PAM Training Series — Module PCS
Delinea PCS · v2024
Server Granular Access

PRIVILEGE
CONTROL
FOR SERVERS

How Delinea Privilege Control for Servers (PCS) replaces coarse-grained root/admin access with granular, identity-aware, policy-driven privilege elevation — giving the right users exactly the rights they need and nothing more.

01
The Problem
02
PCS Concepts
03
Delinea PCS
04
Simulator
05
Implement
06
Assessment
01
Module 01 — Context & Problem Statement

The Root Access Problem

Most server environments rely on all-or-nothing access models. Admins get root — a single account with unlimited power — or they get nothing. This is one of the most dangerous misconfigurations in enterprise security.

74%
Of breaches involve privilege misuse or over-privileged accounts
1,200+
Avg. servers per enterprise with shared root credentials
0
Audit records created when root acts — no attribution possible
93%
Of Linux/Unix servers have unmanaged local root passwords
🔴
The Core Problem: On most Linux, Unix, and Windows servers, administrators either share a single root/Administrator account — or are granted full sudo rights. This means every admin can do everything, no action is attributable, and a single compromised credential gives an attacker unrestricted control of an entire server tier.
⚡ Attack Surface

How Attackers Exploit Coarse Server Access

Critical

Shared Root Credential Compromise

A single root password shared across a server tier. One phished admin, one stolen credential from a config file — and every server in the tier is owned. No rotation, no individual accountability.

Critical

sudo Misconfiguration ("sudo ALL")

Admins granted ALL=(ALL) NOPASSWD: ALL in sudoers — effectively giving unrestricted root without even requiring a password. Misconfigurations like this exist on the majority of enterprise Linux servers.

High

Privilege Escalation via sudo Exploits

CVE-2021-3156 (Baron Samedit) and similar sudo vulnerabilities allow any user to escalate to root. Without command-level restrictions, even patched systems remain vulnerable to logic-based escalation.

High

No Attribution — Forensics Impossible

When 15 admins all use the same root account, a destructive command ("who deleted the database?") cannot be attributed to any individual. Compliance audits fail, insider threats go uninvestigated.

Medium

Inconsistent Sudo Policies Across Servers

sudoers files are managed manually per-server and drift over time. The same admin has different rights on different servers, creating unknown privilege gaps and over-grants that accumulate silently.

❌ The sudo Limitations

Why sudo Alone Is Not Enough

sudo is a useful tool but was designed for individual server management — not enterprise governance. It has no centralised policy management, no Active Directory integration, no session recording, no real-time monitoring, no alerting, no automatic rotation, and no compliance reporting. sudoers files are plain text, drift over time, and are invisible to most security teams.

No Centralised Policy No AD Integration No Session Recording Config Drift No Compliance Reports
✅ The PCS Solution

What Privilege Control Delivers

Delinea PCS replaces scattered sudo with a centralised, policy-driven privilege management layer. Every elevation is identity-aware, scoped to specific commands, time-limited, fully audited, and enforced consistently across thousands of servers from a single policy engine.

Centralised Policy AD / LDAP Bridging Command Filtering Session Recording RBAC for Servers
Section 1 of 6
02
Module 02 — Core Concepts

Privilege Control for Servers — Core Concepts

Understanding the four foundational concepts that underpin granular server access: Identity, Zones, Role-Based Access, and Command Filtering.

🔑
Core Principle: Privilege Control for Servers extends the principle of least privilege to the operating system level. Instead of granting a user root, PCS grants them the ability to run specific commands as an elevated identity — and nothing else. Every action is individually authorised, logged, and attributable.
Concept 01

Identity-Aware Access

Servers are joined to Active Directory (or LDAP) via PCS's AD bridging capability. Linux and Unix servers authenticate users against AD, meaning every login is tied to an individual AD identity — not a local account. No more shared root. Every action carries a named user identity.

Concept 02

Zones — Logical Grouping

Servers are organised into Zones — logical containers that define which AD users and groups can access which servers, with which rights. A Production Database Zone might contain 50 PostgreSQL servers, all sharing the same access policy. Changes to the zone policy propagate instantly to all member servers.

