Delinea PCS Linux Agent & AD Bridging

Delinea Privileged Access Service (PCS) is a cloud-delivered Privileged Access Management (PAM) platform. The Linux Agent (also called the Client) extends PCS policy enforcement to Linux endpoints by intercepting PAM calls, sudo executions, and login events, then evaluating them against cloud-hosted policies.

Architecture Flow

Key Components

Supported Operating Systems

System Requirements

Required Network Access

Pre-flight Checklist

• DNS resolves AD domain name and Domain Controllers
• NTP configured and synchronized (<5 min skew)
• Outbound HTTPS (443) allowed to *.delinea.app
• AD service account created with Domain Join permissions
• Root or sudo access available on target Linux host
• PCS Tenant URL and enrollment token obtained from admin console
• SELinux / AppArmor status reviewed (permissive mode recommended during install)

# Download from Delinea portal or use direct URL
wget https://downloads.delinea.com/pcs/linux/centrifydc-latest.x86_64.rpm

# Verify checksum (SHA-256 hash provided in portal)
sha256sum centrifydc-latest.x86_64.rpm

# Install base agent and AD Bridge packages
sudo rpm -ivh centrifydc-latest.x86_64.rpm
sudo rpm -ivh centrifydc-openssh-latest.x86_64.rpm  # SSH integration
sudo rpm -ivh centrify-agent-latest.x86_64.rpm        # Cloud agent component

# Verify installation
rpm -qa | grep -i centrify

# Add Delinea signing key
curl -fsSL https://downloads.delinea.com/pcs/linux/delinea.gpg | \
  sudo gpg --dearmor -o /usr/share/keyrings/delinea.gpg

# Add repository
echo "deb [signed-by=/usr/share/keyrings/delinea.gpg] \
  https://downloads.delinea.com/pcs/linux/apt stable main" | \
  sudo tee /etc/apt/sources.list.d/delinea.list

sudo apt update

sudo apt install -y centrifydc centrify-agent centrifydc-openssh

# Retrieve script from: Admin Portal → Resources → Add System → Linux
# The portal generates a unique enrollment token per deployment

curl -fsSL https://<your-tenant>.delinea.app/enroll/linux | \
  sudo bash -s -- --enrollment-code <TOKEN> --url https://<tenant>.delinea.app

# This script automatically:
#  1. Detects OS and installs appropriate package
#  2. Runs cenroll to register with PCS cloud
#  3. Optionally joins AD domain if configured in policy

Post-Installation Verification

# Check agent daemon status
sudo systemctl status centrifydc
sudo systemctl status centrify-agent

# Verify agent version
adinfo --version

# Check overall system status
adinfo

# Expected output includes:
#   Local host name    : hostname.domain.com
#   Joined to domain   : (Not Joined)  <-- until adjoin is run
#   CentrifyDC mode    : disconnected

AD Bridging (also called DirectControl) enables Linux hosts to authenticate users via Active Directory using Kerberos and LDAP. AD users can log in to Linux systems using their AD credentials without requiring local accounts.

Joining the AD Domain

nslookup yourdomain.com
nslookup -type=SRV _ldap._tcp.yourdomain.com
host -t SRV _kerberos._tcp.yourdomain.com

# Basic domain join
sudo adjoin yourdomain.com -u DomainJoinUser

# Join to specific OU (recommended for production)
sudo adjoin yourdomain.com \
  -u DomainJoinUser \
  -c "OU=Linux Servers,OU=Computers,DC=yourdomain,DC=com" \
  -n linux-host-01                  # custom computer name

# Join using existing keytab (service account)
sudo adjoin yourdomain.com -k /etc/krb5.keytab

adinfo
# Expected output:
#   Local host name    : linux-host-01.yourdomain.com
#   Joined to domain   : yourdomain.com
#   Joined as          : linux-host-01$
#   Pre-win2k name     : LINUX-HOST-01
#   Current DC         : dc01.yourdomain.com
#   Preferred site     : Default-First-Site-Name
#   CentrifyDC mode    : connected
#   Licensed Features  : DirectControl DirectAudit

# Resolve AD user
id aduser@yourdomain.com

# List AD groups for user
adquery user aduser --attributes memberOf

# Test Kerberos authentication
kinit aduser@YOURDOMAIN.COM
klist         # list acquired tickets

AD Bridge Configuration File

Key parameters in /etc/centrifydc/centrifydc.conf:

Leaving the Domain

# Graceful domain leave (removes computer object from AD)
sudo adleave -u DomainAdminUser

# Force leave (if DC unreachable, does NOT remove computer object)
sudo adleave --force

Enrolling a Linux system into PCS ties it to your cloud tenant, allowing administrators to manage access, apply policies, and see the system in the PCS Admin Portal.

Manual Enrollment with cenroll

# Enroll using an enrollment code (obtain from portal)
sudo cenroll \
  --tenant    https://<yourtenant>.delinea.app \
  --code      ABCD-1234-EFGH-5678 \
  --agentauth true

# Enroll with specific resource profile (recommended)
sudo cenroll \
  --tenant    https://<yourtenant>.delinea.app \
  --code      ABCD-1234-EFGH-5678 \
  --features  aapm,dmc,audit \
  --environment production

# Verify enrollment status
sudo cinfo

Enrollment Token Types

Verify Enrollment in Admin Portal

After running cenroll, the system should appear within 2–3 minutes under:

Admin Portal → Resources → Systems → (Your Linux Host)

# Show enrollment and agent status
sudo cinfo

# Expected output snippet:
#   Enrolled           : Yes
#   Tenant URL         : https://yourtenant.delinea.app
#   Agent ID           : a1b2c3d4-e5f6-...
#   Last check-in      : 2025-03-07 14:22:11 UTC

PCS policies are created in the cloud portal and pushed to enrolled Linux agents. Policies control who can log in, what commands they can run, and which authentication methods are required.

