HP UX Kerberos Data Security Software manual 327

Page 327

R

remote administrator, 111 remote request, 112 reporting level, 295

LOG_ERR, 295 LOG_NOTICE, 295 LOG_WARNING, 295

RFC 1510, 22, 25, 54 RFC 1964, 22, 54 RFC 2743, 22

RFC 2744, 22

S

sample kdc.conf, 319 sample krb.conf, 315 Sample krb.realms, 319 sample krb5.conf, 315 secsrv_name, 252 server, 294

service contract, 308 service key table, 130 Service Request

See SR

service ticket, 27 services ﬁle, 317 services manpage, 317 session key, 27 setuid bit, 303

shell% /opt/krb5/sbin/kadmind, 102 shell% /opt/krb5/sbin/krb5kdc, 102 software distributor

reference material, 39 Software Selection dialog box, 39 Specify Source window, 39

SR, 290, 308

start the kerberos daemons, 102 stash ﬁle, 227

support contact, 290 swinstall command, 39 syslog ﬁle, 295

T

Table 3-1,64 target realm, 286 TGS, 321, 322 TGT, 26, 27 ticket ﬂags, 28 ticket-granting ticket

See TGT

tracing, 293

transitive interrealm trust, 281

Index

troubleshooting checklist, 291 tools, 293

trust, 275 two-way trust, 277

U

uname command, 308 -r option, 37

uniﬁed administration interface, 130 unlocking a principal, 304

V

/var/adm/krb5/kdc/DEBUG directory, 303 /var/adm/messages directory, 295 /var/adm/sw/swagent.log ﬁle, 39 /var/adm/syslog/syslog.log ﬁle, 295

