Complete Session Control Using pcksh

You can use pcksh to get complete session capture of the non-privileged UNIX or Linux system user. For complete session capture of the user, the user’s login shell should be modified to pcksh client. The pcksh client executes commands as a normal Korn shell.The functions and the aliases that replace normal system commands are read from /etc/profile.pcksh.When the user issues a command that needs privileges to run, it is authorized through the Framework.

Configuring pcksh for Complete Session Capture

To get complete session capture using pcksh, the administrator must make appropriate configurations in Privileged Account Manager. For steps to configure the pcksh in Privileged Account Manager, see Work Flow to Configure Privileged Access for Windows

Accessing pcksh for Complete Session Capture

To access pcksh for complete session capture perform the following,

Log into the UNIX or Linux system as a non-privileged user.
Use the tool provided in the UNIX or Linux environment to set the users’ shell to the following:
```
/usr/bin/pcksh
```
To ensure that configured commands are authorized at the Framework, add the following line to either the user’s profile file or to the central profile.pcksh file in the /etc directory on the appropriate UNIX or Linux servers:
```
set -o remote
```
IMPORTANT:The set -o remote option forces all commands that are not built in to the user’s shell to be authorized at the Framework. Commands for which a defined rule does not exist are not permitted to execute. To prevent all commands in the profile.pcksh file or .profile file from being passed to the Framework for authorization, add the set -o remote command at the end of the file.

(Optional) Set the following additional options in the profile file:

Option	Description
set -o host <hostname>	Specifies that all authorized commands are executed on the defined host, if permitted.
set -o user <username>	Specifies that all authorized commands are executed as the defined user if permitted.
set -o audit <n>	Enables auditing, Set <n> to one of the following values: 1: Enables auditing of all commands that are not built into the user's shell. 2: Enables auditing of all commands including commands that are built into the user's shell. This level of auditing can affect login times. After the audit value has been set, it cannot be changed. If it is turned on in the profile, the user cannot turn it off later.
set -o ignoreperm	Enables commands that have not been successfully authorized at the Framework to execute according to the local permissions in effect on the server where the command was issued.
set -o test	Allows typed commands to be checked to see if they would be accepted by the rule structure. A yes or no output to screen indicates the result. The set -o test option is normally used in conjunction with the set -o remote option.
set -o test '${}$'	Returns the complete metadata result that is generated by the Command Control manager.

Rule definitions override the settings for user and host. If a successfully matched rule specifies a run user or a run host, this user or host is used to execute the command, and not those specified in the set -o commands.

You can use rule conditions to match the run user or run host to the username or hostname defined by using these commands (see Setting Conditions for a Rule), but if a run user or run host is defined in the rule configuration, these are the ones that are used.

You can define a list of illegal commands, including built-in shell commands, in a script assigned to a rule. Users using the pcksh shell cannot run these commands, even if they are root.