Advanced Installation Instructions Using pbinstall

Specify y to install the Registry Name Service which provides the product with a method of addressing and locating other parts of Endpoint Privilege Management for Unix and Linux.

Installing the Registry Name Services Server makes installing the Sudo Policy Server mandatory.

For more information, see Install Sudo Policy Server.

This option is only available when you are installing on a policy server or a client registration server.

If you choose this option and specify y on a client registration server, any policy server that registers with this host will automatically have the policy caching feature enabled.

If you choose this option and specify y on a policy server, you can optionally enable the policy caching feature on any of this server's clients so they can function even in a disconnected state from the network.

Enabling this feature automatically enables the required role-based policy feature.

For more information on the Cached Policy feature, see the Endpoint Privilege Management for Unix and Linux Administration Guide.

This option is only available when you are installing on a policy server. Choose this option and specify y to enable the role-based policy feature.

This feature is mandatory if you enabled the Cached Policy feature.

For more information on the Role-Based Policy feature, see the Role Based Policy.

This option installs pbrun.

Available in v23.1.0 and later, and only on Linux.

This option is available when installing an EPM-UL client host which registered with a policy server that allows policy caching. Specify y if you want this client programs like pbrun to function even without network connection.

Enter y to configure the server to be able to store and process sudo policies.

Installing the Sudo Policy Server is mandatory if installing the Registry Name Services Server.

If the installation detects that the user is installing the policy server host or the log host on the current machine, it displays in the menu the install question Enable Logfile Tracking and Archiving? and set it to yes by default. When the answer to this question is set to yes, the installer prompts the user for the Log Archive Storage Server name and the Log Archiver Database Server name. Log Tracking and Archiving requires REST services to be installed.

If the answer to this question is set to yes, the install displays the following question:

Configure this host to be a Log Archive Storage Server which receives logfiles to archive and stores them in the appropriate path: Yes
This host will be configured as a Log Archiver Storage Server
No This host will NOT be configured as a LogArchiver Storage Server
Set as a Log Archiver Storage Server? [no]? yes
The Log Archive Storage Server which will accept and place archived logfiles in a designated pathname.
Ensure that it is located in filesystem with ample free space to 
accommodate incoming logfiles.
Enter the default directory path for archived logfiles []: /pbul/logs

It also sets the Log Archive Storage Server name to the hostname of the current machine.

Configure this host to be a Log Archive Database Server which creates and maintains the log tracking database:
Yes This host will be configured as a Log Archiver Database Server
No This host will NOT be configured as a LogArchiver Database Server
Set as a Log Archiver Database Server? [no]? yes
Endpoint Privilege Management for Unix and Linux will create and maintain a SQLite database to track the location of logfiles. Specify the path and filename of the SQLite 
logfile tracking database file and ensure that the given database 
file system has ample space for growth.
Enter the path and filename of Endpoint Privilege Management for Unix and Linux's SQLite log tracking database file []: /var/log/pbul90_tracking.db

It also sets the Log Archive Database Server name to the hostname of the current machine.

By default, Endpoint Privilege Management for Unix and Linuxcreates subdirectories and files it needs under '/opt/pbul' by default. This menu option allows you to change the base directory path.

The base directory provided must be:

• an absolute path
• owned by root
• only root can read/write

It is recommended that you provide a directory location that is dedicated for Endpoint Privilege Management for Unix and Linux.

• Specify the absolute path where pkrun resides.
• Specify none to clear the entry (default).

• no to disable Endpoint Privilege Management for Unix and Linux integration with AD Bridge. This is the default.
• yes to enable Endpoint Privilege Management for Unix and Linux integration with AD Bridge.

Available in v8.0 and later, and only on Linux and AIX platforms, this feature modifies the pbmasterd, pblocald and pblogd command line arguments (viewable via ps) to include information about the originating pbrun request. This allows administrators to determine which pbrun/pbmasterd/pblocald/pblogd processes are related to a given request.

Choose this option and specify the number of space to reserve in the process list of pbmasterd, pblocald and pblogd processes by adding a -i to the daemon startup files. This new command line option is used to reserve space in the process list so that the command line argument space can be updated with information about the originating request (submituser, submithost, runcommand, and the pbrun pid).

This menu item is enabled only if REST services are to be installed.

This menu item is enabled only if REST services are to be installed.

