HP UX Kerberos Data Security Software Log Files Indicate Problems, Authentication Tests Succeed

Page 233

Propagation

Monitoring Propagation

Log Files Indicate Problems

If an examination of the logs for the primary server and the secondary servers suggests propagation problems, then your set of clues is nearly complete. If kpropd is not running on the primary server and each secondary server, then you can be certain that an out-of-sync condition exists.

Number of Principals Does Not Match

The number of principals on both machines should be identical or close. It is not unusual to see a few discrepancies, especially if the databases were dumped during a propagation cycle. It can be off by a few principals due to incremental database propagation, but rarely will be off by more than a few principals. To ensure accurate results, dump the databases simultaneously and after hours, at a time when administrative activity is at a minimum. Under these conditions, consider a discrepancy of more than ﬁve principal entries to be signiﬁcant.

Authentication Tests Succeed

The last step to conﬁrm this problem is to force authentication tests to go to the primary server. You only need to do this for one or two machines. Ensure that the test principal is not locked and you know the password. Edit the krb.conf ﬁle and comment out the secondary servers by placing a # in the ﬁrst column on each secondary server entry. The ﬁle will look similar to the following:

#FINANCE.BAMBI.COM fnc01.bambi.com

#IT.BAMBI.COM it02.bambi.com

NETWORK.BAMBI.COM netwrk05.bambi.com admin server

Attempt to authenticate from the machine with the new conﬁguration ﬁle. If authentication succeeds continuously you have your ﬁnal clue that the out-of-sync condition exists.

kdb_dump

To view details of any discrepancy between a primary and secondary principal database and look for out-of-sync conditions, export each database to a text ﬁle and compare them. You can dump the databases by stopping the daemons or services and then using the kdb_dump utility. You must stop the daemons before using kdb_dump.

