Using Cloud Client Commands

This section covers commands that you can use on systems where you have installed the Cloud Client. Most commands work the same on Windows and Linux; any differences for operating systems are noted. For details about each command, click the command name to go to the relevant section.

Each command generates a log file at /var/log/ (Linux) or C:\ProgramData\Centrify\Logs (Windows).

cdebug

Use this command to control and check the logging detail level. You can also empty the log file as part of your log rotation process.

Log files are located at /var/log/cagent.log (Linux) or C:\ProgramData\Centrify\Logs (Windows).

Root or Administrator privilege required? Yes

Usage:

cdebug [on | off | clear | status | set <debug_level>
<debug_level> can be TRACE, DEBUG, INFO, WARN, ERROR, DISABLED

Examples:

PS C:\Users\administrator.cloud> cdebug set TRACE
    Debug logging is on. Verbose tracing is on.

PS C:\Users\administrator.cloud> cdebug status
    Debug logging is on. Verbose tracing is on.

cdelaccount

The cdelaccount command deletes the domain, database, or managed local account from Delinea PAS. The local account remains intact. After you remove an account from Delinea PAS, you can't check out the password or use Delinea PAS to rotate the password.

In order to use this command, the system must have the AAPM feature enabled.

If you delete an account from Delinea PAS, you must manage the password yourself for the local account. It's recommended that you either save or copy the password manually or change the password after you've deleted the account.

Root or Administrator privilege required? Yes

Usage:

cdelaccount [-hsVv] [-u, --username __username__] \<account\>

Examples:

# cdelaccount frodo
Caution: Deleting an account means we will no longer know the password. You must make note of it.
Continue to proceed will make the password available and commit the deletion.
Do you want to proceed? (y/n) [n]: y
Getting account password before deletion...
Password for frodo: OneRingToRuleThemAll%#
Account deleted. Save the password to avoid account lockout.

cdiag

Use the cdiag command to check configuration settings to diagnose any potential issues with the Cloud Client. The cdiag command checks the connection between the client and the platform and also checks if system settings such as PAM or NSS are configured correctly on Linux clients when corresponding features are enabled. You can run this command before, during, or after enrollment.

Run the cdiag command if the Cloud Client has any expected functionalities that aren't working, for example.

On Windows, this is a PowerShell script.

Root or Administrator privilege required? Yes

Usage:

cdiag -t __tenanturl__ [-dpnV]

cdiag -t __tenanturl__ -v

cdiag -t __tenanturl__ -h

Examples: cdiag -t abc1234.my.centrify.net

cedit

You can use the cedit command to view, edit, or reset specific Cloud Client configuration parameters. For details about which parameters you can edit, see Customizing Cloud Client Parameters.

Root or Administrator privilege required? Yes if you're editing or resetting a parameter value.

Usage:

cedit [-hlqv] [-g <key>] [-r <key>] [-s <key>:<value>]

Examples:

PS C:\Users\administrator.cloud> cedit -l
                FeatureAAPMEnabled: true
                FeatureAgentAuthEnabled: true
                FeatureDMCEnabled: true
                LogLevel: TRACE
                ProxyURL: http://xx.xx.xx.xx:8080
                ServiceURI: https://abc1234.my.centrify.net/
                agent.tcprelay.proxy: http://xx.xx.xx.xx:8080

PS C:\Users\administrator.cloud> cedit -s LogLevel:WARN
                Parameter successfully updated.
            
PS C:\Users\administrator.cloud> cedit -g LogLevel
                WARN

cenroll

Use the cenroll command to enroll the system into Delinea PAS and thereby add the new vaulted system to Delinea PAS. You can also use the cenroll command to update a profile of an existing system that's already enrolled.

