Creating a UNIX Administrator Role

Now that you have verified an Active Directory user can access the Linux or UNIX computer you are using for the evaluation, you will see to how to create users that have elevated privileges and how you can limit the use of those privileges to specific computers.

To illustrate this scenario, you will create a UNIX administrator role that grants root privileges for the computers in a zone without requiring users to know the root password. Instead, users who are assigned the UNIX administrator role use their Active Directory credentials.

You can use the same steps to define roles with different and more granular rights. For example, you will follow similar steps to create an Apache administrator role that can only perform a limited set of tasks on computers in a child zone.

At the end of this section, you will have two accounts with UNIX Login privileges: one of which has only standard user privileges, the other account has full administrative privileges.

To create a new Active Directory user and group with administrative access

  1. Open Active Directory Users and Computers and create a new User object.

    1. Fill in the First, Last, and the User logon name fields.

    2. Type and confirm a password and select the Password never expires option.

    3. Acknowledge the warning, click Next, then click Finish.

  2. Open Active Directory Users and Computers and create a new Group object in the UNIX Groups organizational unit.

    1. For the Group name, enter EnterpriseUnixAdmins.

    2. Select Global as the scope for the group and Security for the type of group, then click OK.

  3. Add the administrative user to the EnterpriseUnixAdmins group.

    1. Select the user you created in Step 1, right-click and select Add to a group.

    2. Select the EnterpriseUnixAdmins group, then click OK.

  4. Provision a UNIX profile for the new user using Access Manager.

    1. Expand the Zones node and select the Headquarters, right-click, then select Add User.

    2. Select the user you created for UNIX administration.

    3. Select Define user UNIX profile only and deselect Assign roles.

    4. Accept the default values for all profile properties.

    5. Review your selections, click Next, then click Finish.

Defining a Command Right and a New Role

You are now ready to define a new privileged command right that uses the asterisk (*) wild card to give the user the equivalent of all commands, all paths, and all hosts in the sudoers file. In a production deployment, you would define more specific sets of privileged commands and run them using accounts with no restricted access than the root user.

To create new UNIX right definition for the administrative role

  1. Create a new privileged command using Access Manager.

    1. Expand the Authorization node under the Headquarters zone, then expand UNIX Right Definitions and select Commands.

    2. Right-click then select New Command. For this example, you will only set information on the General tab.

    3. Type a command name and description, for example root_any_command and All commands, all paths, all hosts.

    4. Type an asterisk (*) in the Command field to match all commands.

    5. Leave the default setting for Glob expressions.

    6. Select the Specific path options and type an asterisk (*) to match all command paths, then click OK.

You now have a root_any_command that grants privileges to run any command in your role definitions. In the next steps, you create a role that will give members of the EnterpriseUnixAdmins group the root_any_command privileges.

To create and assign the UNIX administrators role

  1. Create a new role definition using Access Manager.

    1. Expand the Authorization node under the Headquarters zone, select Role Definitions, right-click, then select Add Role.

    2. Type a role name (UnixAdminRights) and a description (Set of rights for UNIX administrators) for the new role.

    3. Click the System Rights tab and select all of the UNIX rights and the Rescue right.

    4. Click the Audit tab and select Audit if possible, then click OK.

  2. Add the root_any_command and several default rights to the new role.

    1. Select the UnixAdminRights role, right-click, then select Add Right.

    2. Use CTRL-click to select rights, including login-all, secure shell (ssh, sshd, and dzsshall) rights, and the root_any_command right you just created, then click OK.

  3. Assign the UnixAdminRights role to the enterprise UNIX administrators group using Access Manager.

    1. Expand the Authorization node under the Headquarters zone, select Role Assignments, right-click, then select Assign Role.

    2. Select the UnixAdminRights role and click OK.

    3. Click Add AD Account.

    4. Change the object to Find from User to Group, then search for and select the EnterpriseUnixAdmins group, then click OK.

    5. Click OK to complete the role assignment.

Verifying Administrative Privileges

You now have two role assignments—Login Users and EnterpriseUnixAdmins—in the zone. Any Active Directory user you add to the Login Users group and provision a UNIX profile for will have access rights but no administrative privileges on the computers in the zone. Any Active Directory users you add to the EnterpriseUnixAdmins group and provision a UNIX profile for will be able to run any command with root-level permissions using their Active Directory credentials.

The Active Directory user you added to the EnterpriseUnixAdmins group can now log on and run privileged commands on the UNIX or Linux computers you are using for evaluation.

To verify the user can run privileged commands using Active Directory credentials

  1. Log on to the Linux or UNIX computer using the Active Directory logon name and password you created for the UNIX administrator.

  2. Open a terminal on the Linux or UNIX computer.

  3. Run a command that requires root-level privileges.

    For examples, run the dzinfo command to view the rights and roles for the UNIX Login user you createdAdding and provisioning an evaluation user and group.

    dzinfo user_name

    Because you are logged on as the Active Directory user and not invoking the command using your role assignment, the command displays an error messageindicating that you are not allowed to view authorization information for another user.

  4. Re-run the command using your role assignment by typing dzdo before the command.

    dzdo dzinfo user_name

    The command runs successfully and returns information about the evaluation user similar to this partial output.

    User: lois.lane
    Forced into restricted environment: No

    Role Name Avail Restricted Env
    --------------- ----- --------------
    UNIXLogin/Headquarters Yes None
    Effective rights:
    Password login
    Non password login
    Allow normal shell

    Audit level:
    AuditIfPossible

Viewing Effective Rights

Often, you need to see which users have what privileges in a zone. Access Manager provides you a single view of all of the effective users in a zone and lets you tab through their account properties.

To view effective rights for Linux and UNIX users

  1. Open Access Manager.

  2. Expand Zones, right-click your parent zone name, then select Show Effective UNIX User Rights.

    For example, the following illustrates the effective users in the evaluation zone.

    evaluation zone

  3. Select a user, then click the tabs to see details about that user’s profile, role assignments and UNIX rights.