Linux / Unix

The following articles were published last week. New Knowledge Base Articles: KB0021526 - Endpoint Privileged Management for Unix Linux licensing FAQs KB0021758 - LDAP binding to Active Directory on EPM-UL fails with error - pbrun23.1.2-04[947719]: 3005 Request ended unexpectedly KB0021817 - Errors assigning EPM-UL license key - 3802.6 This host is not the Primary License server or 6025.78 Host is incorrect in the Registry Name Service Cache database KB0021830 - Error when trying to profile BIUL or EPM-UL servers "BIUL ERROR: sudo: sorry, you must have a tty to run sudo"

After the installation of BIUL 23.1 we are seeing below errors in logs. This is a custom installation of BIUL 23.1 on master server. pbksh.logDec  8 19:06:48 [368244] 1171 pbSSLAtomicWrite error 32: Broken pipe pbmasterd.logDec  8 19:18:24 [369488] 3018 LIBMANGLE_mangleRecvStart failure on fd 4. No data returned  

The following articles were published last week. New Knowledge Base Articles: KB0021661 - EPM Unix & Linux (UL) supported versions lifecycle and OS compatibility information KB0021749 - Client registration or REST call from EPMUL failing in an environment with https_proxy configured "Failed to call REST API - HTTP returned error"

The following articles were published last week. New Knowledge Base Articles: KB0021713 - pbuninstall uses high amount of memory and CPU and is not behaving correctly on Ubuntu18 KB0021714 - User assigned to a Role Based Policy in EPM-L is unable to use the policy KB0021725 - 6101.53 Error accessing Message Router statistics error in msgrouter and pb.eventlog is not logging in eventlog

The following articles were published last week. New Knowledge Base Articles: KB0021676 - Error: pbguid Exiting failed to read settings file /etc/pb.settings - general SQL error "

How to open a case for Endpoint Privilege Management for Linux (cloud)? The support Console includes only Mac & Windows option and there is no Linux option. 

One of the things that becomes a big issue for customers, especially when we move to automated build processes, is “how do you allow a user to add/remove users or groups, but NOT allow them to add ‘root-capable’ accounts, or elevate their own access?” As has been well discussed in other forums such as OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html - input validation is very difficult to do properly, especially if all you’re doing is checking “are these options included in the input?”  A lot of customers will simply try to grep the options for dangerous flags or mis-uses, but as documented above, this is not safe - a re-implementation of the commandline parsing is typically required for security.For a customer this month, we built a “pbuseradd” function that re-implements the “useradd” commandline validation, but adds protections such as “you cannot create a new backdoor root user”.  One of the features we use to validate these backdoors is the F