Overview

Environment users are managed through DCT for each environment registered across your connected CD engines. Not to be confused with DCT platform users or CD engine administrator (admin) users, environment users are OS-level credentials that allow the CD engine to connect to and perform actions on each environment. These users are configured for each data platform to interface with the database instance on the host.

  1. In DCT, navigate to Home > Infrastructure Connections.

  2. Click on the existing environment name you want to modify and open the environment information screen.

  3. In the Details tab, click the Plus icon located next to Environment users. 

  4. There are four ways that can be used for the CD engine to log in to the environment.

    1. Enter the Username and Password for the OS user in that environment and click Validate.

    2. If you want to use a public key for logging into your environment:

      1. Select ‘Username and Public Key’ for the Login Type.

      2. Copy the public key that is displayed, and append it to the end of ~/.ssh/authorized_keys file of the new user being added. If this directory or file does not exist, you will need to create it.

      3. Run chmod 600 authorized_keys to enable only the file owner with read and write privileges.

      4. Run chmod 755 ~ to make your home directory writable only by your user and no other user may write to it.

      5. The public key needs to be added only once per user and per environment.

    3. Specify a Custom Key Pair

    4. Specify a Password Vault. Consult the Password Vault Support documentation for more information.

  5. Click the Add icon to save the new user.

  6. To change the primary user for this environment, select the environment. Then click the ‘star’ icon next to Environment Users. Only the primary user will be used for environment discovery.

  7. To delete a user, click the Trash icon next to their username.

Privilege elevation profiles

Privilege elevation profiles exist to provide the CD engine with a mechanism for running privileged commands in a secure way to achieve the following:

  • Mount and unmount Network File System (NFS) file systems

  • Create and remove directories in paths not owned by the CD engine OS user

  • Examine the running process list

  • Run commands as root

How privilege elevation profiles work

Privilege Elevation Profiles need to be tailor-made to work with non-standard environments that may use third-party or proprietary privilege elevation mechanisms other than sudo. You are strongly encouraged to work with Delphix Professional Services to formulate reliable profile scripts. 

Privilege Elevation Profiles exist within a two-tier cascading hierarchy. This means there is one default profile for the entire CD engine that should contain scripts for all the operations that require privilege elevation. Additional profiles may contain a subset of the scripts. When a non-default profile is used, the CD engine uses that profile's scripts where they exist and reverts to the scripts in the default profile if no script for the operation exists. By default, the CD engine ships with simple scripts that pass commands to the standard UNIX sudo command.

All environments added to a CD engine get added with the default Privilege Elevation Profile. The profile can be assigned on a per-environment basis through the environment's configuration in DCT. The description below shows how an environment using a non-standard profile will use scripts in the cascading model.

In order to create a privilege elevation profile, you must create both a profile and a profileScript. Scripts exist for particular operations, which include:

  • dlpx_mount

  • dlpx_umount

  • dlpx_rmdir

  • dlpx_mkdir

  • dlpx_ps

  • dlpx_pfexec

  • dlpx_pfexec_as_user

There are three parameters to consider while creating a new profile:

  1. Name

  2. Contents

  3. Profile

Support for privilege elevation profiles

Writing and troubleshooting scripts, such as those required for Privilege Elevation Profiles, is out of scope and not covered by Delphix Support.

Last updated
Oct 8, 2026