In general, the required parameters are:

• --features
• --tenant
• either --code or --username (an authentication mechanism —- either an enrollment code or a user with the "System Enrollment" administrative right in Delinea PAS)

Parameters that you might use frequently are:

• agentauth permission to be assigned to a role (-l)
• Proxy configuration (-p)
• Connector assignment (-S Connectors:value)
• Suffix for the hostname in Delinea PAS (-x)

Root or Administrator privilege required? Yes

Usage:

cenroll [-fhVv] [-a <IP/DNS name>] [-C] [-c <code>] [-F value] [-l<role1>[,<role2>...,<roleN>]] [-n <name>] [-N <name>] [-O <key:value>] [-o <file>] [-p <proxyURL>] [-P [user:|role:]<name>:<right>[,<right2>,...,<rightN>]] [-S <key:value>] [-s <file>] [-t<url>] [-u <username>] [-w <role>] [-x <suffix>] [-Z <set1>[,<set2>...,<setN>]]

Examples:

[EXAMPLE: to enroll a system with all features enabled into the specified tenant using an enrollment code]
[root@mylinux ~]# cenroll --force --features=all --tenant=abc1234.my.centrify.net --code=PUTTHEENROLLMENTCODEHERE
            Enrolling in https://abc1234.my.centrify.net/ ...
            Centrify agent started.
            Enabled features: AgentAuth, AAPM, DMC
            Enrollment complete.
            
[EXAMPLE: To add a local computer to the Privileged Access Service using a specified user account]
[root@mylinux ~]# cenroll --tenant=abc1234.my.centrify.net --user wily@acme --features aapm,agentauth --agentauth "Authorized Agent Login"


[EXAMPLE: To add the computer using a specific IP address and computer name]
[root@mylinux ~]# cenroll -t abc1234.my.centrify.net -u wily@acme -n rhel9.mydomain.com -a 123.45.67.890


[EXAMPLE: To add the computer and enable all features and use a web proxy]
[root@mylinux ~]# cenroll -F all -f -t abc1234.my.centrify.net -c PUTTHEENROLLMENTCODEHERE -l linuxadmins -p http://12.3.4.56:8080


[EXAMPLE: To add the computer and enable AAPM ]
[root@mylinux ~]# cenroll -F AAPM -f -t -abc1234.my.centrify.net -c PUTTHEENROLLMENTCODEHERE -l linuxadmins


[EXAMPLE: To enroll a computer with username and password instead of an enrollment code]
[root@mylinux ~]# 
cenroll -F all -f -t abc1234.my.centrify.net -u  -u pasadmin@example.com -l linuxadmins



[EXAMPLE: To allow the public network access for this computer and to perform periodic password rotation on the accounts associated with this
computer every 30 days, specify these policies on the command line]
[root@mylinux ~]# cenroll -O "AllowRemote:true" -O "AllowPasswordRotation:true" -O "PasswordRotateDuration:30"


[EXAMPLE: Alternatively, you could use a text editor to create a "policy.conf" file with settings:]
AllowRemote:true
AllowPasswordRotation:true
PasswordRotateDuration:30



[After defining the policies in the "policy.conf" file, run the cenroll command and refer to the policy.conf file:]
[root@mylinux ~]# cenroll --resource-policy-file /tmp/policy.conf


[EXAMPLE: enroll with Use My Account credentials]
cenroll -F agentauth -t tenant> -c <code> -l <agentauth_role> -S CertAuthEnable:true -S AllowRemote:true  -S Connectors:<name>

[NOTE: Using the cenroll command depends on the user in PAS being a member of a role with AgentAuth permission. Use My Account will be immediately accessible for Windows enrolled systems, and then accessible for Linux enrolled systems after MasterSSHKey download/configuration.]

cflush (Linux only)

You use the cflush command on Linux systems to update the local cache of users and groups that have been authenticated by Delinea PAS.

User and group information is stored in the local cache so that the client does not need to lookup the information for the next 60 minutes (after it is stored). This command invalidates the information in the local cache such that the client will request the information from Delinea PAS whenever any client application asks for such information.

Because most Linux applications need to look up user or group information, caching such information reduces the need to frequently request the same information from PAS. Caching this information improves performance.

Root or Administrator privilege required? Yes

Usage:

cflush [-eV]

cflush -v

cflush -h

Examples:

[root@mylinux ~]# cflush
        Flushed cagent cache

cgetaccount

Use the cgetaccount command to retrieve and use the stored password for a domain, database, or managed local account from Delinea PAS. (You can store accounts either from within the Admin Portal or by using the csetaccount command.) In order to use this command, the system must have the AAPM feature enabled.

