Kerberos and Single Sign On, Kdcsetup, Ssoutil

For information on the available methods, see the Open Directory administration guide.

Kerberos and Single Sign On

The following tools are available for setting up your Kerberos and Single Sign-On environment. For more information on a tool, see the related man page.

Tool (in usr/sbin/)	Description
kdcsetup	Creates necessary setup files and adds krb5kdc and kadmind
	servers for the Apple Open Directory KDC.

sso_util	Sets up, interrogates, and tears down the Kerberos configuration
	within the Apple Single Sign On environment.

kerberosautoconfig	Creates the edu.mit.Kerberos file based on the Open Directory
	KerberosClient record.

160

Chapter 14 Working With Open Directory

Page 160

Image 160

Apple oxs manual Kerberos and Single Sign On, Tool in usr/sbin Description, Kdcsetup, Ssoutil, Kerberosautoconfig

Contents

Mac OS X Server Command-Line Administration 034-2354/10-24-03 Contents Setting General System Preferences Energy Saver SettingsViewing or Changing Sleep Settings Power Management Settings Working With Disks and Volumes Mounting and Unmounting VolumesMounting Volumes Unmounting Volumes Working With File Services AFP ServiceStarting and Stopping AFP Service Checking AFP Service Status Working With Print Service Starting and Stopping Print ServiceChecking the Status of Print Service Viewing Print Service Settings Changing Settings Using serveradmin 156 Changing Open Directory Service Settings 157 157 Configuring Ldap Index 171 Commands and Other Terminal Text Command Parameters and OptionsNotation Conventions Summary Default Settings Commands Requiring Root Privileges Using Terminal To open Terminal Correcting Typing Errors Repeating CommandsIncluding Paths Using Drag-and-Drop To type a command $ sudo serveradmin list Sending Commands to a Remote Server Sending a Single CommandExample ssh -l admin To open a connection to a remote server Updating SSH Key Fingerprints Getting Online Help for Commands Using TelnetTo enable Telnet access To disable Telnet access Serversetup Determining Whether a Service Needs to be RestartedPage Installing Server Software Automating Server SetupCreating a Configuration File Template To save a template configuration file during server setup Installing Server Software and Finishing Basic Setup Installing Server Software and Finishing Basic Setup Installing Server Software and Finishing Basic Setup Naming Configuration Files Changing Server SettingsStoring a Configuration File in an Accessible Location Viewing, Validating, and Setting the Software Serial Number Updating Server Software Moving a Server Page Examples Automatic RestartTo restart the local server To restart a remote server immediately Changing a Remote Server’s Startup Disk Shutting Down a ServerTo change the startup disk To shut down a remote server immediately Computer Name Date and TimeViewing or Changing the Computer Name To display the server’s computer name Viewing or Changing the System Time Viewing or Changing the System DateViewing or Changing the System Time Zone Energy Saver Settings Viewing or Changing Sleep SettingsViewing or Changing Automatic Restart Settings Viewing or Changing Network Time Server Usage Startup Disk Settings Power Management SettingsViewing or Changing the Startup Disk Sharing Settings International SettingsViewing or Changing Remote Login Settings Viewing or Changing Language Settings To view the current setting Login SettingsDisabling the Restart and Shutdown Buttons Viewing Port Names and Hardware Addresses Network Port Configurations Viewing or Changing Media SettingsCreating or Deleting Port Configurations Activating Port Configurations Changing Configuration Precedence TCP/IP SettingsChanging a Server’s IP Address To list TCP/IP settings for a configuration To view TCP/IP settings for port en0To view TCP/IP settings for a particular port or device To change TCP/IP settings for a particular port or device Viewing or Changing DNS Servers AppleTalk Settings Proxy SettingsViewing or Changing FTP Proxy Settings Enabling TCP/IP Viewing or Changing Web Proxy Settings Viewing or Changing Secure Web Proxy SettingsViewing or Changing Streaming Proxy Settings Viewing or Changing Gopher Proxy Settings AirPort Settings Viewing or Changing Socks Firewall Proxy SettingsViewing or Changing Airport Settings Computer, Host, and Rendezvous Name Viewing or Changing the Local Host Name Viewing or Changing the Rendezvous NamePage Mounting Volumes Checking for Disk ProblemsUnmounting Volumes