LDAP-UX Client Services B.05.00 Administrator's Guide

ManualsBrandsHP ManualsSoftwareHP-UX LDAP-UX Integration Software

LDAP-UX Client Services B.05.00

Administrator's Guide

HP-UX 11i v2 and v3

HP Part Number: J4269-90086

Published: June 2010

Edition: 1.0

Summary of content (374 pages)

PAGE 1
LDAP-UX Client Services B.05.00 Administrator's Guide HP-UX 11i v2 and v3 HP Part Number: J4269-90086 Published: June 2010 Edition: 1.
PAGE 2
© Copyright 2008 Hewlett-Packard Development Company, L.P. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice.
PAGE 3
Table of Contents 1 Introduction...................................................................................................................15 1.1 Overview of LDAP-UX Client Services...........................................................................................15 1.1.1 How LDAP-UX Client Services works....................................................................................16 2 Installing and configuring LDAP-UX Client Services.................................................
PAGE 4
2.4.6.3 SSL/TLS ciphers...............................................................................................................82 2.4.7 Configuring LDAP-UX Client Services with NIS publickey support.....................................84 2.4.7.1 HP-UX Enhanced Publickey-LDAP software requirement............................................84 2.4.7.2 Extending the NIS publickey schema into your directory..............................................84 2.4.7.3 Admin Proxy user...........................
PAGE 5
3.1.1.1 Printer services..............................................................................................................115 3.1.1.2 Printing protocol...........................................................................................................115 3.1.1.3 LP printer types.............................................................................................................115 3.2 How the LDAP printer configurator works..........................................................
PAGE 6
5.3.3 PAM_AUTHZ supports security policy enforcement...........................................................142 5.3.3.1 Authentication using LDAP..........................................................................................142 5.3.3.2 Authentication with secure shell (ssh) and r-commands..............................................142 5.3.4 Policy file...............................................................................................................................143 5.3.
PAGE 7
5.9.1 Example.................................................................................................................................182 5.10 Displaying the current profile.....................................................................................................182 5.11 Creating a new configuration profile..........................................................................................183 5.12 Modifying a configuration profile.....................................................
PAGE 8
7.2.2.1 Syntax............................................................................................................................214 7.2.2.2 Examples.......................................................................................................................214 7.2.3 create_profile_schema tool....................................................................................................215 7.2.3.1 Syntax.................................................................................
PAGE 9
7.3.6.5 Specific return codes for ldapugmod............................................................................258 7.3.6.6 Security considerations.................................................................................................259 7.3.6.7 Limitations.....................................................................................................................260 7.3.6.8 Examples.....................................................................................................
PAGE 10
7.4.3.1 Syntax............................................................................................................................295 7.4.3.2 ldapsearch options........................................................................................................295 7.4.4 ldapmodify............................................................................................................................296 7.4.4.1 Syntax..............................................................................
PAGE 11
7.7.1 beq (search) tool.....................................................................................................................330 7.7.1.1 Syntax............................................................................................................................330 7.7.1.2 Examples.......................................................................................................................330 7.7.2 certutil (certificate database) tool.............................................
PAGE 12
List of Figures 1-1 1-2 1-3 1-4 2-1 2-2 2-3 3-1 5-1 6-1 6-2 8-1 8-2 8-3 12 A simplified NIS environment......................................................................................................16 A simplified LDAP-UX Client Services environment...................................................................16 ldapclientd and the LDAP-UX Client Services environment..................................................17 Local start-up file and the configuration profile...........................
PAGE 13
List of Tables 1 1-1 2-1 2-2 2-3 2-4 2-5 2-6 2-7 2-8 4-1 5-1 5-2 5-3 5-4 7-1 7-2 7-3 7-4 7-5 7-6 7-7 7-8 7-9 7-10 7-11 7-12 7-13 7-14 9-1 9-2 9-3 A-1 A-2 Publishing history details................................................................................................................2 Examples of commands and subsystems that use PAM and NSS................................................17 New attributes................................................................................................
PAGE 14
List of Examples 2-1 2-2 2-3 2-4 2-5 2-6 2-7 2-8 6-1 6-2 14 Sample host entry..........................................................................................................................30 Sample user entry..........................................................................................................................30 Sample group entry.......................................................................................................................
PAGE 15
1 Introduction This document describes how to install and configure the LDAP-UX Client Services product on HP-UX platforms. This document is intended for system and network administrators responsible for installing, configuring, and managing the LDAP-UX Client Services. Administrators are expected to have knowledge of the LDAP-UX Client Services Integration product. NOTE: The document printing date and part number indicate the document's current edition.
PAGE 16
Figure 1-1 A simplified NIS environment NIS master server Map transfers NIS slave server NIS slave server NIS Client Requests NIS client NIS client NIS client LDAP-UX Client Services improves on this configuration information sharing. HP-UX account and configuration information is stored in an LDAP directory, not on the local client system. Client systems retrieve this shared configuration information across the network from the LDAP directory, as shown below.
PAGE 17
www.hp.com/go/hpux-networking-docs These extensible mechanisms allow new authentication methods and new name services to be installed and used without changing the underlying HP-UX commands. In addition, by supporting the PAM architecture, the HP-UX client is fully integrated into the LDAP environment. The PAM_LDAP library allows the HP-UX system to use the LDAP directory as a trusted server for authentication as well as for centralized password and account policy management.
PAGE 18
Table 1-1 Examples of commands and subsystems that use PAM and NSS (continued) Commands that use NSS Commands that use PAM and NSS who whoami 1 2 These commands enumerate the entire passwd or group database, which may reduce network and directory server performance for large databases. nsquery is a contributed tool included with the ONC/NFS product. For more information, see the nsquery(1) manpage.
PAGE 19
Figure 1-4 Local start-up file and the configuration profile LDAP Directory Configuration profile The shared configuration profile is stored in the directory and downloaded to all LDAP-UX clients. The start-up file points to the configuration profile in the directory. Start-up file Configuration profile LDAP-UX client 1.
PAGE 20
PAGE 21
2 Installing and configuring LDAP-UX Client Services This chapter describes the decisions you need to make and the steps to install the HP-UX Directory Server or Redhat Directory Server and to configure LDAP-UX Client Services. 2.1 Before you begin: general installation and configuration considerations Consider the following as you plan your installation and configuration.
PAGE 22
• For details on how to integrate LDAP-UX Client Services with the Windows Server 2003 R2/2008 Active Directory, see the LDAP-UX Client Services B.05.00 with Microsoft Windows Active Directory Server Administrator's Guide at: http://www.hp.com/go/hpux-security-docs Click HP-UX LDAP-UX Integration Software. • For illustrative purposes, the examples use a base DN of o=hp.com. 2.2 Choosing the method of installation: guided or customized LDAP-UX Client Services releases prior to B.05.
