Prepare your installation | EPM-UL

Use this page to plan your Endpoint Privilege Management for Unix and Linux (EPM-UL) deployment before you start the installation. It covers what you need in place beforehand, which host types to put on which machines, and the settings you choose during installation.

Before you begin, make sure you have:

• Root access on every machine where you install an EPM-UL component
• A license string from your BeyondTrust sales representative
• Working TCP/IP communication between all hosts
• Name resolution working in both directions between all hosts
• The libxcrypt-compat package, if you are installing on Amazon Linux 2023 or RHEL 9+

Before you install

Check platform prerequisites

To install EPM-UL on Amazon Linux 2023 or RHEL 9+ (for x86_64, arm64, ppc64le, s390x), you must first install the libxcrypt-compat package using dnf/yum/rpm. This package provides the libcrypt.so.1 library required by EPM-UL.

Obtain root access

Installing EPM-UL requires root access.

Obtain a license validation key

You need a license string, provided by your BeyondTrust sales representative, to install EPM-UL.

The primary license server host performs the license resolution functions and is the only EPM-UL host type that requires a license key. For a policy server host to accept a task, the primary license server must have a current valid license key. The distribution includes a temporary license key that expires two months from the date of installation.

If you install using pbinstall, you can configure the license key during installation using the license installation menu item. After installation is complete, you can also add the license using the pbadmin --lic -u command.

Verify TCP/IP operation

EPM-UL uses TCP/IP as its communication protocol, so TCP/IP must be working correctly before installation.

Use programs such as ping, netstat, route, or traceroute to verify correct TCP/IP operation among all hosts that will have EPM-UL components installed.

Verify network host information

Ensure that each network host knows the names and addresses of all other network hosts. Network host information is generally stored in the /etc/hosts file on each network host machine, or in the NIS maps or DNS files on a server.

Each submit host must resolve all policy server host names correctly. Each policy server host must resolve all submit, run, GUI, and log host names correctly. Resolution must work in both directions: name-to-IP address and IP address-to-name.

ℹ️

After installation, the pbbench utility generates warnings for any host name resolution issues on a host where EPM-UL components are installed.

Run the pre-installation check script

pbulpreinstall.sh performs basic pre-installation checks:

• Checks hostname resolution, DNS, and name services resolution to verify that the default ports are not in use.
• Checks for sufficient disk space.
• Reports technical support-related information such as the operating system, NIC information, gateway, and super daemon status. If EPM-UL is already installed, the script reports the EPM-UL roles, such as submithost, runhost, policy server, logserver, and pbx.

The script takes two optional arguments:

Before installation, pbulpreinstall.sh is located in the EPM-UL distribution in powerbroker/<version>/<flavor>/install. After installation, the script is installed in the '$inst_admin' directory. The default is /usr/sbin.

Plan your EPM-UL hosts

An EPM-UL installation includes several host types, each performing specific functions. Before you install, determine which host type each machine in your environment needs.

You must install EPM-UL separately on each machine running any type of EPM-UL host. A single machine can run multiple EPM-UL components. For example, one physical machine can serve as a submit host, policy server host, run host, log host, and log sync host.

License servers

Determine which hosts to use as license servers. These are the machines that resolve licenses for EPM-UL.

• The license server host is the only host that requires a license key. License servers store and maintain the product license, parameters, and usage information.
• The first installation of EPM-UL becomes the primary license server and serves as the Root Certificate Authority. On this server, the EPM-UL installation generates a self-signed Root Certificate Authority (Root CA) certificate, which becomes the trust anchor for all subsequent installations.
• Subsequent license server installations obtain their data when the primary license server performs synchronization.

Submit hosts

Determine which machines to use as submit hosts. These are the machines where pbrun is installed and run.

• pbrun is the EPM-UL utility that submits secure tasks, which might run on the same or a different host.
• At least one submit host must be available to process monitored task requests.