The user name used to run the REST services as. The default value is pblight. This user is created if you answer yes to the menu option Create Pblighttpd User?. This menu item is enabled only if installing REST Services.

Enter a user group name or use the default value.

The pblighttpd user specified in step 73 is assigned to the group name provided.

• If you enter a group name that does not exist, that group is created and the pblighttpd user specified in step 73 is assigned to it.
• If you enter a group name that exists, then the pblighttpd user is assigned to that preexisting group.

If you specify no, any existing Endpoint Privilege Management for Unix and Linux installation that is configured with the specified prefix and/or suffix is removed from the superdaemon configuration.

This menu option is platform dependent. On older RHEL or other operating systems using inetd or xinetd, it may display Configure inetd or xinetd, while on Solaris, it displays Configure Solaris Services.

Choose this option and specify the command line options that you want. Available syntax and command line options for pbmasterd are:

Syntax: [-arsV] [-e logfile]
[--disable_optimized_runmode]

-a: Send the job acceptance messages to syslog.

-e: Use the log file as the pbmasterd diagnostic log file. The -e command line option overrides the syslog setting in the pb.settings file. You must specify the file name if you use the -e option.

-r: Send the job rejection messages to syslog.

-s: Send the error messages to syslog. The -s command line option overrides the syslog setting in the pb.settings file, if you want to change it in the future.

-V: Print the version number mismatch messages.

none: Erase all options.

--disable_optimized_runmode: Suppresses optimized run mode for any tasks that are authorized by this policy server host.

The installation is currently set to use the syslog in the Endpoint Privilege Management for Unix and Linuxpb.settings file. This setting is the default.

Choose this option and specify one of the following settings. The Endpoint Privilege Management for Unix and Linux policy server daemon (pbmasterd) can use name resolution to validate the host name and IP address of the submit host connection to a policy server host.

• Specify y to validate submit host connections. If you decide to use this facility, then you must do the following:
  • Ensure that name resolution works correctly on all machines.
  • Ensure all policy server hosts and submit hosts are upgraded to Endpoint Privilege Management for Unix and Linux v3.5.7 or higher before enabling this feature.
  • Ensure that each submit host connection’s host name and IP address match those that are listed in the policy server host’s name resolution services.
• Specify n to disable this checking. This setting is the default value.

Choose this option and do the following:

• If submitmasters already has a value, specify y at the Do you wish to make changes to this list? prompt.
• At the Enter Policy Server list (submitmasters) prompt, specify a host name, or a list of space-delimited host names, to serve as policy servers to submit secured tasks to (a fully-qualified domain name may be required):

  The host names should now appear in the List of Endpoint Privilege Management policy server hosts to submit to line of the pbinstall menu.

The BeyondTrustEndpoint Privilege Management for Unix and Linuxpbssh program can maintain a separate, individual host diagnostic log file. This log file is typically only used when requested by BeyondTrust Technical Support.

Specify a full path specification for the pbssh diagnostic log file or none for none.

Choose this option and specify whether to enable additional secured task checks.

This option determines whether the run host or submit host performs an additional check on the security of the requested command. This check helps to ensure that the command cannot be compromised by a user other than root or the user running the Endpoint Privilege Management for Unix and Linux command (for example, sys, oracle). This setting is used on run hosts or submit hosts using Local Mode. The policy language variable runsecurecommand can be set by the configuration policy on the policy server host for the same effect.

• Specify y to check the runcommand and all directories above it to see if anyone other than root or the runuser has write permission. If the command file or any of the directories above it are writable by anyone other than root or the runuser, then the run host refuses to run the command.
• Specify n to disable this feature.

When a connection to policy server host fails, Endpoint Privilege Management for Unix and Linux fails over to another available policy server host (if configured), and generate an error message regarding the event. Choose this option and do one of the following:

• Specify n to enable the policy server host failover error messages (default).
• Specify y to suppress the policy server host failover error messages.

Choose this option and then do the following:

• If acceptmasters already has a value, specify y at the Do you wish to make changes to this list? prompt.
• At the Enter Incoming Policy Server list (acceptmasters) prompt, specify a host name, or a list of space-delimited host names, to serve as policy servers to accept secured tasks from (a fully-qualified domain name may be required).