PAGE 23
• • • attribute mapping to specifically match the schema model defined in the existing directory server. You want to install the HP-UX host into multiple-domain Windows environment. Guided installation only supports installation into a single windows domain. You cannot modify the directory server’s schema. In this case, you can deploy using a local-only profile. The local-only profile can also be useful for small deployments and testing purposes. For more information, see Section 2.4.5.1 (page 69).
PAGE 24
directory server to suit managing an LDAP-UX domain. For more information about the LDAP-UX domain, see Section 2.3.2 (page 27). In this scenario, the guided installation: — Configures the directory server with an LDAP-UX schema used for managing users, groups, and hosts. This includes definition of the database indexes based on that schema. — Defines the initial framework for the directory information tree. — Defines access control rights for directory server and LDAP-UX domain administration.
PAGE 25
Instructions for installing LDAP-UX for the first time in an existing directory server environment are described in “Guided installation steps: Existing Directory Server Installation mode” (page 50). • Installing LDAP-UX into an existing LDAP-UX domain (Existing LDAP-UX Domain Installation mode): In this scenario, LDAP-UX has already been configured in the environment. You can then use the guided installation to join the HP-UX host to an existing LDAP-UX domain or to a Windows ADS domain.
PAGE 26
2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 26 searching once it makes a successful connection. If a directory server cannot be found by DNS, you will be prompted for the host name and port number for an existing directory server in your environment or asked if you wish to create a new directory server instance on the local host. If you choose to create a new directory server instance on the local host, autosetup will create an HP-UX Directory Server instance on the local machine.
PAGE 27
A sample of the ldapclientd.conf file is included in Section E.4 (page 363). 14. Starts the LDAP-UX client daemon (ldapclientd) and the central configuration service daemon (ldapconfd). 2.3.2 Principles of the LDAP-UX domain When used for installing LDAP-UX in a non-Windows environment for the first time, the guided installation defines the management framework for, and actually creates, an LDAP-UX domain.
PAGE 28
• • Information model: Defines the types of objects managed in the directory server and the attributes and object classes that represent them, as described in Section 2.3.2.2 (page 29).
PAGE 29
• installation configures LDAP-UX, it initializes this subtree with the local host’s information. Any additional hosts that use the guided installation to configure LDAP-UX will be added under this subtree (joined to the LDAP-UX domain). ou=Configuration,ou=Services: Stores centrally managed configuration information for LDAP-enabled applications, or information about services available in the domain. The ldapentry tool can be used to manage items under this subtree.
PAGE 30
Example 2-1 Sample host entry dn: cn=brewer,ou=Hosts,dc=mydomain,dc=example,dc=com objectClass: top objectClass: device objectClass: ldapPublicKey objectClass: iphost objectClass: domainEntity sshPublicKey: ssh-rsa AAAAB3Nza... sshPublicKey: ssh-dss AAAAB3Nza... sshPublicKey: 1024 35 140898... owner: uid=domadmin,ou=people,dc=mydomain,dc=example,dc=com ipHostNumber: 16.92.96.
PAGE 31
objectClass: configurableService cn: cup-ldapuxProfile preferredServerList: 192.168.10.
PAGE 32
Table 2-1 New attributes Attribute name Description and use entityModel Describes the model associated with the object. The ldaphostmgr tool (with the -I option specified) uses this attribute to record the hardware model of the HP-UX host. entityVersion Represents the version of the associated entity. The ldaphostmgr tool (with the -I option specified) uses this attribute to record the version of the HP-UX OS on a host. entityUsage Describes the object’s designated usage.
PAGE 33
organization wishes to register printers in the directory server, and the organization has a policy that “Top Secret” documents may only be printed on a restricted set of printers. The organization could have all printers that are eligible for printing “Top Secret” documents created with the entitySecurityLevel attribute value set to “Top Secret”. The conventions used with the attributes in the preceding table, such as defining acceptable value sets, are entirely up to the policies of the organization.
PAGE 34
This is known as the proxy user. The customized installation requires that you create the proxy user manually. The guided installation automatically creates an entry in the directory server. This user (the host entry) is created with a randomly-generated password. The information is recorded in the /etc/opt/ldapux/pcred file. 2.3.2.3.
PAGE 35
• Owners access control rights: LDAP-UX 5.0 simplifies demarcating ownership of items in the directory server. Owners are considered any users or members of a group that have a DN in the owner attribute of the target entry. Currently, only one type of owner exists: owners of hosts. The rights of these owners are granted with the following ACI: dn: ou=Hosts,dc=mydomain,dc=example,dc=com aci: (targetattr = "sshPublicKey || ipHostNumber")(version 3.
PAGE 36
# # No Bundle(s) on hpt079:/tmp/ca-cup.hp.com.depot # Product(s): # LDAPUX-MYDOMAIN-CA A.01.00 LDAP-UX mydomain.example.com domain CA Certificate NOTE: SSL/TLS protocols support a variety of different cryptographic algorithms (ciphers) for use in authentication operations between server and client, certificate transmissions, and session key establishment. If a cipher is found to be flawed and subject to attack, administrators of HP-UX and the directory server would need to know about their vulnerability.
PAGE 37
joins an HP-UX OS instance into an existing LDAP-UX domain. The guided installation can provision information about hosts in the domain into the directory server. The LDAP-UX domain serves as a focal point for managing hosts, securing data, and in non-Windows AD environments, for simplifying management of ssh host keys. The guided installation uses the LDAP-UX domain name to define the suffix of the directory tree. For example, if the local host is a member of the AccountingDept.acme.
PAGE 38
• Administration domain (Admin domain) — for HP-UX Directory Server, a container entry for server groups, with each server group containing directory server instances that are managed by the same Configuration Directory Server. This domain is administered by the Configuration Administrator. Using the hpds-idm-console, the Configuration Administrator can view and manage all the HP-UX directory server instances in this domain.
PAGE 39
installation. In some cases, you can run the script in silent mode, which requires no user interaction during the installation. To run the script interactively, simply enter the autosetup command as is. The script prompts you for the minimal information required. To reduce user interaction during the installation, you can pass parameters by specifying options in the command line.
PAGE 40
-b search_base Specifies the base DN for which search operations should be performed for an existing LDAP-UX domain, or the base DN used when creating a new LDAP-UX domain; for example, dc=lab,dc=acme,dc=com. Typically, set the base DN to the directory's suffix value. Because the directory suffix is equal to the root, or topmost, entry in the directory, this causes all searches to begin from the directory's root entry.
PAGE 41
of prompting for input for parameters such as the Configuration Administrator or Domain Administrator, it uses the default values and any values specified with command-line options or environment variables. If values are not given for any required parameters that do not have defaults, silent mode will abort. For this reason, silent mode is not valid when installing LDAP-UX on a host for the first time (creating a new directory server requires user intervention).
