On the home page of the console, click Command Control.
In the Command Control pane, click Rules.
Select the rule that you want to modify.
In the details pane, click Modify.
Make the following changes:
Name: Change the name of the rule.
Description: Specify a description of the rule.
User Message: Specify the user message as $<ExtGroups>$.
Session Capture: Select either On or Off.
Authorize: Select either Yes or No, depending on whether you want the command protected by the rule to be authorized or not authorized if the rule conditions are met.
Run User: Select Submit User from the drop-down list.
Credentials: From the drop-down list, select the required resource. The Run User is automatically populated with the domain user provided in the resource.
Run Host: Define a run host by selecting the name of the host on which you want to run this command (this overrides any hostname defined through a set command).
Risk Level: Set a Risk Level of 0 to 99.
Audit Group: Define an Audit Group. This setting is for use in Compliance Auditor reports.
Click Finish. The settings you have defined for the rule are displayed in the console.
A typical result of the LDAP group lookup rule when a rule is created for a user to run the ID command as a root user is displayed below:
user1@pum-sles10sp3:/root> usrun id
<ExtGroups>
<groupname="CN=GROUP3,CN=Users,DC=pum,DC=com"/>
<groupname="CN=GROUP2,CN=Users,DC=pum,DC=com"/>
<groupname="CN=GROUP1,CN=Users,DC=pum,DC=com"/>
<groupname="cn=G1,o=netiq"/>
<groupname="cn=G2,o=netiq"/>
</extroups>
uid=1001(user1) gid=100(users) groups=0(root), 16(dialout), 33(video), 100(users)
user1@pum-sles10sp3:/root>