[deployment-guide/comm-rel: 43/74] Fixed the formatting (BZ#598800).
by dsilas
commit 244a738f1447e85a447d9c29d3b9314b045e03a9
Author: Jaromir Hradilek <jhradile(a)redhat.com>
Date: Fri Jun 25 15:41:17 2010 +0200
Fixed the formatting (BZ#598800).
en-US/Console_Access.xml | 8 +++-----
1 files changed, 3 insertions(+), 5 deletions(-)
---
diff --git a/en-US/Console_Access.xml b/en-US/Console_Access.xml
index c779388..311fe23 100644
--- a/en-US/Console_Access.xml
+++ b/en-US/Console_Access.xml
@@ -92,11 +92,9 @@ Password: </screen>
<keycap>Delete</keycap>
</keycombo> is disabled, the power and reset switches are disabled, and so forth), you may not want to allow any user at the console to run <command>poweroff</command>, <command>halt</command>, and <command>reboot</command>, which are accessible from the console by default.</para>
<para>To disable these abilities, run the following commands as root:</para>
- <screen>
-<command>rm -f /etc/security/console.apps/poweroff</command>
- <command>rm -f /etc/security/console.apps/halt</command>
- <command>rm -f /etc/security/console.apps/reboot</command>
- </screen>
+ <screen><command>rm -f /etc/security/console.apps/poweroff</command>
+<command>rm -f /etc/security/console.apps/halt</command>
+<command>rm -f /etc/security/console.apps/reboot</command></screen>
</section>
<section
id="s1-access-console-define">
13 years, 11 months
[deployment-guide/comm-rel: 42/74] modified DHCP chapter to fix BZ#594562
by dsilas
commit 09215b349b06f3a68db6dc5c88cb0262e41f6725
Author: Martin Prpic <mprpic(a)redhat.com>
Date: Fri Jun 25 15:39:52 2010 +0200
modified DHCP chapter to fix BZ#594562
en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml | 28 ++++++++++----------
1 files changed, 14 insertions(+), 14 deletions(-)
---
diff --git a/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml b/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml
index 9c657ee..9b5bffd 100644
--- a/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml
+++ b/en-US/Dynamic_Host_Configuration_Protocol_DHCP.xml
@@ -37,13 +37,13 @@
<para>The <filename>dhcp</filename> package contains an ISC DHCP server. First, install the package as the superuser:</para>
<screen>~]# <command>yum install dhcp</command>
</screen>
- <para>Installing the <filename>dhcp</filename> package creates a file, <filename>/etc/dhcpd.conf</filename>, which is merely an empty configuration file:</para>
- <screen>~]# <command>cat /etc/dhcpd.conf</command>
+ <para>Installing the <filename>dhcp</filename> package creates a file, <filename>/etc/dhcp/dhcpd.conf</filename>, which is merely an empty configuration file:</para>
+ <screen>~]# <command>cat /etc/dhcp/dhcpd.conf</command>
#
# DHCP Server Configuration file.
# see /usr/share/doc/dhcp*/dhcpd.conf.sample</screen>
<para>The sample configuration file can be found at <filename
- moreinfo="none">/usr/share/doc/dhcp-<<replaceable>version</replaceable>>/dhcpd.conf.sample</filename>. You should use this file to help you configure <filename>/etc/dhcpd.conf</filename>, which is explained in detail below.</para>
+ moreinfo="none">/usr/share/doc/dhcp-<<replaceable>version</replaceable>>/dhcpd.conf.sample</filename>. You should use this file to help you configure <filename>/etc/dhcp/dhcpd.conf</filename>, which is explained in detail below.</para>
<para>DHCP also uses the file <filename>/var/lib/dhcpd/dhcpd.leases</filename> to store the client lease database. Refer to <xref
linkend="lease-database"/> for more information.</para>
<section
@@ -212,7 +212,7 @@ host apex {
<title>Tip</title>
<para>The sample configuration file provided can be used as a starting point and custom configuration options can be added to it. To copy it to the proper location, use the following command:</para>
<screen>
-<command>cp /usr/share/doc/dhcp-<replaceable><version-number></replaceable>/dhcpd.conf.sample /etc/dhcpd.conf</command>
+<command>cp /usr/share/doc/dhcp-<replaceable><version-number></replaceable>/dhcpd.conf.sample /etc/dhcp/dhcpd.conf</command>
</screen>
<para>... where <replaceable><version-number></replaceable> is the DHCP version number.</para>
</note>
@@ -295,7 +295,7 @@ DHCPDARGS=eth0
<listitem>
<para>
<command>-cf <replaceable><filename></replaceable>
