HP UX Kerberos Data Security Software manual Administration

Page 6

Contents

krb.conf Format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Sample krb.conf File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 krb.realms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 krb.realms Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Sample krb.realms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Configuring The Primary Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Creating The Principal Database After Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Add An Administrative Principal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 To add an administrative principal using the Administrator . . . . . . . . . . . . . . . . . . 80 To add an administrative principal using the Remote Command-Line-Administrator

81

Create The host/<fqdn> principal And Extract Its Service Key . . . . . . . . . . . . . . . . . . 82 Start the Kerberos daemons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Define Secondary Server Network Locations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Security Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Password Policy File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 admin_acl_file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Starting the Security Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Configuring The Secondary Security Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Create the Principal Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Copy the Kerberos Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Create a host/<fqdn> Principal and Extract Its Key . . . . . . . . . . . . . . . . . . . . . . . . . 90

6. Administration

Chapter Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Administering the Kerberos Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 kadmind . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 admin_acl_file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Assigning Administrative Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Adding Entries to the admin_acl_file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Creating Administrative Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Using Restricted Adminsitrator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Password Policy File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Editing the Default File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Principals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

6

Page 5 Page 7
Image 6
Page 5 Page 7
Contents Edition Manufacturing Part Number T1417-90003 E0602Legal Notices Page Page Contents Administration Contents Contents Inter-realm Troubleshooting Glossary Index Contents Tables Tables Figures Figures Preface Related Software Products Accessing the World Wide WebAudience Related DocumentationRelated Request for Comments RFCs Conventions WidthUsing This Manual Glossary Index Overview Chapter Overview How The Kerberos Server Works Configuring and Administering the Kerberos Server on HP-UX Authentication Process Authentication Process StepTGT Authentication Process Authentication Process Krbtgt/REALM Name is the ticket-granting principal. This is DES vs 3DES Key Type SettingsMust be assigned a key type or default keys issued by Is added to the database. The krbtgt/REALM NAMEprincipalInstallation Installation Before Installing The Kerberos Server Hardware Requirements Software Requirements Installing The Kerberos Server With SD-UX Installing The Kerberos Server Chapter Migration Migration Policy Migration on Step-wise Procedure For Migration on Policy Migration Step-wise Procedure For Migration For version 2.0 of the Kerberos Server, as described in Step On successful completion the following message is displayed Step-wise Procedure For Migration Chapter Interoperability With Windows Interoperability With Windows Chapter Overview Understanding the Terminology Understanding the Terminology Table of Analogous Terms Table of Analogous Terms HP’s Kerberos Server WindowsHP’s Kerberos Server and Windows 2000 Interoperability CaseEstablishing Trust Between HP’s Kerberos Servers and Windows Single Realm Domain Authentication Inter-Realm Inter-Domain Authentication Encryption Considerations Special Considerations for InteroperabilityDatabase Considerations Postdated TicketsSpecial Considerations for Interoperability Chapter Configuration Configuration Configuration Files For The Kerberos Server Security Server Files That Require ConfigurationFile Auto-Configuration of the Security Server Auto-Configuration of the Security Server Return to the main menu Manual Configuration Of The Kerberos Server Editing the Configuration FilesManual Configuration Of The Kerberos Server Krb.conf Krb.conf FormatRealm Sample krb.conf File Reference Krb.realms Krb.realms Format Krb.realms Sample krb.realms Sample krb.realms Chapter Configuring The Primary Server Creating The Principal Database After Installation Add An Administrative Principal To add an administrative principal usingAdministrator Run Command-Line-Administrator,kadmin Create The host/fqdn principal And Extract Its Service Key Start the Kerberos daemons Define Secondary Server Network Locations Password Policy File AdminaclfileSecurity Policies Starting the Security Server Summary Sbin/initd/krbsrv start Configuring The Secondary Security Servers Create the Principal DatabaseCopy the Kerberos Configuration File Create a host/fqdn Principal and Extract Its Key Administration Administration Administering the Kerberos Database Kadmind Adminaclfile Assigning Administrative Permissions List prinicpal. This is redundant with i or Adding Entries to the adminaclfile Creating Administrative Accounts Using Restricted AdminsitratorHow the r/R Modifiers Work 100 Default Password Policy Settings for the base group Password Policy FileEditing the Default File Password Policy setting Default102 Principals 104 Adding New Service Principals Adding User PrincipalsReserved Service Principals Chapter 107 Do not remove or modify this principal entry Remove Special Privilege Settings Removing User PrincipalsProtecting Secret Keys Removing Service Principals Kadmin Vs kadminl Administration ToolsAdministration Tools Tool Name Tool Description Administrator Standard Functionality of the Administrator ApplyLocal Administrator kadminlui