Skip to main content
Version: Axidian Privilege 3.5

PamSU

The PamSu component enables Axidian Privilege users to run commands with root privileges using the password of their own Active Directory user account.

Installation is performed manually on Linux resources, where you need to run commands with root privileges.

Installation​

Depending on the Linux distribution, select the required installation package format:

  • The .deb format is intended for Debian-based distributions: these include Debian and Ubuntu.
  • The .rpm format is intended for RHEL-based distributions: these include CentOS, Oracle Linux, Rocky Linux and RHEL.

To install PamSu:

  1. Go to the folder with the distribution AxidianPAM_3.5\axidian-pam-tools\pamsu\.

  2. Install the PamSu utility of the latest OSSL version:

    sudo dpkg -i "axidian-privilege.pamsu-ossl(3.1.8)-v3.5.0-master.373564.x64.deb"

If errors occurred during installation or PamSu does not work:

  1. Remove the utility:

    sudo dpkg -P pamsu

  2. Install:

    • an earlier OSSL version, for example:

      sudo dpkg -i "axidian-privilege.pamsu-ossl(1.1.1s)-v3.5.0-master.373564.x64.deb"

    • NO-SSL version, if additional cryptographic modules for OpenSSL are already installed:

      sudo dpkg -i "axidian-privilege.pamsu-no-ossl(3.1.8)-v3.5.0-master.373564.x64.deb"

If you were unable to install PamSu, contact technical support.

Configuration​

On the resource, you need to configure trust for the certificates of the Core and IdP components.

To verify correct operation with certificates, execute the command:

curl https://pam.company.local/idp/

Open the /etc/pamsu.conf  file in any editor with root privileges and specify the following parameters:

  • idp_url — idp URL address
  • core_url — core URL address
  • log_path — path to the folder with log files
  • log_level — logging level, can be INFO, WARN, ERROR, FATAL
Example
Set idp_url https://pam.company.local/idp
Set core_url https://pam.company.local/core
Set log_path /var/log
Set log_level INFO

On some Linux systems, the SSH server does not allow the LC_ * environment variables by default.  For the application to work correctly, add the following line to the /etc/ssh/sshd_config file:

AcceptEnv LC_PAM_USER LC_PAM_SESSION_ID

or just 

AcceptEnv LC_*
info

To allow the execution of the pamsu command, you must enable the Allow run pamsu option in the SSH section in the policy.