- </command> — Specifies the location of the configuration file. The default location is <filename>/etc/dhcpd.conf</filename>.</para>
+ </command> — Specifies the location of the configuration file. The default location is <filename>/etc/dhcp/dhcpd.conf</filename>.</para>
</listitem>
<listitem>
<para>
@@ -429,7 +429,7 @@ ONBOOT=yes
<secondary>server configuration</secondary>
</indexterm>
<para>A multihomed DHCP server serves multiple networks, that is, multiple subnets. The examples in these sections detail how to configure a DHCP server to serve multiple networks, select which network interfaces to listen on, and how to define network settings for systems that move networks.</para>
- <para>Before making any changes, back up the existing <filename>/etc/sysconfig/dhcpd</filename> and <filename>/etc/dhcpd.conf</filename> files.</para>
+ <para>Before making any changes, back up the existing <filename>/etc/sysconfig/dhcpd</filename> and <filename>/etc/dhcp/dhcpd.conf</filename> files.</para>
<para>The DHCP daemon listens on all network interfaces unless otherwise specified. Use the <filename>/etc/sysconfig/dhcpd</filename> file to specify which network interfaces the DHCP daemon listens on. The following <filename>/etc/sysconfig/dhcpd</filename> example specifies that the DHCP daemon listens on the <filename>eth0</filename> and <filename>eth1</filename> interfaces:</para>
<screen>
DHCPDARGS="eth0 eth1";
@@ -438,7 +438,7 @@ DHCPDARGS="eth0 eth1";
<screen>
DHCPDARGS="eth0";
</screen>
- <para>The following is a basic <filename>/etc/dhcpd.conf</filename> file, for a server that has two network interfaces, <filename>eth0</filename> in a 10.0.0.0/24 network, and <filename>eth1</filename> in a 172.16.0.0/24 network. Multiple <computeroutput>subnet</computeroutput> declarations allow different settings to be defined for multiple networks:</para>
+ <para>The following is a basic <filename>/etc/dhcp/dhcpd.conf</filename> file, for a server that has two network interfaces, <filename>eth0</filename> in a 10.0.0.0/24 network, and <filename>eth1</filename> in a 172.16.0.0/24 network. Multiple <computeroutput>subnet</computeroutput> declarations allow different settings to be defined for multiple networks:</para>
<screen>
ddns-update-style <replaceable>interim</replaceable>;
default-lease-time <replaceable>600</replaceable>;
@@ -503,7 +503,7 @@ dhcpd: Not configured to listen on any interfaces!
<para>For further information, refer to the <computeroutput>dhcpd.conf(5)</computeroutput> man page.</para>
<warning>
<title>Alias Interfaces</title>
- <para>Alias interfaces are not supported by DHCP. If an alias interface is the only interface, in the only subnet specified in <filename>/etc/dhcpd.conf</filename>, the DHCP daemon fails to start.</para>
+ <para>Alias interfaces are not supported by DHCP. If an alias interface is the only interface, in the only subnet specified in <filename>/etc/dhcp/dhcpd.conf</filename>, the DHCP daemon fails to start.</para>
</warning>
<section
id="sect-dns_Host_Configuration">
@@ -513,10 +513,10 @@ dhcpd: Not configured to listen on any interfaces!
<primary>Multihomed DHCP</primary>
<secondary>host configuration</secondary>
</indexterm>
- <para>Before making any changes, back up the existing <filename>/etc/sysconfig/dhcpd</filename> and <filename>/etc/dhcpd.conf</filename> files.</para>
+ <para>Before making any changes, back up the existing <filename>/etc/sysconfig/dhcpd</filename> and <filename>/etc/dhcp/dhcpd.conf</filename> files.</para>
<formalpara>
<title>Configuring a single system for multiple networks</title>
- <para>The following <filename>/etc/dhcpd.conf</filename> example creates two subnets, and configures an IP address for the same system, depending on which network it connects to:</para>
+ <para>The following <filename>/etc/dhcp/dhcpd.conf</filename> example creates two subnets, and configures an IP address for the same system, depending on which network it connects to:</para>
</formalpara>
<screen>
ddns-update-style <replaceable>interim</replaceable>;
@@ -571,10 +571,10 @@ host example1 {
</variablelist>
<para>If <computeroutput>option</computeroutput> statements do not end with a semicolon, the DHCP daemon fails to start, and an error such as the following is logged to <filename>/var/log/messages</filename>:</para>
<screen>
-/etc/dhcpd.conf line 20: semicolon expected.
