5.8

n RunHigh. Owner root, group cfgsoft, mode r-sr-x---
n RunLow. Owner csi_acct, group csi_acct, mode r-xr-s---
n RunRemote. Owner root, group cfgsoft, mode r-sr-x---
If permissions are correct, check DBE files for errors stating that RunHigh, RunLow, or RunRemote failed.
See "Run Executable Logging" on page 77 for information about the level of error logging.
Run Executable Logging
If RunHigh, RunLow, or RunRemote fails, the executable file logs errors of type auth.err to syslog as
follows.
n (Linux) /var/log/secure
n (Solaris) /var/adm/messages
n Wherever these message types are configured to be logged as set up in /etc/syslog.conf
The error messages only say that the executable program failed. The messages deliberately avoid details
about the failure so that a hacker cannot use the information to design an attack that defeats the security
of the program.
To get detailed messages, rebuild RunHigh, RunLow, and RunRemote with more logging enabled. Search
for a commented-out syslog entry in the code, remove the comment markers, and rebuild the programs.
Detailed logging creates messages in syslog that have an error code, which VCM engineering uses to
trace to a source file and determine the cause of the failure.
Account and Group Configuration
The Collector might report that the job succeeded, but no data appears. For data to appear, the three
executable files in /opt/CMAgent/ECMu/x.x/bin need accounts and groups to be configured.
NOTE If the installation creates the accounts and groups, the uninstall process removes them. It the
accounts and groups were preexisting, the uninstall process does not remove them.
n The csi_acct user account. Must be properly created and cannot have a shell that permits logins. The
shell for csi_acct must be listed under the CSIRegistry NoLoginShells, and the no login shell must
exist on the Agent machine.
n The csi_acct group. By default, the primary group for the csi_acct user is the csi_acct group.
Like the csi_acct user account name, the group name can be changed during Agent installation if you
want to use another name or an existing group. Using an existing group might create a security risk
depending on the existing group privileges. Use a group that has no elevated permissions, like the
standard nobody group.
n The cfgsoft group. Must be created and have this exact name. The csi_acct user must be a
member of the cfgsoft group, but the cfgsoft group should not be the primary group for csi_
acct.
When troubleshooting the setuid binary files, check nsswitch.conf to confirm that all user lookups are
going to the files first. If they are not, the accounts might need to be created in your environment (for
example: YP, LDAP, or Active Directory). A common problem is that the user account is partially created
in the cloud, so the security checks fail. If none of the user information is in the cloud, the secondary check
to files should work properly.
VCM UNIX Agent
VMware, Inc.
77