Error writing CA ControlMinder users look-aside database file - PAM Server Control

Products

• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)

Issue/Introduction

After logging in as exampleuser and performing su to root, the following error occurs when running sebuildla -a to rebuild the lookaside database in PAM Server Control (PAMSC).

 

[root@ExampleServer ~]# sebuildla -a
CA Privileged Access Manager Server Control: Creating users look-aside database.
Error writing CA Privileged Access Manager Server Control users look-aside database file.

 

Cause

When the su command is called, PAMSC will maintain the user's original identification when determining to allow access to a command or file or performing certain PAMSC functions. A PAMSC user must be an administrator in order to run the sebuildla utility, so it will fail if the original user is not an administrator. This can be confirmed by running the sewhoami -a command and looking at what is listed for User's Mode.

[root@ExampleServer ~]# sewhoami -a
exampleuser
ACEE Contents
  User's Name             : exampleuser
  ACEE's Handle           : 11
  Group Connections Table:
<Empty>
Categories              : <None>
Profile Group           : <None>
Security Label          : <None>
User's Audit Mode       : Failure LoginSuccess LoginFailure
User's Security Level   : 0
Source Terminal         : 10.#.#.#
Process Count for ACEE  : 4
User's Mode             : Regular

Resolution

Log into the PAMSC server with a current PAMSC administrator and run the sebuildla -a to rebuild the lookaside database.

Additional Information

In order to allow exampleuser to run the sebuildla in the future, add the administrator attribute in PAMSC by following these steps:

1. Log into the PAMSC server with a current administrator.
2. Run selang and add the administrator attribute to the user with the following command:
   eu exampleuser admin

The change will not take effect if exampleuser is logged in when the eu command is run, it will take effect on the next login. To confirm, run sewhomi -a on the next login.

[root@ExampleServer ~]# sewhoami -a
exampleuser
ACEE Contents
  User's Name             : exampleuser
  ACEE's Handle           : 11
  Group Connections Table:
<Empty>
Categories              : <None>
Profile Group           : <None>
Security Label          : <None>
User's Audit Mode       : Failure LoginSuccess LoginFailure
User's Security Level   : 0
Source Terminal         : 10.#.#.#
Process Count for ACEE  : 4
User's Mode             : Administrator