User manual NOVELL PRIVILEGED USER MANAGER EVALUATION QUICK START GUIDE

[. . . ] You must make sure that the ksh shell is installed for the example exercises in Section 4 to work. /bin/ls: cannot read symbolic link /proc/22154/exe: Permission denied This is caused by the following line in /etc/ksh. kshrc case "`/bin/ls --color=never -l /proc/$$/exe`" in You can prevent this message by changing the line to the following: case "`/bin/ls --color=never -l /proc/$$/exe 2>/dev/null`" in 1. 2 Obtaining Evaluation Installer The evaluation installer can be obtained through sales or technical support. Page 3 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide 1. 3 Important Information ­ Please Read Before You Start Section 1 ­ Concepts and Prerequisites Note We recommend that you apply the evaluation database package to a clean installation of the standard Manager. You should also uninstall the package when finished as per the instructions at the bottom of this page. The evaluation database package consists of pre-population versions of the following databases: Command Control audit database Compliance Auditor event database Command Control rules database Installing the evaluation package Installing the evaluation database package will create a backup copy of your existing configuration and replace with the following: Sample log events, including keystrokes Sample Compliance Auditor events and rule Sample Command Control rule configuration Sample Command-Risk configuration Uninstalling the evaluation package Uninstalling the evaluation database package will restore your previously backed up configuration. [. . . ] You should see an output similar to the following: ======================================== Version 2. 2. 0 (Rev:14967, Bld:4552) [solaris-2. 10-sparc] Database Version 3. 5. 7 [admin 2. 2. 0 (Rev:14979, Bld:4552) ] module loaded [audit 2. 2. 0 (Rev:14937, Bld:4552) ] module loaded [auth 2. 2. 0 (Rev:14897, Bld:4552) ] module loaded [cmdctrl 2. 2. 0 (Rev:14867, Bld:4552) ] module loaded [distrib 2. 2. 0 (Rev:14601, Bld:4552) ] module loaded [msgagnt 2. 2. 0 (Rev:14842, Bld:4552) ] module loaded [pkgman 2. 2. 0 (Rev:14972, Bld:4552) ] module loaded [regclnt 2. 2. 0 (Rev:14845, Bld:4552) ] module loaded [registry 2. 2. 0 (Rev:14926, Bld:4552) ] module loaded [rexec 2. 2. 0 (Rev:14949, Bld:4552) ] module loaded [secaudit 2. 2. 0 (Rev:14793, Bld:4552) ] module loaded [strfwd 2. 2. 0 (Rev:14872, Bld:4552) ] module loaded Service listening on 0. 0. 0. 0:29120 Service listening on 0. 0. 0. 0:443 Checking service registration for ussm-solv1 (ussm-solv1) valid from Mon Mar 09 17:24:28 2009 to Mon Apr 06 18:24:28 2009 (registry offset 0 seconds) Page 8 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide 2. 1. 5 Tru64 Framework Manager Install Section 2 ­ Installation The Tru64 installation package is compressed through gzip. In order to install the package, you must unzip the package through gunzip. By default, the installation program installs the software into /opt/novell. To change this, create a directory in the required part of the file system and create a symbolic link to /opt/novell. Copy the installation package to a temporary location and use the following command to extract the installation files: gunzip novell-npum-manager-X. X-tru64-X. X-alpha. tar. gz tar ­xvf novell-npum-manager-X. X-tru64-X. X-alpha. tar 2. After the Tru64 installation package is uncompressed, use the following command to install the manager: setld -l NOVELLNPUM/ 3. After installation is complete, check that the service is running by viewing the log file. The log file is located in /opt/novell/npum/logs/unifid. log, if the default install location was used. You should see an output similar to the following: ======================================== Version 2. 2. 0 (Rev:14967, Bld:4551) [tru64-5. 1-alpha] Database Version 3. 5. 7 [admin 2. 2. 0 (Rev:14979, Bld:4551) ] module loaded [audit 2. 2. 0 (Rev:14937, Bld:4551) ] module loaded [auth 2. 2. 0 (Rev:14897, Bld:4551) ] module loaded [cmdctrl 2. 2. 0 (Rev:14867, Bld:4551) ] module loaded [distrib 2. 2. 0 (Rev:14601, Bld:4551) ] module loaded [msgagnt 2. 2. 0 (Rev:0, Bld:4551) ] module loaded [pkgman 2. 2. 0 (Rev:14972, Bld:4551) ] module loaded [regclnt 2. 2. 0 (Rev:14845, Bld:4551) ] module loaded [rexec 2. 2. 0 (Rev:14949, Bld:4551) ] module loaded [registry 2. 2. 0 (Rev:14926, Bld:4551) ] module loaded [secaudit 2. 2. 0 (Rev:0, Bld:4551) ] module loaded [strfwd 2. 2. 