Y

Your_Realm_Name, 316, 320

327

Image 327

Contents Manufacturing Part Number T1417-90009 E0905 EditionCopyright Notices Legal NoticesPage Page Contents Conﬁguring the Kerberos Server with Ldap Administering the Kerberos Server Contents Contents Propagating the Kerberos Server Managing Multiple Realms Contents Tables Table A-2. Conﬁguration Worksheet Explanation Figures Figures Intended Audience What Is in This DocumentGlossary Interoperability with Windows 2000, onWidth Typographic ConventionsIndex Bold ﬁxedHP-UX Release Name and Release Identiﬁer Publishing HistoryRelated Software Products Accessing the World Wide Web Related DocumentationRelated Request for Comments RFCs HP Encourages Your Comments Overview Overview Introduction How the Kerberos Server Works Authentication Process Illustrates the actions of the components and the Kerberos Authentication ProcessStep Authentication Process DES Versus 3DES Key Type Settings Ldap Advantages Introduction to LdapIntegrating Kerberos Server v3.1 with Ldap Integrating a Kerberos Principal in to the Ldap Directory Installing the Kerberos Server Installing the Kerberos Server Prerequisites Version Compatibility System RequirementsHardware Requirements Software RequirementsInstalling the Server Installing the Server Chapter Migrating to a Newer Version Migrating to a Newer Version of the Kerberos Server Migrating from Kerberos Server Version 1.0 to Copy the dump ﬁle to the new system where you are installing Upon success, the following message appears Migrating from Kerberos Server Version 1.0 to Version Migrating from Kerberos Server Version 2.0 toCopy the dump ﬁle to the system on which you are installing Migrating from Kerberos Server Version 3.0 to Version Migrating to a Newer Version of the Kerberos Server Interoperability with Windows Interoperability with Windows Understanding the Terminology Table of Analogous Terms Kerberos Server Windows Scenario Kerberos Server and Windows 2000 InteroperabilityEstablishing Trust Between Kerberos Server and Windows Fqdn qualiﬁer speciﬁes the fully qualiﬁed domain name Single Realm Domain Authentication Interrealm Interdomain Authentication Postdated Tickets Special Considerations for InteroperabilityDatabase Considerations Encryption ConsiderationsSpecial Considerations for Interoperability Chapter Special Considerations for Interoperability Chapter Conﬁguring the Kerberos Conﬁguration Files for the Kerberos Server Security Server Files That Require ConﬁgurationConﬁguration File Function Krb.conf File Format Krb.conf FileKrb.realms File Krb.realms File Format Wildcard Character Description Wildcard CharactersAutoconﬁguring the Kerberos Server To conﬁgure the server, select option Conﬁguring the Kerberos Server with C-Tree Value, DES-MD5, is selected Server with Ldap File Function Conﬁguration Files for Ldap IntegrationKrb5ldap.conf File Ldap Conﬁguration FilesParameter Description Krb5ldap.conf File FormatThis line indicates a space Krb5schema.conf File Krb5schema.conf File Format Ticket’ Syntax Conﬁguration Files for Ldap Integration Krb5map.conf File Format Krb5map.conf FileHpKrbAuthzData HpKrbKeyVersion HpKrbKeyData Before You Begin Planning Your Ldap ConﬁgurationSetting up Your Ldap Conﬁguration For example, ou=people, o=bambi.com For example, ou=accounts, ou=people, o=bambi.com For example, uid. cn, homedirectory, gidnumber, uidnumber Autoconﬁguring the Kerberos Server With Ldap Integration Conﬁguring the Kerberos Server with LdapStep Select one of the following options Qualiﬁed host name or the IP address HpKrbKey Autoconﬁguring the Kerberos Server With Ldap Integration Editing the Conﬁguration Files Manually Conﬁguring the Kerberos Server with LdapManually Conﬁguring the Kerberos Server with Ldap Manually Conﬁguring the Kerberos Server with Ldap Chapter Conﬁguring the Primary Conﬁguring the Primary Security Server Create the Principal Database After InstallationAdd an Administrative Principal To add an Administrative Principal Using the HP KerberosAdministrator To Add an Administrative Principal Through the Command Line Start the Kerberos Daemons Deﬁne Secondary Security Server Network Locations Password Policy File AdminaclﬁleSecurity Policies Starting the Security Server Conﬁguring the Secondary Security Servers with C-Tree Creating the Principal DatabaseCopying the Kerberos Conﬁguration File Creating a host/fqdn Principal and Extracting the Key Conﬁguring the Secondary Security Servers with Ldap Creating a stash ﬁle using the kdbstash utility106 Using Indexes to Improve Database Performance 108 Administering the Kerberos 110 Administering the Kerberos Database Kadmind Command Conﬁguration Files Required for kadmindFile Name Description Adminaclﬁle File Assigning Administrative Permissions Chapter 115 Adding Entries to adminaclﬁle Creating Administrative Accounts Using Restricted AdministratorHow the r/R Modiﬁers Work 118 Password Policy Setting Default Value Password Policy FileEditing the Default File Default Password Policy Settings for the Base Group120 Principals 122 Adding User Principals Adding New Service PrincipalsReserved Service Principals Chapter 125 126 Removing User Principals Removing Special Privilege SettingsProtecting a Secret Key Removing Service PrincipalsChapter 129 Kadmin and kadminl Utilities Administration Utilities Name Description Administration UtilitiesHP Kerberos Administrator Button Name Action Standard Functionality of the AdministratorFunction of OK, Apply, and Cancel Buttons CancelUsing kadminlui Local Administrator kadminluiChapter 135 Principals Tab Principals Tab Components Principals TabList of Principals Component Name Description List AllSearch String SearchGeneral Tab Principal Information Window Principal Information WindowPrincipal Information Window Components Attributes Tab Password TabField Name Description General TabMaximum Renew Time General Tab ComponentsField Name Description Principal Expiration Maximum Ticket LifetimeField Name Description Password Policy Last ModiﬁedModiﬁed By Adding Principals to the Database Change Password Window Adding Multiple Principals with Similar Settings Creating an Administrative Principal Administering the Kerberos Server 148 Searching for a Principal Search CriteriaCharacter Description 150 Deleting a Principal Loading Default Values for a Principal Restoring Previously Saved Values for a Principal Changing Ticket Information Rules for Setting Maximum Ticket Lifetime Rules for Setting Maximum Renew Time Chapter 157 Changing Password Information Chapter 159 Displays the Ldap DN that you are