Manage and test system configuration

Use the following utilities to validate or troubleshoot an EPM-UL installation:

pbbench
pbcheck

pbbench

pbbench helps you diagnose configuration, file permission, and network problems. It reads the Endpoint Privilege Management for Unix and Linux (EPM-UL) settings file on the local host, then verifies those settings against system information such as /etc/services, /etc/hosts, or NIS.

EPM-UL expects certain file permissions and network configurations, and might not run if they are not met. pbbench reports what it finds as INFO, WARNING, or ERROR messages. Some findings are informational; others require action.

ℹ️
For more information, see pbbench.

Run pbbench

pbbench runs as a user program. Both root and non-root users can run it, but some queries fail for non-root users because of insufficient permissions. The default location is /usr/local/bin, which you can change during installation.

Output goes to standard error and includes the tests performed, their results, and any errors found. If pbbench finds no errors, it returns silently.

To send output to a file instead:

pbbench > filename

Example

pbbench > pbbench.output

ℹ️
pbbench also checks for pre-2.0 versions of EPM-UL by looking for /etc/pb.ports and /etc/pb.masters, and warns if it finds them. The HTML GUI version does not perform this check.

pbcheck

The Endpoint Privilege Management for Unix and Linux pbcheck utility provides the capability to test the policy file and also to produce data that describes which commands can run under what conditions.

ℹ️
For detailed information on this utility, see pbcheck.

Testing policies

pbcheck can perform syntax, type, and other checks on a policy file. A common use for this utility is to test a new policy for errors before installing it on a live system. To test a new policy, enter the following:

pbcheck -f filename

pbcheck --file= filename

Another typical use for pbcheck is to check the syntax in an existing policy file without executing a function or procedure. This action is done with the following command:

pbcheck -s

pbcheck --syntax

With no options, pbcheck performs a run-check on the configuration policy file that is specified in the settings file.

Entitlement reporting

Version 4.0 and earlier: entitlement reporting not available.
Version 5.0 and later: entitlement reporting available.

Entitlement reporting is an essential element of audit control, such as Sarbanes-Oxley compliance in the U.S. Beginning with Endpoint Privilege Management for Unix and Linux (EPM-UL) v5.0, pbcheck can use the EPM-UL parser to emulate simple policies and produce data that describes which commands can run under what conditions.

The resulting data is presented as comma-separated values. You can feed it to the EPM-UL report writer to produce a full entitlement report, or export it to other programs.

Because the EPM-UL policy language is so extensive, entitlement reporting has two important limitations:

Policies can use external data sources and programs, and EPM-UL can base entitlement decisions on them. These sources can produce different results even when the policy has not changed.
Policies can be complex, and a complex policy can produce an incomplete report.

ℹ️
For more information about additional limitations of entitlement reporting, see pbcheck.