Concept 03

Role-Based Access Control (RBAC)

Within each zone, roles define what a user can do. A DBA Role might allow service postgresql restart but block rm -rf. A Read-Only Auditor Role might allow only log inspection commands. Roles are defined centrally and mapped to AD groups — ensuring consistent enforcement everywhere.

Concept 04

Command Filtering & Allow-listing

PCS evaluates every privileged command against a policy allow-list before execution. Commands not on the list are blocked and logged. This is fundamentally different from sudo, which operates on a static file and cannot perform dynamic risk evaluation or contextual decisions.

PCS Access Model — Identity → Zone → Role → Command
Granular · Centralised · Audited
👤
AD User
j.smith@corp
DB_Admins (AD group)
🗂️
Zone
Prod-DB-Zone
50 PostgreSQL servers
🎭
Role
DBA-Operations-Role
Mapped from AD group
📋
Allowed Commands
✓ service postgresql *
✓ pg_dump *
✓ tail /var/log/pg*
✗ rm -rf *
✗ passwd root
✗ /bin/bash
📊
Audit Log
User · Command
Timestamp · Result
Session recording

The AD user's group membership determines their zone access and role. Their role defines the exact commands they can elevate. Every attempt — allowed or denied — is logged with full identity context.

Contrast

sudo vs Delinea PCS — Feature Comparison

CapabilityNative sudoDelinea PCS
Policy ManagementPer-server flat file — manual, drifts over timeCentralised, Active Directory–integrated, push to all servers
IdentityLocal OS user — no AD tieAD/LDAP identity — individual attribution always
Command ScopeStatic patterns, easily bypassed (e.g. shell escapes)Dynamic evaluation, shell-escape prevention, argument inspection
Session RecordingNoneFull terminal session capture, keystroke logging, replay
Compliance ReportingNonePre-built PCI, HIPAA, SOX, CIS reports
Behavioural AnalyticsNoneAnomaly detection on command patterns
Windows ServersNot applicableWindows privilege management included
Multi-PlatformLinux/Unix onlyLinux, Unix, macOS, Windows unified
03
Module 03 — Product Deep Dive

Delinea PCS — Key Capabilities

A capability-by-capability walkthrough of Delinea Privilege Control for Servers — from AD bridging and zone management to command filtering, session recording, and compliance.

🏢
About Delinea PCS: Delinea Privilege Control for Servers (formerly Centrify) is the market-leading server PAM solution. It provides centralised privilege management for Linux, Unix, and Windows servers — enabling AD-authenticated identities, policy-driven command elevation, granular RBAC, session recording, and unified compliance reporting across hybrid and cloud server estates.
🌉
Active Directory Bridging
Joins Linux, Unix, and macOS servers to Active Directory without schema extensions. Users authenticate with their AD credentials, enabling single sign-on and eliminating local accounts and shared root passwords on servers.
🗂️
Zone-Based Access Control
Servers are organised into Zones reflecting environment tiers (Prod, Dev, DR) or function (Web, DB, Network). Zones define which AD users/groups can access which servers with which rights — managed from a single console.
🎭
Granular RBAC Roles
Roles define the exact set of commands an identity can run with elevated privilege. Roles are mapped to AD security groups — granting rights via group membership, automatically revoking when users leave a group.
🔍
Command Filtering & Allow-listing
Every elevated command is evaluated against the role's allow-list before execution. PCS prevents shell escapes (e.g. sudo bash), argument wildcards, and indirect privilege escalation patterns — not possible with native sudo.
📹
Server Session Recording
Terminal sessions are captured at the OS level — full keystroke logging, screen capture, and command indexing for searchable playback. Recordings are tamper-proof and retained per policy. Supports SSH, RDP, and local console sessions.
Privilege Elevation Workflow
For high-risk commands, PCS enforces a just-in-time approval workflow before execution. The user's command is paused, routed to an approver, and only executed if approved within the window — with full context logged.
🖥️
Windows Privilege Management
Removes users from local Administrator groups and applies granular application-level privilege elevation for Windows. Specific executables, services, and MSI installers can be elevated per policy without granting full local admin rights.
🌥️
Cloud & Container Support
PCS agent runs on EC2, Azure VMs, and GCP instances. Integrates with cloud IAM for hybrid identity. Supports ephemeral cloud instances — policy pushes automatically to new servers joining a zone tag. Kubernetes node privilege management included.
📋
Compliance & Audit Reports
Pre-built compliance dashboards for PCI DSS, HIPAA, SOX, CIS Benchmarks, and NIST. Reports include privileged access summaries, denied-command logs, session recordings index, and user access reviews — auto-generated and exportable.
Deep Dive — Components

