Linux / Unix

Joining Project Glasswing: Securing the Privilege Backbone of the AI Era An Executive Perspective on Project Glasswing and the Future of AI-Powered Cyber DefenseToday, BeyondTrust joins Anthropic’s Project Glasswing as part of the program’s expansion to organizations that build or maintain critical software for the world. With this inclusion, BeyondTrust gains access to Claude Mythos Preview, the frontier model that has already helped Glasswing partners surface more than 10,000 high and critical severity software vulnerabilities. Why BeyondTrustProject Glasswing is designed for organizations whose software plays a foundational role in the operation of critical systems and whose compromise could have significant downstream consequences across industries, economies, and public services. We believe participation in Project Glasswing aligns directly with BeyondTrust's mission to secure privilege across human, machine, and AI identities. As the identity attack surface expands, protecting th

How to onboard Linux or Unix servers and local Linux or Unix accountsThis article outlines the steps to deploy Linux or Unix systems and local Linux accounts. Pre-deployment steps to be done on the Linux or Unix machine You must create an account to be used as the functional account. This account can be a local account or an Active Directory account that can login to the Linux or Unix system. A functional account must be set up to change passwords and have elevated privileges. Elevated privileges can be set up for the functional account to use sudo, pbrun or pmrun.   For information on sudo setup, refer to How to configure and test Sudo elevation account to be used as a Functional Account. For information on configuring pbrun, refer to How to integrate EPM-UL and use PBRUN for elevation.For information on configuring pmrun, please contact the vendor.  You will need to create a scan account. Check the machine to see if there are any custom prompts or banners with the prompt character in

Secure default X509 certificates for all EPM-UL TLS communicationEndpoint Privilege Management for Unix and Linux 26.1Prior to v26.1.0, a customer could forego the use of their own certificates in favor of EPM-UL’s default self-signed certificates.Starting with v26.1.0, EPM-UL establishes a per-installation Public Key Infrastructure (PKI). The first (primary/license) server generates a self-signed Root Certificate Authority (Root CA) certificate, which becomes the trust anchor for the entire installation. Policy and log servers that can act as registration servers each receive a Subordinate CA certificate signed by the Root CA (or by another subordinate CA), and all servers and client endpoints receive individual CA-signed certificates for use in TLS communication. Certificate and hostname validation are now fully enforced for connections using these new certificates. Note that the new EPM-UL Public Key Infrastructure is only used in cases when the customer doesn’t use their own ce

How to Upgrade EPM-UL Using The BIUL U-series Web Console This article provides the steps to upgrade Endpoint Privilege Management for Unix and Linux (EPM-UL) through the U-Series appliance web console.  This only applies to instances installed through the U-Series web console, and not those installed using the local Linux console.  Pre-requisites Only the versions of EPM-UL that have been made available for BT Updater can be installed through the U-Series appliance web console. All masters in the environment should be upgraded and confirmed to be working before upgrading the client machines.  Mismatching master node versions can lead to unexpected behavior.  Log in to the BIUL U-series webconsole as an administrator (https://<u-series appliance>/pbsmc) Click Hosts Inventory  Click the vertical ellipses next to the master and select Perform Host Actions Select Privilege Management for Unix & Linux and click Next Step Continue reading here Latest Available Version: EPM fo

How to Upgrade EPM-UL Using The BIUL U-series Web Console This article provides the steps to upgrade Endpoint Privilege Management for Unix and Linux (EPM-UL) through the U-Series appliance web console.  This only applies to instances installed through the U-Series web console, and not those installed using the local Linux console.  Pre-requisites  Only the versions of EPM-UL that have been made available for BT Updater can be installed through the U-Series appliance web console. All masters in the environment should be upgraded and confirmed to be working before upgrading the client machines.  Mismatching master node versions can lead to unexpected behavior.  Log in to the BIUL U-series webconsole as an administrator (https://<u-series appliance>/pbsmc) Click Hosts Inventory  Click the vertical ellipses next to the master and select Perform Host Actions Select Privilege Management for Unix & Linux and click Next Step Continue reading here Latest Available Version: Endpo

Getting and Deploying a New EPM-UL License File When purchasing a new Endpoint Privilege Management Unix or Linux (EPM-UL) license key, BeyondTrust will generate the license key based on the hostname and domain name. In some cases, the hostname or domain name can change. If this happens, users will need to request a new EPM-UL license file.  To change the hostname to which the PMUL license key is linked, please download the attached PMUL License Request document listing the hostname, PBHostID, version, and the number of licenses to be assigned. Once this document has been filled out, please forward this to BeyondTrust's Fulfilment team by emailing fulfillment.helpdesk@beyondtrust.com Note: key strings are NOT case sensitive.Once the license is received, users can deploy it on the Primary License Server by running the command: pbadmin --lic -u {LICENSE_STRING} For example: pbadmin --lic -u '{"Owner":"BeyondTrust","HostId":"<GUID>","Comment":"TestComment","Expires":"","Terminates":

Re-creating Certificates for EPM-UL This article outlines the steps to generate a new certificate for Endpoint Privilege Management for Unix and Linux (EPM-UL).  By default the service pblighttpd.service uses the certificate /usr/lib/beyondtrust/pb/rest/ssl/rest.pem. Admins can create another certificate and name it rest.pem to replace the current one.  Steps Generate the certificate Copy the pem file /etc/pbssl.pem to a backup location Extract the ISO contents of the version of EPM-UL to the /tmp directory (replace paths in the command with the correct version). This will create a new certificate pbssl.pem. For argument explanations, refer to pbregister.  pbregister -C -c /tmp/powerbroker/v23.1/EPM-UL_linux.x86-64_23.1.0-12/lib/libcurl.so.4.8.0 -s /tmp/powerbroker/v23.1/EPM-UL_linux.x86-64_23.1.0-12/lib/libcrypto.so.1.1:/tmp/powerbroker/v23.1/EPM-UL_linux.x86-64_23.1.0-12/lib/libssl.so.1.1 > pbssl.pem  Move this to the /etc folder. Restart the following EPM-UL services pbmaste