Managing UNIX Information from a UNIX Terminal

Many organizations find it least disruptive for their UNIX administrators to continue to manage their UNIX and Linux computers directly from their own computer rather than from a Windows computer. If you plan to manage zones, UNIX user and group accounts, access privileges, roles, and role assignments from a UNIX or Linux computer, you can use the command-line tools described in this section.

Using UNIX Commands

This following table summarizes the most commonly used Centrify command line programs.

Command	Location	Description
adcheck	/usr/share/centrifydc/bin	Performs operating system, network, and Active Directory tests to verify a computer meets the system requirements for a successful installation. For example, the install.sh script runs the adcheck program.
adedit	/usr/bin	Starts the adedit application for interactive commands or running scripts For more information about the adedit application, see Using ADEdit.
adflush	/usr/sbin	Clears the computer’s agent cache. Use this after you have made changes to Active Directory accounts to remove and replace the previous values.
adgpupdate	/usr/bin	Retrieves group policies from the Active Directory domain controller and applies the policy settings to the local computer and current user immediately. If you do not use the command, group policies are automatically updated at a random interval between 90 and 120 minutes.
adinfo	/usr/bin	Displays summary or detailed diagnostic information for the managed computer.
adjoin	/usr/sbin	Joins the local computer to an Active Directory domain, organizational unit and zone.
adleave	/usr/sbin	Removes the local computer from the Active Directory domain.
adpasswd	/usr/bin	Changes the Active Directory account password for the current user or a specified user.
adquery	/usr/bin	Queries Active Directory for information about users and groups.
dzinfo	/usr/bin	Displays information about the effective rights and roles for the current login account.
dzdo	/usr/bin	Enables you to run privileged commands as root or another user.

Some UNIX commands require you to be logged on as root or as a user with root privileges. Other commands allow different operations or return different results if you are logged on as root. For the complete list of Verify Privilege Server Suite command line programs you can run on Linux and UNIX computers, see the Administrator’s Guide for Linux and UNIX. For detailed information about the options available for any command, see the man page for that command.

Using ADEdit

The Verify Privilege Server Suite Agent for *NIX also includes the Tcl-based ADEdit program. ADEdit has two basic components:

• the adedit command-line application

• the ade_lib Tcl library

ADEdit provides a scripting language that you can use to bind to one or more Active Directory domain controllers. You can then use ADEdit to retrieve, modify, create, and delete Active Directory objects of any kind, including Verify Privilege Server Suite specific objects such as zones, rights, and roles. For example, you used ADEdit and a sample script to create rights and a role in Defining command rights and a new role for Apache administrators.

The following sections introduce a few of the key features for ADEdit. For more information about using ADEdit commands and the ade_lib library, see the ADEdit Command Reference and Scripting Guide.

ADEdit Application

ADEdit uses Tcl as its scripting language. The Tcl scripting language includes all standard programming features, such as variables, logical operators, and predefined functions (called “procedures” in Tcl). The ADEdit application also includes a Tcl interpreter and Tcl core commands, which allow it to execute standard Tcl scripts, and a comprehensive set of its own commands designed to manage Verify Privilege Server Suite-specific objects in Active Directory.

You can use ADEdit to execute individual commands interactively or to execute sets of commands together in the form of an ADEdit script.

ade_lib Tcl Library

The ade_lib Tcl library is a collection of Tcl procedures that provide helper functions for common Centrify-specific management tasks such as listing zone information for a domain or creating an Active Directory user. You can include ade_lib in other ADEdit scripts to use its commands.

Using adedit Sample Scripts

The Verify Privilege Server Suite Agent for *NIX includes several sample adedit scripts that you can run in your evaluation environment. The scripts are in the /usr/share/centrifydc/samples/adedit directory on the UNIX or Linux computer where you have the agent installed.

To run scripts that have the .sh extension, enter /bin/sh filename.sh.

To run scripts that do not have an extension, you can just enter ./filename.

#!/usr/bin/env adedit

The following table lists the sample scripts and the arguments.

Script name	Required arguments	Optional arguments
AddUnixUsers	users.txt	none
ApacheAdminRole	none	none
computers-report	-domain domain_name -u AD_user_name -sep separator	-m -p password Use -m if you want to authenticate using the computer account credentials instead of an Active Directory user account. If using an Active Directory user account, use -p if you want to include the user's password in the command line. If you don’t specify this option, you are prompted for the password.
CreateChildZones	-d domain_name -z parent_zone_name -u AD_user_name	-p password Use -p if you want to include the user's password in the command line. If you don’t specify this option, you are prompted for the password.
CreateParentZone	-d domain_name -z zone_name	none
GetChildZones	none	none
GetComputers	none	none
GetGroups	none	none
getopt-example	-d domain_name -u AD_user_name	-p password Use -p if you want to include the user's password in the command line. If you don’t specify this option, you are prompted for the password.
Getusers	none	none
GetZones	none	none
MakeRole	Role_apacheAdmin.txt	none
MktDept.sh	List of names, for example, Mary, Joe, and Lance	none
useracc-report	-domain domain_name -u AD_user_name -sep separator	-m -p password Use -m if you want to authenticate using the computer account credentials instead of an Active Directory user account. If using an Active Directory user account, use -p if you want to include the user's password in the command line. If you don’t specify this option, you are prompted for the password.
user-report	-z zone_distinguished_name	-m -p password Use -m if you want to authenticate using the computer account credentials instead of an Active Directory user account. If using an Active Directory user account, use -p if you want to include the user's password in the command line. If you don’t specify this option, you are prompted for the password.

For more information about the sample scripts and how they can be used or modified, see the ADEdit Command Reference and Scripting Guide.