PAGE 42
on the command line. Only used in New Directory Server Installation mode (installing LDAP-UX for the first time). DS_ADMIN_SERVER Sets the host name (or IP address), and optionally the port number, of the directory server's Administration Server, the server that manages the directory server administration domain that the new directory server will join. Only used in New Directory Server Installation mode (installing LDAP-UX for the first time). The default port is 389.
PAGE 43
command option exists for passing this name on the command line. This variable only applies for LDAP-UX installations when creating a new directory server environment. If specified with an LDAP-UX Windows Server AD installation, this variable is ignored. LDAP_DOMAIN_ADM_PASSWD Sets the password for the LDAP-UX Domain Administrator. No command option exists for passing this password on the command line. This variable only applies for LDAP-UX installations when creating a new directory server environment.
PAGE 44
Example 2-6 autosetup: passing two parameters directly in the command line along with a password file # autosetup -D "cn=Directory Manager" -j /tmp/jfile -x document.hp.com This command specifies the Directory Manager and a file that includes the password required for the Directory Manager of the directory server being created. The command also specifies the LDAP-UX domain name. When you invoke autosetup, you will not be prompted for these parameters.
PAGE 45
NOTE: If you are planning a first-time deployment of managing user and group data in the directory server, HP suggests that you devise a strategy to avoid UID number and GID number overlap. Most likely, you will need to continue managing some accounts that are local to the hosts in the LDAP-UX domain. Often the root user, and sometimes application accounts (such as www for the httpd process) remain managed in the local /etc/passwd file.
PAGE 46
You cannot create an actual Directory Server entry that uses the same distinguished name (DN) as the Directory Manager DN. For more information about the Directory Manager and other administrators, see Section 2.3.4 (page 38). 4. The script asks whether you want to manage the new directory server in an existing HP-UX Directory Server administration domain (Admin domain) or whether you want to create a new directory server administration domain.
PAGE 47
An LDAP-UX domain administrator is used to manage all data within the LDAP-UX domain. The domain administrator has fewer privileges than the Directory Manager or Configuration Administrator. This account will be the primary account used to manage data within the directory server, or its privileges can later be distributed to other users. This account should typically be associated with an individual and may be named as such.
PAGE 48
LDAP-UX was successfully configured. As indicated in the guided installation log, the guided installation configures LDAP-UX and starts the LDAP-UX daemon (ldapclientd) and the central configuration service (ldapconfd). For more information about the files configured by autosetup, see “Samples of LDAP-UX configuration files created or modified by autosetup” (page 359). For more information about the central configuration service, see Chapter 6 (page 193).
PAGE 49
2.3.6.2 Automating New Directory Server Installation mode To install LDAP-UX for the first time on a host and create a new directory server, you must run the script interactively to indicate at minimum, when prompted, that you want a new directory server created. You can use command-line options and environment variables to completely automate the rest of the procedure. In the example provided in this section, the following environmental variables are defined for all the parameters needing input.
PAGE 50
============================================================================ Setting up the LDAP-UX client using the newly created directory server. Loading CA certificate from directory server to local host ... done. * Extending schemas ... done. No LDAP-UX Configuration Profile was found. Creating a new one. * * * * * * * Downloading profile from DS ... done. Configuring ldapux_client.conf ... done. Provisioning LDAP-UX Client information into the Directory Server ... done. Setting up proxy user ...
PAGE 51
NOTE: When configuring and setting up LDAP-UX, you will likely be prompted for credentials of an administrator. If you are asked to enter the credentials (password) of a user, make sure that the connection between your client and the HP-UX system (where you are running autosetup) is secured and not subject to network eavesdropping. One option to protect such communication may be to use the ssh protocol when connecting to the HP-UX host being configured. 2.3.7.
PAGE 52
NOTE: Unless you pre-install a CA or server certificate for the directory server, the autosetup tool has no means of validating the identity of the directory server. The tool can download and permanently install the CA or server certificate for the server; however, the server could be an impostor. If autosetup created the specified server, it created a depot file on that server's host that contains the CA certificate for that server.
PAGE 53
LDAP-UX was successfully configured. NOTE: For more information about the configuration files created or modified by autosetup, see “Samples of LDAP-UX configuration files created or modified by autosetup” (page 359). You can display details about the LDAP-UX Client Services configuration by using the /opt/ldapux/config/display_profile_cache command. For more information about the use of this command, see Section 7.2.4 (page 215). 2.3.7.
PAGE 54
NOTE: This section assumes you are installing LDAP-UX on a host on which LDAP-UX is not already installed. If you attempt to run autosetup on a host on which LDAP-UX (ldapclientd) is already running, the procedure aborts. If the LDAP-UX is installed on the host but not running, the procedure proceeds. However, if a previous LDAP-UX configuration profile is found on the system, the procedure warns you that proceeding will overwrite the file and asks if you want to proceed.
PAGE 55
a Windows domain name, or press Return to create a new directory server on this host: acct1053 Return NOTE: Unless you pre-install a CA or server certificate for the directory server, the autosetup tool has no means of validating the identity of the remote directory server (acct1053). The tool can download and permanently install the CA or server certificate for the server; however, the server might be an impostor.
PAGE 56
NOTE: For more information about the configuration files created or modified by autosetup, see “Samples of LDAP-UX configuration files created or modified by autosetup” (page 359). You can display details about the LDAP-UX Client Services configuration by using the /opt/ldapux/config/display_profile_cache command. For more information about the use of this command, see Section 7.2.4 (page 215). 2.3.8.
PAGE 57
2.4.1 Summary of customized installation and configuration steps The following are the steps you take when custom installing and configuring an LDAP-UX Client Services environment: • • • • • • • • • Plan your installation (see Section 2.4.2 (page 59)). Install LDAP-UX Client Services on each client system (see Section 2.4.3 (page 64)). Install and configure an LDAP directory, if not already done (see Section 2.4.4 (page 65)).
PAGE 58
— — — — 58 Control user access to the system, using any of several methods mentioned in “Controlling user access to the system through LDAP” (page 106) Configure subsequent client systems (see the shortcuts mentioned in “Configuring subsequent client systems” (page 112)) Downloading the profile periodically (see “Downloading the profile periodically” (page 113)) Enabling the use of -r commands with PAM_LDAP (see “Using the r-command for PAM_LDAP” (page 113)) Installing and configuring LDAP-UX Client Serv
PAGE 59
2.4.2 Planning for your customized installation and configuration Before beginning your installation, you should plan how you will set up and verify your LDAP directory and your LDAP-UX Client Services environment before putting them into production. Consider the following questions. Record your decisions and other information that you will need later in “Configuration worksheet” (page 347).
PAGE 60
has been made through the addition of a new caching daemon that caches passwd, group, and X.500 group membership information retrieved from an LDAP server. This significantly reduces LDAP-UX's response time to applications. To improve performance further, the daemon re-uses connections for LDAP queries and maintains multiple connections to an LDAP server. The migration scripts provided with LDAP-UX Client Services can build and populate a new directory subtree for your user and group data.
