HP UX LDAP-UX Integration Software specification

Installing And Conﬁguring LDAP-UX Client Services

Use r-command for PAM_LDAP

78

Chapter 2

Image 92

HP UX LDAP-UX Integration Software manual Use r-command for Pamldap Chapter

Contents

Edition Manufacturing Part Number J4269-90071 E0207 Legal Notices Contents Administering LDAP-UX Client Services Command and Tool Reference User Tasks Tables Viii Figures Figures Intended Audience New and Changed Documentation in This Edition Publishing History What’s in This document Xiii Typographical Conventions HP Encourages Your Comments Overview of LDAP-UX Client Services Chapter Overview of LDAP-UX Client Services Simpliﬁed NIS Environment How LDAP-UX Client Services Works Trafﬁc from replica updatesSimpliﬁed LDAP-UX Client Services Environment Introduction That use PAM and NSS Examples of Commands and SubsystemsCommands that use Commands that use PAM Login, ftpd Ls, who Overview of LDAP-UX Client Services Local Start-up File and the Conﬁguration Proﬁle Overview of LDAP-UX Client Services Chapter LDAP-UX Client Services Before You Begin Summary of Installing and Conﬁguring Summary of Installing and Conﬁguring Optionally modify the /etc/opt/ldapux/pamauthz.policy Plan Your Installation Plan Your Installation Still log in to the system Share user names and passwords with other applications, Example Directory Structure Plan Your Installation Plan Your Installation Section must be set to yes. If the start option is enabled, Plan Your Installation Install LDAP-UX Client Services on a Client Install LDAP-UX Client Services on a Client Step Conﬁgure Your DirectoryConﬁgure Your Directory Conﬁgure Your Directory Grant read access of all attributes of the posix schema Conﬁgure Your Directory Import Name Service Data into Your Directory Import Name Service Data into Your Directory Steps to Importing Name Service Data into Your Directory Conﬁgure the LDAP-UX Client Services Conﬁgure the LDAP-UX Client Services Conﬁgure the LDAP-UX Client Services Quick Conﬁguration Required to start the services Simple Sasl DIGEST-MD5 Conﬁguration Parameter Default Values Conﬁgure the LDAP-UX Client Services Custom Conﬁguration Specify up to three directory hosts, to be searched in order Specify the service you want to map? Specify the attribute you want to map You type 0 to exit this menu for the following question Answer Y instead of the default N For the question You want to create a custom search descriptor for Conﬁgure the LDAP-UX Client Serivces with SSL Support Conﬁgure the LDAP-UX Client Serivces with SSL Support Conﬁguring the LDAP-UX Client to Use SSL Steps to Download the CA Certiﬁcate from Mozilla Browser Mail users, and Trust the CA to identify software developers Steps to create database ﬁles using the certutil utility Use the rm command to remove the old database ﬁles Conﬁgure the LDAP-UX Client Serivces with SSL Support Conﬁgure LDAP-UX Client Services with Publickey Support Conﬁgure LDAP-UX Client Services with Publickey Support October Enhanced Publickey-LDAP Software for HP-UX 11i v1 orJune Conﬁguring an Admin Proxy User Using ldapproxyconﬁg Extending the Publickey Schema into Your DirectoryAdmin Proxy User Setting ACI for Key Management Password for an Admin Proxy UserSetting ACI for an Admin Proxy User An Example Conﬁguring serviceAuthenticationMethod Setting ACI for a User Authentication Methods Procedures Used to Conﬁgure serviceAuthenticationMethod ServiceAuthenticationMethodkeyservsasl/digest-md5 Conﬁguring Name Service Switch Conﬁgure LDAP-UX Client Services with Publickey Support Automount Schemas AutoFS SupportAutoFS Patch Requirement AutoFS Support New Automount Schema Schema An Example NisObject Automount Schema Limitations Obsolete Automount SchemaRemoving The Obsolete Automount Schema Attribute Mappings Attribute Mappings New Automount Attribute NisObject Automount Environment Variables AutoFS Migration ScriptsMigration Scripts Description Examples General Syntax For Migration Scripts Migrateautomount.pl Script Syntax AutoFS Support Migratenisautomount.pl Script Following shows the /tmp/autoindirect.ldif ﬁle Migratenispautofs.pl Script Following shows the nispautomap.ldif ﬁle Verify the LDAP-UX Client Services Verify the LDAP-UX Client Services Making sure the output is as expected Verify the LDAP-UX Client Services #cat /etc/nsswitch.conf Conﬁgure Subsequent Client Systems Conﬁgure Subsequent Client Systems Change the current conﬁguration Download the Proﬁle Periodically Download the Proﬁle Periodically Crontab crontab.profile #passwordas = Use r-command for PamldapUse r-command for Pamldap Password, and turning on the rcommand option for pamldap Use r-command for Pamldap Chapter Ldap Printer Conﬁgurator Overview OverviewDeﬁnitions System How the Ldap Printer Conﬁgurator works How the Ldap Printer Conﬁgurator works System