Access Control | HP UX Internet Express Software specs

Access Control

By default, users defined in the LDAP database are able to log into every system which uses that database in conjunction with the LDAP Module for System Authentication. If you want to limit user access to specific systems, use the access control files /etc/ldapusers.deny and /etc/ ldapusers.allow.

A default /etc/ldapusers.deny file is provided at installation time. Included are all of the standard system users: root, bin, daemon, and so on. If you want to deny access to a user, add that user's name to the /etc/ldapusers.deny file.

If you want to disallow access to all but a few users, use the /etc/ldapusers.allow file. If the /etc/ldapusers.allow file exists on a system, only users listed in that file are allowed to log in using LDAP authentication. Note that this is true even if /etc/ldapusers.allow is empty — its very existence invokes the stricter access control rules.

Utilities for Maintaining User Information in the LDAP Directory Server

The Internet Express software kit includes several utilities that you can use to maintain the extended LDAP directory server shipped with Internet Express. The following utilities, summarized in Table 5, are installed in the /usr/internet/ldap_tools directory:

•ldap_check—Section : Checking the LDAP Server Configuration

•passwd_extract—Section : Extracting Users from the /etc/passwd File

•ldap_add_user—Section : Adding a User Entry

•ldap_del_user—Section : Deleting a User Entry

•ldap_get_user—Section : Retrieving a User Entry

•ldap_sync_user—Section : Synchronizing with a Password File

•ldap_add_group—Section : Adding a Group Entry

•ldap_mod_group—Section : Maintaining Group Membership

•ldap_del_group—Section : Deleting a Group Entry

•ldap_get_group—Section : Retrieving a Group Entry

•ldap_passwd—Section : Setting a User's Password in the LDAP Directory Server

•ldap_enable—Section : Starting the ldapcd Daemon

•ldap_disable—Section : Stopping the ldapcd Daemon

78 User Authentication

Image 78

HP UX Internet Express Software manual Access Control

Contents

Internet Express for Tru64 Unix Version AbstractPage Contents User Authentication Mail Delivery Administration Mail Access Administration 132 Web Services Administration 155 XML Component Administration 164Network Security Administration 167 Proxy Services Administration 190 Ldap Directory Server Administration 195 OpenSLP Administration 207 FTP Server Administration 213Samba File and Print Server Administration 216 InterNetNews Server Administration 225 Internet Relay Chat Administration 248 Jabber 265 PostgreSQL Database and MySQL Administration 249Bind Domain Name Server Administration 260 Twiki 266 About This Document Intended AudienceDocument Organization Computer output CommandTypographic Conventions User input Related Information Reading Documentation Using the Administration UtilityReading Documentation Using the Public Web Server Reading the Documentation On a Tru64 Unix System Reading Documentation from the Internet Express CD-ROMReading Reference Pages for Internet Express Components On a PC # man -M /usr/news/man active.5 Readers CommentsReading the Open Source Software Component Documentation Internet electronic mail readerscomment@zk3.dec.com Readers Comments Using the Administration Utility Using the Administration Utility Using the Administration Utility Main Menu Administration Utility Menu Options and Tasks Using Administration Utility Forms Registering Your Internet Express InstallationNavigating the Administration Utility Register Online Sample Administration Utility Form Port Number Description Accessing Administration ServersInternet Express Accounts and Ports 8081 Internet Express Accessing the Internet Express Login Account Accessing and Managing the Internet MonitorManaging Internet Express in a TruCluster Environment Installing and Removing Components Using Internet Express Services in a ClusterTruCluster Impact on Internet Express Administration Hostname of the local host Installing and Removing ComponentsKeywords for URL Line Port number from the current Web server Accessing Web-Based System Management Tools Performing Web-Based System Management Tuning Kernel Attribute Values Accessing Web-Based System Management Tools Using the Administration Utility Where to Find More Information Internet Express and AlphaServer Products Web SitesOpen Source Software Web Sites FreeRADIUS ExpectFirefox GnuPG Lynx Web Browser IRC ServerJabber Majordomo Automated Internet Mailing Lists Manager OpenSLP MySQLOpenLDAP Perl Pure-FTP Server PostgreSQL Relational Database Management SystemProcmail Mail Filtering