Monitoring Disk Space Reclaiming Disk Space Using Log Rolling Scripts Checking to See if Journaling is Enabled Turning on Journaling for an Existing VolumeManaging Disk Journaling Example Enabling Journaling When You Erase a Disk Setting Up a Case-Sensitive HFS+ File SystemErasing, Partitioning, and Formatting Disks Disabling Journaling Imaging and Cloning Volumes Using ASR To image a boot volumeTo restore a volume from an image Hdiutil convert -format Udzo pathtoimage -o compressedimage To create a user with a specific UID To create a userTo create a user with a specific UID and home directory Importing Users and Groups To import users and groups Creating a Character-Delimited User Import File Writing a Record DescriptionUse the shorthand StandardGroupRecord DSRecTypeStandardGroups Using the StandardUserRecord Shorthand Attribute User AttributesFormat Sample values Attribute Format Sample values MCXSettings AdminLimitsAuthentication AuthenticationHint Mail Attributes in User Records MailAttribute field Description Sample values NotificationState KNotificationStateNotificationOff is assumed NotificationStaticIP Value Checking a Server User’s Name, UID, or Password Checking a User’s Administrator Privileges Creating a User’s Home DirectoryCreating a Group Folder Mounting a User’s Home DirectoryPage Listing Share Points To list existing share points To create a share point Creating a Share PointExamples AFP Service Changing AFP Settings List of AFP Settings Admin31GetsSp AdminGetsSpAllowRootLogin AttemptAdminAuth GuestAccess AdminUsersDefault = afpserver LogLogin Unixwithclassicadminpermissions Default = classicpermissionsNoadminkills SpecialAdminPrivs List of AFP serveradmin Commands Listing Connected UsersTo list connected users Output Disconnecting AFP Users Sending a Message to AFP UsersTo send a message To disconnect users To cancel a disconnect Canceling a User DisconnectValue Description Listing AFP Service Statistics To list samples NFS Service Starting and Stopping NFS ServiceChecking NFS Service Status Viewing NFS Settings FTP Service FTP Settings Changing FTP SettingsParameter ftp List of FTP serveradmin Commands Ftpcommand= DescriptionPage Viewing SMB Settings Changing SMB SettingsTo list all SMB service settings Or see List of SMB Service Settings on List of SMB Service Settings Parameter smb Description Netbios name Local masterLog level Max smbd processes Smbcommand= Description List of SMB serveradmin CommandsListing SMB Users Disconnecting SMB Users Value returned by getConnectedUsers Listing SMB Service Statistics Updating Share Point Information Viewing SMB Service Logs Smb-logVar/log/samba/log.smbd Name-logPage Checking the Status of Print Service Viewing Print Service Settings Print Service Settings Changing Print Service SettingsParameter print Description Queue Data Array Parameter printDescription Here is an example of a queue array parameter block Print Service serveradmin Commands Pausing a QueueListing Queues To pause a queue Holding a Job Listing Jobs and Job InformationTo hold a job Viewing Print Service Log Files To release the jobPage Checking NetBoot Service Status Viewing NetBoot Settings Changing NetBoot Settings NetBoot Service SettingsGeneral Settings Parameter netboot Description Storage Record Array Filters Record Array Image Record Array NetBootPortsRecordsArrayarrayindexm IsEnabledAtIndexPort Record Array EthernetPage Checking the Status of Mail Service Viewing Mail Service Settings Mail Service Settings Changing Mail Service SettingsParameter mail Description Postfixdisablevrfycommand PostfixlmtpsaslpasswordmapsPostfixsmtpsaslpasswordmaps Postfixsmtpsaslauthenable Postfixdeliverlockdelay PostfixmailboxcommandPostfixdefaultverpdelimiters Postfixcleanupservicename Postfixforkdelay PostfixdisablemimeoutputconversionPostfixsmtpdtimeout Postfixsmtpderrorsleeptime Postfixdelaywarningtime PostfixtriggertimeoutPostfixrelaytransport Postfixaliasmaps Postfixsmtpdnoopcommands PostfixalternateconfigdirectoriesPostfixdefaulttransport Postfixsmtpddelayreject Postfixqueueservicename PostfixipctimeoutPostfixdefaultprivs Postfixinflowdelay Postfixshowqservicename PostfixsmtppixworkarounddelaytimePostfixqmqpdtimeout Postfixignoremxlookuperror Postfixbounceservicename PostfixcontentfilterPostfixqmqpderrordelay Postfixsmtpdsenderloginmaps Postfixdefaultextrarecipientlimit PostfixlmtpdatadonetimeoutPostfixlmtpdataxfertimeout Postfixsmtpdatadonetimeout Imappoptimeout ImapmupdateserverImaptimeout Imapenablepop Imapdefaultpartition