Command Control; How Does Command Control Work; Chapter 5, "Command Control; Section 5.1, "How Does Command Control Work - Novell PRIVILEGED USER MANAGER 2.2.1 - ADMINISTRATION GUIDE 03-31-2010 Administration Manual

Command Control

5
The Command Control feature provides UNIX and Linux users with controlled access to privileged
commands in a secure manner across the enterprise. Command Control enables the complete
lockdown of user privilege by providing rules to determine the commands that are authorized to be
run, and a powerful account delegation feature that removes the need for common access to the
account.
root
Command Control provides centralized logging of activity across all platforms, and enables the
selective capture of session activity for any user, to the keystroke level, which can be viewed
through the Compliance Auditor and reporting features.
Additional features include external scripting that provides the ability to authenticate via third-party
security databases or applications, and comprehensive test suite tools that allow the administrator to
model and test new rule combinations before committing them to production use.
Section 5.1, "How Does Command Control Work?," on page 63
Section 5.2, "Integrating Command Control into User Environments," on page 64
Section 5.3, "Importing Command Control Configuration Data," on page 71
Section 5.4, "Command Control Transactions," on page 72
Section 5.5, "Configuring Command Control," on page 74
Section 5.6, "Rules," on page 79
Section 5.7, "Command Control Groups," on page 87
Section 5.8, "Commands," on page 94
Section 5.9, "Scripts," on page 98
Section 5.10, "Access Times," on page 103
Section 5.11, "Command Control Reports," on page 105
Section 5.12, "Test Suites," on page 107
Section 5.13, "Deploying Command Control," on page 112

5.1 How Does Command Control Work?

UNIX/Linux commands are passed to the Command Control through scripts, commands, or
replacement shells, using the methods described in
User Environments," on page
When a command is received, Command Control uses the following to evaluate the command:
The command is validated against configured rule criteria such as submit user, submit host, run
host requested, date/time, and the command name itself.
Any Perl scripts associated with the rules are executed, such as setting environment variables.
Section 5.2, "Integrating Command Control into
64.
5
Command Control 63