KB-2380: DirectAudit was unable to establish communication with the DirectAudit daemon.

Home >

KB-2380: DirectAudit was unable to establish communication with the DirectAudit daemon.

Product:

Centrify DirectControl ,

Published:

12 April,16 at 11:07 AM

Rating:

Applies to:

All versions of Centrify DirectAudit on Unix platforms.

Question:

The following message is displayed when a non-root user logs into a Centrify DA server. DirectAudit was unable to establish communication with the DirectAudit daemon. As your shell is audited and you are not a root user, your session is not being allowed to continue. Press return to continue......

Answer:

As a security measure, when auditing is down, Centrify will disable all logins except root. Please note that we prevent users from logging on when we fail to send data to a collector and we failed to spool the data locally. In particular, this may happen if dad (DirectAudit daemon/the audit data collection process) cannot be started or if the disk space on the audited system is full. Also note that even when dad is not running, cdash/dash (the UNIX shell wrapper that intercepts all user traffic) should automatically start dad on behalf of root.

In a situation like this where non-root users are being prevented from logging into servers, the customer will have to login as root or console and restart dad if it is stopped (ps -ef | grep dad).

Future releases of software will allow a group of users (configurable) to login to Centrify DA server even when dad is down. The security ramifications of providing this option will be considered.

The command #dainfo --diag (as root) will provide the status of the dad daemon.

Please see page 84 of the below online guide on how to start dad

http://www.centrify.com/downloads/products/documentation/suite2012/ga/centrify-da-admin-guide.pdf