PAGE 61
good idea to have as few profiles as necessary. To see what is in a profile and help you decide how many different profiles you need, look at the posixNamingProfile object class in “LDAP-UX Client Services object classes” (page 349). If you are familiar with NIS, one possibility is to create a separate profile for each NIS domain. • Where in your directory will you put your profile? The profile contains directory access information.
PAGE 62
you wish to use the Pam Authorization Service module (PAM_AUTHZ) for user access control? PAM provides authentication services. You can configure PAM to use LDAP, Kerberos, or other traditional UNIX locations (for example files, NIS, NIS+) as controlled by NSS. For more information about PAM, see the pam(3) and pam.conf(4) manpages, and the Managing Systems and Workgroups: A Guide for HP-UX System Administrators document at the following location: www.hp.
PAGE 63
IMPORTANT: If you attempt to use this new feature, in the ldapclientd.conf file, the start configuration parameter of the printer services section must be set to yes. If the start option is enabled, the printer configurator will start when ldapclientd is initialized. By default, the start parameter is enabled. • Do you want to import the NIS publickey schema into your LDAP directory if you choose to store and manage NIS publickeys in the LDAP directory.
PAGE 64
/etc/passwd and /etc/netgroup files. If the /etc/opt/ldapux/pam_authz.policy file exists in the system, PAM_AUTHZ uses the access rules defined in the policy file to determine who can log in to the system. For detailed information on this feature and how to configure the /etc/opt/ldapux/ pam_authz.policy file, see Section 5.3 (page 140) or the pam_authz(5) manpage. • Do you want to configure the /etc/opt/ldaux/pam_authz.
PAGE 65
2.4.4 Configuring your directory This section describes how to configure your directory to work with LDAP-UX Client Services. Examples are given for the HP-UX Directory Server. For information about supported directories, see the LDAP-UX Integration Release Notes . If you have a different directory, see the documentation for your directory for details on how to configure it. For more information, see Preparing Your LDAP Directory for HP-UX Integration at: http://www.hp.
PAGE 66
at ou=groups,ou=unix,o=hp.com, allows only the directory administrator to modify entries below ou=groups,ou=unix,o=hp.com: aci: (targetattr = "*")(version 3.0;acl "Disallow modification of group entries"; deny (write) (groupdn != "ldap:///ou=Directory Administrators, o=hp.com");) 4. Grant read access of all attributes of the posix schema. Ensure all users have read access to the posix attributes.
PAGE 67
• • • • gidnumber uid ipserviceport iphostnumber To index these entries with HP-UX Directory Server, go to the Directory Server Console's Configuration tab, then the Indexes tab, and click on the Add Attributes button. 10. Determine if you need to support enumeration requests. If you do, increase the Look-Through limit, and the Size limitin the Directory Server. Enumeration requests are directory queries that request all of a database, for example all users or all groups.
PAGE 68
2.4.5 Configuring the LDAP-UX Client Services Below is a summary of how to configure LDAP-UX Client Services with HP-UX Directory Server. For a default configuration, see Section 2.4.5.1 (page 69). For a custom configuration, see Section 2.4.5.2 (page 73) for more information. NOTE: The setup program has only been certified with HP-UX Directory Server version 8.1, Red Hat Directory Server 8.0, Windows Server 2003 R2 Active Directory Server, and Windows 2008 Active Directory Server.
PAGE 69
IMPORTANT: Starting with LDAP-UX Client Services B.03.20, the client daemon, /opt/ ldapux/bin/ldapclientd, must be running for LDAP-UX functions to work. With LDAP-UX Client Services B.03.10 or earlier, running the client daemon, ldapclientd, is optional. NOTE: The LDAP printer configurator can support any Directory Servers that support the LDAP printer schema based on RFC 3712.
PAGE 70
3. 4. 5. Enter either the host name or IP address of the directory server where your profile exists, or where you want to create a new profile from “Configuration worksheet” (page 347). Enter the port number of the previously specified directory server that you want to store the profile from “Configuration worksheet” (page 347). The default port number is 389.
PAGE 71
Select authentication method for users to bind/authenticate to the server 1. SIMPLE 2. SASL DIGEST-MD5 To accept the default shown in brackets, press the Return key. Authentication method: [1]: Press the return key if you choose to accept SIMPLE authentication method, type 2 if you choose SASL DIGEST-MD5 authentication method for the following prompt: Authentication method: [1]: 13.
PAGE 72
18. Configure the Name Service Switch (NSS). Save a copy of the file /etc/nsswitch.conf and edit the original to specify the LDAP name service and other name services you want to use. See /etc/nsswitch.ldap for a sample. You may be able to just copy /etc/nsswitch.ldap to /etc/nsswitch.conf. See nsswitch.conf(4) for more information. 19. Optionally, configure the Pam Authorization Service module (PAM_AUTHZ). LDAP-UX Client Services provides a sample configuration file, /etc/opt/ldapux/ pam_authz.conf.
PAGE 73
2.4.5.2 Custom configuration Running the setup program for a quick configuration, as described above, configures your client using default values where possible. If you would like to customize these parameters, proceed as follows. If you want to use SSL or TLS, you must perform the following tasks before you run the custom configuration. See Section 2.4.6 (page 79) for details. • Ensure that you have installed the certificate database files, cert8.db and key3.db, on your client system.
PAGE 74
5. 6. Select the client binding you want from “Configuration worksheet” (page 347). This determines the identity that client systems use when binding to the directory to search for user and group information. If you configured a proxy user, enter the DN and password of your proxy user, from “Configuration worksheet” (page 347). If you want to use the SASL/DIGEST-MD5 authentication method, you need to configure a proxy user with its credential level.
PAGE 75
can have up to three different search descriptors. A custom search descriptor consists of three parts: a search base DN, scope, and filter. The client uses the search descriptors in order until it finds what it is looking for. NOTE: If your search filters overlap, enumeration requests will result in duplicate entries being returned.
PAGE 76
2.4.5.3 Remapping attributes for services This section describes detailed procedures on how to perform attribute mappings for automount, dynamic group and X.500 group membership services. Attribute mappings for automount service By default, LDAP-UX Client Services uses the RFC 2307-bis automount schema. The nisObject automount schema can also be used if configured via attribute mappings. Use the following steps if you want to remap the automount attributes to the nisObject automount attributes: 1.
PAGE 77
8. Next, type the attribute nisMapEntry you want to map to the automountInformation attribute and press the return key: automountInformation -> nisMapEntry 9. Next, it will take you to the screen which shows you the following information: Current Automount attribute names: 1.automountMapName ->[nisMapname] 2.automountKey -> [cn] 3.automountInformation -> [nisMapEntry] Specify the attribute you want to map.
