Missing Admin user mode on the 'root' user

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

Inadvertently 'Admin' user mode has been removed from the 'root' user. There is no other user that has 'Admin' user mode. 
Running 'su root' on selang prompt shows there is no "Admin" user mode.

PAMSC> su root (localhost) Data for USER 'root' ----------------------------------------------------------- User mode         : Auditor, Ignore-Holiday Audit mode        : Login-Success, Failure, Login-Failure Last accessed     : _CRONJOB_ Last access time  : 23-Dec-2022 14:01 Update time       : 23-Dec-2022 17:20 Updated by        : root          (USER   )

Trying to add 'Admin' user role on selang prompt fails as 'root' user doesn't have enough privilege now.

PAMSC> eu root Admin (localhost) ERROR: Operation not allowed ERROR: You are not allowed to update the user type

How can we fix this problem?

Environment

PAMSC 14.1 Endpoint

Resolution

You need to rebuild the database. Please refer

Rebuild the Privileged Access Manager Server Control Database

Before re-importing the exported rule file, please do the following

Modify the following line (add 'admin')

From

editusr ('root') auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE)

  
To

editusr ('root') admin auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE)

and also find any other editusr line against root user and remove. E.g. if you find the following at the bottom then remove the line

editusr root regular auditor ign_hol

Then re-import and do 'migrate -w'.

Here are the detailed steps.

1. Reboot OS if 'secons -s' doesn't work to shutdown PAMSC, otherwise just run 'secons -s' to shutdown PAMSC

2. Backup the seosdb to a backup location, e.g. ~/Download/backup2 directory

[root@wsang-xxxxxxxxx bin]# cp -R /opt/CA/PAMSC/seosdb ~/Download/backup2

3. Export and migrate from the backup directory

[root@wsang-xxxxxxxxx bin]# cd ~/Download/backup2/seosdb [root@wsang-xxxxxxxxx seosdb]# [root@wsang-xxxxxxxxx seosdb]# /opt/CA/PAMSC/bin/dbmgr -export -l -f ./export.txt CA Privileged Access Manager Server Control dbmgr v14.10.40.182 - Database to Script Dump Copyright (c) 2018 CA. All rights reserved [root@wsang-xxxxxxxxx seosdb]# /opt/CA/PAMSC/bin/dbmgr -migrate -r ./migrate.txt Processing class USER Processing USER +devcalc. Processing USER +policyfetcher. Processing USER _seagent. Processing USER _sebuildla. Processing USER _seoswd. Processing USER _undefined. Processing USER nobody. Processing USER root. Processing USER <user>. Processing class XUSER Processing XUSER all. Processing XUSER <user2>. Processing XUSER <user3>. Processing class PROGRAM Processing PROGRAM /opt/CA/PAMSC/bin/sebuildla. Processing PROGRAM /opt/CA/PAMSC/bin/sechkey. Processing PROGRAM /opt/CA/PAMSC/bin/sesudo. Processing PROGRAM _default. Processing class HNODE Processing HNODE __local__. Done.

4. Now, before re-importing the database into a new fresh seosdb, I need to modify exported rule file, i.e. export.txt. I use 'vi' to open the export.txt and search for 'root' related rules in the file.

I found the following line

editusr ('root') auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE)

I have modified this line to

editusr ('root') admin auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE)

I searched more and at the bottom I found

editusr root regular auditor ign_hol

I have deleted this line. And I search more and I don't find any 'editusr root' related rule anymore. I have saved the file.

5. Now, I need to import the exported rules into a new fresh seosdb. First of all, create /opt/CA/PAMSC/seosd_new directory and create a fresh db

[root@wsang-xxxxxxxxx PAMSC]# mkdir seosdb_new [root@wsang-xxxxxxxxx PAMSC]# cd seosdb_new [root@wsang-xxxxxxxxx seosdb_new]# ../bin/dbmgr -create -cq Creating new database:   1. Building database file.   2. Initialize new database.   3. Open new database.   4. Add classes to new database.   5. No user-defined classes added to database.   6. Add properties to classes.   7. Add objects to class SeOS and class UACC.   8. Add predefined objects to database.   9. No user-defined properties added to database.   10. Close new database files. Successfully created new CA Privileged Access Manager Server Control database.

6. Make sure you are in /opt/CA/PAMSC/seosd_new directory now and import the modified exported rule file.

[root@wsang-xxxxxxxxx seosdb_new]# ../bin/selang -l -d . -f ~/Download/backup2/seosdb/export.txt CA Privileged Access Manager Server Control selang v14.10.40.182 - command line interpreter Copyright (c) 2018 CA. All rights reserved. Successfully updated CA Privileged Access Manager Server Control options Successfully updated CA Privileged Access Manager Server Control options Successfully updated CA Privileged Access Manager Server Control options Successfully updated CA Privileged Access Manager Server Control options < ... cut ... >

7. Do the migrate command

[root@wsang-xxxxxxxxx seosdb_new]# ../bin/dbmgr -migrate -w ~/Download/backup2/seosdb/migrate.txt Processing +devcalc of class USER. Processing +policyfetcher of class USER. Processing nobody of class USER. Processing root of class USER. Processing <user> of class USER. Processing all of class XUSER. Processing <user2> of class XUSER. Processing <user3> of class XUSER. Done.

8. Replace /opt/CA/PAMSC/seosdb with seosdb_new

[root@wsang-xxxxxxxxx seosdb_new]# cd .. [root@wsang-xxxxxxxxx PAMSC]# mv seosdb seosdb_old [root@wsang-xxxxxxxxx PAMSC]# mv seosdb_new seosdb

9. Restart PAMSC and verify.