  The accept policy server host name should now display in the List of Endpoint Privilege Management Policy Server hosts to accept from ... line of the pbinstall menu.

[-sV] [-e logfile] [-m master_host]

• -s: Send error messages to syslog. The -s command line option overrides the syslog setting in the pb.settings file if you decide to change it in the future.
• -e: Use logfile as the pblocald diagnostic log file. The -e command line option overrides the settings file.
• -m: Accept pbmasterd connections from master_host only. Multiple -m options can be used to specify more than one host.
• -V: Print version number mismatch messages.
• none: Erase all options.

The installation is currently set to use the syslog in the Endpoint Privilege Management for Unix and Linuxpb.settings file. This setting is the default.

Choose this option and specify one of the following settings. The Endpoint Privilege Management for Unix and Linux local daemon (pblocald) can use name resolution to validate the host name and IP address of the policy server host connection to a run host.

• Specify y to validate policy server host connections. This validation requires that each policy server connection’s host name and internet address match those that are retrieved from name resolution services.

If you decide to use this facility, then you must ensure that name resolution works correctly on all machines before enabling this feature. You must also ensure that all policy server hosts and run hosts are upgraded to Endpoint Privilege Management for Unix and Linux v3.5.7 or later before enabling this feature.

• Specify n to disable this checking. This setting is the default value.

Choose this option and specify which machines are to be log hosts. Endpoint Privilege Management for Unix and Linux needs to know which machines you have selected as log hosts. Log hosts are the hosts that policy server hosts select to perform event and I/O logging. To accomplish this task, policy server looks at the setting for logservers in the pb.settings file. This logservers setting contains the names of the log host machines or a netgroup. You can add, modify, or remove machine names by doing the following:

• If logservers already has a value, specify y at the Do you wish to make changes to this list? prompt.

• At the Enter Log Server list (logservers) prompt, specify a host name, or a list of space-delimited host names, to serve as Log Hosts:

  The log host names should now appear in the List of Privilege Management Log Hosts line of the pbinstall menu.

A logserver must be installed before enabling the changemanagementevents keyword.

Choose this option and specify the command line options that you want. The available syntax and command line options for pblogd are:

[-ars] [-e logfile]

-a: Record accept events on syslog.

-e: Use logfile as the pblogd diagnostic log file. If you previously specified the pblogd log file as /var/log/pblogd.log, the -e command line option overrides the pblogd setting in the pb.settings file.

-r: Record reject events on syslog.

-s: Send error messages to syslog. If you have previously specified to use the syslog setting in the pb.settings file, the -s command line option overrides the settings file if you decide to change it in the future.

none: Erase all options.

Choose this option to specify reserved file systems. Endpoint Privilege Management for Unix and Linux allows the log host to control the file system space and enables the immediate failover to the next log host.

• Enter none to specify no reserved file systems.
• To specify reserved file systems, type the names of the reserved file systems that you want to failover. Use spaces to separate multiple file system names.

When a file system is specified in this option, you also should use the next option to specify the minimum number of free blocks that the log system file must have available. If that number of free blocks is not available, then the logging is done on the next log host.

Choose this option and specify the command line options that you want. The available command line options for pbsyncd are:

[-s] [-e logfile]

• -e: Use logfile as the pbsyncd diagnostic log file.
• -s: Use the syslog facilities.

Choose this option and specify whether to add installed shells. The operating system can validate your Endpoint Privilege Management for Unix and Linux shells and then add them to /etc/shells.

• yes: Add installed shells to /etc/shells.
• no: Do not add installed shells to /etc/shells.

shell executes with the system in Single-User Mode, it is necessary to know which command to execute for some secured task requests that are handled by pblocald. This setting provides the Endpoint Privilege Management for Unix and Linux shell, running in Single-User Mode, with the pblocald command to execute. Specify the full command for the local daemon.

Choose this option and indicate whether to specify a stand-alone pblocald command. When an Endpoint Privilege Management for Unix and Linux

/usr/sbin/[prefix]pblocald[suffix] -s

When you specify the command, any installation prefix or suffix must be included. Specify none to specify no command for the local daemon in Single-User Mode.

Choose this option to specify whether to use the system syslog facility.

The Endpoint Privilege Management for Unix and Linux programs can send errors reported by the policy server and local daemons to the syslog. If you decide to use the system’s syslog facility, then you must ensure that the facility selected for use by Endpoint Privilege Management for Unix and Linux is enabled according to your system’s documentation.