administrator manually adds or removes printers to Printer Conﬁgurator Architecture Printer Conﬁguration Parameters Printer Conﬁguration Parameters An Example Printer SchemaPrinter Schema Printer Schema Example Managing the LP printer conﬁgurationManaging the LP printer conﬁguration Managing the LP printer conﬁguration Managing the LP printer conﬁguration Limitations of Printer Conﬁgurator Limitations of Printer Conﬁgurator Limitations of Printer Conﬁgurator Chapter Administering LDAP-UX Client Overview Using The LDAP-UX Client DaemonUsing The LDAP-UX Client Daemon Ldapclientd Starting the clientControlling the client Client Daemon performance Command options Diagnostics Conﬁguration ﬁle syntax Missing settingsLdapclientd.conf Opt/ldapux/conﬁg/setup Using The LDAP-UX Client Daemon 100 Chapter 101 102 Chapter 103 Conﬁguration File Integrating with Trusted Mode Features and LimitationsIntegrating with Trusted Mode Auditing Password and Account Policies Chapter 107 PAM Conﬁguration FileOthers Conﬁguration Parameter Pamauthz Login Authorization Enhancement Policy And Access RulesPamauthz Login Authorization Enhancement Chapter 109 How Login Authorization Works Pamauthz Environment Policy File Chapter 111 Constructing an Access Rule in pamauthz.policy Fields in an Access RuleField Syntax in an Access Rule Actiontyperule Chapter 113 No value is required Action Chapter 115 116 Policy Validator Chapter 117 An Example of /etc/opt/ldapux/pamauthz.policy File Adding a Directory ReplicaAdding a Directory Replica Chapter 119 Displaying the Proxy User’s DNDisplaying the Proxy User’s DN Verifying the Proxy User Creating a New Proxy UserExample Verifying the Proxy User Displaying the Current Proﬁle Creating a New ProﬁleDisplaying the Current Proﬁle Chapter 121 Modifying a Proﬁle Changing Which Proﬁle a Client Is UsingModifying a Proﬁle Changing from Anonymous Access to Proxy AccessChanging from Proxy Access to Anonymous Access Changing from Anonymous Access to Proxy Access Changing from Proxy Access to Anonymous Access Performance Considerations Minimizing Enumeration RequestsPerformance Considerations Chapter 125 Client Daemon Performance Client Daemon PerformanceLdapclientd Caching Map Name Beneﬁts Example Side-Effect Chapter 127 128 Chapter 129 Ldapclientd Persistent Connections Troubleshooting TroubleshootingEnabling and Disabling LDAP-UX Logging Chapter 131 Enabling and Disabling PAM Logging TIP Chapter 133 Netscape Directory Server Log FilesUser Cannot Log on to Client System 134 You should get output like the following Chapter 135 136 Command and Tool Reference Chapter 137 LDAP-UX Client Services Components Description LDAP-UX Client Services ComponentsLDAP-UX Client Services Components Chapter 139 LDAP-UX Client Services ComponentsComponent Description LDAP-UX Client Services Libraries on the HP-UX 11.0 or 11i PA machine Files Description Chapter 141 LDAP-UX Client Services Libraries on the HP-UX 11i v2 PAMachine Files Description LDAP-UX Client Services Libraries on the HP-UX 11i v2 IA Client Management Tools Createproﬁleentry ToolCreateproﬁlecache Tool Client Management Tools Createproﬁleschema Tool Displayproﬁlecache Tool Getproﬁleentry Tool Chapter 145 Ldapproxyconﬁg Tool Getprofileentry -s NSS File Chapter 147 148 Chapter 149 Beq Search Tool Beq Search ToolSyntax Examples Chapter 151 152 Uid2dn Tool Chapter 153 Ldap Directory Tools Ldap Directory ToolsGetattrmap.pl Tool Ldapentry Chapter 155 156 Ldapsearch Chapter 157 Ldapmodify Ldapdelete Certutil Chapter 159 Adding One or More UsersAdding One or More Users Name Service Migration Scripts Name Service Migration ScriptsDefault Naming Context Naming Context Chapter 161 Migrating All Your FilesMigrating Individual Files Migration Scripts Script Name Description General Syntax for Perl Migration ScriptsMigration Scripts Script Name Description Chapter 163 164 Chapter 165 Ldappasswd Command Ldappasswd Command Chapter 167 168 To Change Passwords Chapter 169 To Change Passwords Cannot Change Passwords on Replica Servers Chapter 171 172 Chapter 173 To Change Personal InformationTo Change Personal Information 174 Mozilla Ldap C SDK Chapter 175 176 Mozilla Ldap C SDK File Components Mozilla Ldap C SDK File ComponentsMozilla Ldap C SDK File Components on the PA machine Files Description Mozilla Ldap C SDK File Components on the IA machine Chapter 179 Mozilla Ldap C SDK API Header Files Header Files Description Chapter 181 182 Table A-1 LDAP-UX Client Services Conﬁguration Worksheet Appendix a 183 Appendix a Appendix a 185 186 Classes Appendix B 187 Appendix B Proﬁle AttributesProﬁle Attributes Appendix B 189 190 ﬁle Appendix C 191 Sample /etc/pam.ldap.trusted ﬁle Appendix C Appendix C 193 194 PAM Authorization Service Module GlossaryLdap Data Interchange Format Ldif Glossary 195 Slapd Glossary Symbols Index NIS, 2, 12, 15 Pwget, 4, 69 200