Inadvertently 'Admin' user mode has been removed from the 'root' user. There is no other user that has 'Admin' user mode.
Running 'su root' on selang prompt shows there is no "Admin" user mode.
PAMSC> su root |
Trying to add 'Admin' user role on selang prompt fails as 'root' user doesn't have enough privilege now.
PAMSC> eu root Admin |
How can we fix this problem?
PAMSC 14.1 Endpoint
You need to rebuild the database. Please refer
Rebuild the Privileged Access Manager Server Control Database
Before re-importing the exported rule file, please do the following
Modify the following line (add 'admin')
From
editusr ('root') auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE) |
To
editusr ('root') admin auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE) |
and also find any other editusr line against root user and remove. E.g. if you find the following at the bottom then remove the line
editusr root regular auditor ign_hol |
Then re-import and do 'migrate -w'.
Here are the detailed steps.
1. Reboot OS if 'secons -s' doesn't work to shutdown PAMSC, otherwise just run 'secons -s' to shutdown PAMSC
2. Backup the seosdb to a backup location, e.g. ~/Download/backup2 directory
[root@wsang-xxxxxxxxx bin]# cp -R /opt/CA/PAMSC/seosdb ~/Download/backup2 |
3. Export and migrate from the backup directory
[root@wsang-xxxxxxxxx bin]# cd ~/Download/backup2/seosdb |
4. Now, before re-importing the database into a new fresh seosdb, I need to modify exported rule file, i.e. export.txt. I use 'vi' to open the export.txt and search for 'root' related rules in the file.
I found the following line
editusr ('root') auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE) |
I have modified this line to
editusr ('root') admin auditor ign_hol audit(FAILURE LOGINSUCCESS LOGINFAILURE) |
I searched more and at the bottom I found
editusr root regular auditor ign_hol |
I have deleted this line. And I search more and I don't find any 'editusr root' related rule anymore. I have saved the file.
5. Now, I need to import the exported rules into a new fresh seosdb. First of all, create /opt/CA/PAMSC/seosd_new directory and create a fresh db
[root@wsang-xxxxxxxxx PAMSC]# mkdir seosdb_new |
6. Make sure you are in /opt/CA/PAMSC/seosd_new directory now and import the modified exported rule file.
[root@wsang-xxxxxxxxx seosdb_new]# ../bin/selang -l -d . -f ~/Download/backup2/seosdb/export.txt |
7. Do the migrate command
[root@wsang-xxxxxxxxx seosdb_new]# ../bin/dbmgr -migrate -w ~/Download/backup2/seosdb/migrate.txt |
8. Replace /opt/CA/PAMSC/seosdb with seosdb_new
[root@wsang-xxxxxxxxx seosdb_new]# cd .. |
9. Restart PAMSC and verify.