• Specify y to use the system syslog facility.
• Specify n to not use the system syslog facility.

Choose this option to specify the syslog facility to use. For Endpoint Privilege Management for Unix and Linux to use the syslog facility, it must be specified. The facilities that can be specified are:

• LOG_AUTH security/authorization messages
• LOG_AUTHPRIV security/authorization messages (Linux). Only supported in Endpoint Privilege Management for Unix and Linux 7.1.0 and later.
• LOG_DAEMON daemon messages
• LOG_LOCAL0 local messages
• LOG_LOCAL1 local messages
• LOG_LOCAL2 local messages
• LOG_LOCAL3 local messages
• LOG_LOCAL4 local messages
• LOG_LOCAL5 local messages
• LOG_LOCAL6 local messages
• LOG_LOCAL7 local messages
• LOG_USER user messages

The default [LOG_AUTH] is usually sufficient. The message severity level that is used by Endpoint Privilege Management for Unix and Linux is LOG_INFO.

Unlike individual daemon ports, the base port may not be a Unix or Linux domain socket or a program name. Any daemon port that is already set to either a Unix or Linux domain socket or program name will not be changed. However, the used port number will be skipped. For more information about assigning ports, see Installation Preparation.

Choose this option and do one of the following:

• If ports 24345 to 24350 are available for all of the Endpoint Privilege Management for Unix and Linux daemon ports, then accept these ports and continue the installation.
• If those ports are not available, then do one of the following:
  • Specify an available port number that also has the next six sequential port numbers available to set all of the Endpoint Privilege Management for Unix and Linux daemon ports. The specified value must be numeric and must fall within the range from 1024 to 65530 (inclusive).

    The pbmasterd port is set to the specified value.

    The pblocald port is set to the specified value +1.

    The pblogd port is set to the specified value +2.

    The pbguid port is set to the specified value +3.

    The pbsguid port is set to the specified value +4.

    The pbsyncd port is set to the specified value +5.

    The pbrest port is set to the specified value +6.

  • Use the following port-related menu options to set the port numbers individually for pbmasterd, pblocald, pblogd, pbguid, pbsyncd and pbrestport.

Choose this option to specify the port number for pbmasterd. The Endpoint Privilege Management for Unix and Linux policy server host daemon (pbmasterd) requires a dedicated port number or a Unix or Linux domain socket name to receive inbound secured task requests from submit hosts. See Important! in step 126.

Choose this option to specify the port number for pblocald. The Endpoint Privilege Management for Unix and Linux run host daemon (pblocald) requires a dedicated port number or a Unix or Linux domain socket name to receive inbound secured task requests from policy server hosts. See Important! in menu item Base daemon port number.

Choose this option to specify the port number for pblogd. The Endpoint Privilege Management for Unix and Linux log host daemon (pblogd) requires a dedicated port number or a Unix or Linux domain socket name to receive inbound secured task requests from policy server and local daemons. See Important! in menu item Base daemon port number.

Choose this option to specify the port number for pbsyncd. The Endpoint Privilege Management for Unix and Linux log synchronization daemon (pbsyncd) requires a dedicated port number or a Unix or Linux domain socket name to receive inbound requests. See Important! in menu item Base daemon port number.

Choose this option and specify y to have the services entries added to /etc/services. Endpoint Privilege Management for Unix and Linux must be able to look up the port numbers to be used by the various Endpoint Privilege Management for Unix and Linux services. The port number lookup can be done from NIS after you manually create the appropriate NIS entries. Otherwise, these services should be listed in /etc/services.

Only ports that are specified by number for the Endpoint Privilege Management for Unix and Linux daemons can have services added to /etc/services. Unix and Linux domain sockets and ports that are specified by name are not added to /etc/services by this installation procedure.

On some systems you must put entries into your NIS services map (or reboot) because inetd ignores /etc/services after boot time.

Choose this option and choose one of the following:

• Specify y to allow non-reserved port connections.
• Specify n to disallow connections from non-reserved port connections.

The MinListeningPort setting in the pb.settings file determines the lower bound on the originating port range that may be used to make Endpoint Privilege Management for Unix and Linux connections on the listening side. The MaxListeningPort setting determines the upper bound on the originating port range that may be used to make Endpoint Privilege Management for Unix and Linux connections on the listening side.