Language Samba File and Print Server System Security Web Sites InterNIC Other Useful Web SitesApplications Microsoft Encompass User Administration Manage Users Menu User Administration Overview of User Accounts Specifying User Names Assigning Passwords to User AccountsPurging Obsolete Passwords Overview of User Accounts Searching for User Accounts Searching for User Accounts Assigning Users to Groups Selecting User Accounts Creating Captive Accounts for Named Users Shows the Create Named User Account form Creating Captive Accounts for Generic Users Creating a Named User Account Creating a Noncaptive Account for a Unix System User Creating Generic User Accounts To create a group, see Section Creating Groups Creating a Noncaptive Account for a Unix System User Creating Groups Creating a System User Account Displaying User Account Information Creating Groups Deleting User Accounts Displaying User Account Information Changing Groups for User Accounts Changing Groups for User Accounts User Administration Changing the Password for an Account Changing the Password for an Account Changing Mail Services for Users Assigning Regular Delivery Mail Service Assigning POP with Password Mail ServiceChanging Mail Services for Users Assigning the Cyrus Imap Mail Service Assigning Cyrus Imap with Password Mail Service Changing the iass Account Forwarding Address Assigning Apop with Password Mail ServiceManaging the iass Account Managing the .users.list File Purging Passwords for User Accounts Managing the User Self-Administration FeatureListing User Accounts and Passwords Removing the .users.list File Enabling and Disabling the User Self-Administration Feature Managing the User Self-Administration Feature Manage User Self-Administration Menu Modifying the Web Server Configuration Configure Web Server for Self-Administration Form Enabling and Disabling Login Delays Modify Web Server Configuration Managing User Self-Administration Groups Adding Groups Deleting and Modifying Groups Adding Groups Customizing the User Self-Administration Feature Enabling and Disabling Groups User Administration User Authentication Managing the Ldap Module for System AuthenticationManaging the Ldap Module for System Authentication Example 1 Security Matrix Enabled for Ldap User Authentication Ldap Caching Daemon Example 2 Ldap Caching Daemon Configuration File Creating Branches Value of searchbase Value of machinedn Value of machinepass Extended Ldap Schema for Unix Account Information Userbranch ou=accounts,searchbase Indexing Attributes for the Directory Servers Configuring the Ldap Module for System Authentication Adding Indices for OpenLDAPLdap Database Index Types Modifying the Ldap Module Configuration Configuring the Ldap Module for System AuthenticationDefining Ldap System Parameters Configuring Ldap Password Attributes Configuring Ldap Group Attributes Testing the Ldap Module Configuration Importing and Exporting Users from /etc/passwdEnabling and Disabling the Ldap Module Exporting Users from the Directory Server Importing Users into the Directory ServerImporting Users from NIS Adding an Ldap User in a C2 Environment Access Control Ldap Database Utilities File in which to store search results the default is Remove login names from specified groupRemove login names from all groups Authentication mechanism Checking the Ldap Server Configuration Extracting Users from the /etc/passwd FileAdding a User Entry Deleting a User Entry Retrieving a User Entry Synchronizing with a Password File Adding a Group EntryLdapsyncuser -b branch filename Maintaining Group Membership Deleting a Group Entry Starting the ldapcd Daemon Setting a Users Password in the Ldap Directory ServerRetrieving a Group Entry Ldapgetgroup -b branch -f input-file Adding Entries to an Ldap Database Maintaining the Ldap Directory Server Using Ldap CommandsStopping the ldapcd Daemon Modifying Entries in an Ldap Database Overview of the Ldap Client Authentication Actions PerformedFiles Modified by theLDAP Module for System Authentication Actions Performed by the Ldap Client Debugging ldapdc Operation of login/suBehavior of the the ldapdc Daemon Etc/ldapusers.allow # su user1 Mail Delivery Administration Mail Delivery AdministrationSendmail Server Administration Bogofilter to filter spam Section Bogofilter Spam Filter Configuring the System as a Mail Server Configuring the System as a Standalone Mail SystemConfiguring the System as a Mail Client Ldap see Section Configuring Ldap Creating and Deleting Host Aliases for a Mail Server Changing the Sendmail Server Configuration Sendmail Server Administration Through Section Configuring the X.25 Protocol Configuring Mail