Delinea Privilege Control for Servers

Why Delinea Privilege Control for Servers?

sudo grants too broad permissions. ALL=(ALL) ALL is equivalent to root. No granularity in native privilege tools. Command logging in sudo is easy to bypass. Central policy management is impossible.

Delinea Privilege Control for Servers provides granular privilege control on servers. Command-level filtering instead of all-or-nothing. dzdo replaces sudo with central policy and audit. Full command logging without bypass possibility.

How does it work?

Command Control

Granular privilege:

• Per-command allowlists
• Parameter restrictions
• Context-aware policies
• Blacklists for dangerous commands
• Least privilege enforcement

dzdo (Delinea sudo)

Enhanced privilege elevation:

• Drop-in sudo replacement
• Central policy management
• Tamper-proof logging
• MFA support
• Audit everything

Central Policies

Unified management:

• Policy zones
• Role-based assignments
• Inheritance and exceptions
• Version control
• Push deployment

Main features

Privilege Zones

• Logical server grouping
• Per-zone policies
• Role definitions
• Nested zones
• Emergency override

Command Filtering

• Allowlist commands
• Parameter restrictions
• Script approval
• Path restrictions
• Time-based rules

Audit Trail

• All command logging
• Keystroke capture
• Session recording option
• Tamper-proof logs
• Compliance reports

MFA Integration

• MFA for elevation
• Per-command MFA
• Risk-based MFA
• Multiple methods
• Grace periods

Policy Examples

Role	Allowed Commands	Restrictions
DBA	mysql, pg_dump	No DROP, TRUNCATE
Web Admin	apache, nginx	Config files only
Developer	docker, kubectl	Non-prod namespaces
Helpdesk	passwd, usermod	Specific users only
Emergency	All	Time-limited, recorded

Supported Platforms

Platform	Versions
RHEL/CentOS	7, 8, 9
Ubuntu	18.04, 20.04, 22.04
SUSE	SLES 12, 15
Debian	10, 11, 12
Windows Server	2016, 2019, 2022

Who is it for?

• Enterprise with least privilege requirements
• Organizations with compliance mandates
• Security teams controlling server access
• IT teams managing mixed environments

Benefits

For security: Granular control, least privilege, full audit trail

For IT: Central policy management, reduced sudo abuse, simplified administration

For compliance: Command logging, tamper-proof audit, compliance reports

Specification

Control	Command-level, parameter-level
Replacement	sudo (dzdo)
Platforms	Linux, Unix, Windows
Logging	Tamper-proof, searchable

FAQ

How is dzdo different from sudo? dzdo is a sudo replacement with central policy, tamper-proof logging, MFA, parameter filtering.

Can I migrate from sudo? Yes. Compatibility mode allows gradual migration. Existing sudoers can be imported.

How does command filtering work? Policies define allowed commands and parameters. dzdo enforces policy before execution.

Can logging be bypassed? No. Agent enforces logging locally. Tamper-proof, cannot be disabled without privilege.

What about Windows support? Equivalent control for Windows commands and PowerShell. Role-based, audited.

Can I test policies? Yes. Dry-run mode shows what would be allowed/denied without enforcement.

How does emergency access work? Break-glass roles with full access but mandatory logging and time limits.

Does it support containers? Host-level control. Container privilege management via integration.

What about high availability? Agent caches policies locally. Continues operation if central server unavailable.

What about support? Delinea support for software. nFlo offers policy design and deployment assistance.