0 (Rev:14872, Bld:4551) ] module loaded Service listening on 0. 0. 0. 0:29120 Service listening on 0. 0. 0. 0:443 Checking service registration for ussm-truv1 (ussm-truv1) valid from Mon Mar 09 16:42:59 2009 to Mon Apr 06 17:42:59 2009 (registry off set 0 seconds) Page 9 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide 2. 1. 6 Windows Framework Manager Install Section 2 ­ Installation 1. Run the following install executable to start the installation: novell-npum-manager-X. X-windows-5. 0-intel. exe 2. The Framework Manager service can be installed on any part of the normal file system. After installation is complete, check that the service is running by viewing the log file. The log file is located in C:\Program Files\Novell\npum\logs\unifid. log, if the default install location was used. You should see an output similar to the following: ======================================== Version 2. 2. 0 (Rev:14967, Bld:4554) [windows-5. 0-intel] Database Version 3. 5. 7 Parent (1508) starting child ======================================== Version 2. 2. 0 (Rev:14967, Bld:4554) [windows-5. 0-intel] Database Version 3. 5. 7 Child (1520) main thread starting [admin 2. 2. 0 (Rev:14979, Bld:4554) ] module loaded [audit 2. 2. 0 (Rev:14937, Bld:4554) ] module loaded [auth 2. 2. 0 (Rev:14897, Bld:4554) ] module loaded [cmdctrl 2. 2. 0 (Rev:14867, Bld:4554) ] module loaded [distrib 2. 2. 0 (Rev:14601, Bld:4554) ] module loaded [msgagnt 2. 2. 0 (Rev:14842, Bld:4554) ] module loaded [pkgman 2. 2. 0 (Rev:14972, Bld:4554) ] module loaded [regclnt 2. 2. 0 (Rev:14845, Bld:4554) ] module loaded [registry 2. 2. 0 (Rev:14926, Bld:4554) ] module loaded [secaudit 2. 2. 0 (Rev:14793, Bld:4554) ] module loaded [strfwd 2. 2. 0 (Rev:14872, Bld:4554) ] module loaded Service listening on 0. 0. 0. 0:29120 Service listening on 0. 0. 0. 0:443 Checking service registration for ussm-winv1 (ussm-winv1) valid from Tue Mar 10 11:12:34 2009 to Tue Apr 07 12:12:34 2009 (registry offset 0 seconds) Page 10 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide 2. 2 Log on and Set Administrator Password Section 2 ­ Installation Log on to the Novell Privileged User Manager Administration console In a browser with access to test machine, enter: https://testmachinename Note: When prompted, accept security certificate On first use, click through the license screen and enter the default credentials of: Username: admin Password: novell Change password You will be prompted to change your password: (minimum of 6 characters, 1 alpha and 1 numeric) Page 11 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide 2. 3 Load and Install Evaluation Databases Section 2 ­ Installation 2. 3. 1 Load Evaluation Installer UNIX/Linux Copy the evaluation installer file "cceval-2-2. pak" to a temporary location on your server. Change to that directory and issue the following command to load the installer into your Framework Package Manager. /opt/novell/npum/sbin/unifi -u admin distrib publish -f cceval-2-2. pak Note: You will be prompted for the administration password you set in section 2. 2 Windows Copy the evaluation installer file "cceval-2-2. pak" to a temporary location on your server. Change to that directory and issue the following command to load the installer into your Framework Package Manager. "C:\Program Files\Novell\npum\bin\unifi" -u admin distrib publish -f cceval-2-2. pak Note: You will be prompted for the administration password you set in section 2. 2 2. 3. 2 Install Evaluation Databases to Host Log onto the Administration Console and select the Hosts option. Expand the hostname of your machine as shown below and then click on Packages. Now select Install Packages from the left-hand menu Page 12 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide Section 2 ­ Installation Now select the Evaluation Databases package as shown below and click Next When the install is complete, return to the main menu by clicking Home in the breadcrumb trail, (underneath the title-bar at the top) to complete the remaining exercises in this guide. Page 13 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide Section 3 ­ Initial Orientation 3. 