ProtocolsPSInet see Section Configuring the X.25 Protocol Creating and Deleting Pseudo Domain Aliases Configuring the MTS Protocol Configuring the DECnet Phase IV Protocol Configuring the DECnet/OSI Protocol Configuring the Uucp Protocol Configuring the X.25 Protocol Configuring Masquerading Accessing the Configure Masquerading Form Root Postmaster News Uucp Configuring Your System for Masquerading Mailer-daemon Rdist Nobody Daemon Pop Imap Configuring Virtual Domains Example 4 Sample Virtual Domain Table # makemap btree virtusertable virtusertable Enabling Procmail as a Local Mailer Enabling Anti-Virus Configuring Anti-Spam Configuring Relaying Configuring the Access Database Example 5 Sample Access Database for the Sendmail Server Configuring an Access Database Configuring Ldap Configuring Checking on Senders Information Configuring Mail Filters Milter Shows the Configure Ldap form Socket inet61066@myhost.com Socket local/var/run/f1.sockSocket inet1099@remotehost.com Socket inet1066@myhost.com,T=C5mS10sR10sE5m Sample -p local/var/run/example1.sock Configuring Queues Adding a Queue # sendmail -bt -q queue-name Modifying a Queue GroupDeleting a Queue Group Configuring Queue Performance Queue TimersGeneral Queue Properties Configuring Trusted Layer Security Sendmail TimersSendmail Tunable Parameters TLS Certificate Values Certificate DefaultsCertificate Issuer One that issues certificates a CA Certicate Authority Abbreviation Certificate Authority Enabling Support Using the Access Database Failure marked as temporary VERIFYbits CIname Sendmail Server AdministrationMarked as permanent Side Configuring Mailbox Access Controlling the Sendmail ServerRelay or Subject Viewing the Sendmail Server Log Majordomo Mailing List AdministrationMajordomo Mailing List Administration Creating a Majordomo Mailing List Changing a Majordomo Mailing List Configuration Changing List Owner or Charter Changing Administration Parameters Changing Subscription Parameters Changing Message Content Parameters Changing Command Access Parameters Changing Digest Parameters Changing Moderated List Parameters Changing List Restriction Parameters Changing Address Processing Parameters MailmanDeleting a Majordomo List Mailman Deleting a Mailing List Creating the Initial Mailman List Using a ScriptCreate a Mailing List Managing Mailman Mailman Mailing List Administration Menu Mailman Log Files Bogofilter Spam FilterMailman Scripts Training Bogofilter Filter Integration with Other Tools Using Bogofilter with procmailFiltering with Bogofilter Bogofilter/wordlist.db Mutt Integration with Bogofilter Pine Integration with BogofilterMail Transport Agent MTA Integration with Bogofilter Bogofilter Spam Filter Controlling the POP3 Server Mail Access AdministrationPOP Mail Server Administration Controlling the POP2 Server Imap Mail Server Administration Imap Mail Server AdministrationViewing the POP Mail Server Log Setting Up a Unix User Account for UW Imap Setting Up a Unix User Account for Cyrus ImapConverting Imap Mail Folders Usr/dt/bin/mailcv -evdt -I -f foldername directoryname user Controlling the Cyrus Imap ServerControlling the UW Imap Server Usr/dt/bin/mailcv -I -t -f ./bar duke Configuring SSL for UW-IMAP Viewing the Imap Server Log IMP Webmail Administration IMP Webmail Administration Accessing the IMP Webmail Administration Menu Enabling and Disabling IMP Webmail Managing Mail Server Settings Enable/Disable IMP Webmail IMP Mail Server Settings Modifying the Mail Server ListAdding a Mail Server IMP Mail Server List Settings Managing Mailbox Settings Modifying a Mail ServerDeleting a Mail Server Managing Compose Settings IMP Mailbox Settings Managing Message Settings IMP Compose SettingsPreference settings Managing Logging Settings IMP Message Settings IMP Logging Settings Managing Preference Driver Settings Preference Driver Settings Miscellaneous IMP Settings Managing Miscellaneous IMP SettingsManaging Horde Settings Setting Description Allow usage of folders Horde Settings Managing Turba Settings Setting Description Enabled Using IMP Upgrade ToolsIMP Turba Settings Have access to their addressbook Upgrading IMP Configurations Upgrading IMP Databases IMP Database Upgrade Settings Accessing IMP Webmail Additional Webmail DocumentationNew Preference Table Web Services Administration Secure Web Server AdministrationSecure Web Server Administration Accessing the Secure Web Servers Internet Express Ports and URLs Web Server Management Changing Configuration ParametersConfiguration Files for Secure Web Servers Server Changing the Password for the Administration Web Server Httpd.conf Srm.conf Access.conf Ht//Dig Search Tool Administration