HP UX Kerberos Data Security Software manual Setting Administrative Permissions

Page 159

Administration

Setting Administrative Permissions

 

 

Setting Administrative Permissions

 

 

Use the kadminl_ui window to assign administrative permissions to

 

 

users. When a principal is assigned administrative permissions, the

 

 

principal and its permissions are saved to the admin_acl_file located

 

 

on the primary security server.

 

 

We recommend the convention of adding a principal with the instance

 

 

/admin to identify a principal who is an administrator. The user’s /admin

 

 

instance should have a different password than other instances, thus

 

 

providing additional security during administrative tasks. Users signing

 

 

on to kadmin_ui to perform administrative tasks must log in with the

 

 

admin principal. For example, user/admin@REALM.

 

 

To set administrative permissions

Step

1. In the kadminl_ui window, choose the Principals tab and select the

 

 

realm where the principal resides.

Step

2.

Find the principal to be assigned administrative permissions and then

 

 

click Edit. The Principal Information window appears. See “Finding

 

 

a Principal” on page 126 on how to search for a principal.

Step

3.

From the Edit menu, select Edit Administrative Permissions. The

 

 

Administrative Permissions window appears.

Step

4.

Select the appropriate permissions for the principal. The principal may

 

 

be assigned permissions for all realms or just for the realm where the

 

 

principal resides.

 

 

To enable a principal to run the Administrator program, the principal

 

 

must have the Inquire About Principals permission enabled.