Choose this option and do the following:

• Specify the value of the minimum port number to listen on. The value of this setting must be between 1 and the current value of the MaxListeningPort setting (65535).
• Specify the value of the maximum port number to listen on. The value of this setting must be between the current value of the MinListeningPort setting (1025) and 65535.

The MinOutgoingPort setting in the pb.settings file determines the lower bound on the originating port range that may be used to make Endpoint Privilege Management for Unix and Linux connections on the originating side. The MaxOutgoingPort setting determines the upper bound on the originating port range that may be used to make Endpoint Privilege Management for Unix and Linux connections on the originating side.

Choose this option and do the following:

• Specify the value of the minimum outbound port number to originate from. The value of this setting must be between 1 and 65535.
• Specify the value of the maximum outbound port number to originate from. The value of this setting must be between the current value of the MinOutgoingPort setting (600) and 65535.

Starting with version 8.0, the new default in pbinstall for the minimum value of the outbound port range was changed from 600 to 1025. However, if you don't set this value during the install and the keyword minoutgoingport is commented out in the pb.settings, the default used by the binaries is still 600. This is in order to keep backward compatibility with older releases of Endpoint Privilege Management for Unix and Linux.

Before specifying any file types are to be encrypted, see "Network Traffic and File Encryption" in the Endpoint Privilege Management for Unix and Linux Administration Guide.

Choose this option and do one of the following:

• Specify none to not use any network encryption. Optionally, you can type the start date and/or end date for not using any network encryption in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).
• To add a new network encryption option, do the following:
  • Specify a to add a new network encryption option.
  • Specify the encryption type from the list in the following table. The default for version 8.0 and later is AES-256, and for versions prior to 8.0 is DES. The default (AES-256 or DES) is used if end dates are specified for the listed network encryption algorithm and they have all expired. If you do not want the default to be used, then specify a network encryption or none with no end date.

    Algorithm	Encryption Type
    none	none
    DES	des 3des tripledes
    AES	aes-16-16 (or aes-128) aes-16-24 (or aes-192) aes-16-32 (or aes-256) aes-24-16 aes-24-24 aes-24-32 aes-32-16 aes-32-24 aes-32-32
    Blowfish	blowfish
    Cast128	cast128
    Gost	gost
    Loki97	loki97
    Saferplus	saferplus-16 saferplus-24 saferplus-32
    Serpent	serpent-16 serpent-24 serpent-32
    Threeway	threeway
    Tiny	tiny
    Twofish	twofish-16 twofish-24 twofish-32

  • Type the full path and file name where Endpoint Privilege Management for Unix and Linux is to place the encryption key file. The default is /etc/pb.key. Endpoint Privilege Management for Unix and Linux requires a key file to use encryption. We recommend that you specify the /etc directory for the encryption key file.
  • Optional. Type the start date and/or end date for the encryption pair in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).

Administrators must ensure that all hosts are using the same encryption pair; otherwise, the hosts cannot communicate with each other.

• Specify e to edit an existing network encryption option and specify the number of the network encryption option. You can edit any of the following items for the selected option:
  • Network encryption type
  • Location and file name for the encryption file
  • Start date for the encryption pair to take effect
  • End date for the encryption pair
• Specify d to delete an existing network encryption option and specify the number of the network encryption option to delete it.
• Specify x to exit this option.

Choose this option and do one of the following:

• Specify none to not use any event log encryption. Optionally, you may type the start date and/or end date for not using any event log encryption in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).
• To add a new event log encryption option, do the following:
  • Specify a to add a new event log encryption option.
  • Set the encryption type. The default for version 8.0 and later is AES-256, and for versions prior to 8.0 is DES.
  • Specify the full path and file name where Endpoint Privilege Management for Unix and Linux is to place the encryption key file. The default is /etc/pb.key. Endpoint Privilege Management for Unix and Linux requires a key file to use encryption. We recommend that you specify the /etc directory for the encryption key file.
  • Optional. Type the start date and/or end date for the encryption pair in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).
• Specify e to edit an existing event log encryption option and specify the number of the event log encryption option. You can edit any of the following items for the selected option:
  • Event log encryption type
  • Location and file name for the encryption file
  • Start date for the encryption pair to take effect
  • End date for the encryption pair
• Specify d to delete an existing event log encryption option and specify the number of the event log encryption option to delete it.
• Choose x to exit this option.

