You have several options for authenticating users | Apple 10.6

In Mac OS X Server, users trying to access services (like logging in to a directory-aware workstation, or trying to mount a remote volume) must authenticate by providing a login name and password before privileges for the users can be determined.

You have several options for authenticating users:

ÂÂ Open Directory authentication. Based on the standard Simple Authentication and Security Layer (SASL) protocol, Open Directory authentication supports many authentication methods, including CRAM-MD5, APOP, WebDAV, SHA-1, LAN Manager, NTLMv2, and Kerberos.

Open Directory authentication lets you set up password policies for individual users or for all users whose records are stored in a directory, with exceptions if required. Open Directory authentication also lets you specify password policies for individual directory replicas.

For example, you can specify a minimum password length or require a user to change the password the next time he or she logs in. You can also disable login for inactive accounts or after a specified number of failed login attempts.

ÂÂ Kerberos v5 authentication. Using Kerberos authentication allows integration into existing Kerberos environments. The Key Distribution Center (KDC) on

Mac OS X Server offers full support for password policies you set up on the server. Using Kerberos also provides a feature known as single sign-on,described in the next section.

The following services on Mac OS X Server support Kerberos authentication: ÂÂ Address Book Server

ÂÂ Apple Filing Protocol (AFP)

ÂÂ File Transfer Protocol (FTP) ÂÂ iCal Server

ÂÂ iChat Server

ÂÂ Login window ÂÂ Mail Services

ÂÂ Network Filing Protocol (NFS) ÂÂ Open Directory (LDAPv3)

ÂÂ Printing (IPP) ÂÂ Screen saver

ÂÂ Secure Shell (SSH)

ÂÂ Server Message Block file service (SMB) ÂÂ Virtual Private Network (VPN)

ÂÂ Virtual Network Computing (VNC, known as Screen Sharing in Mac OS X Server)

Chapter 4    Enhancing Security

57

Image 57

Apple 10.6 manual You have several options for authenticating users, ÂÂ Secure Shell SSH