+/etc/dhcp/dhcpd.conf line 20: semicolon expected.
dhcpd: }
dhcpd: ^
-dhcpd: /etc/dhcpd.conf line 38: unexpected end of file
+dhcpd: /etc/dhcp/dhcpd.conf line 38: unexpected end of file
dhcpd:
dhcpd: ^
dhcpd: Configuration file errors encountered -- exiting
@@ -605,12 +605,12 @@ host interface1 {
</itemizedlist>
<para>When a name given in a <computeroutput>host</computeroutput> declaration is not unique, the DHCP daemon fails to start, and an error such as the following is logged to <filename>/var/log/messages</filename>:</para>
<screen>
-dhcpd: /etc/dhcpd.conf line 31: host interface0: already exists
+dhcpd: /etc/dhcp/dhcpd.conf line 31: host interface0: already exists
dhcpd: }
dhcpd: ^
dhcpd: Configuration file errors encountered -- exiting
</screen>
- <para>This error was caused by having multiple <computeroutput>host interface0</computeroutput> declarations defined in <filename>/etc/dhcpd.conf</filename>.</para>
+ <para>This error was caused by having multiple <computeroutput>host interface0</computeroutput> declarations defined in <filename>/etc/dhcp/dhcpd.conf</filename>.</para>
</section>
</section>
<section
13 years, 11 months
[deployment-guide/comm-rel: 41/74] proc_fs: change some default vals per review
by dsilas
commit 1a9556dd66328fca0b24a82b8ec59068bd9b348d
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Fri Jun 25 13:45:03 2010 +0200
proc_fs: change some default vals per review
Fix BZ#607422: default values changed for some settings
en-US/The_proc_File_System.xml | 45 ++++++++++++++++++++++++++++++++++++---
1 files changed, 41 insertions(+), 4 deletions(-)
---
diff --git a/en-US/The_proc_File_System.xml b/en-US/The_proc_File_System.xml
index 653587d..32f2245 100644
--- a/en-US/The_proc_File_System.xml
+++ b/en-US/The_proc_File_System.xml
@@ -3687,8 +3687,17 @@ Can write RAM: 0
<para>
<filename>msgmni</filename>
— Sets the maximum number of message queue
- identifiers. The default is <computeroutput>16</computeroutput>.
+ identifiers. The default is <computeroutput>1990</computeroutput>.
</para>
+
+<!-- ddomingo: BZ#607422
+
+ <para>
+ <filename>msgmni</filename>
+ — Sets the maximum number of message queue
+ identifiers. The default is <computeroutput
+ >16</computeroutput>.
+ </para> -->
</listitem>
<listitem>
@@ -4274,8 +4283,19 @@ Can write RAM: 0
message. This setting is used to mitigate
<firstterm>Denial of Service</firstterm>
(<firstterm>DoS</firstterm>) attacks. The default
- setting is <computeroutput>50</computeroutput>.
+ setting is <computeroutput>10</computeroutput>.
</para>
+
+<!-- BZ#607422 <para>
+ <filename>message_burst</filename>
+ — Sets the amount of time in tenths of a
+ second required to write a new warning
+ message. This setting is used to mitigate
+ <firstterm>Denial of Service</firstterm>
+ (<firstterm>DoS</firstterm>) attacks. The default
+ setting is <computeroutput
+ >50</computeroutput>.
+ </para> -->
</listitem>
<listitem>
@@ -4309,8 +4329,18 @@ Can write RAM: 0
packets faster than the kernel can process
them. The default value for this file is
<computeroutput
- moreinfo="none">300</computeroutput>.
+ moreinfo="none">1000</computeroutput>.
</para>
+<!-- BZ#607422 <para>
+ <filename
+ >netdev_max_backlog</filename>
+ — Sets the maximum number of packets allowed
+ to queue when a particular interface receives
+ packets faster than the kernel can process
+ them. The default value for this file is
+ <computeroutput
+ moreinfo="none">300</computeroutput>.
+ </para> -->
</listitem>
<listitem>
@@ -4634,8 +4664,15 @@ Can write RAM: 0
<filename>dirty_ratio</filename>
— Starts active writeback of dirty data at this
percentage of total memory for the generator of dirty
- data, via pdflush. The default value is <command>40</command>.
+ data, via pdflush. The default value is <command>20</command>.