Run hosts

Determine which machines to use as run hosts. These are the machines where pblocald, pbsh, and pbksh are installed and run.

• pblocald is the daemon process that executes secure tasks.
• At least one run host must be available to process accepted task requests.

Policy server hosts

Determine which machines to use as policy server hosts.

• pbmasterd is installed and run on the policy server host. pbmasterd is the daemon process that accepts or rejects all tasks submitted by submit hosts and, if accepted, authorizes a specific run host to execute each task.
• Policy files reside on the host. The default is /opt/pbul/policies/pb.conf from v9.4.3+, and /etc/pb.conf prior to v9.4.3. Any policy files referenced by include statements are also in the policy file.
• Starting with EPM-UL v26.1.0, if EPM-UL CA-signed certificates are enabled, policy servers can serve as subordinate Certificate Authorities. They receive a subordinate CA certificate to use for signing certificates.
• There must be at least one policy server host. We recommend that you also install a second, failover policy server host with the same policy files as the primary policy server host, to provide redundancy.
• Depending on the size of your environment and the volume of tasks run through EPM-UL, you might want to add more policy server hosts. You can add policy server hosts during the initial installation or afterwards.

Log hosts

Using a log host to record event and I/O logs is optional. If you do not use a log host, pbmasterd and pblocald are responsible for logging activities.

Determine the machine or machines to use as log hosts. These are the machines where pblogd is installed and run.

• Starting with EPM-UL v26.1.0, if EPM-UL CA-signed certificates are enabled, log hosts that can act as registration servers can serve as subordinate Certificate Authorities and can receive a subordinate CA certificate to use for signing certificates.
• As with policy server hosts, we recommend multiple log hosts to provide redundancy. When a log host failover occurs, you can use the EPM-UL log synchronization utilities to resynchronize the log entries.
• The load on the log hosts varies with the amount of logging. I/O logs require greater resources on the log hosts. You can add more log hosts to your environment during installation or afterwards, as needed.

Log synchronization hosts

Log synchronization enables a log host, or a policy server host acting as a log host, to participate in log synchronization.

• Install the log synchronization component on any log host or policy server host that might participate in log synchronization.
• Install log synchronization on each log or policy server host if you are installing primary and failover log hosts, or installing policy server hosts that act as log hosts.
• If you use log synchronization, one or more machines need the ability to initiate log synchronization.

Choose installation settings

Port numbers

Decide whether to use the default port numbers or select your own. EPM-UL uses the following default port numbers:

If you change the port number defaults, choose port numbers that do not conflict with those already in use. See /etc/services. Also review the services NIS map, if it is present and active.

EPM-UL port numbers must use the non-reserved system ports. The allowed port numbers are 1024 to 65535.

Installation directories

Decide whether to use the default installation directories or set your own. Using your own installation directories allows for EPM-UL optimization of the local installation.

Encryption

By default, EPM-UL installs with AES-256 encryption. EPM-UL also supports a number of other encryption technologies.

Optional components and environment

EPM-UL utilities

Using the EPM-UL utilities is optional.

• Utilities are secured versions of vi, nvi, mg, umacs, and less.
• You can install utilities only where an EPM-UL run host is installed.

EPM-UL shells

Using the EPM-UL shells is optional.

• Shells are secured versions of the Korn Shell and the Bourne Shell.
• You can install shells only on a machine where an EPM-UL submit host is installed.

syslog

Using syslog is optional. Determine whether the policy server host, run host, submit host, log sync host, and log host generate syslog records when system error conditions occur.

Firewalls

You can use EPM-UL in a firewall environment with special configuration.

NIS

EPM-UL can use NIS to provide configuration services for EPM-UL settings. You can define netgroups for:

• Accept policy servers (pbacceptmaster)
• Submit policy servers (pbsubmitmasters)
• Log host (pblogservers)

You can also use NIS to provide port lookup information for the EPM-UL components. If NIS is running in your environment, consider using EPM-UL netgroups and port definitions.