PAGE 78
Attribute mappings for X.500 group membership support If you want to configure X.500 group membership support, you should remap the group member attribute to member or uniquemember instead of using the default attribute, memberuid. Perform the following steps for attribute mappings to set up X.500 group membership: 1. Type yes for the following question: Do you want to remap any of the startdard RFC 2307 attributes? [yes]: yes 2.
PAGE 79
2.4.6 Configuring the LDAP-UX Client Services with SSL or TLS support The LDAP-UX Client Services supports either SSL (Secure Socket Layer) or TLS (Transport Layer Security) to secure communication between LDAP clients and the LDAP directory server. With SSL, an encrypted session is established on an encrypted port, 636.
PAGE 80
LDAP-UX Client and configure your LDAP directory server to support SSL or TLS before you run the setup program. NOTE: If you already have the certificate database files cert8.db and key3.db on your client for your HP-UX applications, you can simply create a symbolic link /etc/opt/ldapux/ cert8.db that points to cert8.db, and /etc/opt/ldapux/key3.db that points to key3.db. 2.4.6.2.
PAGE 81
# # /opt/ldapux/contrib/bin/certutil -d /etc/opt/ldapux -A -n "server cert" -t “P,,” -i servercert.der NOTE: The required –n parameter gives the certificate a nickname in the certificate database files. The nickname value is arbitrary. If you plan to connect to multiple LDAP servers that were issued SSL certificates by different certificate authorities, you should use the nickname to help differentiate between the different CA certificates.
PAGE 82
2. Select and execute one of the following steps: • Either LDAP-UX must not be used for host-name resolution by removing “ldap” from the “hosts” service in the /etc/nsswitch.conf file. • Or the host name and IP address must be provided by some other name resolution service, such as “files” or “dns”, and that service must appear before “ldap” in the /etc/nsswitch.conf file for the “hosts” service. 2.4.6.2.2.
PAGE 83
and servers may support different cipher suites, or sets of ciphers, depending on a variety of factors. The ciphers currently supported by LDAP-UX are listed in Table 2-5 (page 83).
PAGE 84
2.4.7 Configuring LDAP-UX Client Services with NIS publickey support LDAP-UX Client Services supports discovery and management of NIS publickeys in an LDAP directory. Both public and secret keys, used by the Secure RPC API can be stored in user and host entries in an LDAP directory server, using thenisKeyObject objectclass. Support for discovery of keys in an LDAP directory server is provided through the getpublickey() and getsecretkey() APIs.
PAGE 85
must re-run the setup program to extend the publickey schema into your LDAP directory. You do not need to re-run the setup program for the subsequent client systems. For detailed information on how to run the setup program to extend the publickey schema into an LDAP directory, see Section 2.4.5.1 (page 69). 2.4.7.3 Admin Proxy user A special type of proxy user, known as an Admin Proxy has been added to LDAP-UX to support management of NIS publickey information in an LDAP directory server.
PAGE 86
aci:(targetattr ="objectclass||nispublickey||nissecretkey") (version 3.
PAGE 87
2.4.7.4.2 Setting ACI for a user With the HP-UX Directory Server, you need to set up an ACI which gives a user permission to change his own nissecretkey and nispublickey attributes. To set up ACI for a user, use the Directory Server Console or ldapmodify. An Example The following ACI gives a user permission to change his own nissecretkey and nispublickey attributes for user keys: dn:ou=People,dc=org,dc=hp,dc=com aci:(targetattr ="nissecretkey||nispublickey")(version 3.
PAGE 88
can find the profile DN from PROFILE_ENTRY_DN in /etc/opt/ldapux/ ldapux_client.conf after you finish running the setup program. The following example edits the profile entry "cn=ldapuxprofile,dc=org,dc=hp,dc=com": For example: cd /opt/ldapux/bin ./ldapentry -m "cn=ldapuxprofile,dc=org,dc=hp,dc=com" After you enter the prompts for "Directory login:" and "password:", ldapentry will bring up an editor window with the profile entry. You can add the serviceAuthenticationMethod attribute.
PAGE 89
serv-auth: keyserv:sasl/digest-md5 auth opts: username: uid realm: For subsequent LDAP-UX client systems that share the same profile configuration, use the following steps to download and activate the profile: 1. 2. Log in as root. Go to /opt/ldapux/config: cd /opt/ldapux/config 3. Use /opt/ldapux/config/get_profile_entry to download the modified LDIF profile: ./get_profile_entry -s nss 4.
PAGE 90
2.5.1 Importing name service data into your directory To import your name service data into your LDAP Directory, consider the following: • • If you have already imported data into your directory with the NIS/LDAP Gateway product, LDAP-UX Client Services can use that data and you can skip to Section 2.4.5 (page 68). If you are using NIS, the migration scripts take your NIS maps and generate LDIF files. These scripts can then import the LDIF files into your directory, creating new entries in the directory.
PAGE 91
dn: cn=DomainAdmins,ou=Groups,dc=mydomain,dc=example,dc=com cn: Domain Administrators cn: DomainAdmins gidNumber: 1900 memberUid: domadmin Use the ldapugmod tool to change numbers as needed. In the following example, the ldapugmod tool changes the GID number of DomainAdmins from 1900 to 1999.
PAGE 92
2.5.2 Verifying the LDAP-UX Client Services This section describes some simple ways you can verify the installation and configuration of your LDAP-UX Client Services. You may need to do more elaborate and detailed testing, especially if you have a large environment. If any of the following tests fail, see Section 5.18 (page 189). 1.
PAGE 93
./beq -k n -s pwd -l /usr/lib/libnss_ldap.1 iuser1 nss_status........ NSS_SUCCESS pw_name...........(iuser1) pw_passwd.........(*) pw_uid............(101) pw_gid............(21) pw_age............() pw_comment........() pw_gecos..........(gecos data in files) pw_dir............(/home/iuser1) pw_shell..........(/usr/bin/sh) pw_audid..........(0) pw_audflg.........(0) Use the following beq command if you are running 64-bit applications on an HP-UX 11i v2 or v3 HP Integrity server: .
PAGE 94
1. Create a valid posix user and group. Add this user as a member of this group using the attribute "member" instead of "memberuid". Here is an example ldif file specifying xuser2 as a member of the group xgrpup1: #cat example_ids.ldif dn: cn=xgroup1,ou=Groups,o=hp.com] objectClass: posixGroup objectClass: groupofnames objectClass: top cn: xgroup1 userPassword: {crypt}* gidNumber: 999 member: uid=xuser2,ou=People,o=hp.com dn: uid=xuser2,ou=People,o=hp.
PAGE 95
2.5.3 Enabling AutoFS support AutoFS is a client-side service that automatically mounts appropriate file systems when users request access to them. If an automounted file system has been idle for a period of time, AutoFS unmounts it. AutoFS uses name services such as files, NIS, or NIS+ to store and manage AutoFS maps. LDAP-UX Client Services supports the automount service under the AutoFS subsystem. This feature allows users to store AutoFS maps in an LDAP directory server. 2.5.3.