Contents

Mac OS X Server 019-1410/2009-08-15 Contents Enhancing Security Administration Tools Installation and Deployment Initial Server Setup Ongoing System Management Monitoring Your System Index Push Notification Server Contents What’s in This Guide About This Guide To see the most recent server help topics Using Onscreen Help Getting Started Document Road Map Preface About This Guide Getting Additional Information Getting Documentation Updates Standards System Requirements for Installing Mac OS X Server ÂÂ iCal Server What’s New in Mac OS X Server Understanding Server Configuration Methods What’s New in Server Admin Snmp NFS Radius Supported Standards System Overview and Supported Standards System Overview and Supported Standards Mac OS X Server’s Unix Heritage Determining Your Server Needs Planning Server Usage Setting Up a Planning Team Determining Whether to Upgrade or Migrate Determining Services to Host on Each Server Identifying Servers to Set Up Planning Server Usage Defining a Migration Strategy Migrating from WindowsDefining an Integration Strategy Defining Physical Infrastructure Requirements Defining Server Setup Infrastructure Requirements Setting up basic server infrastructure Minimizing the Need to Relocate Servers After Setup Defining Backup and Restore PoliciesMaking Sure Required Server Hardware Is Available Understanding Backup and Restore Policies Understanding Backup Types Understanding Restores Understanding Backup Scheduling Defining a Backup Verification Mechanism Other Backup Policy Considerations Understanding Time Machine as a Server Backup Tool Command-Line Backup and Restoration Tools ÂÂ Wiki ÂÂ Xgrid ÂÂ Remote Access Settings ÂÂ Software Update Opening and Authenticating in Server Admin Server Admin M N Server Admin Interface Customizing the Server Admin Environment Server Assistant is used for Server Assistant Workgroup Manager Server Preferences Workgroup Manager Interface Customizing the Workgroup Manager Environment Server Monitor For additional information, see Server Monitor Help ICal Service Utility Interface ICal Service Utility Media Streaming Management System Image Management Command-Line Tools RAID AdminServer Status Widget Podcast Capture, Composer, and Producer Xgrid Admin Apple Remote Desktop About Physical Security Enhancing Security About Network Security Firewalls and Packet FiltersNetwork DMZ MAC Filtering VLANs Payload Encryption Transport Encryption About File Security File and Folder PermissionsAbout File Encryption Secure Delete About Authentication and Authorization ÂÂ Secure Shell SSH You have several options for authenticating users Single Sign-On Public and Private Keys About Certificates, SSL, and Public Key Infrastructure About Certificate Authorities CAs Certificates About Identities About Self-Signed CertificatesAbout Intermediate Trust Certificate Manager in Server Admin To configure clients to trust a certificateFrom the command line Enhancing Security Readying Certificates Requesting a Certificate from a Certificate Authority Creating a Self-Signed CertificateTo create a self-signed certificate To request a signed certificate To create a CA Creating a Certificate Authority Enhancing Security Importing a Certificate Identity Using a CA to Create a Certificate for Someone ElseTo create a certificate for someone else To import an existing OpenSSL style certificate Editing a Certificate Managing Certificates Deleting a Certificate Distributing a CA Public Certificate to ClientsTo distribute your certificate to your clients To delete a certificate Renewing an Expiring Certificate Using CertificatesReplacing an Existing Certificate To renew an expiring certificate To do this, run the following commands in Terminal Key-Based SSH LoginSSH and SSH Keys Generating a Key Pair for SSH Key-Based SSH with Scripting Sample Setting Administration Level Privileges Administration Level Security Service Level Security Setting Sacl PermissionsTo set Sacl permissions for a service Security Best Practices Password Guidelines Creating Complex Passwords Installation Overview Confirm you meet the requirements Gather your information Start up the computer from an installation disk Set up the environment Start the installer Prepare the target disk Gathering the Information You Need Set Up Services About the Server Install Disc Setting Up Network ServicesConnecting to the Directory During Installation SSH During Installation Preparing an Administrator Computer Mac OS X Server Install DiscAdministration Tools CD About Starting Up for Installation To install Mac OS X Server v10.6 administration toolsBefore Starting Up Starting Up from the Install DVD To start up the computer with the installation discStarting Up from an Alternate Partition Restore the image to the alternate partition Create a restorable image of the Install DVDTo create an image of the Install DVD Prepare the disks and partitions on the target computer To restore the image to a free volume To access the computer with Server Assistant Remotely Accessing the Install DVD To access the computer with VNC To access the computer using Screen SharingTo access the computer with SSH Identify the target server Identifying Remote Servers When Installing Mac OS X Server Starting Up from a NetBoot Environment Create a NetInstall image from the Install DVD Preparing Disks for Installing Mac OS X Server Start up the computer from the NetBoot server To create a NetInstall image from the Install DVD ÂÂ Mac OS Extended Journaled, Case-Sensitive aka Hfsx Choosing a File System About Hard Disk Partitioning Partitioning a Disk To partition a disk using Disk Utility About Creating a RAID Set So the command is You cannot create a RAID set from the startup disk To create a RAID set using Disk Utility Diskutil createRAID mirror setName format device device For example Installing Server Software Interactively To install server software locally Installing Locally from the Installation Disc To install on a remote server by using Server Assistant Installing Remotely with Server Assistant Installing Remotely with Screen Sharing and VNC To change a remote computer’s startup disk Changing a Remote Computer’s Startup Disk To use installer