Portal Administration for Linux

Introduction

This topic describes several key areas of the Admin Portal that can be used to manage Linux Settings and Linux Sub Settings. Fields that can be set and/or configured in the portal are presented in tables, with each table showing:

  • Setting - the name of the field that controls the setting

  • Type - the type of value that can be entered or selected and its default value

  • Description - how the setting is used and notes about any implications it may have on other settings

To change any of the settings in the portal, log in to the portal and select the setting from the menu.

In this topic

Run As Admin Settings

Admin Session Settings

Lockdown Settings

Pre-Approval Settings

File Blocking Settings

Privacy Settings

Entra ID Support

Preventing Abuse

Policies for Linux

Supplementary Technical Information

Run As Admin Settings

Portal menu: Settings > Workstation Settings > Mac Settings > Authorization > AUTHORIZATION

Admin Session Settings

Portal menu: Settings > Workstation Settings > Mac Settings > Authorization > AUTHORIZATION

Changing Admin Session Duration

Admin session duration (access time) is the maximum amount of time in minutes an Admin Session may last. This time must be sufficient for the user to install software or perform any other necessary tasks.

To change the time allocated for an administrator session:

  1. Log in to the Portal and select menu Settings > Linux Settings.

  2. From the Authorization left menu, make sure the AUTHORIZATION tab is displayed (it is the default) and update the Access time (minutes) field in the Admin Session panel:

  3. Click Save when done.

Lockdown Settings

The Lockdown menu allows control over the following settings:

  • Admin Rights

  • Sudo

  • Root

Admin Rights

Portal menu: Settings > Workstation Settings > Linux Settings > Lockdown > ADMIN RIGHTS

Sudo

Portal menu: Settings > Workstation Settings > Linux Settings > Lockdown > SUDO

Root

Portal menu: Settings > Workstation Settings > Linux Settings > Lockdown > ROOT

Pre-Approval Settings

Portal menu: Settings > Workstation Settings > Linux Settings > App Control > PRE-APPROVE

Pre-Approval (known sometimes as Whitelisting) refers to the method of working out which applications are trusted and frequently used, and adding them to a list that automatically allows users to elevate those applications when they need to. This is essentially the opposite of Blocklisting/Blacklisting – creating a list of applications that cannot be elevated.

This method of “allow most, deny some” has proven to be extremely resource-efficient for large enterprises compared to the method of denying all applications and only allowing elevations on a case-by-case basis.

Admin By Request allows for quick pre-approval of trusted applications from the Auditlog. Pre-Approval is based on the application vendor or checksum, visible when the Application Control screen is displayed (step 3 below).

Once an application has been installed on an endpoint with Admin By Request:

  1. Log in to the portal and navigate to the application’s corresponding entry in the portal Auditlog.

  2. Expand on the application entry, and select Pre-approve this file under Actions:

  3. On the Application Control screen, modify any settings as required. For more information on pre-approval settings, refer to the Settings Table below.

  4. Click Save verify that the app has been added to the list of pre-approved applications.

For example, the following applications are pre-approved:


File Blocking Settings

You can specify programs and applications that you wish to prevent users from executing with administrator privileges. You can block applications based on one or more of the conditions: file name, checksum, vendor or file location.

NOTE:

You should never block solely based on the file name, as this will open up the endpoint to simple file renaming to bypass the blocking.

PIN code exceptions: The option is available to use a PIN code in case you allow the execution as an exception - simply retrieve the PIN code from the computer's inventory. If you do not wish to offer a PIN option, you can disable this under the Run As Admin tab.

Defining a blocked application:

Type:

  • Block file from running as administrator

  • Block vendor files from running as admin (digital certificate)

  • Block location from running as admin (all files in folder tree)

  • Block always

Condition:

  • No condition (block always)

  • Block if located in directory

  • Block if matching digital certificate

  • Block if matching checksum

Application name is a label only - used for convenience in the overview list.

File name allows you to point to a file name that will be blocked from executing. You can specify wildcards in the file name, such as *.sh.

Blocking message will appear as a denial message to the user when execution of the application is attempted.

Privacy Settings

Portal menu: Settings > Workstation Settings > Mac Settings > Data > PRIVACY

Entra ID Support

NOTE:

Azure AD has been renamed by Microsoft to Entra ID. This version of the site pages uses both terms interchangeably, but future versions will refer to Entra ID only.

A huge selling point for the Admin By Request PAM solution is its flexibility and tools for granular access control; organizations can configure every setting to their specific needs and the needs of all, some, or even individual users.

Settings act as rules, such as whether the Run as Admin or Admin Session features are enabled, and whether or not users need approval to use them. You likely wouldn’t want the rules applied for an IT Administrator to be the same as those applied for a Customer Relations employee, so settings can be differentiated based on Sub-Settings, which allow different rules to be applied to different users and/or groups.

For all the clients, we’ve built in support for Entra ID groups, meaning you can now apply Sub-Settings to existing Entra ID / Azure AD user and device groups.

For more information, refer to Tenant Settings.

For more information on the Entra ID / Azure AD feature, refer to Features > Azure AD Connector.

Preventing Abuse

So what prevents the user from abusing an Admin Session? The fact that the user has to ask IT for access will in itself prevent the most obvious abuse. But as part of your settings, you can also configure a Code of Conduct page. Here you customize wording that suits your company policy. For example, what the penalty is for using the administrator session for personal objectives. You can also choose to explain the things you can monitor from the portal.

When you enable the Code of Conduct ("instructions") screen in the settings, this screen appears right before the administrative session starts. You can also customize company name and logo for all screens, so there is no doubt this message is authentic and indeed from the user’s own company. This is the configuration part of the portal, where you set authorization, company logo, policies, email communications, etc:

Policies for Linux

Settings in the Admin By Request client application are controlled under “Linux Settings” in the Settings menu, when logged in to the portal. If, for whatever reason, you want to overrule these settings on specific clients, you can set overruling policies in a policy file.

IMPORTANT:

Please note we do not recommend that you use a policy file to control client behavior. Instead, we recommend that you use portal settings and sub settings for better transparency and for real-time control of computers not connected to your LAN.

If you have any questions about portal settings or would like a demo of these, please feel free to contact us.

Supplementary Technical Information

This section provides more information on the following: