{"id":765,"date":"2017-08-22T02:45:19","date_gmt":"2017-08-21T19:45:19","guid":{"rendered":"https:\/\/trichev.com\/blog\/?p=765"},"modified":"2017-08-22T02:47:51","modified_gmt":"2017-08-21T19:47:51","slug":"powerbroker-identity-services-open","status":"publish","type":"post","link":"https:\/\/trichev.com\/blog\/2017\/08\/22\/powerbroker-identity-services-open\/","title":{"rendered":"PowerBroker Identity Services Open"},"content":{"rendered":"

Download link: https:\/\/github.com\/BeyondTrust\/pbis-open\/releases<\/a><\/p>\n

PBIS AD membership, basic setup for Linux (RPM)<\/strong><\/p>\n

#UnattendedMode
\n.\/pbis-open-8.5.4.334.linux.x86_64.rpm.sh install<\/code><\/p>\n

\/opt\/pbis\/bin\/domainjoin-cli join --assumeDefaultDomain yes your.domain.com yourname <\/code><\/p>\n

# cat < \/etc\/pbis.conf
\nrem AD domain: YOUR
\nAssumeDefaultDomain true
\nHomeDirTemplate \"%H\/%D\/%U\"
\nLoginShellTemplate \"\/bin\/bash\"
\nRemoteHomeDirTemplate \"\"
\nCacheEntryExpiry \"00000060\"
\nEOT<\/code><\/p>\n

\/opt\/pbis\/bin\/config --file \/etc\/pbis.conf<\/code><\/p>\n

\/opt\/pbis\/bin\/update-dns<\/code><\/p>\n

Login\/Server Access Rights<\/strong><\/p>\n

In the \/etc\/pbis.conf file, before HomeDirTemplate, add or modify a new line beginning ‘RequireMembershipOf’. RequireMembershipOf specifies a comma separated list of AD groups – To login to the system the user must belong to one of the listed groups eg:
\nRequireMembershipOf \"your\\\\group1\" \"your\\\\group2\"<\/code><\/p>\n

To apply a new configuration, you need to run \/opt\/pbis\/bin\/config –file \/etc\/pbis.conf manually.<\/p>\n

SUDO Rights<\/strong><\/p>\n

Use the visudo command, and add the name of the AD group, prefixed with % using standard sudoers syntax: eg:
\n%group1 ALL=(ALL) ALL<\/code><\/p>\n

PBIS Utilities<\/strong><\/p>\n

A number of useful scripts are available in the \/opt\/pbis\/bin directory. Most of these scripts are self documenting and support eg, the –help argument.
\n\/opt\/pbis\/bin\/get-status ; show ad connection\/status information
\n\/opt\/pbis\/bin\/find-user-by-name ; lookup an ad user by name.
\n\/opt\/pbis\/bin\/find-group-by-name ; lookup an ad group by name.
\n\/opt\/pbis\/bin\/list-groups-for-user [–level=2] ; show group membership for a user.<\/p>\n

There are lots of useful scripts in this directory, it’s worth exploring.<\/p>\n

Delegate rights using Active Directory Users and Computers for PBIS computer join user<\/strong><\/p>\n

This process allows a specific user\/group to manage a group, or a section of the AD tree.
\n1.Open the Active Directory Users and Computers snap-in.
\n2.Right-click the container under which you want the computers added, and press Delegate Control.
\n3.Press Next.
\n4.Press Add.
\n5.After adding all the users and\/or groups, press Next.
\n6.Select Create custom task to delegate and press Next.
\n7.Select Only the following objects in the folder, check Computer objects, check the “Create selected objects in this folder”, “Create selected objects in this folder” boxes, and press Next.
\n8.Check the “Create all child object”, “Delete all child object” boxes and press Next.
\n9.Press Finish.<\/p>\n

ISSUES<\/strong><\/p>\n

If pbis just stopped working and you get “Error: ERROR_FILE_NOT_FOUND code 0x00000002” after “service lwsmd restart”, remove it completely:
\n\/opt\/pbis\/bin\/domainjoin-cli leave
\n\/opt\/pbis\/bin\/uninstall.sh uninstall<\/code><\/p>\n

and reinstall\/reconfigure<\/p>\n

pbis-open-8.5.4.334.linux.x86_64.rpm.sh install \/opt\/pbis\/bin\/domainjoin-cli join --assumeDefaultDomain yes your.domain.com yourname<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

Download link: https:\/\/github.com\/BeyondTrust\/pbis-open\/releases PBIS AD membership, basic setup for Linux (RPM) #UnattendedMode .\/pbis-open-8.5.4.334.linux.x86_64.rpm.sh install \/opt\/pbis\/bin\/domainjoin-cli join –assumeDefaultDomain yes your.domain.com yourname # cat < \/etc\/pbis.conf rem AD domain: YOUR AssumeDefaultDomain true HomeDirTemplate “%H\/%D\/%U” LoginShellTemplate “\/bin\/bash” RemoteHomeDirTemplate “” CacheEntryExpiry “00000060” EOT \/opt\/pbis\/bin\/config –file \/etc\/pbis.conf \/opt\/pbis\/bin\/update-dns Login\/Server Access Rights In the \/etc\/pbis.conf file, before HomeDirTemplate, add or modify […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[231],"tags":[32,240,241,14,11],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/765"}],"collection":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/comments?post=765"}],"version-history":[{"count":4,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/765\/revisions"}],"predecessor-version":[{"id":769,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/765\/revisions\/769"}],"wp:attachment":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/media?parent=765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/categories?post=765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/tags?post=765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}