The Command Control feature provides users controlled access to privileged commands in a secure manner across the enterprise. Command Control enables the complete lockdown of user privilege by providing rules to determine the commands that are authorized to run, and a powerful account delegation feature that removes the need for common access to the root account.
Using Command Control you can enable centralized logging of activity across all platforms, and the selective capture of session activity for any user, to the keystroke level, which can be viewed through the Compliance Auditor and reporting features.
Additional features include external scripting that provides the ability to authenticate via third-party security databases or applications, and comprehensive test suite tools that allow the administrator to model and test new rule combinations before committing them to production use.
This section lists the tasks that you can perform to manage the policies.
The commands are passed to the Command Control through scripts, commands, or replacement shells.
When a command is received, the Command Control uses the following to evaluate the command:
The command is validated against configured rule criteria such as submit user, submit host, run host requested, date/time, and the command name itself.
Any Perl script associated with the rules are executed, such as setting environment variables.
If the evaluation authorizes the command to run:
The command is executed on the requested run host unless a matching rule specifies a run host. When a rule specifies a run host, the command is executed on that host. Rule values always overwrite values in the command request.
The command is executed as the requested run user unless a matching rule specifies a run user. When a rule specifies a run user, the command is executed as that user. Rule values always overwrite values in the command request.
If the evaluation returns unauthorized, the command is not executed and the reason for the failure is returned.