Ht//Dig Search Tool AdministrationCreating the Search Index Ht//Dig Indexing and Search Administration Link to Ht//Dig Search Index Updated Ht//Dig Configuration File Message Searching the Index DocumentationHttp//hostname/htdig/search.html XML Component Administration Directories and Subsets for XML ComponentsDirectories and Subsets for XML Components Apache Axis Server Administration Apache Axis Server AdministrationApache Cocoon Servlet Administration Managing the Apache Axis Server Managing the Apache Cocoon Servlet Enabling and Disabling the Cocoon ServletViewing the Cocoon Log Files Network Services Wrapped by Internet Express Network Security AdministrationTCP Wrapper Administration Network Services Wrapped by Internet Express Controlling Access to Other Network Services Modifying Access to a Wrapped Network Service Testing TCP Security Modifications Network Service Access Options FireScreen Administration FireScreen Administration Menu Installing FireScreen FireScreen Administration Checking FireScreen Installation Prerequisites Etc/rc.config file FireScreen Administration Install FireScreen Page with Gateway Screening Enabled Configuring FireScreen Setting Command-Line Options Configure FireScreen Menu Set Options Confirmation Setting the Screening Mode Adding a Screening Rule Add New Screening Rule Form Checking Syntax of Screening Rules Deleting a Screening Rule Starting and Stopping FireScreen Starting FireScreen Start/Stop FireScreen Form with Restart Option Enabled Stopping FireScreen Viewing FireScreen Status Viewing FireScreen Screening RulesViewing the FireScreen Log Snort Intrusion Detection System Viewing FireScreen StatisticsUsr/internet/docs/snort Snort documentation Option Disable Decode Alert Configuring Snort DecoderConfiguring Snort Preprocessor Snort -vd -l ./log FreeRADIUS Server Administration Running SnortViewing Alert Messages Starting and Stopping the FreeRADIUS Server Considerations While Installing FreeRADIUSUnderstanding FreeRADIUS Configuration Files Users File Configure --disable-shared make make install Clients.conf fileRadiusd.conf file Viewing FreeRADIUS Log File Proxy Services Administration Proxy Services AdministrationDante Socks Server Administration Controlling the Dante Socks Server Accessing Dante Socks Information Squid Proxy/Caching Server AdministrationConfiguring the Dante Socks Server Squid Proxy/Caching Server Administration Configuring the Squid Proxy/Caching Server Reinitializing the Disk CacheManaging the Squid Proxy/Caching Server Displaying Access Statistics Rotating Log Files Controlling the Squid Proxy/Caching Server Ldap Directory Server Administration Understanding the Ldap Directory SchemaUnderstanding the Ldap Directory Schema Using the Ldap Browser Ldap Directory Server AdministrationExample 6 Ldap Standard Object Class Definition for Person Managing Frequently Used Connections Installing and Running the Ldap BrowserConnecting to an Ldap Server Creating or Editing Frequently Used Connections Connecting to an Ldap Server using SSL Using the Main Browsing Window Disconnecting from an Ldap ServerReconnecting to an Ldap Server Closing a Main Window Controlling Client-Side Schema CheckingOpening a New Main Window Viewing a Directory Entry in a Separate Window Deleting a Directory Entry Adding a New Directory EntryModifying a Directory Entry Copying a Directory Entry Adding Attributes Renaming a Directory EntryMoving a Directory Entry Modifying Attributes Creating Entry Templates Deleting AttributesManaging Directory Entry Templates Modifying Entry Templates Viewing the Object Class Schema Viewing the Attribute SchemaSearching the Directory Configuring the OpenLDAP Directory Server Managing and Using the OpenLDAP Directory ServerUser Configuration File Managing the OpenLDAP Directory Server Ldap Directory Server Administration OpenSLP Administration Configuration Files and ExamplesOpenSLP Overview Configuring OpenSLP Using the OpenSLP Configuration and Registration FilesConfiguring Optional Security Running the Services Configuring OpenSLP Running the Example Configuration Considerations for Using SLP APIs Documentation Documentation OpenSLP Administration Administering Pure-FTP Server FTP Server AdministrationAdministering Pure-FTP Server Creating or Modifying an Anonymous Pure-FTP User Account Enabling or Disabling chroot Enabling or Disabling Anonymous Pure-FTP AccessFTP Server Administration Upload /data/ftp /pub yes ftp daemon Displaying Active Pure-FTP Users Enabling or Disabling Pure-FTP server Understanding the smb.conf Configuration File Samba File and Print Server AdministrationOptions for Modifying the smb.conf Configuration