Root or Administrator privilege required? Yes

Usage:

cgetaccount [-tTsvV] [-t, --lifetime minutes] [-T, --type type ] [-s, --silent] [-u, --username username] [-v, --version] [-V, --verbose] targetname / accountname

Examples:

[root@mylinux ~]# cgetaccount frodo
            Password for account "frodo" will be checked out. The checkout will be logged and expire in 1 minute.
            Do you want to continue and display the password? (y/n) [n]: y
            Password for frodo: OneRingToRuleThemAll%#

cinfo

Use the cinfo command to display detailed and diagnostic information about the local system's configuration in Delinea PAS.

Root or Administrator privilege required? Yes if you're using the --support option

Usage:

cinfo [-aADhNoPtTVv] [-C <url>] [-p <proxy URL>]

Examples:

root@mylinux ~]# cinfo
                Enrolled in:       https://abc1234.my.centrify.net/
                Enrolled as:
                    Service account:  mylinux$@acme.net
                    Resource name:    mylinux
                    IP/DNS name:      10.10.10.1
                    Owner:            sysadmin (Type: Role)
                Customer ID:        ABC1234
                Enabled features:   AgentAuth, AAPM, DMC
                Client Channel status: Online
                Client status:      connected

creload

Use the creload command to force the client to reload configuration properties after you've changed them using cedit.

Root or Administrator privilege required? Yes

Usage:

creload [-hVv]

Examples:

[root@mylinux ~]# creload 

crotatepasswd

Use the crotatepasswd command to rotate the password for the specified account, such as for an account for a domain, database, or a system. If you're rotating the password for a vaulted local account, the password is updated both locally and in the Admin Portal. If the password is currently checked out, you must use the --force option to force the password rotation. In order to use this command, the system must have the AAPM feature enabled.

Root or Administrator privilege required? Yes

Usage:

crotatepasswd [-fhVv] [-T value] [<target>/]<account>

Examples:

[root@mylinux ~]# crotatepasswd frodo
            Rotating password for frodo...
            Failed to rotate password for frodo: Failed to rotate password from identity platform: The password for this account is currently checked out
[root@mylinux ~]#
[root@mylinux ~]# crotatepasswd --force frodo
            Rotating password for frodo...
            Rotated Password for frodo

csetaccount

Use the csetaccount command to create or update a vaulted privilege account in Delinea PAS for the specified local account. In order to use this command, the system must have the AAPM feature enabled.

Root or Administrator privilege required? Yes

Usage:

csetaccount.exe [-hPVv] [-a <name>|user:<name>|role:<name>] [-d <description>] [-m <true|false>] [--password <password>] [-p [user:|role:|group:]<name>:<right>[,<right2>,...,<rightN>]] [-s <set1>[,<set2>...,<setN>]] [--stdin] [-u, --username username] [-w <enable|disable|default>] [-x <true|false>] <account>

Examples:

[root@mylinux ~]# csetaccount -m true frodo
            Password for frodo:
            Account frodo has been successfully vaulted

cunenroll

Use the cunenroll command to un-enroll a vaulted system from Delinea PAS. Un-enrolling a system means the following:

• Remove the system from Delinea PAS in such a way that any client-based features no longer work on the system (unless you re-enroll the system).
• Unless you specify otherwise, un-enrolling does not completely remove the system from Delinea PAS. Vault functions such as remote access to the system still work. The system displays in Delinea PAS with an unenrolled status.
• The Cloud Client software remains installed on the system. This way, you can re-enroll the system without having to reinstall anything.

To unenroll a system using the cunenroll command, you must specify one of the following options:

• \-m machine credential
• \-u user credentials (the user account must have Grant permission on the system)

To completely remove the system from Delinea PAS, you specify the option -d. Using the -d option removes the system completely from Delinea PAS and any client-generated accounts. To remove a system from Delinea PAS, you must have the View and Delete permissions.

Root or Administrator privilege required? Yes

Usage:

cunenroll [-CdfhmRtVv] [-u value]

Examples:

(This example uses the system's service account in PAS and deletes the system in PAS.
            [root@mylinux ~]# cunenroll --delete --machine
            Successfully Unenrolled.