Integrating SailPoint with Linux

Connecting SailPoint to your Linux system allows you to enable user to manage their Linux Account, Groups, and other resources. Linux system data is aggregated and users can edit entities and their attributes.

Supported Features

The SailPoint Linux connector supports the following features.

• Load and *provision Linux accounts
• *Access Certifications (certification of entitlements connected to accounts)
• *Password management
• Delete accounts

For more information on features, refer to Source Features.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

For more information, refer to Managing Privilege Classification.

Supported Managed Systems

The Linux connector supports the following managed system versions:

• Ubuntu OS versions 20.04 and 22.04 LTS
• Red Hat Enterprise Linux versions 8.5, 8.8, 9.1, and 9.2
• SUSE Linux Enterprise Server 15, 12, and 11
• Federal Information Processing Standard (FIPS) support with Red Hat Enterprise Linux version 9.2

Prerequisites

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

Consider the following before configuring the Linux connector.

• SSH should be installed on the Linux computer

• Aggregate the sudo user's permissions:

  • The administrator user must have rights to execute the /usr/bin/awk command.

    Update the /etc/sudoers file entry for the administrator user with the /usr/bin/awk command.

  • Add new multi-valued schema attributes to the accounts and entitlement schemas as sudoCommands, which collect all the necessary user commands and stores them as a part of the attribute.

    • If you need to aggregate the sudoCommands from multiple sudo files, then you must provide a list of files as a separate configuration attribute. Separate each sudo file in the command with a comma (,).

      For example:

      • key - sudoCmdFiles
      • value - /etc/sudoers.d/special_user.conf,/etc/sudoers.d/special_group.conf

      The default command which collects the sudo commands is as follows:

      awk '/^[^#]/' /etc/sudoers
      

      In the above command, the commented lines are skipped and the remaining content of the /etc/sudoers file are aggregated in to a temporary file on the Linux computer.

      If you want to provide a new command for aggregating file data, then you can configure it as a part of the application XML file.

      For example:

      key: sudoUserCommand and value : awk '/^[^#]/' /etc/sudoers
      

• For Red Hat Enterprise Linux version 9.1 and later, ensure that service account has Bracketed paste mode disabled.

  To disable the bracketed paste mode for a specific user, add the following line to ~/.inputrc:

  set enable-bracketed-paste off
  

Required Permissions

• You can use a root user for managing your applications, however SailPoint recommends that you use a minimum permission user. For example, configure a sudo user to manage your applications.

• If you want to use a sudo user to perform the operations, you must configure the sudo user with the rights and permissions to execute the following commands:

  /usr/sbin/useradd, /usr/sbin/usermod, /usr/sbin/userdel,
  /usr/sbin/groupadd, /usr/sbin/groupmod, /usr/sbin/groupdel, /usr/bin/passwd,
  /usr/bin/faillog, /usr/bin/groups, /bin/rm -f spt_tmp_*, /bin/echo,
  /usr/bin/chage, /bin/cat /etc/shadow, /bin/cat /etc/passwd,
  /bin/cat /etc/group, /bin/cat /etc/pam.d/system-auth, /usr/bin/getent, /bin/grep,
  /usr/bin/awk, /usr/bin/id, /usr/bin/lastlog, /usr/sbin/pam_tally2,
  /sbin/pam_tally2, /bin/cat /etc/pam.d/password-auth, /bin/cat
  /etc/pam.d/common-account, /bin/cat /etc/pam.d/common-auth, /usr/bin/printf,
  /usr/sbin/faillock, /bin/cat /etc/security/faillock.conf
  

  An entry in /etc/sudoers file must look similar to the following:

  username ALL = (root) PASSWD: /bin/chmod, /usr/sbin/useradd, /usr/sbin/usermod,
  /usr/sbin/userdel, /usr/sbin/groupadd, /usr/sbin/groupmod,
  /usr/sbin/groupdel,/usr/bin/passwd, /usr/bin/faillog, /usr/bin/groups, /bin/rm -f
  spt_tmp_*, /bin/echo, /usr/bin/chage, /bin/cat /etc/shadow,
  /bin/cat /etc/passwd, /bin/cat /etc/group, /bin/cat /etc/pam.d/system-auth,
  /usr/bin/getent, /bin/grep, /usr/bin/awk, /usr/bin/id, /usr/bin/lastlog,
  /usr/sbin/pam_tally2, /sbin/pam_tally2, /bin/cat /etc/pam.d/password-auth,
  /bin/cat /etc/pam.d/common-account, /bin/cat /etc/pam.d/common-auth,
  /usr/bin/printf, /usr/sbin/faillock, /bin/cat /etc/security/faillock.conf
  

  Note

  • All commands mentioned above are for the default configuration. If any of the commands are modified in the application definition, then you should also make similar changes in the /etc/sudoers file entry.
  • Verify the command paths on Linux computers as they might differ from the values mentioned here.
  • If you want to use a sudo user to handle provisioning operations, ensure that you grant them the proper write access for the home directory. If the sudo user is using the Guest home directory, then ensure it has proper write access for that directory as well.
  • /bin/chmod permission is not required as SailPoint Linux connector does not support target collector.

Read Only Permissions

If you want to use the sudo user to perform read only operations, the sudo user must be configured with the following rights and permissions:

/bin/echo, /bin/cat /etc/group, /bin/rm -f spt_tmp_*, /bin/cat /etc/passwd,
/bin/grep, /bin/cat /etc/shadow, /bin/cat /etc/pam.d/system-auth, /bin/cat
/etc/pam.d/password-auth, /usr/bin/faillog,
/usr/sbin/pam_tally2, /sbin/pam_tally2, /usr/bin/lastlog, /usr/bin/awk,
/usr/sbin/faillock, /bin/cat /etc/security/faillock.conf

username ALL = (root) PASSWD: /bin/echo, /bin/cat /etc/group, /bin/rm -f spt_tmp_*, /bin/cat /etc/passwd, /bin/grep, /bin/cat /etc/shadow, /bin/cat /etc/pam.d/system-auth, /bin/cat /etc/pam.d/password-auth, /usr/bin/faillog, /usr/sbin/pam_tally2, /sbin/pam_tally2, /usr/bin/lastlog, /usr/bin/awk

/bin/echo, /bin/ cat /etc/group, /bin/rm -f spt_tmp_*, /bin/grep

username ALL = (root) PASSWD: /bin/echo, /bin/ cat /etc/group, /bin/rm -f spt_tmp_*, /bin/grep

newuser1 ALL= PASSWD: /usr/bin/awk, /bin/rm -f spt_tmp_*, /bin/cat /etc/shadow, /bin/cat /etc/passwd, /bin/cat /etc/group, /bin/grep, /bin/echo

Supported Authentication Methods

The Linux connector supports username and password authentication for root and sudo users.

Upgrade Considerations

This page provides information you need to consider when using different versions of SailPoint.

2023

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.