Delinea PCS Architecture

🔌 PCS Agent (Server-Side)
A lightweight agent installed on each managed server (Linux, Unix, Windows). The agent intercepts every privilege escalation attempt (sudo, su, runas), evaluates it against the centralised policy, logs the result, and captures session data. The agent continues to enforce the last-downloaded policy even if it temporarily loses connectivity to the policy server — ensuring no security gaps during network outages.
🏛️ Delinea PCS Policy Server (Central Management)
The central management plane — runs on Windows Server and integrates with Active Directory via LDAP. Administrators define Zones, Roles, and Command policies here. Policy changes are pushed to agents in real time. The PCS Policy Server also acts as the LDAP/Kerberos proxy for Linux servers authenticating AD users — enabling true AD single sign-on on non-Windows platforms without requiring native AD domain-join capabilities.
📊 Audit & Monitoring Service
A separate service that collects, stores, and indexes all session recordings, command audit events, and access decisions from PCS agents. Provides the session playback console for security teams, powers the compliance reporting engine, and feeds events to SIEM integrations (Splunk, Sentinel, QRadar). Audit data is signed and tamper-evident — recordings can be used as forensic evidence.
🔗 Secret Server Integration
PCS integrates with Delinea Secret Server for credential management of local service accounts and emergency root passwords. When a break-glass scenario requires direct root access, the password is checked out from the vault, the session is recorded by PCS, and the credential is rotated automatically on check-in — providing full PAM governance even for emergency root access scenarios.
🏷️ Zone Provisioning API (Cloud / DevOps)
PCS exposes a REST API and supports infrastructure-as-code integration (Terraform, Ansible, CloudFormation). New servers can be automatically enrolled in the correct Zone at provisioning time based on tags or naming conventions — ensuring new servers inherit correct access policies immediately, with no manual onboarding step. This is critical for auto-scaling cloud environments where servers spin up and down dynamically.
Example — Command Policy

Sample PCS Role Policy Definition

Below is an illustrative PCS role policy for a database administrator. Note how specific commands are allowed, dangerous commands are explicitly blocked, and argument patterns are controlled — far more precise than a sudoers file entry.

# Zone: Prod-DB-Zone | Role: DBA-Operations | User: DB_Admins (AD group) ALLOWED COMMANDS (elevation granted, recorded) /usr/bin/service postgresql start|stop|restart|status /usr/bin/pg_dump -h localhost -U postgres * /usr/bin/pg_restore --dbname=* * /usr/bin/tail -f /var/log/postgresql/*.log /usr/bin/psql -U postgres -c "SELECT *" # read-only SQL only DENIED COMMANDS (blocked + alerted) /bin/bash # shell escape prevention /bin/sh # shell escape prevention /usr/bin/passwd # cannot change passwords /bin/rm -rf / # destructive operations /usr/bin/curl * | bash # pipe-to-shell blocked SETTINGS RequireJustification: true # ticket ID required for restart RecordSession: true # all elevated sessions recorded AlertOnDeny: true # SIEM alert on blocked command
04
Module 04 — Interactive Exercise

PCS Terminal Simulator

Simulate server access as different users with different roles. Experience how PCS allows, blocks, and records commands in real time — try to escalate privilege and see PCS intervene.