PAGE 96
attributeTypes: ( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'user defined' ) attributeTypes: ( 1.3.6.1.1.1.1.32 NAME 'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'user defined' ) attributeTypes: ( 1.3.6.1.1.1.1.33 NAME 'automountInformation' DESC 'Automount information' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.
PAGE 97
nisMapName: auto_direct cn: /mnt_direct/test1 nisMapEntry:hostA:/tmp dn:cn=/mnt_direct/test2, nisMapname=auto_direct, dc=nishpind objectClass: top objectClass: nisObject nisMapName: auto_direct cn: /mnt_direct/test2 nisMapEntry:hostB:/tmp 2.5.3.1.2.2 Limitations The nisObject automount schema contains three attributes, cn, nisMapEntry and nisMapName. cn is an attribute that ignores case-matching.
PAGE 98
If you want to perform attribute mappings or search filter changes by using the Custom Configuration, ensure that you do not accept the remaining default configuration parameters in step 4 of the Custom Configuration. NOTE: You can use the nisObject automount schema without attribute mappings and search filter changes if only the nisObject automount schema exists in the LDAP directory. 2.5.3.3 Configuring NSS Configure the Name Service Switch (NSS) to enable the LDAP support for AutoFS.
PAGE 99
domain name is not specified, LDAP-UX uses the value of the NIS_DOMAIN parameter configured in the /etc/rc.conf.d/namesvrs file. Examples: The following command sets the fully qualified name of the NIS+ domain to "cup.hp.com": export DOM_ENV="cup.hp.com" The following command sets the fully qualified name of the NIS domain to "india.hp.com": export NIS_DOMAINNAME="india.hp.com" The following command sets the base DN to "dc=cup, dc=hp, dc=com": export LDAP_BASEDN="dc=cup, dc=hp, dc=com" 2.5.3.4.
PAGE 100
objectClass: automount automountInformation:hostB:/tmp automountKey:/mnt_direct/lab2 You can use the /opt/ldapux/bin/ldapmodify tool to import the LDIF file /tmp/ auto_direct.ldif that you just created above into the LDAP directory. For example, the following command imports the /tmp/auto_direct.ldif file to the LDAP base DN "dc=nishpind" in the LDAP directory server LDAPSERV1: /opt/ldapux/bin/ldapmodify -a -h LDAPSERV1 -D "cn=Directory Manager" -w -f /tmp/auto_direct.
PAGE 101
2.5.3.4.4 The migrate_nis_automount.pl script This script, found in /opt/ldapux/migrate, migrates the AutoFS maps from the NIS server to LDIF. 2.5.3.4.4.1 Syntax scriptnameinputfileoutputfile 2.5.3.4.4.2 Examples The following commands migrate the AutoFS map /etc/auto_indirect to LDIF and place the results in the /tmp/auto_indirect.ldif file: export LDAP_BASEDN="dc=nisserv1" export NIS_DOMAINNAME="cup.hp.com" migrate_nis_automount.pl /etc/auto_indirect /tmp/auto_indirect.
PAGE 102
2.5.3.4.5 The migrate_nisp_autofs.pl script This script, found in /opt/ldapux/migrate/nisplusmigration, migrates the AutoFS maps from the NIS+ server to the nisp_automap.ldif file. 2.5.3.4.5.1 Syntax scriptnameinputfile 2.5.3.4.5.2 Examples The following commands migrate the AutoFS map /etc/auto_indirect to LDIF and place the results in the nisp_automap.ldif file: export LDAP_BASEDN="dc=nishpbnd" export DOM_ENV ="cup.hp.com" migrate_nisp_autofs.
PAGE 103
NOTE: For information about patches that need to be installed to support offline credential caching, see the LDAP-UX Integration B.05.00 Release Notes. 2.5.4.1 How the offline cache works To support this feature, you can configure LDAP-UX to maintain a secondary (offline) long-term cache that stores previously-discovered user account and group information, including authentication passwords that are hashed using the salted Secure Hash Algorithm (SHA-512).
PAGE 104
# value should be at least twice as large as the combined size of all those # groups. #longterm_cache_size=50000000 # # Should long term caching support enumeration of users and groups. If # getpwent() and getgrent() are not required, this can be disabled. #longterm_enum_enable=no # # How frequently should the HP-UX client go to the directory server to refresh # the enumeration cache. 84600 = once per day. #longterm_enum_search_interval=86400 As shown, offline credential caching is disabled by default.
PAGE 105
2.5.5.2 Netgroups in LDAP With LDAP, the ability to use netgroups to control which groups of users are visible on a host, or which fields are masked, is still available. System administrators can enable NIS compat mode by defining the following sequence in the /etc/nsswitch.conf file: ... passwd: compat passwd_compat: files ldap ... The first line indicates that the passwd name service should operate in the traditional “compatibility mode,” allowing netgroups to be specified in the /etc/passwd file.
PAGE 106
b. /etc/opt/ldapux/ldapux_client.conf Search for "enable_compat_mode". To enable internal compat-mode processing in ldapclientd, set this value to 1. NOTE: If LDAP-UX has been configured previously on your host, you will need to examine the newly delivered configuration files found under /opt/ldapux/newconfig/etc/ opt/ldapux. Compare and merge the existing configuration files with those delivered in the newconfig subdirectory. 3. Restart ldapclientd.
PAGE 107
# # You can disable specific users so that they are unable to log in # through the LDAP server by uncommenting the "disable_uid_range" # flag and adding the UID numbers you want to disable. For example: # # disable_uid_range=0-100,120,300-400 # # Note: The list of UID numbers must be on one line and the maximum # number of ranges is 20. The system will ignore the typos and white spaces. # #disable_uid_range=0 To enable and configure the flag, first save a copy of the /etc/opt/ldapux/ ldapux_client.
PAGE 108
deny_local Specifies the deny_local option The following example shows the portion of the /etc/pam.conf file that configures the authentication and account services. As a result, for any attempt to use these services to log in or establish a session on the HP-UX client system, if PAM_LDAP detects an equivalent account name or UID in the /etc/passwd file, it returns PAM_IGNORE (PAM_LDAP does not authenticate the user).
PAGE 109
OTHER auth required OTHER auth sufficient OTHER auth required # # Account management # login account required login account sufficient login account required su account required su account sufficient su account required dtlogin account required dtlogin account sufficient dtlogin account required dtaction account required dtaction account sufficient dtaction account required ftp account required ftp account sufficient ftp account required rcomds account required rcomds account sufficient rcomds account requi
PAGE 110
module_type Specifies the service module type: authentication (auth), account management (account), session management (session), or password management (password). libpam_ldap.so.1 Specifies the pathname to the PAM_LDAP library object that implements the service functionality. If the pathname is not absolute, it is assumed to be relative to /usr/lib/security/ $ISA/. ignore Specifies the ignore option. The following is an example of a pam_user.