</para>
+<!-- BZ#607422 <para>
+ <filename>dirty_ratio</filename>
+ — Starts active writeback of dirty data at this
+ percentage of total memory for the generator of dirty
+ data, via pdflush. The default value is <command
+ >40</command>.
+ </para> -->
</listitem>
<listitem>
13 years, 11 months
[deployment-guide/comm-rel: 40/74] Merge branch 'martin'
by dsilas
commit c3e23547a486b87a4622d871b7a8fa750981f556
Merge: 233e9f8... 22cb5d1...
Author: Douglas Silas <dhensley(a)redhat.com>
Date: Fri Jun 25 10:25:45 2010 +0200
Merge branch 'martin'
en-US/Authentication_Configuration.xml | 943 ++++++++++++++++++++++++++------
en-US/SSSD.xml | 250 +++++----
en-US/The_sysconfig_Directory.xml | 34 +-
en-US/images/authconfig_LDAP_kerb.png | Bin 0 -> 52573 bytes
en-US/images/authconfig_advanced.png | Bin 0 -> 44688 bytes
5 files changed, 956 insertions(+), 271 deletions(-)
---
13 years, 11 months
[deployment-guide/comm-rel: 39/74] modified authconfig section
by dsilas
commit 22cb5d106fcf5da2d1a77cd33c79ca7cc785f0af
Author: Martin Prpic <mprpic(a)redhat.com>
Date: Fri Jun 25 10:22:39 2010 +0200
modified authconfig section
en-US/Authentication_Configuration.xml | 101 ++++++++++++++++++++++++++++----
1 files changed, 89 insertions(+), 12 deletions(-)
---
diff --git a/en-US/Authentication_Configuration.xml b/en-US/Authentication_Configuration.xml
index b71a216..52e9c64 100644
--- a/en-US/Authentication_Configuration.xml
+++ b/en-US/Authentication_Configuration.xml
@@ -67,7 +67,7 @@
</listitem>
<listitem>
<para>
- <guilabel>LDAP Server</guilabel> — Specifies the IP address of the <systemitem class="service">LDAP</systemitem> server.
+ <guilabel>LDAP Server</guilabel> — Specifies the address of the <systemitem class="service">LDAP</systemitem> server.
</para>
</listitem>
<listitem>
@@ -124,7 +124,12 @@
</para>
</listitem>
</itemizedlist>
-
+ <note>
+ <title>Note</title>
+ <para>
+ The SSSD service is used as a client for LDAP and Kerberos servers. Thus, offline login is enabled and supported by default. No user interaction is needed to set up the SSSD service with the <application>Authentication Configuration Tool</application>. For more information about the SSSD service, refer to <xref linkend="chap-SSSD_User_Guide-Introduction"/>
+ </para>
+ </note>
<bridgehead>NIS</bridgehead>
<para>
The <guilabel>NIS</guilabel> option configures the system to connect to a NIS server (as an NIS client) for user and password authentication. To configure this option, specify the NIS domain and NIS server. If the NIS server is not specified, the daemon attempts to find it via broadcast.
@@ -156,7 +161,7 @@
</listitem>
<listitem>
<para>
- <guilabel>Security Model</guilabel> — Allows you to select a security model, which configures how clients should respond to Samba. The drop-down list allows you to select any of the following:
+ <guilabel>Security Model</guilabel> — Allows you to select a security model, which configures the Samba client mode of operation. The drop-down list allows you to select any of the following:
<itemizedlist>
<listitem>
<para>
@@ -202,14 +207,7 @@
</para>
<para>
Winbind provides only one method of authentication, <guilabel>Winbind password</guilabel>. This method of authentication uses the options specified in the User Account Configuration of Winbind to connect to a Windows Active Directory or a Windows domain controller.