0 Initial Orientation Log on to the Novell Privileged User Manager administration console In a browser with access to test machine, enter: https://testmachinename Note: When prompted, accept security certificate If first use, click through the license screen and enter the default credentials of: Username: admin Password: novell Change password If first use, you will be prompted to change your password. Page 14 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide Section 3 ­ Initial Orientation Orientation: Home Menu The Home menu is where you are able to access the individual administrative , , consoles that are installed as part of your solution. Manage security policies for privilege management using an intuitive GUI interface. Proactive auditing tool that pulls events from the event logs, according to predefined rules, for analysis. Centrally manage application installation and update, loadbalancing / redundancy of resources, and host alerting. Manage users that will log onto the admin console using rolebased grouping. Easily access and search event logs, review user keystroke activity, color-coded through our unique Command-Risk Analysis Engine. Any module can be easily updated via connection to an online update server and pushed out to hosts. NOTE The administration console is Adobe Flash-driven and requires only a single click to select menu options. IMPORTANT: To navigate when in the administration console, DO NOT use your browsers forward or back buttons; use the , , breadcrumb trail at the top of each page, for example: "Home / Compliance Auditor" ­ click on Home to return to main console menu Page 15 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide Section 3 ­ Initial Orientation Orientation: Compliance Auditor From the Home menu, select the Compliance Auditor console New: Events have not been examined Pending: Examination in progress Authorized: Activity has been signed off as okay Unauthorized: Activity not acceptable Each event record is color-coded according to the highest rated command risk (see below). Filters can be set on combination of date range and event status. Note: Events containing keystroke activity through the , , rush shell are colored according to risk, ranging from Green (low) to Red (high). [. . . ] This demonstrates the ability for Command Control to rewrite commands. This is the end of Use Command Control to access a privileged shell You may now view your generated events using the forensic method as described earlier in this guide. Page 31 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide Section 4 ­ Step by Step Exercises Review Novell Privileged User Manager system logs a) Select the Hosts Console from the Home Menu b) Select your host by selecting it in the domain tree, then click View Host Log as below. This is the end of Review Novell Privileged User Manager System Logs To return to the Home Menu, click Close, then click Home near the top of the screen Page 32 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide Section 4 ­ Step by Step Exercises Download Novell updates and deploy to your host a) Select the Package Manager console from the Home Menu b) Select Settings from the left-hand menu Enter the access credentials (supplied by Novell), into the User name and Password boxes as shown below, If applicable, enter any proxy host information, and then click Finish. Page 33 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide Section 4 ­ Step by Step Exercises c) From the main Package Manager Console, select Add Packages from the left-hand menu. Make sure you select the checkboxes shown on the left for the Types and Components groups, at a minimum. Check the appropriate operating systems you have (or planning to have) in your Framework under Platforms. Select any module and click Ctrl-A to select all modules for download, click Next. To select a range Click on the top item and then click on the bottom item while holding the shift key down. To select single items Hold the Ctrl key down while clicking individual rows to alternately select or deselect d) Modules will start downloading to your Package Manager as shown below. When all modules have been successfully transferred to your Package Manager, click Finish Page 34 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide e) Verify that the Package Manager looks similar to the following: Section 4 ­ Step by Step Exercises f) Click Home on the top menu to return to the Home Menu, then select the Hosts Console In this next step, we will check to make sure that there are no updated components in the Package Manager that need to be deployed to our test environment. Page 35 Novell Privileged User Manager v2. 2 Evaluation Quick Start Guide g) Update installed Framework host modules Section 4 ­ Step by Step Exercises From the main console menu, select Hosts. [. . . ]