editing Password Tab Principal InformationPassword Tab Components WindowExpiration/Date Component Name Description PasswordPassword Last Change PasswordChange Password Window Password Tab Change Password Window Components Entering a passwordVeriﬁcation Components Description New PasswordChanging a Key Type Changing a DES-CRC or DES-MD5 Principal Key TypeTo 3DES 166 Changing Principal Attributes Attributes Tab Principal Information 12 describes the components of the Attributes tabAttributes Tab Components Tickets Components DescriptionAllow Postdated Allow Renewable170 Session Keys Components Description Allow ForwardableAllow Proxy Allow DuplicateChange PreauthenticationRequire Password Components Description RequireComponents Description Lock Principal Allow As ServiceComponents Description Require Initial AuthenticationSet As Password Change ServiceLdap Attributes Tab Prinicpal Information Window 176 Deleting a Service Principal Extracting Service Keys Chapter 179 Extracting a Service Key Table Table Type Extract Service Key Table ComponentsService Key Component Description PrincipalEditing the Default Group Using Groups to Control SettingsChapter 183 Group Information Window Principal InformationEditEdit Default Group to display the Group Group Information Window ComponentsComponent Description Group Component Description Setting the Default Group Principal AttributesDefault Principal Attributes Principal AttributesChapter 187 Setting Administrative Permissions 11 Administrative Permissions Window Administrative PermissionsPrincipals Inquire about Add PrincipalsPrincipals ModifyComponent Description Restricted Override the Principal InformationEditEdit Group DefaultDefaults InformationEditEdit Default GroupGroup Information192 Realms Tab Realms Tab Components Realms TabRealm Information Window Components Realm Information WindowAdding a Realm Deleting a Realm Remote Administrator kadminui Logon Screen Logon screen displays as shown in Figure200 Chapter 201 Manual Administration Using kadmin Chapter 203 Adding a New Principal Adding a Random Key Specifying a New PasswordDeleting a Principal Changing Password to a New Randomly Generated3DES Extracting a PrincipalModifying a Principal Listing the Attributes of a PrincipalNumber of Authentication Failures fcnt Key Version Number Attribute Policy Name AttributesAllow Postdated Attribute Allow Renewable Attribute Allow Forwardable Attribute Allow Proxy Attribute Allow Duplicate Session Key Attribute Require Password Change Attribute Require Preauthentication AttributeLock Principal Attribute Allow As Service Attribute Principal InformationEditEdit Administrative Permissions Require Initial Authentication AttributeAuthentication Select Require Initial Authentication Set As Password Change Service AttributeNo text shows Password Expiration Attribute Maximum Ticket Lifetime Attribute Principal Expiration AttributeMaximum Renew Time Attribute Key Type AttributeSalt Type Attribute Principal Database Utilities Principal Database UtilitiesUtility Task Kerberos Database Utilities 226 Database Encryption Database Master Password Destroying the Kerberos Database 230 Dumping the Kerberos Database Loading the Kerberos Database Stashing the Master Key 234 Starting and Stopping Daemons Starting and Stopping Daemons and Services SituationHost/fqdn@REALM Maintenance TasksMaster Password Protecting Security Server SecretsBacking Up the Principal Database Backing Up primary security server Data238 Removing Unused Space from the Database 240 Propagating the Kerberos 242 Propagation Relationships Propagation HierarchyService Key Table Extracting a Key to the Service Key Table FileMaintaining Secret Keys in the Key Table File Deleting Older Keys from the Service Key Table File Creating a New Service Key Table FilePropagation Tools If You Want To Use This Tool Propagation ToolsOne or more servers once Propagation is conﬁgured Started Kpropd Daemon Mkpropcf Tool 250 Kpropd.ini File Sections Defaultvalues SectionChapter 253 Secsrvname Section Conﬁguration ﬁle Examples256 Prpadmin Administrative Application Setting Up Propagation Daemon Name Function Generic Usage Primary security server Services and Daemons260 Chapter 261 262 Critical Error Messages Monitoring PropagationMonitoring the Log File Monitoring Old File Date and Large File Size Monitoring Propagation Queue FilesAuthentication problems Updating the principal.ok Time StampComparing the Database to Its Copies Administration appears normal Log ﬁles indicate problemsMismatch between the number of principals Kdbdump Utility Restarting Propagation Using the Full Dump Method Restarting Propagation Using a Simple ProcessPropagation Failure Security server Converting a secondary security server to a primaryCleaning the Temp Directory Restarting ServicesConﬁguring Multirealm Enterprises Number of Realms per DatabasePrimary security servers Supporting Multiple Realms Adding More Realms to a Multirealm Database Multiple primary security servers Supporting a Single RealmDatabase Propagation for Multirealm Databases Managing Multiple Realms 276 Considering a Trust Relationship One-Way TrustTwo-Way Trust Other Types of Trust Hierarchical TrustConﬁguring Direct Trust Relationships 280 Hierarchical Chain of Trust Hierarchical Interrealm TrustHierarchical Interrealm Conﬁguration Chapter 283 Conﬁguring the Local Realm Conﬁguring the Intermediate Realm Conﬁguring the Target Realm Hierarchical Interrealm Trust Chapter 287 288 Troubleshooting 290 Characterizing a Problem 292 Diagnostic Tools Summary Diagnostic ToolsTool Description Name Troubleshooting Kerberos Error MessagesLogging Capabilities Unix Syslog File Services Checklist Troubleshooting TechniquesTroubleshooting Scenarios Cause Tips Troubleshooting Scenarios 298 Server Scenario Cause Troubleshooting Tips Troubleshooting Scenarios for your LDAP-based Kerberos300 Chapter 301 302 Forgotten Passwords General ErrorsClock Synchronization Locking and Unlocking AccountsDecrypt Integrity Check Failed User Error MessagesAdministrative Error Messages Password Has Expired While Getting Initial TicketService Key Not Available While Getting Initial Ticket Chapter 307 Reporting Problems to Your HP Support Contact Chapter 309 310 Conﬁguration Worksheet Appendix a Appendix a 313 314 Sample krb.conf File Appendix B Services File 318 Sample krb.realms File Appendix C Key Distribution Center See KDC GlossaryGlossary Ticket-granting ticket See TGT V5srvtabTicket-granting ticket Index Symbols326 327

Related manuals

Manual 13 pages 9.67 Kb

Manual 285 pages 23.05 Kb