Quest homes in on Unix password management

Constructing a working QPM-password protected infrastructure can be daunting, as various aforementioned execution constraints imposed on users and groups must be entered into an /etc/pmconf file manually. Additionally, while the product includes a program called pmcheck that parses the deployment for errors, we found it not much help in debugging issues because it's not able to articulate what caused the problems, it just points to them.

It's up to administrators to use other applications that tap into syslog, or direct syslog examination, to determine problems, such as unauthorized user attempts at privilege, applications or logons that aren't working, or other difficulties with the QPM privilege granting processes.

Overall, QPM requires moderate Unix administrative skills to both install and use. It doesn't, of course, cover Windows, but does cover Solaris and HP-UX (not tested). It's very highly configurable, and puts reasonably strong barriers in place to prevent undesired privileged access. Configuration is moderately tedious but has a lot of flexibility. It's a usable alternative to the user-session isolation of privilege effects of SELinux and Solaris Containers, with a similar configuration dance to learn, with better cross-platform results.