to install server software 105 Installing Multiple Servers Most Efficient Methods of InstallationMore Interactive Methods of Installation Upgrading a Computer from Mac OS X to Mac OS X Server How to Keep Current Postponing Server Setup Following Installation To postpone setting up Mac OS X ServerInformation You Need Connecting to the Network During Initial Server Setup Configuring Servers with Multiple Ethernet PortsAbout Settings Established During Initial Server Setup ÂÂ Create Users and Groups Specifying Initial Open Directory Usage Not Changing Directory Usage When Upgrading ÂÂ Configure ManuallyÂÂ Import Users and Groups Binding a Server to Multiple Directory Servers Setting Up a Server as a Standalone Server To interactively connect to an additional directory server Setting up Servers Interactively Select the target servers from the configuration list To set up servers interactively Using Automatic Server Setup Creating and Saving Setup Data To create a setup data file How a Server Searches for Saved Setup Data Files Using Encryption with Setup Data Files Setting Up Servers Automatically Using Data Saved in a File Create the saved setup folder on the remote server To use setup data from a file remotelyRestart the remote server To set the server serial number Handling Setup Errors Adding Services to the Server View Setting Up ServicesTo change services to administer From the command-line Setting Up User Management Setting Up Open DirectorySetting Up All Other Services To set up a user account Setting Up an Administrator Computer Computers You Can Use to Administer a Server Insert the Mac OS X Server Admin Tools CD Using a Non-Mac OS X Computer for Administration Working with Pre-v10.6 Computers from v10.6 Servers Using the Administration Tools Ports Open By Default Ports Used for Administration Adding and Removing Servers in Server Admin Server Admin Basics Grouping Servers Using Smart Groups Grouping Servers ManuallyTo create a server group To create a server smart group Working with Settings for a Specific Server Toolbar button Shows 132 ÂÂ Directory Service ÂÂ Firewall ÂÂ Mobile Access ÂÂ NetBootUnderstanding Mac OS X Server Names Dhcp Directory Service and Kerberos Mobile Access Proxy Services NetBootFirewall Web ÂÂ MySQL Certificates for Web and Wiki Services MySQLWiki 138 ÂÂ Certificates for collaboration services Certificates for Mail ServicesImap and POP Mailing List Address Book Service ICal ServiceIChat Service Certificates for Collaboration Services To change the DNS name of the Podcast Producer computer To change the IP address of the Podcast Producer computer Print Software Update ServerPush Notification Xgrid Changing the IP Address of a Server Changing the Server’s DNS Name After SetupChanging the Server’s Computer Name and the Local Hostname To change the DNS name Administering Services From the command lineTo change computer name and local hostname Importing and Exporting Service Settings Adding and Removing Services in Server AdminTo add or remove a service in Server Admin To export service settings To configure service access SACLs Controlling Access to Services Managing Sharing Using SSL for Remote Server Administration Tiered Administration Permissions Defining Administrative Permissions Workgroup Manager BasicsTo assign permissions Administering Accounts Opening and Authenticating in Workgroup ManagerWorking with Users and Groups 152 Defining Managed Preferences To display the inspector Working with Directory Data Critical Configuration and Data Files Service Configuration AssistantsAssistants are available for the following services General Mail Service Firewall ServiceIChat Server Mail-POP/IMAP Server Dovecot NAT Service MySQL Service Notifications OpenDirectory ServiceQuickTime Streaming Server Tomcat App Server Web Service Improving Service AvailabilityEliminating Single Points of Failure Wiki and Blog Server Using Xserve for High Availability Using Backup Power Setting Up Your Server for Automatic RestartUsing UPS with Xserve Following is the Energy Saver panel of System Preferences Ensuring Proper Operational Conditions To enable automatic restartProviding Open Directory Replication Automatic restart options are Link Aggregation Link Aggregation Scenarios About the Link Aggregation Control Protocol Lacp Computer to Switch To create a link aggregate Setting Up Link Aggregation in Mac OS X Server To monitor the status of a link aggregate Monitoring Link Aggregation Status Load Balancing ÂÂ mDNSresponder local network service discovery process Using launchd for Daemon ControlDaemon Overview Viewing Running Daemons 170 Planning Monitoring Response Planning a Monitoring Policy Using with Server Status Widget Using Server MonitorTo configure the Server Status widget Using RAID Admin for Server Monitoring Using Console for Server MonitoringUsing Disk Monitoring Tools Using Network Monitoring Tools Monitoring Server Status Overviews Using Server Admin Using Server Status Notification in Server AdminTo set a notification To see a status overview for one server Following shows a sample Overview pane for a single server Using Remote Kernel Core Dumps 177 Setting up a core dump server Setting Up a Core Dump Server Setting Up a Core Dump Client Setting up a core dump clientRestart the computer for the settings to take effect About Simple Network Management Protocol Snmp Configuring Common Core Dump Options Configuring snmpd To enable SnmpEnabling Snmp reporting To enable and configure Snmp Customize data Restart snmpd to take changes About Notification and Event Monitoring Daemons Additional Information about SnmpTools to Use with Snmp There are two main notification daemons syslogd and emond Syslog Logging Syslog Configuration File Directory Service Debug LoggingOpen Directory Logging To start debugging at startup Additional Monitoring Aids To enable client-side loggingAFP Logging To run slapd in debugging mode About Push Notification Server Push Notification Server Starting and Stopping Push Notification To enable Push Notification Changing a Service’s Push Notification Server Click Save, then restart the serviceTo change the existing push notification server Index 192 193 194 195 196 197