Implementation Guide › Installing and Customizing a UNIX Endpoint › Regular Script Installations › How the install_base Script Works

How the install_base Script Works

The install_base script performs the following steps:

1. Asks you whether you want to change the default installation directory.
2. Displays the installation options you supplied and asks that you to confirm that you want to continue with the installation.
3. Extracts the data from the tar.Z file into the installation location (default or as specified by target_dir).
4. Different platforms cause different actions:
   • For Sun Solaris, the script adds the CA ControlMinder syscall script to the file /etc/name_to_sysnum. The original file is saved as /etc/name_to_sysnum.bak. It then creates the file /etc/rc2.d/S68SEOS that forms part of the boot sequence.
   • For IBM AIX, the script loads the SEOS_syscall script.
5. Allocates, initializes, and formats the CA ControlMinder database and builds the seos.ini file. The database files are placed in the ACInstallDir/seosdb directory (ACInstallDir is the CA ControlMinder installation directory.)
6. Determines if the machine is NIS+
   • If it is, it sets the nis_env token in the [passwd] section to nisplus
   • If it is not and the machine is NIS, it sets the token to nis.

     In addition, if rpc.nisd is running, the script sets the NisPlus_server token in the [passwd] section to yes.

7. Under supported 32-bit platforms Sun Solaris, IBM AIX, HP‑UX, and Linux, the script determines if the machine is running under NIS or DNS (using caching). If it is, the script automatically creates a lookaside database and sets two tokens in the [seosd] section of the seos.ini file to yes: under_NIS_server and use_lookaside.

   Note: On other platforms the script prompts you for whether you want to install a lookaside database and for the target installation directory.

8. Prompts you for the following additional information: (You can modify these settings any time after installation.)
   • The name for the group of auditors that can read the audit file.
   • Whether you want to add all your UNIX users, user groups, and hosts to the CA ControlMinder database now.
   • Whether you want your database to be subscribed to a PMDB; and if so, to which one.

     Your answer does not actually subscribe your database to a PMDB; it only lets the specified PMDB make updates to this database when you create the subscription later.

     Two safe responses to this question include:

A third response, _NO_MASTER_ , allows your database to be subscribed to any PMDB. However, this can be a dangerous response, because it removes the selection of the PMDB from your control.

• The password Policy Model name.
• What users will be security administrators for CA ControlMinder.
• Whether you want CA ControlMinder to support enterprise users; and if so, whether you want to define any as security administrators.
• If you chose a FIPS-only installation, whether you want to specify FIPS-only options related to encryption.
• If you did not choose FIPS-only encryption, whether you want to replace the default encryption method.

  CA ControlMinder provides you with symmetric, public key, and a combination of the two as encryption options that you can choose.

• If you choose public key encryption, CA ControlMinder lets you specify how you want to provide the subject certificate and root certificate.

  Depending on your choices, CA ControlMinder helps you set up SSL.

• If you choose symmetric encryption, whether you want to set a new encryption key.

  Note: See sechkey in the Reference Guide for information about encryption.

• Whether you want to install the Baseline Security rules.

  Baseline Security rules offer administrators an opportunity to install a package containing two sets of rules to better protect your system, password and log files. One set of rules applies to all platforms to protect CA ControlMinder files. The other set protects UNIX files and is specific to the Sun Solaris, HP-UX, IBM AIX, and Digital DEC UNIX platforms. You cannot install one set of rules without the other. Baseline Security rules install in Warning mode providing you with information but not actual protection. That is why we recommend that you remove the Warning mode as soon as you become familiar with the rules.

• Whether you want to be able to start CA ControlMinder from a remote host.
• Whether you want to enable the Report Agent, and if so, whether you want to enable CA User Activity Reporting.

  The Report Agent sends scheduled snapshots of the database to the Message Queue. You must define the Distribution Server host name, the port to use, and the queue name if you enable the Report Agent. If you enable CA User Activity Reporting, you can also specify to keep time-stamped backups of the audit log file.

• Whether you want to enable the SAM Agent.

  The SAM Agent configures the local computer for SAM, so that you can obtain privileged account passwords from this computer. You must define the Distribution Server host name, the port to use, and the queue name if you enable the SAM Agent.

• Whether you want to set up this endpoint for advanced policy management; and if so, the Distribution Host (DH) name to send calculation deviation results to.

  Define the DH host name using the format dhName@hostName For example, if you installed the Distribution Server on a host named host123.comp.com, you should use the following: DH__@host123.comp.com