File Samba File and Print Server Administration Understanding the smb.conf Configuration File Workgroup Add the following value Administering the Samba Server Using the Swat Program Configuring the Samba Server Using the Swat ProgramAdministering the Samba Server Using the Swat Program Samba File and Print Server Administration Configure the Samba Server Menu Configuring Global Variables Configuring Share ParametersManage passwords see Section Administering Passwords Controlling Printers Viewing the Current ConfigurationAdministering Passwords Viewing the Status of the Server Samba File and Print Server Administration InterNetNews Server Administration 225 Specifying INN Configuration Data InterNetNews Server AdministrationINN Daemons Configuring an External Newsfeed Configuring an External Newsfeed Article Retention Period Displaying an External NewsfeedRecommended Spool Space for News Articles Days 12 GB Adding an External Newsfeed Typically, a newsfeed has the following flags set Modifying Newsfeed Defaults Modifying an External NewsfeedRemoving an External Newsfeed Managing Client Access Updating the Local Active File Displaying Client Access Groups Adding a Client Access GroupAccess Groups Form Fields Modifying an Existing Client Access Group Removing a Client Access Group Adding Client Authentication Groups Displaying Client Authentication GroupsManaging Client Authentication Groups Client Authentication Groups Menu Fields Modifying Client Authentication Groups Usr/bin/news/auth/passwd Deleting Client Authentication Groups Configuring Storage OptionsConfiguring Storage Method Entries Configuring Storage Options Options on the Configure Storage Menu Adding a New Storage Method ClassModifying a Storage Method Class Displaying Cnfs Entries Configuring the Cnfs Storage MethodDeleting a Storage Method Class Adding New Cnfs Entries Modifying Cnfs Entries Deleting Cnfs Entries Managing Article ExpirationDisplaying Article Expiration Definitions Managing Article Expiration Adding an Article Expiration Definition Specific newsgroup for example, rec.photo Managing Article Expiration Modifying an Article Expiration Definition Specifying an Article Expiration Definition Modifying the Retention Period for Expired Articles Managing Local NewsgroupsDeleting an Article Expiration Definition Managing Local Newsgroups Viewing INN Log Files Creating Local NewsgroupsDeleting Local Newsgroups Controlling the INN Server Controlling the INN Server Internet Relay Chat Administration Internet Relay Chat AdministrationConfiguring IRC Controlling the IRC Server Installing PostgreSQL PostgreSQL Database and MySQL AdministrationInstalling PostgreSQL Starting and Stopping PostgreSQL Server PostgreSQL Database and MySQL Administration Viewing the PostgreSQL Log File Administering PostgreSQL Accounts Administering PostgreSQL AccountsImportant Files and Directories Running the Postmaster Startup Script Setting up a Crontab Entry for Vacuuming DatabasesUsing Existing PostgreSQL Accounts PostgreSQL Files and Directories Setting up a Crontab Entry for Vacuuming Databases PostgreSQL Database and MySQL Administration Setup Vacuum Crontab Form Scaling PostgreSQL #/sbin/init.d/postgres stop#/sbin/init.d/postgres start #/sbin/sysconfig -q ipc #ps -ef grep postmasterScaling PostgreSQL Starting and Stopping MySQL Administering MySQLDirectories and Files Established by MySQL Installation MySQL Directories Viewing the MySQL Error Log Starting and Stopping the MySQL Server Using a Command LineMySQL Configuration Files MySQL Log Files Important Bind Files and Directories Bind Domain Name Server AdministrationBind Overview Bind Files and Directories Bind Binary File Directories Enabling Bind Enter /sbin/init.d/named start Enter /sbin/rcinet start Running the Bind Startup ScriptBind Documentation Running the Bind Startup Script Http//ops.ietf.org/dns/dynupd/secure-ddns-howto.html Jabber Controlling the Jabber ServerControlling the Jabber Server Twiki Starting TWikiTwiki Sample client server configuration Sample client server configurationStunnel Background OpenSSL Certificate Creation Sendmail Supplemental InformationCreating a Certificate of Authority Sample mail filter Section Mail Filter Example Mail Filter Example Mail Filter Example Sendmail Supplemental Information Smfiversion Glossary Glossary FTP 273 See also Https See TCP/IP 275 Symbols IndexIndex Decus see Encompass deinstall.sh script Web site, 30 external newsfeed adding277 Index Ldap client, 87 Ldap commands Log file FireScreen viewing, 183 login account279 Index OpenLDAP Project Web site Poppassd server controlling281 Screening mode, 178 screening rule FireScreen TIN 283