Choose this option and do one of the following:

• Specify none to not use any I/O log encryption. Optionally, you may type the start date and/or end date for not using any I/O log encryption in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).
• To add a new I/O log encryption option, do the following:
  • Specify a to add a new I/O log encryption option.
  • Set the encryption type. The default for version 8.0 and later is AES-256, and for versions prior to 8.0 is DES.
  • Specify the full path and file name where Endpoint Privilege Management for Unix and Linux is to place the encryption key file. The default is /etc/pb.key. Endpoint Privilege Management for Unix and Linux requires a key file to use encryption. We recommend that you specify the /etc directory for the encryption key file.
  • Optional. Type the start date and/or end date for the encryption pair in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).

Administrators must ensure that all hosts are using the same encryption pair; otherwise, the hosts cannot communicate with each other.

• Specify e to edit an existing I/O log encryption option and specify the number of the I/O log encryption option. You can edit any of the following items for the selected option:
  • I/O log encryption type
  • Location and file name for the encryption file
  • Start date for the encryption pair to take effect
  • End date for the encryption pair
• Specify d to delete an existing I/O log encryption option and specify the number of the I/O log encryption option to delete it.
• Choose x to exit this option.

Choose this option and do the following:

• Enter none to not use any policy file encryption.
• To use the policy file encryption options, do the following:
  • Set the encryption type. The default for version 8.0 and later is AES-256, and for versions prior to 8.0 is DES.
  • Specify the full path and file name where Endpoint Privilege Management for Unix and Linux is to place the encryption key file. The default is /etc/pb.key.Endpoint Privilege Management for Unix and Linux requires a key file to use encryption. We recommend that you specify the /etc directory for the encryption key file.

Choose this option and do one of the following:

• Specify none to not use any settings file encryption.
• Specify one of the encryption types.

Configure encryption for the REST service Application Key database. Choose this option and do one of the following:

• Specify none to not use encryption for the REST keystore. Optionally you may type the start date and/or end date for not using any REST keystore encryption in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).
• To add a new REST keystore encryption option, do the following:
  • Choose a to add a new REST keystore encryption option.
  • Set the encryption type. The default for version 8.0 and later is AES-256, and for versions prior to 8.0 is DES.
  • Specify the full path and file name where Endpoint Privilege Management for Unix and Linux is to place the encryption key file. The default is /etc/pb.rest.key. Endpoint Privilege Management for Unix and Linux requires a key file to use encryption. We recommend that you specify the /etc directory for the encryption key file.
  • Optional. Type the start date and/or end date for the encryption pair in the format: yyyy/mm/dd. Dates are evaluated in Universal Coordinated Time (UTC).
• Choose e to edit an existing REST keystore encryption option and specify the entry number of the encryption option to change. You can edit any of the following items for the selected option:
  • REST keystore encryption type.
  • Location and file name for the encryption file
  • Start date for the encryption pair to take effect
  • End date for the encryption pair
• Choose d to delete an existing REST keystore encryption option and specify the entry number of the encryption option to delete.
• Specify x to exit this option.

Choose this option and do one of the following:

• Specify n if Kerberos v5 is not used.
• Specify y to configure using Kerberos v5. You need also to perform steps 148 through 152.

Enabling High Security enforces configuration to adhere to FIPS 140-2 security. Non-FIPS compatible encryption and hashing algorithms will be disabled. SSL running in strict FIPS mode will be enabled, enhancing the security of the installation.

Choose this option and do one of the following:

• Specify allownonssl to allow connections to and from non-SSL hosts.
• Specify clientcertificates to require client certificates.
• Specify requiressl to allow communication among Endpoint Privilege Management for Unix and Linux components without requiring Endpoint Privilege Management for Unix and Linux client certificates. This option is not compatible with the AllowNonSSL option.
• Specify none to clear all existing parameters.

Choose this option and do one of the following:

• Specify the directory location for the SSL pbrun certificate authority files.
• Specify none to not specify a directory for the SSL pbrun certificate authority file. If you do not specify a directory, then you must specify the full path and file name for the SSL pbrun certificate authority file in the next step.