🖥️
Exercise: Log in as different server users (DBA, Web Admin, Auditor, Attacker) and run commands against a production Linux server managed by Delinea PCS. The PCS policy engine evaluates each command against the user's role in real time. Try privilege escalation — see how PCS blocks it where native sudo would not.
PCS Managed Server — prod-db-01.corp.internal
● PCS Agent Active
Select user identity and server target to begin simulation
PCS Agent — Evaluating Access Request
Access Control Decision Matrix
AD Authentication — Kerberos ticket validation
Zone Membership — Server zone vs user's authorised zones
Role Assignment — AD group → PCS role mapping
Account Status — Active, not locked, within access window
Session Recording — Initialising capture for privileged session
Active Session — — PCS Recording Active
$
⛔ ZONE ACCESS DENIED — PCS Agent Block
📊 Live Audit Trail

PCS Command Audit Log — This Session

No commands recorded yet. Start a session above to populate the audit trail.
05
Module 05 — Implementation Guide

Implementing Delinea PCS

From pre-deployment checklist to phased rollout and operational best practices — a practical guide for deploying Delinea PCS across your server estate.

✅ Deployment Readiness Checklist

Pre-Deployment Controls

Server Estate Inventory Complete
All Linux, Unix, and Windows servers documented — OS version, current local accounts, existing sudo configurations, zone/environment classification
Active Directory Design for Server Access
AD groups created per server tier and function (e.g. DBA_Admins, WebOps_Team, Audit_ReadOnly) — each to be mapped to PCS roles in their respective zones
PCS Policy Server Deployed & AD-Integrated
Central PCS management server installed, AD trust established, admin console configured, service accounts provisioned with least-privilege AD rights
Zones Defined and Server Groupings Mapped
Production, staging, dev, and DR zones created. Server naming conventions or network ranges used to assign servers to zones automatically
Role and Command Policy Library Drafted
Command allow-lists defined per role (DBA, Web Admin, App Admin, Auditor, Break-Glass). Peer reviewed by security team and tested in dev zone before prod deployment
PCS Agent Deployed to Pilot Server Set (Dev Zone)
Agent installed on 5–10 dev servers. AD bridging tested, user authentication confirmed, command policies validated, session recording verified
Audit Service Configured and SIEM Integration Active
PCS audit events streaming to SIEM (Splunk / Sentinel). Alerts configured for: denied commands, break-glass access, after-hours privilege elevation, shell escapes
Break-Glass / Emergency Root Process Defined
Emergency root access procedure documented: vault checkout + forced session recording + CISO notification + mandatory post-session review. No sudo exception to this process
Admin Training Completed Before sudo Cutover
All privileged users trained on PCS workflow before native sudo is disabled. Change management comms sent 2 weeks in advance of production cutover date
⚠️ Common Pitfalls

What Goes Wrong

High

Leaving Native sudo Active After PCS Rollout

If sudo is not disabled after PCS deployment, users continue using it — bypassing PCS recording and policy entirely. Native sudo must be removed from PATH or the binary renamed/locked as part of cutover.

High

Overly Broad Initial Command Policies

Starting with permissive policies to avoid disruption and never tightening them. PCS's value comes from specificity — begin tightly, then expand based on legitimate requests.

Med

No Review of Denied Command Logs

Denied commands are a rich signal — for both policy gaps (legitimate command not allowed) and attack detection (privilege escalation attempts). These must feed into a regular review process.

📅 Phased Rollout

Recommended Deployment Phases

Phase 1 — Weeks 1–3
Dev Zone Pilot
Deploy agent to dev servers. AD bridging live. Validate authentication, roles, recording. Refine policies based on real usage patterns.
Phase 2 — Weeks 4–8
Non-Production & Staging
Roll out to staging and UAT servers. Train admins on PCS workflow. Confirm command policies stable. Enable SIEM alerting.
Phase 3 — Weeks 9–14
Production Rollout
Deploy to production tiers in order of risk. Critical servers last. Disable native sudo on each server after a 2-week parallel run validation period.
Phase 4 — Ongoing
Continuous Governance
Quarterly access reviews, denied-command trend analysis, policy tightening, new zone onboarding via IaC automation.
06
Module 06 — Knowledge Assessment

Server Privilege Control Assessment

Eight questions testing your understanding of server granular access principles and Delinea PCS capabilities. Immediate feedback on every answer.