PAGE 111
module_type Specifies the service module type: authentication (auth), account management (account), session management (session), or password management (password). required Specifies the control flag as required (mandatory). libpam_updbe.so.1 Specifies the pathname to the PAM_UPDBE shared library object that implements the service functionality. If the pathname is not absolute, it is assumed to be relative to /usr/lib/security/ $ISA/. For more details, see the pam_updbe(5) and pam_user.
PAGE 112
2.5.7 Configuring subsequent client systems Once you have configured your directory and one client system, you can configure subsequent client systems using the following steps. If you used autosetup to create your LDAP-UX domain, you should continue to use autosetup to configure subsequent clients, since it provisions the HP-UX host information in the directory server. To do this, you can run autosetup in silent mode, as described in Section 2.3.8.2 (page 56). 1.
PAGE 113
2.5.8 Downloading the profile periodically The setup program allows you to define a time interval after which the current profile is being automatically refreshed. The start time for this periodic refresh is defined by the time the setup program was run and the value defined for ProfileTTL. Therefore, it does not allow you to define a specific time of day when the profile should be downloaded (refreshed). For more detailed information, see the ldapclientd(1) manpage.
PAGE 114
su su su dtlogin dtlogin dtlogin dtaction dtaction dtaction ftp ftp ftp rcomds rcomds rcomds sshd sshd sshd OTHER OTHER account account account account account account account account account account account account account account account account account account account account required sufficient required required sufficient required required sufficient required required sufficient required required sufficient required required sufficient required sufficient required libpam_hpsec.so.1 libpam_unix.so.
PAGE 115
3 LDAP Printer configurator support This chapter contains information describing how LDAP-UX supports the printer configurator, how to set up the printer schema, and how to configure the printer configurator to control its behaviors. 3.1 Overview Management of network printing is complex, and printers themselves are more complicated. Instead of having printer configuration and information scattered over client systems and printer servers, they can be stored and managed from a single repository.
PAGE 116
• Updates master printer record file When ldapclientd is initialized, it will enable the printer configurator services at the same time. Once the printer configurator is up, it periodically searches for any existing printer entries in the LDAP Direcotry Server based on predefined search filters. If there are any printer entries in the LDAP Directory Server, the printer configurator will extract the LP printer configuration from each printer entry.
PAGE 117
NOTE: The system administrator manually adds or removes printers to the HP-UX system. The LDAP Printer Configurator will only add or remove printers that it has discovered in the LDAP directory according to the search filter defined for the printer. Figure 3-1 Printer configurator architecture Directory Server *New Printer Schema *Printer Entries dn: printer-name: laser2,ou=printers,dc=hp,dc=com printer-name: laser2 printer-uri: lpd://hostA.corp.hp.
PAGE 118
http://www.ietf.org For the detailed structure information of the new printer schema, see Appendix C. You must import the new printer schema into the LDAP Directory Server to create new printer objects. NOTE: The LDAP printer configurator supports any Directory Servers that support the LDAP printer schema based on RFC 3712. 3.4.
PAGE 119
dn: printer-name=laser2,ou=printers,dc=hp,dc=com printer-name: laser2 printer-uri: lpd://hostA.cup.hp.com/lj2004 printer-location: Engineering Lab printer-model: Hewlett Packard laserjet Model 2004N printer-service-person: David Lott Since the local printer name, remote host name, remote printer name, and the printing protocol information are still the same, the LDAP Printer Configurator will not change the current remote LP printer configuration for laser2. Example 3: The system hostA.hp.com is retired.
PAGE 120
3.6 Limitations of the printer configurator • • • 120 The new LDAP printer schema based on RFC 3712 is imported into the LDAP Directory Server to create the printer objects. LDAP-UX Client Services only suports the HP-UX LP spooler system, network printers, and printerservers that support Line Printer Daemon (LPD) protocol. The printer configurator does not support local printers. In a global management envoriment, it is hard to determine a default printer for the individual client system.
PAGE 121
4 Dynamic group support This chapter contains information about how LDAP-UX Client Services supports dynamic groups, how to set up dynamic groups, and how to enable or disable dynamic group caches. 4.1 Overview A system administrator can associate some users with a group, and apply security policies (e.g. access control, password policies) to the group. As a result, all users belonging to the group inherit the specific policies, such as being able to access a file.
PAGE 122
The following shows an example of a dynamic group entry created using the Directory Server Console: dn: cn=dyngroup,ou=groups,dc=example,dc=hp,dc=com cn=dyngroup objectClass: top objectClass: groupofuniquenames objectClass: groupofnames objectClass: groupofurls memberURL: ldap:///dc=example,dc=hp,dc=com??sub?(l=California) The memberURL attribute in the above example specifies a sub-tree search starting at any level under dc=example, dc=hp, dc=com to find all entries matching (l=California).
PAGE 123
objectClass: groupofuniquenames objectClass: groupofnames objectClass: groupofurls objectClass: posixgroup objectClass: top cn: dyngroup memberURL: ldap:///dc=example,dc=hp,dc=com??sub?(l=California) gidNumber: 500 4.
PAGE 124
4.2.2 Changing an HP-UX POSIX static group to a dynamic group To change an HP-UX POSIX static group to an HP-UX POSIX dynamic group, use the Directory Server Console to add the following objectclass and attribute information to the HP-UX POSIX static group: • • groupofurls objectclass memberURL attribute For detailed information on how to use the Directory Server Console to modify a group, see the HP-UX Directory Server administrator guide available at the following website: http://www.hp.
PAGE 125
----------name: gid: members: ------------cn gidnumber memberuid memberURL member uniquemember LDAP-UX retrieves group members and processes groups that a specific user belongs to by looking into all configured attributes. If needed, you can create a group which include both static and dynamic members. When returning group members, LDAP-UX will return both static and dynamic members that belong to a specific group.
PAGE 126
Table 4-1 Attribute mappings Default Group Attribute Dynamic Group Attribute Static X.500 Group Attribute memberuid memberURL member If you want to perform group attribute mappings by using the Custom Configuration, ensure that you do not accept the remaining default configuration parameters in step 4 of the Custom Configuration.
PAGE 127
4.4 Number of group members returned With dynamic membership support, as with regular (static) group membership support, the number of group members for a specific group returned by getgrnam()/getgrgid()/getgrent() on an HP-UX system is limited by internal buffer sizes. On HP-UX 11i v2 and v3 systems, the buffer size is 7296 bytes for 32–bit applications and 10496 bytes for 64-bit applications. This limitation is mainly impacted by the size of each member name.
PAGE 128
4.6 Performance impact for dynamic groups The dynamic group is specified by either an LDAP URL or a search filter. Depending on how you configure dynamic groups, potentially, there could be a lot of LDAP searches involved. In that case, the performance of those applications calling getgrnam(), getgrgid() or getgrent()(3C) (e.g. the command "id", "groups", etc) will be affected.