Choose this option and do one of the following:

• Specify the file name for the SSL pbrun certificate authority file. If you did not specify a directory in the previous step, then you need to provide the full path and file name.
• Specify none to not specify a filename for the SSL pbrun certificate authority file.

Failure to specify this file name results in failed communication negotiation.

SSL provides a variety of algorithms that can be used for encryption. This option enables you to restrict the set of encryption algorithms that are used by pbrun for server communication to a subset of those ciphers that are available to SSL.

Choose this option and do one of the following:

• Specify ALL to allow all ciphers to be used from the list in the following table:

  NULL-MD5	NULL-SHA
  EXP-RC4-MD5	RC4-MD5
  RC4-SHA	EXP-RC2-CBC-MD5
  EXP-DES-CBC-SHA	DES-CBC-SHA
  DES-CBC3-SHA	EXP-EDH-DSS-DES-CBC-SHA
  EDH-DSS-CBC-SHA	EDH-DSS-DFS-CBC3-SHA
  EXP-EDH-RSA-DES-CBC-SHA	EDH-RSA-DES-CBC-SHA
  EDH-RSA-DES-CBC3-SHA

• Specify one or more of the ciphers. If more than one cipher is specified, then type a space between the ciphers.

Choose this option and do one of the following:

• Specify the directory location for the SSL pbrun certificate file.
• Specify none to not specify a directory for the SSL pbrun certificate file. If you do not specify a directory, then you must specify the full path and file name for the SSL pbrun certificate file in the next step.

Choose this option and do one of the following:

• Specify the file name for the SSL pbrun certificate file. If you did not specify a directory in the previous step, you need to provide the full path and file name.
• Specify none to not specify a file name for the SSL pbrun certificate file.

Failure to specify this file name results in failed communication negotiation.

Choose this option and do one of the following:

• Specify the directory for the SSL pbrun private key file.
• Specify none to not specify a directory for the SSL pbrun private key file. If you do not specify a directory, you need to provide the full path and file name in the next step.

Choose this option and do one of the following:

• Specify the file name for the SSL pbrun private key file. This is the PEM-formatted private key for the client certificate file. If you did not specify a directory in the previous step, then you need to provide the full path and file name.
• Specify none to not specify a filename for the SSL pbrun private key file.

Failure to specify this file name results in failed communication negotiation.

The sslpbrunverifysubject setting enables strings or substrings of the subjects of SSL certificates to be checked and accepted by pbrun from pbmasterd.

Choose this option and do one of the following:

• Specify the string or substring to check in the SSL pbrun certificate subject. If the specified string or substring finds a match in the certificate subject, then the connection proceeds; otherwise, the connection fails.
• Specify none to remove all checks.

Choose this option and do one of the following:

• Specify the directory for the SSL server certificate authority file.
• Specify none to not specify a directory for the SSL server certificate file. If you do not specify a directory, then you need to provide the full path and file name for the SSL server certificate authority directory in the next step.

Choose this option and do one of the following:

• Specify the file name for the SSL server certificate authority file. If you did not specify a directory in the previous step, then you need to provide the full path and file name.
• Specify none to not specify a SSL server certificate authority file.

Failure to specify this file name results in failed communication negotiation.

OpenSSL provides a variety of algorithms which can be used for encryption. This option enables you to restrict the set of encryption algorithms that are used by the SSL server for communication to a subset of those ciphers that are available to OpenSSL.

Choose this option and do one of the following:

• Specify ALL to allow all ciphers in the following table to be used

  NULL-MD5	NULL-SHA
  EXP-RC4-MD5	RC4-MD5
  RC4-SHA	EXP-RC2-CBC-MD5
  EXP-DES-CBC-SHA	DES-CBC-SHA
  DES-CBC3-SHA	EXP-EDH-DSS-DES-CBC-SHA
  EDH-DSS-CBC-SHA	EDH-DSS-DFS-CBC3-SHA
  EXP-EDH-RSA-DES-CBC-SHA	EDH-RSA-DES-CBC-SHA
  EDH-RSA-DES-CBC3-SHA

• Specify one or more of the ciphers. If more than one cipher is specified, type a space between the ciphers.

Choose this option and do one of the following:

• Specify the directory for the SSL server certificate file.
• Specify none to not specify a directory for the SSL server certificate file. If you do not specify a directory, then you need to provide the full path and file name for the SSL server certificate file in the next step.

