Using pcksh method the administrator can grant privileged session to a non-privileged system user and all the user action in the privileged session are captured.
To grant privileged session to a non-privileged system user, the administrator must configure pcksh privileged session in Privileged Account Manager. For steps to configure the pcksh privileged session in Privileged Account Manager, see Work Flow to Configure Privileged Access for Windows
To access pcksh privileged session in Linux or UNIX system perform the following,
Log into the UNIX system as a non-privileged user.
Use usrun command to gain privileged shell access to perform administrative functions.
For example, specify usrun pcksh or usrun shell command. The command is rewritten to /usr/bin/pcksh and Command Control Audits set to 1 based on the policy created in Privileged Account Manager.
Execute the commands that require privileged access and perform the required operations in the UNIX or Linux system. These actions that are performed within the pcksh shell are audited based on the Command Control policy and can be viewed in Command Control Reports.
If the users need different environment variables to run some of their privileged commands, you can use a script to set up the values.
By default, Command Control uses the environment variables of the executing user. If the users receive a "not found" message for a command, you need add environment variables to the rule. For configuration information, see Scripts.
You can also define illegal commands, including built-in shell commands, in a script assigned to the rule.
Consider a scenario where the administrator has to provide privileged access to a part of the user session and monitor that privileged session.
For this scenario, the administrator must perform the following configuration in the command control:
Register the agent to Privileged Access Manager
Add a pcksh command pcksh_cmd with the following field values:
Description: Explain the purpose of this command. For example, When a user submits a usrun pcksh command or a usrun shell command, the command is rewritten to /usr/bin/pcksh. The Command Control Audit level is set to 1, which enables an additional level of audit to use with the Command Risk.
Rewrite: /usr/bin/pcksh -o audit 1
Commands:
pcksh
shell
Create a user group pcksh_usrgrp with the following field values:
Description: Explain the purpose of the user group. For example, Defines the user accounts that can run the usrun pcksh command to access root privileges.
Users: Specify the usernames of the users on the Linux and UNIX hosts that have thepermission to use the usrun pcksh command.
Add a rule pcksh_rule with the following field values:
Description: Explain the purpose of the rule. For example, Matches users who submit a usrun pcksh or usrun shell command. It authorizes their session and enables session capture as root. The command assigned to this rule also included a rewrite that enables the additional level of audit to be used in conjunction with the command risk list.
Session Capture: Select On.
Authorize: Select Yes, then select Stop from the drop-down menu.
Run User: Specify root.
Drag and drop the command pcksh_cmd and user group pcksh_usrgrp to the rule pcksh_rule.
After the administrator has configured the authorization rule in Privileged Account Manager, the non-privileged Linux or UNIX user can gain privileged session as following:
Log into the Linux or UNIX system as a non-privileged user.
Enter the command usrun pcksh to start a privileged session.
All the user actions in this privileged session are audited and the administrator can view these reports in the admin console.