Command Control uses rules to protect and control user commands. When configuring a rule, you need to set rule conditions to determine which rule or rules are processed, depending, for example, on the command submitted or the user who submitted it. You also need to define what processing to do if the rule conditions are matched.
The components you can define and configure for a rule are as follows:
The rule itself. For configuration information, see Section 5.6, Rules.
Account groups, user groups, and host groups, which determine who matches the rule. For configuration information, see Section 5.7, Command Control Groups.
Commands. For configuration information, see Section 5.8, Commands.
Scripts for additional functionality. For configuration information, see Section 5.9, Scripts.
Access times to define specific times during which access is denied or granted. For configuration information, see Section 5.10, Access Times.
NOTE:To enable access to the Command Control console for a Framework user and to control the level of access available, you must add the user to a group with the appropriate roles defined. See Section 4.2.4, Configuring Roles for details.
The following additional features are provided to assist you with Command Control configuration and management:
All Command Control audit records contain the following information:
Submit details such as the submitting username, hostname, and primary group.
Target details such as the run username and the run hostname.
Command details, which include the original command requested and the actual command run.
Authorization status, either yes or no.
Session capture status, either yes or no.
Audit ID, which is the unique ID used to group audit events for the user’s session.
Codeset, which is the character encoding used for localization.
Terminal details such as tty name, terminal dimensions, and type.
The option allows you to modify this default record and add the following:
Encryption of sensitive password data in keystroke capture reports along with a password that allows authorized Framework administrators to decrypt it.
Additional options that can be audited for each record.
To define audit settings:
Click on the home page of the console.
Click in the task pane.
Configure the Password keystorke settings:
Select the check box.
In the text box, specify the text that is used to prompt users for their passwords.
For example, if your systems request a user’s password by using the word Password, specify Password in this field. If your systems use password, enter password in this field. If your systems use either, enter assword in this field. This ensures that the password the user enters in response to this prompt is encrypted in reports.
Select the check box.
In the text box, specify the password to be used to decrypt the sensitive password data in the report.
This password must be entered on the page to decrypt the password data.
Specify the password again in the text box.
(Optional) Select from the following check boxes to add more information to the audit record:
Command: Complete information about the command being run, including the actual filename and arguments.
Host: Information about the submitting host
Environment: Complete list of the environment variables passed to the executed command.
Local time: The time on the machine that submitted the request.
Cwd: Details about the current working directory where the command was executed.
Options: Details about the various process control options for executing the command.
Run Account: Information about the account that is used to execute the command.
Process: Details about the process that submitted the request.
Jobs: The job control setting that were passed to the executed command.
Passwd: Details of the /etc/passwd entry for the user submitting the request.
Groups: The group membership details for the executed command.
Logon: The login time and source for the user submitting the request.
Click .
The backup option allows you to create snapshots of the command control database and restore these snapshots at future date. You can back up and restore from the Framework Manager console, but you need to use the command line to remove a backed-up snapshot. For information about the command line options, see Section 10.2.2, Backing Up and Restoring a Command Control Configuration.
Click on the home page of the console.
Click .
To back up the database, specify a reason for the backup, then click .
To restore a previous version of the database, select the version, then click .
The current version is overwritten by the selected version.
Click .
The following information is recorded for each backed-up version:
Date: The date and time the backup was performed.
Administrator: The user that performed the backup.
Reason: The reason for performing the backup. This is optional information, but recommended.
The option allows you to find where a specific account group, user group, host group, command, script, or access time is referenced in the database. For example, you could use this option to find out which account group or groups a specific user group belongs to.
Click on the home page of the console.
Select the entity for which you want to find references.
Click in the task pane. The groups or rules in which the entity is referenced are displayed.
To go to one of the listed groups or rules, double-click it, or to return to the navigation pane, click .
Custom attributes can be defined for account groups, user groups, host groups, commands, and access times to provide additional parameters for use in scripts. For example, you could set an expiration date as a custom attribute for a user group, check for this date in your script, then expire the user group when the date is reached.
To define custom attributes:
Click on the home page of the console.
Select the entity you want to add custom attributes to.
Click in the task pane.
Click .
In the field, specify the name of the custom attribute, such as Expiration date.
In the field, specify the value for the attribute, such as the date you want the entity to expire.
Repeat Step 4 through Step 6 for any other custom attributes you want to add.
Click .
The udsh command invokes commands on a set of hosts. It concurrently issues a Command Control request for each host that is specified and returns the output from all the hosts, formatted so that command results from all hosts can be managed.
udsh [-bcdqv] [-t <timeout>] [-l <user>] [-f <num>] [-w <host>, <host wildcard>] [-g <hostgrp>, <hostgrp wildcard>] [cmd ...]
The following options can be specified only on the command line:
Table 5-1 udsh Options
If a command is not specified, the user is placed at a command prompt. Each entry run from this prompt is run separately on each host. If readline(3) is available, command line editing and history are provided.
There are various macros that can be specified in the command to substitute keywords when the command is run on the remote host. For example, the following command uses the ${rhost}$ keyword. It performs a usrun echo command of the remote host name on all agents that have a command control agent deployed:
udsh -w \* /bin/echo '${rhost}$'
Table 5-2 udsh Keywords
You can use the appropriate option to group your account groups, user groups, host groups, commands, scripts, and access times into categories for ease of use and maintenance.
Click on the home page of the console.
Select the section to which you want to add a category. You can also add subcategories to existing categories.
Click the option in the task pane.
Specify a name for the category.
Click .
Before deleting a category, you must delete or move the items and subcategories that it contains.
Click on the home page of the console.
Select the category you want to delete.
Click the option in the task pane. The category is deleted.