PAGE 129
5 Administering LDAP-UX Client Services This chapter describes how to keep your clients running smoothly and expand your computing environment. 5.1 Using the LDAP-UX client daemon This section describes the following: • • • Overview of ldapclientd daemon operation. Configurable parameters and syntax in the ldapclientd configuration file, ldapclientd.conf. Command line syntax and options for the ldapclientd command. 5.1.
PAGE 130
/opt/ldapux/bin/ldapclientd <[-D ]|-E |-S [cache]> /opt/ldapux/bin/ldapclientd <-f| -k| -L| -h| -r> 5.1.2.3 Client daemon performance Performance (client response time) is improved by the use of two techniques: 1. 2. Reuse of connections to the LDAP Directory Server: This feature improves performance by reducing the overhead associated with opening and closing bindings to the directory server and significantly reduces network traffic and server load.
PAGE 131
Meaning: The /etc/opt/ldapux/ldapclientd.conf file is missing or has a syntax error. If the problem is with its syntax, the error message will be accompanied by a line showing exactly where it could not recognize the syntax, or where it found a setting which is out of range. 5.1.2.6 Warnings Whenever the system is rebooted, ldapclientd launches if [StartOnBoot] has the parameter enabled=yes in the file /etc/opt/ldapux/ldapclientd.conf (the ldapclientd configuation file).
PAGE 132
-[automountMap] - [printers] setting This will be different for each section. value Depending on the setting, this can be . 5.1.3.2.1 Section details Within a section, the following syntax applies: [StartOnBoot] Determines if ldapclientd starts automatically when the system boots. enable= By default, this is enabled after LDAP-UX has been configured by the LDAP-UX setup program /opt/ldapux/config/setup.
PAGE 133
except dynamic_group. If this limit is reached, new entries are not cached until enough expired entries are freed to allow it. The default value is 10000000. state_dump_time=<0-2147483647> As state, functions like a virtual between the client and LDAP server, is created for setXXent() request, and stays for the subsequent getXXent() requests. If no get requests are received in the specified time interval (in seconds), the state will be removed. The default value is 300 (in seconds).
PAGE 134
accessible through ldapclientd's API. However, the default delivered ldapclientd.conf file will set this parameter to allow access to the sshPublicKey attribute for the passwd and hosts service. This parameter can be specified more than once. allowed_attribute example: allowed_attribute=hosts:sshPublicKey [passwd] Cache settings for the passwd cache (which caches name, UID, and shadow information). enable= ldapclientd only caches entries for this section, when it is enabled.
PAGE 135
The time, in seconds, before a cache entry expires from the positive cache. If group caching is enabled, this value must be greater than poscache_ttl of [group]. The default value is 43200 (12 hours). negcache_ttl=<1-2147483647> The time, in seconds, before a cache entry expires from the negative cache. If group caching is enabled, this value must be greater than negcache_ttl of [group] The default value is 43200 (12 hours).
PAGE 136
[domain_pwd] This cache maps user names and UIDs to the domain holding its entry. enable= ldapclientd only caches entries for this section, when it is enabled. By default, caching is enabled. poscache_ttl=<0-2147483647> The time, in seconds, before a cache entry expires from the positive cache. Since new domains are rarely added to or removed from the forest, the cache is typically valid for a long time.
PAGE 137
The default value is 1800 (30 minutes). [automountMap] Cache settings for the automount map cache. enable= ldapclientd only caches entries for this section, when it is enabled. By default, caching is enabled. poscache_ttl=<0-2147483647> The time, in seconds, before a cache entry expires from the positive cache. The default value is 1800 (30 minutes). negcache_ttl=<1-2147483647> The time, in seconds, before a cache entry expires from the negative cache. The default value is 7200 (2 hours).
PAGE 138
If you update LDAP-UX Client Services from an older version, such as B.03.00 or B.03.10, the new configuration file will be /opt/ldapux/newconfig/etc/opt/ldapux/ ldapclientd.conf. 5.2 Integrating with Trusted Mode This section describes features and limitations, PAM configuration changes and configuration parameter for integrating LDAP-UX with Trusted Mode. 5.2.1 Overview LDAP-UX Client Services B.03.30 or later supports coexistence with Trusted Mode.
PAGE 139
5.2.2.2 Password and account policies The primary goal of integrating Trusted Mode policies and those policies enforced by an LDAP server is coexistence. This means that Trusted Mode policies are not enforced on LDAP-based accounts, and LDAP server policies are not enforced on local-based accounts.
PAGE 140
5.3 PAM_AUTHZ login authorization The Pluggable Authentication Module (PAM) is an industry standard authentication framework that is supplied as an integrated part of the HP-UX system. PAM gives system administrators the flexibility of choosing any authentication service available on the system to perform authentication. The PAM framework also allows new authentication service modules to be plugged in and made available without modifying the PAM enabled applications.
PAGE 141
Figure 5-1 PAM_AUTHZ environment 1 pam enabled application 2 policy configuration file 5 7 3 pam_authz 6 authentication modules, for examples: pam_kerberos pam_ldap 4 ldap_ux client daemon ldapclientd /etc/group /etc/netgroup LDAP directory server The following describes the policy validation processed by PAM_AUTHZ for the user login authorization shown in “PAM_AUTHZ environment” (page 141): PAM_AUTHZ environment 1.
PAGE 142
5.3.3 PAM_AUTHZ supports security policy enforcement PAM_AUTHZ supports enforcement of account and password policies, stored in an LDAP directory server. This feature works with secure shell (ssh), r-commands with rhost enabled where authentication is not performed by PAM (Pluggable Authentication Module) subsystem, but is performed by the command itself.
PAGE 143
5.3.4 Policy file The system administrator can define a local access policy that can be stored in an access policy file. The default access policy file is /etc/opt/ldapux/pam_authz.policy, but it can be stored in an alternate location by setting the policy option in pam.conf. The PAM_AUTHZ service module uses this local policy file to process the access rules and to control the login authorization. Any service that loads the libpam_authz.1 library will also load this file.
PAGE 144
5.3.5 Policy validator PAM_AUTHZ works as a policy validator. Once it receives a PAM request, it starts to process the access rules defined in pam_authz.policy. It validates and determines the user's login authorization based on the user's login name and the information it retrieves from various name services. The result is then returned to the PAM framework. PAM_AUTHZ processes access rules in the order they are defined in the access policy file.
PAGE 145
5.3.6 Dynamic variable support Dynamic variable support is a method by which an access rule can be defined where part or all of the policy criteria will be determined at the time the rule is evaluated. For example, the name of the computer from which the user attempts to logon can be substituted into the access rule to be evaluated. See Section 5.3.9 (page 151) for more information on how to define an access rule using dynamic variable support. 5.
PAGE 146
5.3.7 Constructing an access rule in the access policy file In the access policy file, an access rule consists of three fields as follows: ::