Usage of kadminluiChapter 117 Principals Tab Principals TabChapter 119 General Tab Principal Information window General Tab Principal Information WindowChapter 121 Adding Principals to the Database To add a principalSame settings To simultaneously add multiple principals withCreating an Administrative Principal To create an administrative principalChapter 125 Finding a Principal To search for a principalSearch Criteria Chapter 127 128 Deleting a Principal To delete a user principalLoading Default Values for a Principal To reload the default values for a principalTo restore previously saved values for a principal Restoring Previously Saved Values for a PrincipalChanging Ticket Information To change ticket informationChapter 133 Rules for Setting Maximum Ticket Lifetime ExampleRules for Setting Maximum Renew Time ExamplesChanging Password Information To change the password informationA principal’s password. You must inform the principal Password at their next logonPassword Tab Principal Information Password Tab Principal Information WindowWindow Chapter 139 Change Password window Password tab Change Password Window Password TabChapter 141 Changing Key Types To change a DES principal’s key type to 3DESChapter 143 Changing Principal Attributes To change principal attributesAttributes Tab Principal Information Attributes Tab Principal Information Window146 Chapter 147 148 Chapter 149 Deleting a Service Principal To delete a service principalExtracting Service Keys To securely extract principal keys to the service key152 Extract Service Key Table window Extract Service Key Table Window154 Using Groups to Control Settings To edit the default groupGroup Information window Principal Group Information Window Setting the Default Group Principal Attributes Default Principal AttributesPrincipal Attributes Setting Administrative Permissions To set administrative permissionsAdministrative Permissions Administrative PermissionsChapter 161 162 Realms Tab Realms TabRealm Information window Realms tab 10 Realm Information Window Realms TabAdding a Realm To add a realmDeleting a Realm To delete a realmRemote Administrator kadminui 168 Administration Manual Administration Using kadmin Chapter 171 Add a New Principal Add Random KeySpecify New Password Change Password to a New Randomly Generated PasswordDelete a Principal Extract a Principal List the Attributes of a Principal Modifying a PrincipalTo modify the principal admin, you need to do the following Number of Authentication failures fcntKey Version Number Attribute AttributesAllow Postdated Attribute Allow Renewable AttributeAllow Forwardable Attribute Allow Proxy Attribute Require Preauthentication Attribute Allow Duplicate Session Key AttributeRequire Password Change Attribute Allow as Service Attribute Lock Principal AttributeRequire Initial Authentication Attribute FollowingAuthentication Set As Password Change Service Attribute TgtbasedPassword Expiration Attribute Principal Expiration Attribute Maximum Ticket Lifetime AttributeMaximum Renew Time Attribute Key Type AttributeSalt Type Attribute Chapter 189 Principal Database Utilities Principal Database Utilities If you want to Use This ToolCreating the Kerberos Database 192 Database Encryption Database Master Password Destroying the Kerberos Database Dumping the Kerberos Database Loading the Kerberos Database Stashing the Master Key Chapter 199 Services Situation Daemons and Services Starting and Stopping DaemonsSituations that require Starting and Stopping Daemons Protecting Security Server Secrets Maintenance TasksMaster Password Host/fqdn@REALMBacking Up Primary Server Data Special Note on Backing up the Principal DatabaseChapter 203 Removing Unused Space From the Database Chapter 205 206 Propagation 208 Propagation Hierarchy Propagation RelationshipsService Key Table v5srvtab Extracting a Key to the Service Key Table FileMaintaining Secret Keys In The Key Table File Creating a New Service Key Table File Deleting Older Keys From the Service Key Table FilePropagation Tools Propagation Tools If You Want To Use This ToolChapter 213 Kpropd Mkpropcf 216 Kpropd.ini Defaultvalues section SectionsChapter 219 Secsrvname Section Examples All servers contain the following entries222 Prpadmin Setting Up Propagation Chapter 225 226 Chapter 227 228 Critical Error Messages Monitoring PropagationMonitoring the Log File Monitoring Propagation Queue Files Monitoring for Old File Date and Large File SizePrincipal.ok Time Stamp Does Not Update Comparing the Database to its CopiesAuthentication Problems Occur Administration Appears NormalNumber of Principals Does Not Match Log Files Indicate ProblemsAuthentication Tests Succeed KdbdumpRestarting Propagation Using the Simple Process Restarting Propagation Using the Full Dump Method Propagation FailureConverting a Secondary Server to a Primary Server Restarting Services Cleaning the Temp Directory238 Configuring for Multi-realm Enterprises Number of Realms per DatabasePrimary Servers That Support Multiple Realms Multiple Primary Servers That Support a Single Realm Adding More Realms to a Multi-realm DatabaseDatabase Propagation for Multi-realm Databases To Configure a propagation in a multi-realm environment 242 Inter-realm 244 Considering Trust Relationships One-way TrustTwo-way Trust Hierarchical Trust Other Types Of TrustChapter 247 248 Chapter 249 Configuring Direct Trust Relationships Direct Trust Relationship Example Hierarchical Inter-realm Trust Hierarchical Chain of TrustHierarchical Inter-realm Example Hierarchical Inter-realm Configuration 254 Chapter 255 256 Chapter 257 258 Troubleshooting 260 Chapter 261 Characterizing the Problem Chapter 263 Diagnostic Tools Summary Diagnostic ToolsTroubleshooting Kerberos Error MessagesLogging Capabilities Services Checklist Unix Syslog FileTroubleshooting Techniques Table of Errors Messages Chapter 269 270 General Errors Forgotten PasswordsLocking and Unlocking Accounts Clock Synchronization Typical User Error Messages Decrypt integrity check failedService key not available while getting initial ticket Administrative Error MessagesPassword has expired while getting initial ticket ActionChapter 275 Reporting Problems to Your Hewlett-Packard Support Contact Chapter 277 278 Glossary Glossary Glossary 281 Ticket-granting-ticket Symbols Index284 285
Related manuals
Manual 327 pages 9.34 Kb Manual 13 pages 9.67 Kb
Top Page Image Contents