Chapter 7

233

Image 233

Contents Manufacturing Part Number T1417-90003 E0602 EditionLegal Notices Page Page Contents Administration Contents Contents Inter-realm Troubleshooting Glossary Index Contents Tables Tables Figures Figures Preface Audience Accessing the World Wide WebRelated Software Products Related DocumentationRelated Request for Comments RFCs Width ConventionsUsing This Manual Glossary Index Overview Chapter Overview How The Kerberos Server Works Conﬁguring and Administering the Kerberos Server on HP-UX Authentication Process Step Authentication ProcessTGT Authentication Process Authentication Process Must be assigned a key type or default keys issued by DES vs 3DES Key Type SettingsKrbtgt/REALM Name is the ticket-granting principal. This is Is added to the database. The krbtgt/REALM NAMEprincipalInstallation Installation Before Installing The Kerberos Server Hardware Requirements Software Requirements Installing The Kerberos Server With SD-UX Installing The Kerberos Server Chapter Migration Migration Policy Migration on Step-wise Procedure For Migration on Policy Migration Step-wise Procedure For Migration For version 2.0 of the Kerberos Server, as described in Step On successful completion the following message is displayed Step-wise Procedure For Migration Chapter Interoperability With Windows Interoperability With Windows Chapter Overview Understanding the Terminology Understanding the Terminology Table of Analogous Terms HP’s Kerberos Server Windows Table of Analogous TermsCase HP’s Kerberos Server and Windows 2000 InteroperabilityEstablishing Trust Between HP’s Kerberos Servers and Windows Single Realm Domain Authentication Inter-Realm Inter-Domain Authentication Database Considerations Special Considerations for InteroperabilityEncryption Considerations Postdated TicketsSpecial Considerations for Interoperability Chapter Conﬁguration Conﬁguration File Conﬁguration Files For The Kerberos ServerSecurity Server Files That Require Conﬁguration Auto-Conﬁguration of the Security Server Auto-Conﬁguration of the Security Server Return to the main menu Editing the Conﬁguration Files Manual Conﬁguration Of The Kerberos ServerManual Conﬁguration Of The Kerberos Server Krb.conf Format Krb.confRealm Sample krb.conf File Reference Krb.realms Krb.realms Format Krb.realms Sample krb.realms Sample krb.realms Chapter Conﬁguring The Primary Server Creating The Principal Database After Installation Administrator Add An Administrative PrincipalTo add an administrative principal using Run Command-Line-Administrator,kadmin Create The host/fqdn principal And Extract Its Service Key Start the Kerberos daemons Deﬁne Secondary Server Network Locations Security Policies Password Policy FileAdminaclﬁle Starting the Security Server Summary Sbin/initd/krbsrv start Copy the Kerberos Conﬁguration File Conﬁguring The Secondary Security ServersCreate the Principal Database Create a host/fqdn Principal and Extract Its Key Administration Administration Administering the Kerberos Database Kadmind Adminaclﬁle Assigning Administrative Permissions List prinicpal. This is redundant with i or Adding Entries to the adminaclﬁle How the r/R Modiﬁers Work Creating Administrative AccountsUsing Restricted Adminsitrator 100 Editing the Default File Password Policy FileDefault Password Policy Settings for the base group Password Policy setting Default102 Principals 104 Adding User Principals Adding New Service PrincipalsReserved Service Principals Chapter 107 Do not remove or modify this principal entry Removing User Principals Remove Special Privilege SettingsProtecting Secret Keys Removing Service Principals Administration Tools Kadmin Vs kadminlAdministration Tools Tool Name Tool Description Administrator Apply Standard Functionality of the AdministratorUsage of kadminlui Local Administrator kadminluiChapter 117 Principals Tab Principals TabChapter 119 General Tab Principal Information Window General Tab Principal Information windowChapter 121 To add a principal Adding Principals to the DatabaseTo simultaneously add multiple principals with Same settingsTo create an administrative principal Creating an Administrative PrincipalChapter 125 Search Criteria Finding a PrincipalTo search for a principal Chapter 127 128 To delete a user principal Deleting a PrincipalTo reload the default values for a principal Loading Default Values for a PrincipalRestoring Previously Saved Values for a Principal To restore previously saved values for a principalTo change ticket information Changing Ticket InformationChapter 133 Example Rules for Setting Maximum Ticket LifetimeExamples Rules for Setting Maximum Renew TimeTo change the password information Changing Password InformationPassword at their next logon A principal’s password. You must inform the principalWindow Password Tab Principal InformationPassword Tab Principal Information Window Chapter 139 Change Password Window Password Tab Change Password window Password tabChapter 141 To change a DES principal’s key type to 3DES Changing Key TypesChapter 143 To change principal attributes Changing Principal AttributesAttributes Tab Principal Information Window Attributes Tab Principal Information146 Chapter 147 148 Chapter 149 To delete a service principal Deleting a Service PrincipalTo securely extract principal keys to the service key Extracting Service Keys152 Extract Service Key Table Window Extract Service Key Table window154 To edit the default group Using Groups to Control SettingsGroup Information window Principal Group Information Window Principal Attributes Setting the Default Group Principal AttributesDefault Principal Attributes To set administrative permissions Setting Administrative PermissionsAdministrative Permissions Administrative PermissionsChapter 161 162 Realms Tab Realms Tab10 Realm Information Window Realms Tab Realm Information window Realms tabTo add a realm Adding a RealmTo delete a realm Deleting a RealmRemote Administrator kadminui 168 Administration Manual Administration Using kadmin Chapter 171 Add Random Key Add a New PrincipalDelete a Principal Specify New PasswordChange Password to a New Randomly Generated Password Extract a Principal Modifying a Principal List the Attributes of a PrincipalNumber of Authentication failures fcnt To modify the principal admin, you need to do the followingAttributes Key Version Number AttributeAllow Renewable Attribute Allow Postdated AttributeAllow Forwardable Attribute Allow Proxy Attribute Allow Duplicate Session Key Attribute Require Preauthentication AttributeRequire Password Change Attribute Lock Principal Attribute Allow as Service AttributeFollowing Require Initial Authentication AttributeTgtbased Authentication Set As Password Change Service AttributePassword Expiration Attribute Maximum Ticket Lifetime Attribute Principal Expiration AttributeSalt Type Attribute Maximum Renew Time AttributeKey Type Attribute Chapter 189 Principal Database Utilities If you want to Use This Tool Principal Database UtilitiesCreating the Kerberos Database 192 Database Encryption Database Master Password Destroying the Kerberos Database Dumping the Kerberos Database Loading the Kerberos Database Stashing the Master Key Chapter 199 Situations that require Starting and Stopping Daemons Services Situation Daemons and ServicesStarting and Stopping Daemons Master Password Maintenance TasksProtecting Security Server Secrets Host/fqdn@REALMSpecial Note on Backing up the Principal Database Backing Up Primary Server DataChapter 203 Removing Unused Space From the Database Chapter 205 206 Propagation 208 Propagation Relationships Propagation HierarchyMaintaining Secret Keys In The Key Table File Service Key Table v5srvtabExtracting a Key to the Service Key Table File Deleting Older Keys From the Service Key Table File Creating a New Service Key Table FilePropagation Tools If You Want To Use This Tool Propagation ToolsChapter 213 Kpropd Mkpropcf 216 Kpropd.ini Sections Defaultvalues sectionChapter 219 Secsrvname Section All servers contain the following entries Examples222 Prpadmin Setting Up Propagation Chapter 225 226 Chapter 227 228 Monitoring the Log File Critical Error MessagesMonitoring Propagation Monitoring for Old File Date and Large File Size Monitoring Propagation Queue FilesComparing the Database to its Copies Principal.ok Time Stamp Does Not UpdateAdministration Appears Normal Authentication Problems OccurAuthentication Tests Succeed Log Files Indicate ProblemsNumber of Principals Does Not Match KdbdumpRestarting Propagation Using the Simple Process Propagation Failure Restarting Propagation Using the Full Dump MethodConverting a Secondary Server to a Primary Server Cleaning the Temp Directory Restarting Services238 Primary Servers That Support Multiple Realms Conﬁguring for Multi-realm EnterprisesNumber of Realms per Database Database Propagation for Multi-realm Databases Multiple Primary Servers That Support a Single RealmAdding More Realms to a Multi-realm Database To Conﬁgure a propagation in a multi-realm environment 242 Inter-realm 244 Two-way Trust Considering Trust RelationshipsOne-way Trust Other Types Of Trust Hierarchical TrustChapter 247 248 Chapter 249 Conﬁguring Direct Trust Relationships Direct Trust Relationship Example Hierarchical Inter-realm Example Hierarchical Inter-realm TrustHierarchical Chain of Trust Hierarchical Inter-realm Conﬁguration 254 Chapter 255 256 Chapter 257 258 Troubleshooting 260 Chapter 261 Characterizing the Problem Chapter 263 Diagnostic Tools Diagnostic Tools SummaryLogging Capabilities Troubleshooting KerberosError Messages Unix Syslog File Services ChecklistTroubleshooting Techniques Table of Errors Messages Chapter 269 270 Locking and Unlocking Accounts General ErrorsForgotten Passwords Clock Synchronization Decrypt integrity check failed Typical User Error MessagesPassword has expired while getting initial ticket Administrative Error MessagesService key not available while getting initial ticket ActionChapter 275 Reporting Problems to Your Hewlett-Packard Support Contact Chapter 277 278 Glossary Glossary Glossary 281 Ticket-granting-ticket Index Symbols284 285

Related manuals

Manual 327 pages 9.34 Kb

Manual 13 pages 9.67 Kb