# Integrating SailPoint with Linux Connecting SailPoint to your Linux system allows you to enable user to manage their Linux Account, Groups, and other resources. Linux system data is aggregated and users can edit entities and their attributes. > [!IMPORTANT] > > The Linux connector no longer supports the Ubuntu 16.04 LTS version. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. The SailPoint Linux connector supports the following features. - Load and \*provision Linux accounts - \*Access Certifications (certification of entitlements connected to accounts) - \*Password management - Delete accounts For more information on features, refer to [Source Features](). ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ## Supported Managed Systems The Linux connector supports the following managed system versions: - Ubuntu OS versions 20.04 and 22.04 LTS - Red Hat Enterprise Linux versions 8.5, 8.8, 9.1, and 9.2 - SUSE Linux Enterprise Server 15, 12, and 11 - Federal Information Processing Standard (FIPS) support with Red Hat Enterprise Linux version 9.2 > [!NOTE] > > For any issues related to SUSE Linux, refer to the [Troubleshooting]() section. ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). Consider the following before configuring the Linux connector. - SSH should be installed on the Linux computer - Aggregate the sudo user's permissions: - The administrator user must have rights to execute the `/usr/bin/awk` command. Update the `/etc/sudoers` file entry for the administrator user with the `/usr/bin/awk` command. - Add new multi-valued schema attributes to the accounts and entitlement schemas as `sudoCommands`, which collect all the necessary user commands and stores them as a part of the attribute. - If you need to aggregate the `sudoCommands` from multiple sudo files, then you must provide a list of files as a separate configuration attribute. Separate each sudo file in the command with a comma (`,`). For example: - key - `sudoCmdFiles` - value - `/etc/sudoers.d/special_user.conf,/etc/sudoers.d/special_group.conf` The default command which collects the sudo commands is as follows: ```text awk '/^[^#]/' /etc/sudoers ``` In the above command, the commented lines are skipped and the remaining content of the `/etc/sudoers` file are aggregated in to a temporary file on the Linux computer. If you want to provide a new command for aggregating file data, then you can configure it as a part of the application XML file. For example: ```text key: sudoUserCommand and value : awk '/^[^#]/' /etc/sudoers ``` - For Red Hat Enterprise Linux version 9.1 and later, ensure that service account has **Bracketed paste mode** disabled. To disable the bracketed paste mode for a specific user, add the following line to `~/.inputrc`: ```text set enable-bracketed-paste off ``` ## Required Permissions - You can use a root user for managing your applications, however SailPoint recommends that you use a minimum permission user. For example, configure a sudo user to manage your applications. - If you want to use a sudo user to perform the operations, you must configure the sudo user with the rights and permissions to execute the following commands: ```text /usr/sbin/useradd, /usr/sbin/usermod, /usr/sbin/userdel, /usr/sbin/groupadd, /usr/sbin/groupmod, /usr/sbin/groupdel, /usr/bin/passwd, /usr/bin/faillog, /usr/bin/groups, /bin/rm -f spt_tmp_*, /bin/echo, /usr/bin/chage, /bin/cat /etc/shadow, /bin/cat /etc/passwd, /bin/cat /etc/group, /bin/cat /etc/pam.d/system-auth, /usr/bin/getent, /bin/grep, /usr/bin/awk, /usr/bin/id, /usr/bin/lastlog, /usr/sbin/pam_tally2, /sbin/pam_tally2, /bin/cat /etc/pam.d/password-auth, /bin/cat /etc/pam.d/common-account, /bin/cat /etc/pam.d/common-auth, /usr/bin/printf, /usr/sbin/faillock, /bin/cat /etc/security/faillock.conf ``` An entry in `/etc/sudoers` file must look similar to the following: ```text username ALL = (root) PASSWD: /bin/chmod, /usr/sbin/useradd, /usr/sbin/usermod, /usr/sbin/userdel, /usr/sbin/groupadd, /usr/sbin/groupmod, /usr/sbin/groupdel,/usr/bin/passwd, /usr/bin/faillog, /usr/bin/groups, /bin/rm -f spt_tmp_*, /bin/echo, /usr/bin/chage, /bin/cat /etc/shadow, /bin/cat /etc/passwd, /bin/cat /etc/group, /bin/cat /etc/pam.d/system-auth, /usr/bin/getent, /bin/grep, /usr/bin/awk, /usr/bin/id, /usr/bin/lastlog, /usr/sbin/pam_tally2, /sbin/pam_tally2, /bin/cat /etc/pam.d/password-auth, /bin/cat /etc/pam.d/common-account, /bin/cat /etc/pam.d/common-auth, /usr/bin/printf, /usr/sbin/faillock, /bin/cat /etc/security/faillock.conf ``` > **Note** > > - All commands mentioned above are for the default configuration. If any of the commands are modified in the application definition, then you should also make similar changes in the `/etc/sudoers` file entry. > - Verify the command paths on Linux computers as they might differ from the values mentioned here. > - If you want to use a sudo user to handle provisioning operations, ensure that you grant them the proper write access for the home directory. If the sudo user is using the Guest home directory, then ensure it has proper write access for that directory as well. > - `/bin/chmod` permission is not required as SailPoint Linux connector does not support target collector. ### Read Only Permissions If you want to use the sudo user to perform read only operations, the sudo user must be configured with the following rights and permissions: > [!NOTE] > > **For Account Aggregation only** > > Rights to execute the following commands with root privilege: > > ```text > /bin/echo, /bin/cat /etc/group, /bin/rm -f spt_tmp_*, /bin/cat /etc/passwd, > /bin/grep, /bin/cat /etc/shadow, /bin/cat /etc/pam.d/system-auth, /bin/cat > /etc/pam.d/password-auth, /usr/bin/faillog, > /usr/sbin/pam_tally2, /sbin/pam_tally2, /usr/bin/lastlog, /usr/bin/awk, > /usr/sbin/faillock, /bin/cat /etc/security/faillock.conf > ``` > > > **Note** > > > > For a Linux server configured with `pam_tally2` and `Faillock`, the following permissions are required: > > > > - **pam\_tally2** - `/usr/sbin/pam_tally2`, `/sbin/pam_tally2` > > - **Faillock** - `/usr/sbin/faillock`, `/bin/cat /etc/security/faillock.conf` > > An entry in `/etc/sudoers` file must look similar to the following: > > ```text > username ALL = (root) PASSWD: /bin/echo, /bin/cat /etc/group, /bin/rm -f spt_tmp_*, /bin/cat /etc/passwd, /bin/grep, /bin/cat /etc/shadow, /bin/cat /etc/pam.d/system-auth, /bin/cat /etc/pam.d/password-auth, /usr/bin/faillog, /usr/sbin/pam_tally2, /sbin/pam_tally2, /usr/bin/lastlog, /usr/bin/awk > ``` > [!NOTE] > > **For Entitlement Aggregation only** > > Rights to execute the following commands with root privilege: > > ```text > /bin/echo, /bin/ cat /etc/group, /bin/rm -f spt_tmp_*, /bin/grep > ``` > > An entry in `/etc/sudoers` file must look similar to the following: > > ```text > username ALL = (root) PASSWD: /bin/echo, /bin/ cat /etc/group, /bin/rm -f spt_tmp_*, /bin/grep > ``` > > > **Note** > > > > If any of the commands are modified in the application definition, then you should also make similar changes in the `/etc/sudoers` file entry. Verify the command paths on Linux computers as they might differ from the values mentioned here. > [!NOTE] > > **For Test Aggregation only** > > Add below permission for read operations only like (Test, Connection, Account Aggregation, Group Aggregation and single account aggregation): > > ```text > newuser1 ALL= PASSWD: /usr/bin/awk, /bin/rm -f spt_tmp_*, /bin/cat /etc/shadow, /bin/cat /etc/passwd, /bin/cat /etc/group, /bin/grep, /bin/echo > ``` ### Supported Authentication Methods The Linux connector supports username and password authentication for root and sudo users. ## Upgrade Considerations This page provides information you need to consider when using different versions of SailPoint. ### 2023 > [!NOTE] > > **December** > > Linux does not support SCP transport protocol, and instead recommends that you use SFTP. Where applicable, new Linux sources have SFTP protocol selected by default. However, if your organization requires it, you can select SCP. There is no negative impact on existing sources which use SCP.