitive password data in keystroke capture reports along with a password that allows authorized Framework administrators to decrypt it.
Additional options that can be audited for each record.
To define audit settings:
On the home page of the console, click Command Control.
In the command control pane, click Command Control.
In the details pane, click Audit Settings.
Configure the Password keystroke settings:
Select the Password filter check box.
In the Password filter text box, specify the text that is used to prompt users for their passwords.
For example, if the systems request a user’s password by using the word Password, specify Password in this field. If the systems use password, enter password in this field. This ensures that the password the user enters in response to this prompt is encrypted in the command control reports.
You can also use regular expressions as a password filter.
For example:
=~#([Pp]assword:)|(RDN:)#
This password filter would match Password, password, or RDN.
Select the Encryption password check box.
NOTE:If a filter is set and the Encryption Password is not set, then the filtered data is deleted from audit records.
In the Encryption password text box, specify the password that you require to decrypt the sensitive password data in the report.
This password must be entered on the Command Control Keystroke Report page under the Reports console to decrypt the password data.
Specify the password again in the Confirm password text box.
(Optional) Select the required check boxes under Metadata Audit Settings to add more information to the audit record:
Command: Complete information about the command being run, including the actual filename and arguments.
Host: Information about the submitting host
Environment: Complete list of the environment variables that are passed to the executed command.
Local time: The time on the machine that submitted the request.
Cwd: Details about the current working directory where the command was executed.
Options: Details about the various process control options for executing the command.
Run Account: Information about the account that is used to execute the command.
Process: Details about the process that submitted the request.
Jobs: The job control setting that were passed to the executed command.
Passwd: Details of the /etc/passwd entry for the user submitting the request.
Groups: The group membership details for the executed command.
Logon: The login time and source for the user submitting the request.
Click Finish.