Manuals / HP / Computer Equipment / Software

HP UX Kerberos Data Security Software manual Installing the Server Chapter

Models: UX Kerberos Data Security Software

1 327

Download 327 pages 9.34 Kb

Troubleshooting Install Error codes Krb5schema.conf File Password Editing the Default File Symbols Administrator Maintenance Authentication problems

Page 40

Image 40

Installing the Kerberos Server v3.1

Installing the Server

40

Chapter 2

Page 39 Page 41

Image 40

HP UX Kerberos Data Security Software manual Installing the Server Chapter

Page 39 Page 41

Related manuals

Manual 13 pages 9.67 Kb

Manual 285 pages 23.05 Kb

Our partner
Обсуждение вопроса Что делать, если пинк слип готов, но не пришло письмо? из чата CY Law, Visas, Taxes, Insurance, Кипр

Related pages All Install page To install or replace batteries for Cobra Electronics PR 270 Install Discharge Chute / Chute Rotater Head See Fig for Poulan 192038 HInstalling the cradle for FujiFilm FinePix A607 Service d’installation Sears for Kenmore 4709* Installation de la carte d’expansion Wave for Roland Piano Setting up systems After installation For best performance for MB QUART PAB 1200.1 D Plan Ductwork Installation for Broan 884804 Réinstaller la façade du tiroir for Whirlpool W10297791 Installing the optical drive for Lenovo 5048 Installing drain spud in bowl for Bradley Smoker WF2708 How to turn on the PC module without using the LFD in Samsung TVs? Learn more

