Applies to:
All versions of Centrify DirectAudit on Unix platforms.
Question:
The following message is displayed when a non-root user logs into a Centrify DA server. DirectAudit was unable to establish communication with the DirectAudit daemon. As your shell is audited and you are not a root user, your session is not being allowed to continue. Press return to continue......
Answer:
As a security measure, when auditing is down, Centrify will disable all logins except root. Please note that we prevent users from logging on when we fail to send data to a collector and we failed to spool the data locally. In particular, this may happen if dad (DirectAudit daemon/the audit data collection process) cannot be started or if the disk space on the audited system is full. Also note that even when dad is not running, cdash/dash (the UNIX shell wrapper that intercepts all user traffic) should automatically start dad on behalf of root.
In a situation like this where non-root users are being prevented from logging into servers, the customer will have to login as root or console and restart dad if it is stopped (ps -ef | grep dad).
Future releases of software will allow a group of users (configurable) to login to Centrify DA server even when dad is down. The security ramifications of providing this option will be considered.
The command #dainfo --diag (as root) will provide the status of the dad daemon.
Please see page 84 of the below online guide on how to start dad