Unix Configuration Scripts

The psunix archive package contains the Unix Listener and other tools and files used to perform Bravura Security Fabric operations on Unix systems. There are versions for each type of supported Unix system. The packages are installed in the unix directory when you choose a complete Connector Pack installation, or select them as part of a custom installation.

To install the package on a Unix system:

sh install.sh [-c <n>] [-ni] [-inf <path>/idmsetup.inf] [-inst <instancename>] [-rf <responsefile>] [-bd <dir>]

For the -c argument, the component is identified numerically where:

Installing interactively takes less preparation and allows you to specify settings during installation. Installing non-interactively allows you to install components unattended on many systems. You must edit the response file (psunix-responsefile.cfg) and the applicable configuration files before installing non-interactively.

Examples

See also

Specific requirements and instructions for installing Unix components see:

You can set the following options in the configuration file:

facility By default the logger directs any logging to syslog through the LOG_USER facility. Use this setting to direct the logging to another syslog facility. See Logging for more information.

Example:

 facility = "LOG_USER";

level The log level option allows the logger to filter content of a specified level and higher out of syslog. Higher logging levels result in more verbose entries in syslog.

Valid logging levels:

See Logging for more information.

Example:

level = "5";

include -dir Describes the location of the psunix.d configuration directory. See The psunix configuration directory for more information.

Example:

include-dir = "/etc/psunix.d";

commkey Defines the private key used for encryption. This key must match the one set during installation on the Bravura Security Fabric server.

Example:

commkey = "<encrypted commkey value>";

passwd-path Defines an alternate path to the password database file where all user information is stored. If it is not specified (default behavior), the location is /etc/passwd.

Example:

passwd-path = "/var/yp/passwd";

shadow-path Defines an alternate path to the shadow database file where all user password information is stored. If it is not specified (default behavior), the location is /etc/shadow.

Example:

shadow-path = "/var/yp/shadow";

group Defines an alternate path to the group database file where all group information is stored. If it is not specified (default behavior), the location is /etc/group.

Example:

group-path = "/var/yp/group";

gshadow-path Defines an alternate path to the group shadow database file where all group password information is stored. If is is not specified (default behavior), the location is /etc/gshadow. If this configuration option is not applicable then leave it unconfigured.

Example:

gshadow-path = "/var/yp/gshadow";

restricted-user-list Restrict these users from psunix and Bravura Security Fabric operations, (except the list operation). The accounts are listed in a colon-separated list.

Example:

restricted-user-list = "root:psadmin:joesomebody" ;

pslang-override-path Specifies a script file that allows users to script PSLang code that either overrides the built-in psunix operation, or adds pre/post operations that augment the built-in operations.

Example:

pslang-override-path = "/usr/local/psunix/<instance>/pslang-override.psl";

archive-homedir-path Specifies the directory to place the archived home directories in when users are removed from the system. This value must point to an existing directory. If it is not specified (default behavior), or points to an invalid directory, the users home directory will not be removed/archived when they are deleted.

Example:

archive-homedir-path = "/homedir_archive/";

tcb-retire Specifies if users should be retired when Bravura Security Fabric performs a delete request. This configuration option only applies to systems that have Trusted Computing Base (TCB) installed. C2 Security compliance requires that userid’s are never removed or reused, as such the default behavior for ’Trusted’ systems is to retire users. This can be overridden by setting this configuration option to false.

Example:

tcb-retire = "true" ;

The idarchive file is used to configure the options for the Bravura Privilege Client Service if installed.

The options are as follows:

cgipath Path used by the Bravura Privilege Client Service when connecting to an Bravura Privilege server via HTTP.

Example:

cgipath = "instance/psw.exe";

defaultgroup The name of the managed system policy that the Bravura Privilege Client Service automatically adds to Bravura Privilege on the initial connection. This is typically the same managed system policy that produced the installation key.

Example:

defaultgroup = "PULL_SVC_GRP";

serverlist A comma separated list of Bravura Privilege servers used by the Bravura Privilege Client Service to obtain user information.

Example:

serverlist = "10.0.0.1, 192.168.1.1";

port Port number used by the Bravura Privilege Client Service when connecting to a Bravura Privilege server via HTTP.

Example:

port = "80";

polltime Interval (in seconds) between update requests to the Bravura Privilege servers. A small value is not recommended since an update request can be a CPU and time intensive process. The default value is set to 3600 seconds.

Example:

polltime = "3600";

HttpTimeout Timeout (in seconds) that should be used when communicating with the Bravura Privilege HTTP service. The default value is set to 300 seconds.

Example:

HttpTimeout = "300";

waittime Wait time (in seconds) to wait after establishing connection to Bravura Privilege Client Service. The default value is set to 60 seconds.

Example:

waittime = "60";

The listener file is used for Unix Listener service configuration. The options are as follows:

admin-user Administrative user, used for authentication in Bravura Security Fabric operations.

Example:

admin-user = "administrator";

timeout The timeout (in seconds) that should be used when communicating with the Unix Listener. The default value is set to 10 seconds.

Example:

timeout = "10";

The pam file is used for configuring the password authentication module. The psldap file is used for configuring password policies. Both files currently have the same options. The options are as follows:

strength-check-only If this option is set to true, the password reset operation will not occur. The default value is set to true.

Example:

strength-check-only = "true";

The pspasswd file specifies the passwd utility used to perform an operation on a non- Bravura Security Fabric users password. Usually, this option specifies operating system’s passwd command. The native password operation is executed if the user is contained in the [restricted-user-list] option, or is contained in the ignore list on the Bravura Security Fabric server. The options are as follows:

passwd-cmd-reset A reset operation is less strict than a change operation since it does not validate the users old password first. Most native passwd commands do both change and reset operations depending on who is running the command and the arguments passed on the command line. Generally, running the passwd command as superuser is considered a password reset operation.

