Application Command List

Keeping Windows and Linux/Unix agents in perspective, rather than elevating the entire session for the user, we have option to elevate privileges for certain applications. This may be for a command prompt or database client <SQL client> which ever application which might required granular permissions to be granted.

For agentless sessions although they are elevated sessions using SSH and Telnet, we can restrict the user functions. These command lists are easy to configure because there are wizards to guide to users.

The following procedure helps you in adding commands which you want to allow or deny.

  1. Create a command list.

    1. Go to Access Control > Configuration > Application Command List.

    2. Click New List > Create New List

    3. Enter the Name, optionally add the Description.

    4. Select the List Type. Either Windows or Linux.

    5. Click Create.

  2. Add commands which you want to allow or deny.

  3. Set the Risk Score to any of the following levels:

    • Undefined

    • Low

    • Medium

    • High

  4. Go to Credential Vault. Select either Linux/Unix Network Device or Windows. as applicable.

  5. Select the resource for creating the vault for which you want to add allow/deny commands.

  6. Create a Resource Pool.Access Control > Resource Pools. For more information, see Section 6.2.2, Configuring Resource Pools.

  7. Create a User Role based on the user selection from Local User, Agent User, LDAP User. For more information see, Section 6.2.3, Configuring User Roles.

  8. Create an Assignment by delegating necessary permissions.

  9. In the Command List page, add the command list you created in the configuration tab and specify if you want to allow or deny those set of commands.

  10. Click Finish > Save.

If you log into the target machine and execute the commands, you will notice that the commands you set to deny will throw a “permission denied” error.

You can view the risk details in Reports > All Sessions Details > Keystrokes.