delegated permission software PowerBroker

[tom quach_1]

Hello all,

I am looking for a software that it could delegate permission to users or IT members on their daily duties.
i am checking one of the product called "PowerBroker" from Symark so far, but would like to know if there is any other choice.
if anyone has known or been using similar software. Please give me your opinion on this issue.
Regards,
Tom

[tom quach_1]

Sorry, forgot to mention my ENV
HP-UX 11.11

Regards,
Tom

[Bill Hassell]

PowerBroker is a well-known product and a lot of people use it on many different platforms. The alternative is sudo which can be downloaded from HP. Configuration can be a challenge at the beginning but once setup, maintenance is easy.

[tom quach_1]

Thank you Bill,
I am using Sudo now, Would you please give me some advantaces between two products. Sudo is free and PowerBroker costs few thousands.
is it worth to use POwerBroker than Sudo?

Regards,
TOm

[Bill Hassell · Accepted solution]

I haven't used PowerBroker directly but I am going to assume it offers multiple levels of delegation and authority, definitely a simpler interface than visudo/sudoers editing, and something sudo does not offer: restricted file access based on user's need to know or change. It can integrate with LDAP and has keystroke logging to monitor selected user sessions. And logs can be viewed with web pages.

This isn't a sales pitch, just reading the Symark web pages. Like sudo, setup and configuration will take a while and usefulness depends on how much definition is put into the alllowed/restricted config lists.

[Yang Qin_1]

Hi, Tom, we are using PowerBroker on our HPUX servers. It was installed for SOX audit.

1. If you have lots of Unix servers to be managed, it is much easier to use PowerBroker than use sudo. You just need a single configuration server to manage the access on all your Unix servers. It is, of course, a single point of failure. If your management server is not reachable, nobody can use PowerBroker on all other servers.

2. It logs everything (commands and output) per session with username as a part of the log file name. This is very helpful when people want to log ftp sessions. It will record all files to be transferred or deleted in a ftp session.

3. If it is not for the audit and you do not have a company policy saying don't use freeware. You can continue to use sudo and save some money for your company.


Yang

[PeterWolfe]

See the white papers section
of the PowerBroker site:

http://www.symark.com/white_papers.htm

for a comparision of PB to sudo.
(Note: Incredibly annoying. You have
to supply personal information
to get the whitepaper). What looks like the same
white paper is freely downloadable
here:

http://www.sans.org/reading_room/analysts_program/PowerBroker_Feb06.pdf?portal=68bef423eef12d37c1b6c4b2fdceff00

Note that Symark commissioned this
paper so read it with that in mind.

[tom quach_1]

Thank you for all info.
Regards,
Tom

[tom quach_1]

Thank you