Choose this option and do one of the following:

• Specify the file name for the SSL server certificate file. If you did not specify a directory in the previous step, you need to provide the full path and file name.
• Specify none to not specify a SSL server certificate file name.

As a convenience, pbinstall can generate the SSL server certificate file if it doesn't yet exist, provided that the absolute path is specified and the parent directories already exist.

Failure to specify this file name results in failed communication negotiation.

Choose this option and do one of the following:

• Specify the directory for the SSL server private key file.
• Specify none to not specify a directory for the SSL server private key file. If you do not specify a directory, then you need to provide the full path and file name for the SSL server private key file in the next step.

Choose this option and do one of the following:

• Specify the file name for the SSL server private key file. If you did not specify a directory in the previous step, then you need to provide the full path and file name.
• Specify none to not specify the SSL server private key file name.

As a convenience, pbinstall can generate the SSL Server private key file if it doesn't yet exist, provided that the absolute path is specified and the parent directories already exist.

Failure to specify this file name results in failed communication negotiation.

Choose this option and do one of the following:

• Specify the string or substring to check in the SSL server certificate subject. If the specified string or substring finds a match in the certificate subject, then the connection proceeds; otherwise, the connection fails.
• Specify none to remove all checks.

Choose this option and do one of the following:

• Specify n to not enable Endpoint Privilege Management for Unix and Linux to use LDAP
• Specify y to enable Endpoint Privilege Management for Unix and Linux to use LDAP.

Choose this option and do one of the following:

• Specify y to install the BeyondTrust built-in third-party libraries.
• Specify n to not install BeyondTrust built-in third party libraries.

If you are using LDAP, Kerberos, or SSL, then you need to install third-party libraries. You can install the BeyondTrust third-party libraries or your own. We recommend that you use the BeyondTrust third-party libraries.

Choose this option and specify the directory for the BeyondTrust built-in third-party libraries. You also need to specify a directory for your own built-in libraries in step 188 .

Endpoint Privilege Management for Unix and Linux enables the use of Pluggable Authentication Modules (PAM) when Endpoint Privilege Management for Unix and Linux asks for password confirmation.

The authentication and account management portions of this service are invoked whenever Endpoint Privilege Management for Unix and Linux verifies a password.

• PAM is used on a policy server host when the getuserpasswd() and getgrouppasswd() policy functions are invoked and this setting is set to y.
• PAM is used on a submit host when the policy calls the submitconfirmuser() policy language function and this setting is set to y.
• PAM is used on a run host when the policy sets the runconfirmuser policy language variable to TRUE and this setting is set to y.

Choose this option and do one of the following:

• Specify y to use PAM Endpoint Privilege Management for Unix and Linux processing on this machine. You also need to perform the next PAM-related steps.
• Specify n to not use PAM Endpoint Privilege Management for Unix and Linux processing on this machine.

When this option is set to n, Endpoint Privilege Management for Unix and Linux prohibits the control of remotely executed jobs as follows:

• On a policy server host, requests that have different submit host and run host names are automatically rejected. The runhost policy variable is set to read only.
• On a submit host, the -h option for the pbrun command is disabled, and the runhost variable of the request is set to the IP address of the submit host.
• On a run host, all requests that do not originate from the Run Host are rejected. Choose this option and do one of the following:
  • Specify y to allow remote jobs. This setting is the default.
  • Specify n to not allow remote jobs.

When Endpoint Privilege Management for Unix and Linux determines that communication may occur using Unix or Linux domain sockets, there must be a protected directory that contains the sockets used for reconnects and backconnects. Using Unix and Linux domain sockets for communication between daemons on the same machine should be more efficient than TCP socket communications.

The directory that is specified for Endpoint Privilege Management for Unix and Linux Unix and Linux domain sockets must be protected from non-root read and write access, and each of the parent directories must be protected from non-root write access.

Choose this option and specify the directory for the Endpoint Privilege Management for Unix and Linux Unix or Linux domain socket.

Choose this option and do one of the following:

• Specify n to match an entered null password to any existing password.
• Specify y to require the user to exactly match the password.

Choose this option and do one of the following:

• Specify n to disable TCP keepalive signals.
• Specify y to enable TCP keepalive signals.