Unix Server

Before you begin:

Installing interactively takes less preparation and allows you to specify settings during installation. You can use the idmsetup.inf configuration to pass through some of the information as defaults.

Ensure that you have met the requirements.

To interactively install the Unix Listener on the Unix system:

The installer’s non-interactive mode allows you to perform unattended installations. This would be advantageous where you want to install on many systems over SSH, for example. This mode requires you to write a response file that is used with a command line option.

Ensure that you have met the requirements.

To install the Unix Listener non-interactively:

The install script automatically finds and updates the inetd.conf or xinetd.conf file and restarts the service.

The script updates the inetd.conf file with:

psunix-<instance> stream tcp nowait root /usr/local/psunix/<instance>/server.<os>.<cpu> server

A new file called psunix–<instance> is placed in the /etc/xinetd.d folder and contains the following:

service psunix-<instance>
{
    socket_type     = stream
    protocol        = tcp
    flags          = IPv4
    port            = 905
    wait            = no
    user            = root
    server          = /usr/local/psunix/<instance>/server.<os>.<cpu>
    server_args     =
    disable         = no
}

On some Unix systems, inetd (or inetutils-inetd ) only listens on IPv6 sockets by default. In that case, if IPv4 operation is required, replace "tcp" with "tcp4" in the psunix line in inetd.conf .

Once changes are made, restart the inetd process.

The psunix local instance name, defined by the -inst option when running the install.sh script, is not connected to the main Bravura Security Fabric instance name. If specified, it designates a sub-target.

All instances are configured to use the default database (/etc/passwd) but they can each be changed to match the logic needed for each sub-target.

It is recommended that you use port 905 and the default name to install the first local instance that targets the Unix server. You can then setup sub-targets with their own configuration (communication key (or Master Key), administration user, database, policies, scripts, and so on).

For example, you could use a PSLang script for psunix to target an application, such as a MySQL database, messaging server, or internal web-based application, while still retaining the default instance to manage the unix users themselves separately.

In another example, when implementing privileged access management, regular users could be served by the default instance, where it would be forbidden to touch administrators, and administrative users would be handled by a separate psunix instance with different credentials, and would be allowed to touch privileged users.

A default configuration file, psunix.cfg , is created for you in the etc directory during the Unix Listener installation. A default directory, /etc/psunix.d/, is also created and contains additional configuration files. You can edit these files to modify the values you entered during installation, or to set additional options.

You may also override account operations, built into the Unix Listener, by adding a PSLang file specified by the pslang-override-path option in psunix.cfg . The conf directory of the psunix archive contains three samples :

See:

The default path for psunix is /usr/local/psunix . At times it might be necessary to change this location in the psunix installer using the -bd option, for example:

 ./install.sh -bd /usr/share/psunix

In addition to this, you need to add an LD_LIBRARY_PATH entry for mtcspi in the service account’s .profile (by default, psadmin).

By default, the directory permissions for /usr/local/psunix are set for root for the user and group ownerships. It may be necessary at times to change this for an alternate administrative account when root is not used for the services.

For example, when the Unix Listener is installed, check to see what user is used to run the xinetd or inetd service for the psunix listener. Another example could be if LDAP Transparent Synch is installed and a different administrative user is used for the directory server service.

If any of these services are not root, you will need to modify the configuration files for psunix for this alternate administrative user, for example:

 chown -R <user>:<usersgroup> /usr/local/psunix

An NIS server derives its password database NIS maps from NIS source files. You must configure psunix so that it can locate and update the NIS source files.

In the psunix.cfg configuration file, configure passwd-path, group-path, shadow-path, and grpshadow-path to point to the NIS source files. A typical NIS instance does not use a shadow or gshadow file; this section may be commented out. The following is a sample excerpt from the psunix.cfg file for an NIS target system:

 database = {
   user = {

# Specifies an alternate path to the password database file where all
# user information is stored.  If it is not specified (default
# behavior), the location is /etc/passwd.
#

      passwd-path = "/var/yp/maps/passwd";

          };

      group = {

# Specifies an alternate path to the group database file where all
# group information is stored.  If it is not specified (default
# behavior), the location is /etc/group.
#
   

      group-path = "/var/yp/maps/group";

     };
    };

For transparent synchronization (pspasswd ) the configuration will be taken from the system (nsswitch.conf) since pspasswd uses system calls to get user credentials and set passwords, it does not use the specified configuration lines found in psunix.cfg.

Copy the provided pslang-override-nis.psl file located inside the conf directory in the psunix archive, into /usr/local/psunix/<instance>/. Edit the file to suit your requirements.

In the psunix.cfg file, add a pslang-override-path option that points to the PSLang override file:

# This option allows users to script pslang code that either:
# 1) overrides builtin psunix operations, or
# 2) adds pre/post operations that augement the builtin operations.
#
# Please refer to the psunix conf/pslang-override-sample.psl for a
# general example.
#
# Please refer to the psunix conf/pslang-override-nis.psl for a
# NIS example.
#
      pslang-override-path = "/usr/local/psunix/<instance>/pslang-override-nis.psl";

An NIS server builds the NIS maps using the make utility. Copy the following script into /usr/local/psunix/<instance>/make-nis.sh and edit accordingly. Ensure that the script includes the "hashbang" (#!) line with the full path to the interpreter program.

#!/bin/sh
# This script runs make to build the nis maps.
   

# Change the NISDIR to the path of the NIS makefile.

NISDIR=/var/yp/maps/
NISTARGET=passwd
   

# Change the NISTARGET to the make target(s) of interest.

cd $NISDIR
/usr/bin/make $NISTARGET

Ensure that the script has execution rights:

chmod u+x /usr/local/psunix/<instance>/make-nis.sh

Test the script to ensure it works.