Step

5. Click OK to save the permissions to admin_acl_file.

Chapter 6

159

Page 158 Page 160
Image 159
Page 158 Page 160
Contents Manufacturing Part Number T1417-90003 E0602 EditionLegal Notices Page Page Contents Administration Contents Contents Inter-realm Troubleshooting Glossary Index Contents Tables Tables Figures Figures Preface Related Documentation Accessing the World Wide WebAudience Related Software ProductsRelated Request for Comments RFCs Width ConventionsUsing This Manual Glossary Index Overview Chapter Overview How The Kerberos Server Works Configuring and Administering the Kerberos Server on HP-UX Authentication Process Step Authentication ProcessTGT Authentication Process Authentication Process Is added to the database. The krbtgt/REALM NAMEprincipal DES vs 3DES Key Type SettingsMust be assigned a key type or default keys issued by Krbtgt/REALM Name is the ticket-granting principal. This isInstallation Installation Before Installing The Kerberos Server Hardware Requirements Software Requirements Installing The Kerberos Server With SD-UX Installing The Kerberos Server Chapter Migration Migration Policy Migration on Step-wise Procedure For Migration on Policy Migration Step-wise Procedure For Migration For version 2.0 of the Kerberos Server, as described in Step On successful completion the following message is displayed Step-wise Procedure For Migration Chapter Interoperability With Windows Interoperability With Windows Chapter Overview Understanding the Terminology Understanding the Terminology Table of Analogous Terms HP’s Kerberos Server Windows Table of Analogous TermsCase HP’s Kerberos Server and Windows 2000 InteroperabilityEstablishing Trust Between HP’s Kerberos Servers and Windows Single Realm Domain Authentication Inter-Realm Inter-Domain Authentication Postdated Tickets Special Considerations for InteroperabilityDatabase Considerations Encryption ConsiderationsSpecial Considerations for Interoperability Chapter Configuration Configuration Configuration Files For The Kerberos Server Security Server Files That Require ConfigurationFile Auto-Configuration of the Security Server Auto-Configuration of the Security Server Return to the main menu Editing the Configuration Files Manual Configuration Of The Kerberos ServerManual Configuration Of The Kerberos Server Krb.conf Format Krb.confRealm Sample krb.conf File Reference Krb.realms Krb.realms Format Krb.realms Sample krb.realms Sample krb.realms Chapter Configuring The Primary Server Creating The Principal Database After Installation Add An Administrative Principal To add an administrative principal usingAdministrator Run Command-Line-Administrator,kadmin Create The host/fqdn principal And Extract Its Service Key Start the Kerberos daemons Define Secondary Server Network Locations Password Policy File AdminaclfileSecurity Policies Starting the Security Server Summary Sbin/initd/krbsrv start Configuring The Secondary Security Servers Create the Principal DatabaseCopy the Kerberos Configuration File Create a host/fqdn Principal and Extract Its Key Administration Administration Administering the Kerberos Database Kadmind Adminaclfile Assigning Administrative Permissions List prinicpal. This is redundant with i or Adding Entries to the adminaclfile Creating Administrative Accounts Using Restricted AdminsitratorHow the r/R Modifiers Work 100 Password Policy setting Default Password Policy FileEditing the Default File Default Password Policy Settings for the base group102 Principals 104 Adding User Principals Adding New Service PrincipalsReserved Service Principals Chapter 107 Do not remove or modify this principal entry Removing User Principals Remove Special Privilege SettingsProtecting Secret Keys Removing Service Principals Administration Tools Kadmin Vs kadminlAdministration Tools Tool Name Tool Description Administrator Apply Standard Functionality of the AdministratorUsage of kadminlui Local Administrator kadminluiChapter 117 Principals Tab Principals TabChapter 119 General Tab Principal Information Window General Tab Principal Information windowChapter 121 To add a principal Adding Principals to the DatabaseTo simultaneously add multiple principals with Same settingsTo create an administrative principal Creating an Administrative PrincipalChapter 125 Finding a Principal To search for a principalSearch Criteria Chapter 127 128 To delete a user principal Deleting a PrincipalTo reload the default values for a principal Loading Default Values for a PrincipalRestoring Previously Saved Values for a Principal To restore previously saved values for a principalTo change ticket information Changing Ticket InformationChapter 133 Example Rules for Setting Maximum Ticket LifetimeExamples Rules for Setting Maximum Renew TimeTo change the password information Changing Password InformationPassword at their next logon A principal’s password. You must inform the principalPassword Tab Principal Information Password Tab Principal Information WindowWindow Chapter 139 Change Password Window Password Tab Change Password window Password tabChapter 141 To change a DES principal’s key type to 3DES Changing Key TypesChapter 143 To change principal attributes Changing Principal AttributesAttributes Tab Principal Information Window Attributes Tab Principal Information146 Chapter 147 148 Chapter 149 To delete a service principal Deleting a Service PrincipalTo securely extract principal keys to the service key Extracting Service Keys152 Extract Service Key Table Window Extract Service Key Table window154 To edit the default group Using Groups to Control SettingsGroup Information window Principal Group Information Window Setting the Default Group Principal Attributes Default Principal AttributesPrincipal Attributes To set administrative permissions Setting Administrative PermissionsAdministrative Permissions Administrative PermissionsChapter 161 162 Realms Tab Realms Tab10 Realm Information Window Realms Tab Realm Information window Realms tabTo add a realm Adding a RealmTo delete a realm Deleting a RealmRemote Administrator kadminui 168 Administration Manual Administration Using kadmin Chapter 171 Add Random Key Add a New PrincipalSpecify New Password Change Password to a New Randomly Generated PasswordDelete a Principal Extract a Principal Modifying a Principal List the Attributes of a PrincipalNumber of Authentication failures fcnt To modify the principal admin, you need to do the followingAttributes Key Version Number AttributeAllow Renewable Attribute Allow Postdated AttributeAllow Forwardable Attribute Allow Proxy Attribute Allow Duplicate Session Key Attribute Require Preauthentication AttributeRequire Password Change Attribute Lock Principal Attribute Allow as Service AttributeFollowing Require Initial Authentication AttributeTgtbased Authentication Set As Password Change Service AttributePassword Expiration Attribute Maximum Ticket Lifetime Attribute Principal Expiration AttributeMaximum Renew Time Attribute Key Type AttributeSalt Type Attribute Chapter 189 Principal Database Utilities If you want to Use This Tool Principal Database UtilitiesCreating the Kerberos Database 192 Database Encryption Database Master Password Destroying the Kerberos Database Dumping the Kerberos Database Loading the Kerberos Database Stashing the Master Key Chapter 199 Services Situation Daemons and Services Starting and Stopping DaemonsSituations that require Starting and Stopping Daemons Host/fqdn@REALM Maintenance TasksMaster Password Protecting Security Server SecretsSpecial Note on Backing up the Principal Database Backing Up Primary Server DataChapter 203 Removing Unused Space From the Database Chapter 205 206 Propagation 208 Propagation Relationships Propagation HierarchyService Key Table v5srvtab Extracting a Key to the Service Key Table FileMaintaining Secret Keys In The Key Table File Deleting Older Keys From the Service Key Table File Creating a New Service Key Table FilePropagation Tools If You Want To Use This Tool Propagation ToolsChapter 213 Kpropd Mkpropcf 216 Kpropd.ini Sections Defaultvalues sectionChapter 219 Secsrvname Section All servers contain the following entries Examples222 Prpadmin Setting Up Propagation Chapter 225 226 Chapter 227 228 Critical Error Messages Monitoring PropagationMonitoring the Log File Monitoring for Old File Date and Large File Size Monitoring Propagation Queue FilesComparing the Database to its Copies Principal.ok Time Stamp Does Not UpdateAdministration Appears Normal Authentication Problems OccurKdbdump Log Files Indicate ProblemsAuthentication Tests Succeed Number of Principals Does Not MatchRestarting Propagation Using the Simple Process Propagation Failure Restarting Propagation Using the Full Dump MethodConverting a Secondary Server to a Primary Server Cleaning the Temp Directory Restarting Services238 Configuring for Multi-realm Enterprises Number of Realms per DatabasePrimary Servers That Support Multiple Realms Multiple Primary Servers That Support a Single Realm Adding More Realms to a Multi-realm DatabaseDatabase Propagation for Multi-realm Databases To Configure a propagation in a multi-realm environment 242 Inter-realm 244 Considering Trust Relationships One-way TrustTwo-way Trust Other Types Of Trust Hierarchical TrustChapter 247 248 Chapter 249 Configuring Direct Trust Relationships Direct Trust Relationship Example Hierarchical Inter-realm Trust Hierarchical Chain of TrustHierarchical Inter-realm Example Hierarchical Inter-realm Configuration 254 Chapter 255 256 Chapter 257 258 Troubleshooting 260 Chapter 261 Characterizing the Problem Chapter 263 Diagnostic Tools Diagnostic Tools SummaryTroubleshooting Kerberos Error MessagesLogging Capabilities Unix Syslog File Services ChecklistTroubleshooting Techniques Table of Errors Messages Chapter 269 270 General Errors Forgotten PasswordsLocking and Unlocking Accounts Clock Synchronization Decrypt integrity check failed Typical User Error MessagesAction Administrative Error MessagesPassword has expired while getting initial ticket Service key not available while getting initial ticketChapter 275 Reporting Problems to Your Hewlett-Packard Support Contact Chapter 277 278 Glossary Glossary Glossary 281 Ticket-granting-ticket Index Symbols284 285
Related manuals
Manual 327 pages 9.34 Kb Manual 13 pages 9.67 Kb
Top Page Image Contents