Policy Hierarchy

Common Policy Settings (Portal Navigation)

Applying Policies via Group Policy (AD Bridge)

When AD Bridge is active, PCS can deliver Group Policy Objects (GPOs) to Linux systems. Policies are stored in AD and fetched by the agent using the standard GPO mechanism.

# Force Group Policy refresh on Linux
sudo adgpupdate

# Show applied GPOs
adgpresult

# Test policy enforcement (shows effective sudo rights)
dzinfo aduser@yourdomain.com

PCS uses a Role-Based Access Control (RBAC) model. Roles bundle permissions and are assigned to AD users, AD groups, or PCS-native users. Roles can be system-specific or tenant-wide.

Built-in Roles

Assigning Roles (Portal)

Verify Role Assignments on Agent

# View effective rights for an AD user on this machine
dzinfo user@yourdomain.com

# List all users/groups with login rights
adquery user --all

# Force policy refresh from cloud
sudo centrifyda --force-sync

PCS enforces MFA through its PAM module. When a user logs in via SSH or runs sudo, the PAM module contacts the PCS cloud to validate the second factor before granting access.

Supported MFA Methods

PAM Configuration

The PCS PAM module is inserted into the PAM stack automatically at install time. Review at:

# PCS PAM module — inserted by install
auth       required     pam_centrifydc.so try_first_pass
auth       required     pam_centrifydc.so mfa

account    required     pam_centrifydc.so
session    required     pam_centrifydc.so
password   required     pam_centrifydc.so

MFA Policy Settings

Testing MFA Enforcement

# Test PAM stack interactively
sudo pamtester sshd aduser@domain.com authenticate

# View PAM-related agent log
sudo tail -f /var/log/centrifydc.log | grep -i pam

# Check MFA configuration applied to agent
sudo cinfo --mfa

Important Log Files

Health Check Commands

# Full system health summary
adinfo --test

# Check agent connectivity to PCS cloud
sudo cinfo --connectivity

# AD connectivity test
adinfo --dc        # show connected DC
adinfo --sitename  # AD site information

# Check daemon statuses
sudo systemctl status centrifydc centrify-agent

# View live authentication events
sudo journalctl -u centrifydc -f

Session Audit & Recording

When DirectAudit is licensed, PCS records terminal sessions to the cloud. Recordings are searchable and replayable in the Admin Portal under Audit → Sessions.

# Check audit daemon status
sudo systemctl status centrifyda

# View current session audit queue
dastatus

# Force upload of cached audit data
sudo daflush

SIEM Integration

PCS can forward audit events via syslog (RFC 5424) to your SIEM. Configure in /etc/centrifydc/centrifydc.conf:

# Enable syslog forwarding
adclient.syslog.events: login logout sudo privilege

# Forward to external SIEM (rsyslog/syslog-ng handles transport)
# Add to /etc/rsyslog.conf:
# *.* @@siem.yourdomain.com:514

# 1. Check if user has login permission
dzinfo user@domain.com

# 2. Check group membership via AD
adquery user username

# 3. Check PAM log for deny reason
sudo grep username /var/log/centrifydc.log | tail -20

# 4. Test PAM authentication chain
sudo pamtester sshd user@domain.com authenticate

# Check current domain status
adinfo

# Test DC connectivity
adinfo --test

# Check Kerberos clock skew
ntpdate -q dc01.yourdomain.com

# Re-join if computer account is stale
sudo adleave --force
sudo adjoin yourdomain.com -u AdminUser --force

# Flush Kerberos tickets and retry
sudo kdestroy -A
kinit user@DOMAIN.COM

# Test HTTPS connectivity to PCS endpoints
curl -v https://<tenant>.delinea.app/health 2>&1 | head -20

# Check if proxy is required
env | grep -i proxy

# Set proxy for agent if needed
sudo cagent config --proxy http://proxy.company.com:8080

# View agent communication log
sudo tail -100 /var/log/centrify-agent/agent.log

# Restart agent to force reconnect
sudo systemctl restart centrify-agent

# Unenroll from PCS cloud (soft reset)
sudo cunenroll --remove-all

# Re-enroll with new token
sudo cenroll --tenant https://<tenant>.delinea.app --code NEW-TOKEN

# Full wipe and reinstall (nuclear option)
sudo adleave --force
sudo cunenroll --remove-all
# Remove packages (rpm -e / apt purge centrifydc centrify-agent)
# Reinstall from scratch

Debug Logging

# Enable debug logging temporarily
sudo adinfo --loglevel DEBUG

# Or in centrifydc.conf — set temporarily:
adclient.log.level: DEBUG    # WARNING: verbose, disable after troubleshooting

# Restart agent to apply
sudo systemctl restart centrifydc

# Monitor logs
sudo tail -f /var/log/centrifydc.log