pbssh | EPM-UL

• Version 6.0.1 and earlier: pbssh program not available.
• Version 6.1 and later: pbssh program available.

Using EPM-UL policy and the pbssh program, you can control access to, and activities on, SSH-managed devices. The pbssh program is similar to the pbrun program, except that it uses the SSH protocol (or, optionally, the telnet protocol) to connect to devices that do not have EPM-UL installed on them; such devices can include Windows computers and certain network devices.

You must specify the -h option (to indicate the host name of the target device), and the -u option (to indicate the user name with which to log into the device). To execute a command on the target device, use the -C option. You may also optionally use the -P (--port) option to specify a particular port for the SSH connection.

If you have a Password Safe appliance, the EPM-UL can be configured to automatically obtain the device password from Password Safe. To do so, the following EPM-UL settings must be specified on the submit host:

• pkrunfile
• pk_cert (or the --pk_cert option)
• pk_servers (or the --pk_servers option)
• pbsshshell (optional)

If you do not have a Password Safe appliance, then pbssh prompts the user for the password. The user is also prompted under these circumstances:

• The Password Safe appliance is not available.
• The Endpoint Privilege Management for Unix and Linux settings are not specified or not correctly specified.
• The --skip_pkrun option is specified on the pbrun command line.
• The --telnet option is specified on the pbrun command line.

The --domain option has two purposes, both of which are related to Password Safe:

• If you need to log into a host using a domain account, then you use the --domain option defines the domain from which Password Safe should obtain the domain account password.
• If the --user option defines a user account, and you want to use a Password Safe managed account alias in place of the actual managed system name, then you use the --domain option to specify the managed system alias.

ℹ️

Unlike pbrun, pbssh does not require a command to be specified. Consequently, the Endpoint Privilege Management for Unix and Linux policy function basename() always returns pbssh. In the Endpoint Privilege Management for Unix and Linux policy, to determine the command that was specified, parse the argv list.

Syntax

pbssh [options] command [command_arguments]
   -c, --pk_cert
   -C, --command
   -d, --debug=connect
   -d, --debug=time
   -d, --debug=ttime
   -D, --domain
   -h, --host=run_host
   -k, --skip_pk
   -K, --pk_servers
   -P, --port=ssh_port
   -r, --pk_reset_password
   -T, --telnet
   -u, --user=request_user
pbssh –v | --version
pbssh --help

Arguments

Files

/etc/pb.settings Local EPM-UL submithost settings

Example

pbssh –h runhost -u jjones -C "dir /w"

ℹ️

For more information, see Connections to SSH-Managed Devices.