Contents

Edition Manufacturing Part Number T1417-90009 E0905 Legal Notices Copyright NoticesPage Page Contents Conﬁguring the Kerberos Server with Ldap Administering the Kerberos Server Contents Contents Propagating the Kerberos Server Managing Multiple Realms Contents Tables Table A-2. Conﬁguration Worksheet Explanation Figures Figures What Is in This Document Intended Audience Interoperability with Windows 2000, on Glossary Typographic Conventions IndexBold ﬁxed Width Publishing History HP-UX Release Name and Release IdentiﬁerRelated Software Products Related Documentation Accessing the World Wide WebRelated Request for Comments RFCs HP Encourages Your Comments Overview Overview Introduction How the Kerberos Server Works Authentication Process Authentication Process Illustrates the actions of the components and the Kerberos Step Authentication Process DES Versus 3DES Key Type Settings Introduction to Ldap Ldap Advantages Integrating Kerberos Server v3.1 with Ldap Integrating a Kerberos Principal in to the Ldap Directory Installing the Kerberos Server Installing the Kerberos Server Prerequisites System Requirements Hardware RequirementsSoftware Requirements Version Compatibility Installing the Server Installing the Server Chapter Migrating to a Newer Version Migrating to a Newer Version of the Kerberos Server Migrating from Kerberos Server Version 1.0 to Copy the dump ﬁle to the new system where you are installing Upon success, the following message appears Migrating from Kerberos Server Version 1.0 to Migrating from Kerberos Server Version 2.0 to Version Copy the dump ﬁle to the system on which you are installing Migrating from Kerberos Server Version 3.0 to Version Migrating to a Newer Version of the Kerberos Server Interoperability with Windows Interoperability with Windows Understanding the Terminology Table of Analogous Terms Kerberos Server Windows Kerberos Server and Windows 2000 Interoperability Scenario Establishing Trust Between Kerberos Server and Windows Fqdn qualiﬁer speciﬁes the fully qualiﬁed domain name Single Realm Domain Authentication Interrealm Interdomain Authentication Special Considerations for Interoperability Database ConsiderationsEncryption Considerations Postdated Tickets Special Considerations for Interoperability Chapter Special Considerations for Interoperability Chapter Conﬁguring the Kerberos Security Server Files That Require Conﬁguration Conﬁguration Files for the Kerberos ServerConﬁguration File Function Krb.conf File Krb.conf File Format Krb.realms File Krb.realms File Format Wildcard Characters Wildcard Character Description Autoconﬁguring the Kerberos Server To conﬁgure the server, select option Conﬁguring the Kerberos Server with C-Tree Value, DES-MD5, is selected Server with Ldap Conﬁguration Files for Ldap Integration Krb5ldap.conf FileLdap Conﬁguration Files File Function Krb5ldap.conf File Format Parameter Description This line indicates a space Krb5schema.conf File Krb5schema.conf File Format Ticket’ Syntax Conﬁguration Files for Ldap Integration Krb5map.conf File Krb5map.conf File Format HpKrbAuthzData HpKrbKeyVersion HpKrbKeyData Planning Your Ldap Conﬁguration Before You Begin Setting up Your Ldap Conﬁguration For example, ou=people, o=bambi.com For example, ou=accounts, ou=people, o=bambi.com For example, uid. cn, homedirectory, gidnumber, uidnumber Conﬁguring the Kerberos Server with Ldap Autoconﬁguring the Kerberos Server With Ldap IntegrationStep Select one of the following options Qualiﬁed host name or the IP address HpKrbKey Autoconﬁguring the Kerberos Server With Ldap Integration Manually Conﬁguring the Kerberos Server with Ldap Editing the Conﬁguration Files Manually Conﬁguring the Kerberos Server with Ldap Manually Conﬁguring the Kerberos Server with Ldap Chapter Conﬁguring the Primary Create the Principal Database After Installation Conﬁguring the Primary Security Server To add an Administrative Principal Using the HP Kerberos Add an Administrative PrincipalAdministrator To Add an Administrative Principal Through the Command Line Start the Kerberos Daemons Deﬁne Secondary Security Server Network Locations Adminaclﬁle Password Policy FileSecurity Policies Starting the Security Server Creating the Principal Database Conﬁguring the Secondary Security Servers with C-TreeCopying the Kerberos Conﬁguration File Creating a host/fqdn Principal and Extracting the Key Creating a stash ﬁle using the kdbstash utility Conﬁguring the Secondary Security Servers with Ldap 106 Using Indexes to Improve Database Performance 108 Administering the Kerberos 110 Administering the Kerberos Database Conﬁguration Files Required for kadmind Kadmind CommandFile Name Description Adminaclﬁle File Assigning Administrative Permissions Chapter 115 Adding Entries to adminaclﬁle Using Restricted Administrator Creating Administrative AccountsHow the r/R Modiﬁers Work 118 Password Policy File Editing the Default FileDefault Password Policy Settings for the Base Group Password Policy Setting Default Value 120 Principals 122 Adding New Service Principals Adding User Principals Reserved Service Principals Chapter 125 126 Removing Special Privilege Settings Removing User Principals Removing Service Principals Protecting a Secret Key Chapter 129 Kadmin and kadminl Utilities Administration Utilities Administration Utilities Name Description HP Kerberos Administrator Standard Functionality of the Administrator Function of OK, Apply, and Cancel ButtonsCancel Button Name Action Local Administrator kadminlui Using kadminlui Chapter 135 Principals Tab Principals Tab Principals Tab Components Component Name Description List All Search StringSearch List of Principals Principal Information Window General Tab Principal Information WindowPrincipal Information Window Components Password Tab Field Name DescriptionGeneral Tab Attributes Tab General Tab Components Field Name Description Principal ExpirationMaximum Ticket Lifetime Maximum Renew Time Last Modiﬁed Field Name Description Password PolicyModiﬁed By Adding Principals to the Database Change Password Window Adding Multiple Principals with Similar Settings Creating an Administrative Principal Administering the Kerberos Server 148 Search Criteria Searching for a PrincipalCharacter Description 150 Deleting a Principal Loading Default Values for a Principal Restoring Previously Saved Values for a Principal Changing Ticket Information Rules for Setting Maximum Ticket Lifetime Rules for Setting Maximum Renew Time Chapter 157 Changing Password Information Chapter 159 Password Tab Principal Information Password