Sample Scripts

Privileged Account Manager ships with the following sample scripts that you can import and use:

  • Display message scripts

  • Password validation scripts

  • Alternate validation scripts

  • Email scripts

  • Modify environment script

  • Emulate su script

  • Secure vi script

Before creating your own Perl script, check out the sample scripts to see if one is available that meets your needs or one that can be modified to meet your needs. To understand what is available, see the sample scripts in the following sections.

To import a sample script, click Command Control > Import Samples > Sample Perl Script.

Modify Environment Script

This script is used to process environment variables. It has a number of script arguments that can add, delete, clear, and keep environment variables.

Argument

Description

clearenv=1:

Clears all environment variables (unless specifically kept using keepenv)

keepenv=VAR:

Specifically keeps environment variables. As soon as this is set, all other environment variables are deleted.

setenv=VAR=val:

Sets up a specific environment variable.

unsetenv=VAR:

Deletes a specific environment variable.

defaultenv=#:

Sets the default environment:

0: Sets up no default environment variables.

1: Sets up all default environment variables.

2: Sets up default environment variables that do not already exist in the environment.

Sample Environment Script

my $e=$meta->child("Environment");
return(1) if(! $e);
 
my $n=$e->node_args();
my %env=();
 
while($n) {
    $env{$1}=$2 if($n->key() ne "items" && $n->value() =~ /^(.*)=(.*)$/);
    $n=$n->next();
}
 
my %keepenv=();
my $clearenv=0;
 
for(my $a=$args->node_args();$a;$a=$a->next()) {
    if($a->key() eq "clearenv" && $a->value() > 0) {
        $clearenv=1;
    } elsif($a->key() eq "keepenv" && $a->value() ne "") {
        $keepenv{$a->value()}=1;
    } elsif($a->key() eq "defaultenv" && $a->value >= 0) {
        $meta->child("Job")->arg_int("job_default_env",$a->value());
    }        
}    
 
if(scalar %keepenv || $clearenv) {
    while(my ($key,$val) = each %env) {
        delete $env{$key} if(! $keepenv{$key});
    }        
}
        
for(my $a=$args->node_args();$a;$a=$a->next()) {
    if($a->key() eq "unsetenv" && $a->value() ne "") {
        delete $env{$a->value()};
    } elsif($a->key() eq "setenv" && $a->value() =~ /^(.*)\s*=\s*(.*)$/) {
        $env{$1}=$2;
    }            
} 
 
$meta->del($e);
$e=$meta->add_node("Environment");
 
my $items=0;
 
while(my ($key,$val) = each(%env)) {
    $e->arg("arg-$items","$key=$val");
    $items++;
}    
 
$e->arg_int("items","$items");
 
return(1);

pcksh Illegal Commands Script

When using the pcksh shell, Command Control has the ability to restrict the commands being run (even as root). This sample script is named illegalcmd, and it restricts the use of the passwd command.

This script does not restrict a user that initiates another shell from within a session. When a user does this, Command Control cannot continue a full audit or control the illegal commands, although the session is still captured

#to set script argument - name=illegalcmd value= kill *
my $t=$meta->get_params('Ticket');
if(! $t) {
$t=$meta->add_param('Ticket');
}

my $i=$t->get_params('IllegalCmds');
if(! $i) {
$i=$t->add_param('IllegalCmds');
}

my @illegal = $args->arg_values('illegalcmd');

#my @illegal=("echo","ls -l","passwd","/usr/bin/ls -l","ksh","echo date");
foreach my $b (@illegal) {
my $c=$i->add_param('Command');
$c->arg("cmd",$b);
}
return 1;