Consider a scenario where the administrator has to provide a privileged session and complete session when a non-privileged user logs in.
For this scenario, the administrator must perform the following configuration in the command control:
Register the agent to Privileged Access Manager
Add a pcksh command cpcksh_cmd with the following field values:
Description: Explain the purpose of this command. For example, When a user's shell is set to /usr/bin/cpcksh and the user logs in, a Command Control request is sent with a submitting command of -cpcksh to indicate login. The user's login shell is rewritten to /usr/bin/pcksh. The Command Control Audit level is set to 1, which enables an additional level of audit to use with the Command Risk.
Rewrite: /usr/bin/pcksh -o audit 1
Commands:
-cpcksh
Create a user group cpcksh_usrgrp with the following field values:
Description: Explain the purpose of the user group. For example, Defines the user accounts that can use the cpcksh command.
Users: Specify the usernames of the users on the Linux and UNIX hosts that have thepermission to use the usrun pcksh command.
Add a rule cpcksh_rule with the following field values:
Description: Explain the purpose of the rule. For example, Authorizes the matching of submit users who have /usr/bin/cpcksh as their defined login shell. It authorizes their session and enables session capture, when they are still running as their original login ID.
Session Capture: Select On.
Authorize: Select Yes, then select Stop if authorized from the drop-down menu. These settings allow subsequent commands to be executed without authorization checks whenever the user has had one command authorized.
Drag and drop the command cpcksh_cmd and user group cpcksh_usrgrp to the rule cpcksh_rule.
After the administrator has configured the authorization rule in Privileged Account Manager, the non-privileged Linux or UNIX user can gain privileged session as following:
Log into the Linux or UNIX system as a non-privileged user.
Use the tool provided in the UNIX or Linux environment to set the users’ shell to the following:
/usr/bin/cpcksh
Perform the required action in the Linux or UNIX system.
All the user actions in this privileged session are audited and the administrator can view these reports in the admin console.