Imapsrvtab Default = /etc/srvtab ImapimapauthloginImapenableimap Imapallowanonymouslogin Mail serveradmin Commands Command Listing Mail Service Statistics Viewing the Mail Service Logs To display the log locations Setting Up SSL for Mail Service Generating a CSR and Creating a Keychain 120 Obtaining an SSL Certificate Importing an SSL Certificate Into the Keychain Setting Up SSL for Mail Service on a Headless Server Creating a Passphrase File Checking Web Service Status Viewing Web Settings Changing Web Settings Serveradmin and Apache SettingsChanging Settings Using serveradmin An appropriate value for the setting Web serveradmin Commands Viewing Service LogsListing Hosted Sites To list sites Viewing Service Statistics Requestspersecond forCacherequestspersecond for Cachethroughput for Addsite File Example Script for Adding a WebsiteAddsite.in File To run the script IpaddressPort Root Dhcp Service Starting and Stopping Dhcp ServiceChecking the Status of Dhcp Service Viewing Dhcp Service Settings Dhcp Service Settings Changing Dhcp Service SettingsParameter dhcp Description About Subnet IDs Dhcp Subnet Settings ArraySubnet Parameter Leasetimesecs NetaddressNetmask Netrangeend Adding a Dhcp Subnet To add a subnetWINSscopeid WINSsecondaryserver List of Dhcp serveradmin Commands Viewing the Dhcp Service LogCommand Dhcpcommand=Description Location of the DNS service log DNS Service Firewall Service Listing DNS Service StatisticsStarting and Stopping Firewall Service Sample Output Checking the Status of Firewall Service Viewing Firewall Service SettingsChanging Firewall Service Settings Firewall Service Settings Defining Firewall Rules IPFilter Groups With Rules ArrayAdding Rules by Modifying ipfw.conf Parameter ipfilter Description Unmodified ipfw.conf file Example Adding Rules Using serveradminRule Firewall serveradmin Commands IPFilter Rules Array NAT Service NAT Service Settings Changing NAT Service SettingsParameter nat Description Viewing the NAT Service Log NAT serveradmin CommandsParameter natDescription VPN Service Starting and Stopping VPN ServiceChecking the Status of VPN Service Viewing VPN Service Settings List of VPN Service Settings Parameter vpnServers Description PPPDSACLEnabled Com.name.ppp.l2tp PPPAuthenticatorPlugins Arrayindex n Com.name.ppp.l2tpPPPLCPEchoEnabled Com.name.ppp.l2tp PPPVerboseLogging Com.name.ppp.l2tp PPPDSACLEnabled Com.name.ppp.pptp PPPAuthenticatorPlugins Arrayindexn Com.name.ppp.pptpPPPLCPEchoEnabled Com.name.ppp.pptp PPPCCPEnabled Com.name.ppp.pptp List of VPN serveradmin Commands Viewing the VPN Service LogVPN Service Log on this Be restarted. See Determining Whether a Service Needs to be IP Failover RequirementsFailover Operation Hardware To enable IP failover Enabling IP Failover Notification Only Configuring IP FailoverPre and Post Scripts Enabling PPP Dial-In Page Testing Your Open Directory Configuration Testing Open Directory PluginsGeneral Directory Tools Modifying an Open Directory Node Changing Open Directory Service Settings Registering URLs With Service Location Protocol SLPParameter dirserv Description Standard Distribution Tools Configuring LdapProgram Used to Delay Rebind Idle TimeoutIdle Rebinding Options Additional Information About Ldap Password Server NetInfo Kdcsetup KerberosautoconfigKerberos and Single Sign On Tool in usr/sbin Description Stopping Qtss Service Checking Qtss Service Status Viewing Qtss Settings Changing Qtss SettingsTo list all Qtss service settings $ sudo serveradmin settings qtss Qtss Settings Descriptions of SettingsQtss parameters you might change Parameter qtss Description ModulesarrayidQTSSAdminModule AdministratorGroup ModulesarrayidQTSSAdminModuleAuthenticate ModulesarrayidQTSSAdminModule Enableremoteadmin ModulesarrayidQTSSAdminModule Disableoverbuffering ModulesarrayidQTSSReflectorModule Enablebroadcastannounce ModulesarrayidQTSSReflectorModuleEnablebroadcastpush ModulesarrayidQTSSReflectorModule Serverdefaultauthorizationrealm Qtss serveradmin Commands Listing Current Connections Viewing Qtss Service Statistics Error.log Forcing Qtss to Re-Read its PreferencesTo force Qtss to re-read its preferences Library/QuickTimeStreaming/Logs Preparing Older Home Directories for User Streaming To set up /Sites/Streaming in older home directoriesCreated Page Index Kdcsetup utility 160 Kerberos Installer command 21 IP addressKerberosautoconfig tool 173 Used by ldapsearch 157 scripts 174 175

Kerberos and Single Sign On

Tool (in usr/sbin/)

Description

kdcsetup

sso_util

kerberosautoconfig