This option accepts psunix textual replacement strings, notably the "%u" keyword indicating the username.

Example:

passwd-cmd-reset = "/bin/passwd.bin %u";

passwd-cmd-change A change operation is more strict than a reset operation since it validates the user's old password first. Most native passwd commands do both change and reset operations depending on who is running the command and the arguments passed on the command line. Generally, running the passwd command as a non-privileged user is considered a password change operation.

This option accepts psunix textual replacement strings, notably the "%u" keyword indicating the username.

Example:

passwd-cmd-change = "/usr/bin/yppasswd %u";

Exit status codes

The following table outlines the pspasswd exit status codes:

The idapi file is used to configure the connection to API SOAP Service (idapisoap). The options are as follows:

targetid If you are using aliasing, this option is used to specify the ID of the target.

Example:

targetid = "UNIXSERVER";

url The url that API SOAP Service (idapisoap) is listening on.

Example:

url = "http://hipmserver/default/idapi";

user The product administrator used to connect to the API SOAP Service.

Example:

user = "_API_USER";

psw The product administrator password used to connect to the API SOAP Service. idaptool can be used to provide an encyrpted form of the password.

Example:

psw = "{AES}xdWShI2f+fM7Bd0SRhIi9kHvdhM9Y0fVxvKjpIbHfp4T47X2IAjLakoNitoSfu4Z" ;

libcurl In order to communicate to the API SOAP Service over SSL, the libcurl is required. If the full path is specified, then the library can be loaded when connecting over SSL. If no libcurl is avalable and plain HTTP is used, the value can be set to ’0’. If empty, the system default is used.

Example:

libcurl = "0";

capath When communicating to the API SOAP Service over SSL, a certificate check will be made unless ignore is set to "1". If the CA certificate is not installed on the system default paths, a path can be specified.

Example:

capath = "/etc/certs";

cert When communicating to the API SOAP Service over SSL, a client-side certificate can be provided. If there is a passphrase as part of the certificate it needs to be specified as well.

Example:

cert = "/etc/certs/hipmcert.pem:apassphrase";

ignore When communicating to the API SOAP Service over SSL, the certificate check can be ignored. If 0, the check is not ignored. If 1, the check is ignored.

Example:

ignore = "1";

language The language set in this value will be used when fetching the password rules. By default is it is en-us. The language packs must be installed in order to retrieve rules in other languages.

Example:

language = "fr-fr";

fail-if-unavailable Specifies the action to take if the password operation fails and the Password Manager service (idpm ) cannot be contacted. The default behavior is to fail the operation if the Password Manager service is unavailable.

Example:

fail-if-unavailable = "true";

The pushpass file is used to configure the Password Manager service (idpm). The options are as follows:

targetid If you are using aliasing, this option is used to specify the ID of the target.

Example:

targetid = "UNIXSERVER";

hostname The hostname option is used to specify the location of the Password Manager service service to be used by pspasswd . This can either be an IP address or a hostname.

Example:

hostname = "UNIXSERVER";

port The port option is used to specify the port that the Password Manager service is running on. The default value for the Password Manager service is 3333.

Example:

port = "3333";

timeout Specifies the timeout (in seconds) that should be used when communicating with Password Manager service. The default value is set to 10 seconds.

Example:

timeout = "10" ;

fail-if-unavailable Specifies the action to take if the password operation fails and the Password Manager service cannot be contacted. The default behavior is to fail the operation if the Password Manager service is unavailable.

Example:

fail-if-unavailable = "true";

Each operation is implemented using a PSLang function with the same name. Most of the functions (create, enable, etc.) take one parameter, an associative array. Each element is a string unless otherwise indicated. The following listing defines the elements that may be required:

Utility functions are used by one or all operations to pass back information specific to the operation.

agentError Return an error message to the agent.

agentWarning Return a warning message to the agent.

agentInfo Return an info message to the agent.

agentListAttribute Return user attributes from a list operation.

agentListGroup Return group information, excluding the group SID, from a listgroups operation.

agentListGroupSID Return group information, including the group SID, from a listgroups operation.

agentIsEnabled Return enabled status from an isenabled operation.

agentIsLocked Return locked status from an islocked operation.

agentIsPassExpired Return password expired status from an ispwexpired operation.

agentIsAcctExpired Return account expired status from an isacctexpired operation. Although this function point is implemented, the isacctexpired operation is not yet supported.

agentLongId Return longid from a create operation.

agentShortId Return shortid from a create operation.

agentGroups Return a list of groups for which user belongs from a userattribute/checktpl operation.

The operation overrides that may be specified in the configuration file are as follows:

checktpl List the attribute information for a given acctid.

list List the accounts for the target.

listgroups List the groups for the target.

isenabled Checks if the account is enabled.

islocked Checks if the account is locked.

ispwexpired Checks if the account password is expired.

disable Disables an account.

enable Enables an account.

lock Locks an account.

unlock Unlocks an account.

expirepw Expires an account password.

unexpirepw Unexpires an account password.

create Creates an account.

delete Deletes an account.

verify Verify an account password and increment the failed password attempts on verification failure.

admin_verify Verify an account password.

verifyreset Verify an account password and on failed password verification, reset the password.

reset Reset an account password.

change Verify an account password and on successful password verification, reset the password.

resetexpirepw Reset an account password and expire the account password.

groupuseradd Add an account to a given group.

groupuserdelete Remove an account from a given group.

groupcreate Create a group.

groupdelete Delete a group.

update Updates an account.