Roles

What are roles?

Roles are a set of permissions, responsibilities, or actions assigned to a user, process, or system component in EPM Cloud for Linux that can control access, manage frameworks, and help define what entities can and cannot do in the software.

Available roles

How are roles useful?

Use roles to streamline operations, enforce security policies, and effectively manage access for your EPM Cloud for Linux users.

Important information about roles

When you edit an existing role, the edits apply to all users, hosts, and groups with the role.

📘

Note

Edit and assign allowed users (Who), command groups (What), hosts (Where), and schedule (When) to a role.

Each role can have zero to many relationships with each entity type. This is managed using the lists matching the appropriate entity. The following configuration sections are available when editing role assignments:

WHO

Defines which users the policy applies to. This item is divided into two user types, Submit Users and Run Users, and these lists contain the user entities.

Select Use Default Group and Working Directory to automatically populate the run users in a script block on the Script Policy page. Changing the block properties is not recommended.

WHAT

Defines which commands the policy applies to. This list contains the command entities.

WHERE

Defines which hosts the policy applies to. This item is divided into two host type, Submit Hosts and Run Hosts, and these lists contain the host entities.

WHEN

Defines which schedule the policy applies to. This list contains the schedule entities.

Add a new role

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Click Add Role.
   The Roles panel displays.
4. Enter a Role name and Description.
5. Click Create Role to create the role, or click Create And Edit the Role to configure it.
   If you create the role, the role displays in the list on the Roles page.
   If you create and edit the role, the Edit Role page displays.
6. Click Save.
   The role and its configuration saves, and the role displays in the Role list on the Roles page.

View a role's details

View a snapshot of a role's configurations.

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to view.
4. Click > View Role Details.
   The Roles panel slides out from the right with a snapshot of the role's configurations.

Edit a role's general details

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to modify.
4. Click > Edit Role.
   The Edit Role page opens and the General tab displays.
5. Modify any of the following:
   • Role name: A unique name.
   • Tag: Tags function as a filter. Use them to sort through policy roles.
   • Description: A brief description to identify the role.
   • Comment: Comments are only visible to users with the Administrator role.
   • Role Risk Level: The perceived risk level of the policy, from 0 - 50.
   • Request Type: Allows the administrator to specify which request types this policy will apply to (for example, a policy might apply to commands issued only by pbrun invocations).
     Use the dropdown to select the appropriate request type, or select Any. The default value is to allow any request type.
   • Policy: Enable or disable the role (default is Enabled).
   • Action: Select whether this role triggers an Accept or Reject action (default is Accept).
   • Entitlement Reporting: Enable or disable entitlement reporting on this role (default Disabled).
6. Click Save.
   Changes apply immediately to the role and affect all users, hosts, and groups with the role.

Edit role assignments

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to modify.
4. Click > Edit Role.
   The Edit Role page displays.
5. In the left panel, click Assignments.
   The Assignments page displays.
6. Modify the Who (users and groups), What (command groups), Where (hosts), and/or When (schedule) for the role.
7. Click Save.
   The role assignments save and apply to all users, groups, and hosts with that role.

Edit a role's reauthentication

If configured, this feature requires users to reauthenticate themselves when this policy is invoked. Only one reauthentication method can be configured per policy. Most reauthentication options allow for customization of messages and prompts to be displayed to the user as well as logs. Reauthentication can be enabled in a number of configurations:

• None: Reauthentication is not required.
• Shared Secret: Create a shared secret value. The user must provide it to reauthenticate.
• Privilege Access Management (PAM): A number of PAM modules can be selected, or a custom one can be provided. Additionally, most options allow the user to configure where the authentication will occur.

Configure a Shared Secret reauthentication option

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to modify.
4. Click > Edit Role.
   The Edit Role page displays.
5. From the left panel, click Reauthentication.
6. The Reauthentication page displays.
7. In the Type dropdown, select Shared Secret.
8. Enter the Shared Secret and confirm it.
9. Enter a Reauthentication Prompt message, or use the default.
10. Enter the Number of attempts (retries) before reauthentication locks the user out.
11. Enter the Failure Message the user sees if reauthentication fails, or use the default.
12. Enter the Log Message you want recorded in the log when reauthentication fails, or use the default.
13. Click Save.
    The reauthentication method and details save and are applied to all users, groups, and hosts with the role.

Configure a PAM reauthentication option

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to modify.
4. Click > Edit Role.
   The Edit Role page displays.
5. From the left panel, click Reauthentication.
   The Reauthentication page displays.
6. In the Type dropdown, select PAM.
7. Select the PAM Service to use for authentication.
8. Select the Location to use, where the authentication happens.

   📘

   Note

   If you select the Run Host option, you only need to complete the next two steps, then click Save.

9. Select the User To Be Authenticated.
   If you select Custom, enter a custom user name.
10. Enter a Reauthentication Prompt message, or use the default.
11. Enter the Number of attempts (retries) before reauthentication locks the user out.

    📘

    Note

    This may depend on the policies imposed by the authentication services that EPM Cloud for Linux accesses through PAM.

12. Enter the Valid time length (in seconds) for the length of time you want the reauthentication attempts cached before a login is required again.
13. Enter the Failure Message the user sees if reauthentication fails, or use the default.
14. Enter the Log Message you want recorded in the log when reauthentication fails, or use the default.
15. In the Change requested by [loggedInUserName] field, enter a reason for the assignment or change.
16. Click Save.
    The reauthentication method and details save and are applied to all users, groups, and hosts with the role.

Add or edit a role message

Use messages to output a message to the user when this policy is processed. This field can use variables to provide a custom, context-specific message using the EPM Cloud for Linux template syntax of %%. A few options are available using buttons to quickly insert the most popular options. Values can also be entered freely.

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to modify.
4. Click > Edit Role.
   The Edit Role page displays.
5. In the left menu, click Messages.
   The Messages page displays.
6. Enter a message in the Accept and Reject Messages field.
7. Optionally, click one of the standard messages to the right of the Accept and Reject Messages field.
8. Click Save.
   The message saves and is applied to all users, groups, and hosts with the role.

Edit a role's Session Replay settings

Use the session replay settings to preview the file location for your iologs, which log standard input, standard output, and standard error information that is associated with the current task request.

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to modify.
4. Click > Edit Role.
   The Edit Role page displays.
5. From the left menu, click Session Replay.
   The Session Replay page displays.
6. Toggle the Session Replayon to save iologs logs.
   The file location for your iologs displays in the Preview section.
7. Click Save.

Create or edit a custom script policy for a role

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to modify.
4. Click > Edit Role.
   The Edit Role page displays.
5. From the left menu, click Script Policy.
   The Script Policy page displays.
6. Enter your script policy.
7. Click Save.
   The policy saves and is applied to all users, groups, and hosts with the role.

Duplicate a role

Duplicate a role to create a new role with all field values (including assignments of host groups, command groups, user groups, and schedule groups) retained from the original role.

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to duplicate.
4. Click > Duplicate Role.
   The Duplicate Role page displays with the General tab open by default.
5. Rename the Add a new role name. Duplicate role names are not permitted. By default, the name is Copy of (original role name).

Delete a role

❗️

WARNING

Deleting a role is an unrecoverable operation.

1. Click > Endpoint Privilege Management for Linux > Policy.
   The Role Based Policy page displays.
2. Click the Roles tile.
   The Roles list displays.

3. Locate the role you want to delete.
4. Click > Delete Role.
   A confirmation message displays.
5. Click DELETE.
   The role is immediately removed and all users, groups, and hosts with that role are no longer assigned to it.