Tab ComponentsWindow Displays the Ldap DN that you are editing Component Name Description Password Password LastChange Password Expiration/Date Change Password Window Password Tab Entering a password Change Password Window Components Components Description New Password Veriﬁcation Changing a DES-CRC or DES-MD5 Principal Key Type Changing a Key TypeTo 3DES 166 Changing Principal Attributes 12 describes the components of the Attributes tab Attributes Tab Principal InformationAttributes Tab Components Components Description Allow PostdatedAllow Renewable Tickets 170 Components Description Allow Forwardable Allow ProxyAllow Duplicate Session Keys Preauthentication Require PasswordComponents Description Require Change Allow As Service Components Description Lock Principal Authentication Set As PasswordChange Service Components Description Require Initial Ldap Attributes Tab Prinicpal Information Window 176 Deleting a Service Principal Extracting Service Keys Chapter 179 Extracting a Service Key Table Extract Service Key Table Components Service KeyComponent Description Principal Table Type Using Groups to Control Settings Editing the Default Group Chapter 183 Group Information Window Principal Group Information Window Components InformationEditEdit Default Group to display the GroupComponent Description Group Setting the Default Group Principal Attributes Default Principal AttributesPrincipal Attributes Component Description Chapter 187 Setting Administrative Permissions Administrative Permissions 11 Administrative Permissions Window Add Principals PrincipalsModify Principals Inquire about Override the Principal InformationEditEdit Group Default DefaultsInformationEditEdit Default GroupGroup Information Component Description Restricted 192 Realms Tab Realms Tab Realms Tab Components Realm Information Window Realm Information Window Components Adding a Realm Deleting a Realm Remote Administrator kadminui Logon screen displays as shown in Figure Logon Screen 200 Chapter 201 Manual Administration Using kadmin Chapter 203 Adding a New Principal Specifying a New Password Adding a Random Key Changing Password to a New Randomly Generated Deleting a Principal Extracting a Principal 3DES Listing the Attributes of a Principal Modifying a Principal Number of Authentication Failures fcnt Key Version Number Attribute Attributes Policy NameAllow Postdated Attribute Allow Renewable Attribute Allow Forwardable Attribute Allow Proxy Attribute Allow Duplicate Session Key Attribute Require Preauthentication Attribute Require Password Change Attribute Lock Principal Attribute Allow As Service Attribute Require Initial Authentication Attribute Principal InformationEditEdit Administrative Permissions Authentication Set As Password Change Service Attribute Authentication Select Require InitialNo text shows Password Expiration Attribute Principal Expiration Attribute Maximum Ticket Lifetime Attribute Key Type Attribute Maximum Renew Time AttributeSalt Type Attribute Principal Database Utilities Principal Database UtilitiesUtility Task Kerberos Database Utilities 226 Database Encryption Database Master Password Destroying the Kerberos Database 230 Dumping the Kerberos Database Loading the Kerberos Database Stashing the Master Key 234 Starting and Stopping Daemons and Services Situation Starting and Stopping Daemons Maintenance Tasks Master PasswordProtecting Security Server Secrets Host/fqdn@REALM Backing Up primary security server Data Backing Up the Principal Database 238 Removing Unused Space from the Database 240 Propagating the Kerberos 242 Propagation Hierarchy Propagation Relationships Extracting a Key to the Service Key Table File Service Key TableMaintaining Secret Keys in the Key Table File Creating a New Service Key Table File Deleting Older Keys from the Service Key Table File Propagation Tools Propagation Tools If You Want To Use This Tool One or more servers once Propagation is conﬁgured Started Kpropd Daemon Mkpropcf Tool 250 Kpropd.ini File Defaultvalues Section Sections Chapter 253 Secsrvname Section Examples Conﬁguration ﬁle 256 Prpadmin Administrative Application Setting Up Propagation Primary security server Services and Daemons Daemon Name Function Generic Usage 260 Chapter 261 262 Monitoring Propagation Critical Error MessagesMonitoring the Log File Monitoring Propagation Queue Files Monitoring Old File Date and Large File Size Updating the principal.ok Time Stamp Authentication problemsComparing the Database to Its Copies Log ﬁles indicate problems Administration appears normalMismatch between the number of principals Kdbdump Utility Restarting Propagation Using a Simple Process Restarting Propagation Using the Full Dump Method Propagation Failure Converting a secondary security server to a primary Security server Restarting Services Cleaning the Temp Directory Number of Realms per Database Conﬁguring Multirealm EnterprisesPrimary security servers Supporting Multiple Realms Multiple primary security servers Supporting a Single Realm Adding More Realms to a Multirealm Database Database Propagation for Multirealm Databases Managing Multiple Realms 276 One-Way Trust Considering a Trust RelationshipTwo-Way Trust Hierarchical Trust Other Types of Trust Conﬁguring Direct Trust Relationships 280 Hierarchical Interrealm Trust Hierarchical Chain of Trust Hierarchical Interrealm Conﬁguration Chapter 283 Conﬁguring the Local Realm Conﬁguring the Intermediate Realm Conﬁguring the Target Realm Hierarchical Interrealm Trust Chapter 287 288 Troubleshooting 290 Characterizing a Problem 292 Diagnostic Tools Diagnostic Tools SummaryTool Description Name Error Messages Troubleshooting KerberosLogging Capabilities Unix Syslog File Troubleshooting Techniques Services ChecklistTroubleshooting Scenarios Cause Tips Troubleshooting Scenarios 298 Troubleshooting Scenarios for your LDAP-based Kerberos Server Scenario Cause Troubleshooting Tips 300 Chapter 301 302 General Errors Forgotten Passwords Locking and Unlocking Accounts Clock Synchronization User Error Messages Decrypt Integrity Check Failed Password Has Expired While Getting Initial Ticket Administrative Error MessagesService Key Not Available While Getting Initial Ticket Chapter 307 Reporting Problems to Your HP Support Contact Chapter 309 310 Conﬁguration Worksheet Appendix a Appendix a 313 314 Sample krb.conf File Appendix B Services File 318 Sample krb.realms File Appendix C Glossary Key Distribution Center See KDC Glossary V5srvtab Ticket-granting ticket See TGT Ticket-granting ticket Symbols Index 326 327

Top Page Image Contents