- </para>
- <note>
- <title>Note</title>
- <para>
- The SSSD service handles all the authentication procedures by default (except for Winbind). No user interaction is needed to set up the SSSD service with the <application>Authentication Configuration Tool</application>. For more information about the SSSD service, refer to <xref linkend="chap-SSSD_User_Guide-Introduction"/>
- </para>
- </note>
-
+ </para>
</section>
<section id="sect-The_Authentication_Configuration_Tool-Advanced_Options">
<title>Advanced Options</title>
@@ -405,6 +403,22 @@
</row>
<row>
<entry>
+ <command>--enablerfc2307bis</command>
+ </entry>
+ <entry>
+ Enable use of RFC-2307bis schema for LDAP user information lookups
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <command>--disablerfc2307bis</command>
+ </entry>
+ <entry>
+ Disable use of RFC-2307bis schema for LDAP user information lookups
+ </entry>
+ </row>
+ <row>
+ <entry>
<command>--enableldapauth</command>
</entry>
<entry>
@@ -630,7 +644,54 @@
Configures winbind to prevent offline login
</entry>
</row>
-
+ <row>
+ <entry>
+ <command>--smbsecurity=<replaceable><user|server|domain|ads></replaceable></command>
+ </entry>
+ <entry>
+ Security mode to use for the Samba and Winbind services
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <command>--smbrealm=<replaceable><realm></replaceable></command>
+ </entry>
+ <entry>
+ Default realm for Samba and Winbind services when <guilabel>security</guilabel> is set to <guimenuitem>ads</guimenuitem>
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <command>--enablewins</command>
+ </entry>
+ <entry>
+ Enable Wins for hostname resolution
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <command>--disablewins</command>
+ </entry>
+ <entry>
+ Disable Wins for hostname resolution
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <command>--enablesssd</command>
+ </entry>
+ <entry>
+ Enable SSSD for user information
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <command>--disablesssd</command>
+ </entry>
+ <entry>
+ Disable SSSD for user information
+ </entry>
+ </row>
<row>
<entry>
<command>--enablecache</command>
@@ -665,6 +726,22 @@
</row>
<row>
<entry>
+ <command>--enablesysnetauth</command>
+ </entry>
+ <entry>
+ Authenticate system accounts with network services
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <command>--disablesysnetauth</command>
+ </entry>
+ <entry>
+ Authenticate system accounts with local files only
+ </entry>
+ </row>
+ <row>
+ <entry>
<command>--enablepamaccess</command>
</entry>
<entry>
13 years, 11 months
[deployment-guide/comm-rel: 37/74] more last minute changes from tech review
by dsilas
commit 86dccffff97ca2620c4ccc1905a8ff88dc664df4
Author: David O'Brien <davido(a)redhat.com>
Date: Fri Jun 25 14:10:22 2010 +1000
more last minute changes from tech review
en-US/SSSD.xml | 33 +++++++++++++++++++--------------
1 files changed, 19 insertions(+), 14 deletions(-)
---
diff --git a/en-US/SSSD.xml b/en-US/SSSD.xml
index dc1099d..4b5ae34 100644
--- a/en-US/SSSD.xml
+++ b/en-US/SSSD.xml
@@ -6,16 +6,16 @@
<title>The System Security Services Daemon (SSSD)</title>
<para>
- This chapter provides an introduction to the <firstterm>System Security Services Daemon (SSSD)</firstterm>, the main features that it provides, and discusses the requirements and any limitations of a typical SSSD deployment.
+ This section provides an introduction to the <firstterm>System Security Services Daemon (SSSD)</firstterm>, the main features that it provides, and discusses the requirements and any limitations of a typical SSSD deployment.
</para>
<para>
- This chapter also describes how to install and configure SSSD, and how to use the features that it provides. It provides information on the types of services that it supports and how to configure them, and introduces and describes the most important configuration options. Sample configuration files are also provided to help you optimize your deployment.
+ This section also describes how to configure SSSD, and how to use the features that it provides. It provides information on the types of services that it supports and how to configure them, and introduces and describes the most important configuration options. Sample configuration files are also provided to help you optimize your deployment.
</para>
<section id="sect-SSSD_User_Guide-Introduction-What_is_SSSD">
<title>What is SSSD?</title>
<para>
- The System Security Services Daemon (SSSD) is a service which provides access to different identity and authentication providers. You can configure SSSD to use a native LDAP domain (that is, an LDAP identity provider with LDAP authentication), or an LDAP identity provider with Kerberos authentication. It provides an NSS and PAM interface to the system, a pluggable back-end system to connect to multiple different account sources.
+ The System Security Services Daemon (SSSD) is a service which provides access to different identity and authentication providers. You can configure SSSD to use a native LDAP domain (that is, an LDAP identity provider with LDAP authentication), or an LDAP identity provider with Kerberos authentication. It provides an NSS and PAM interface to the system, and a pluggable back-end system to connect to multiple different account sources.
</para>
<para>
SSSD is also extensible; you can configure it to use new identity sources and authentication mechanisms should they arise.
@@ -97,6 +97,9 @@
class="domainname">ldap.myhome.com</systemitem> domain. You can use SSSD to make requests using fully-qualified usernames. If you request information for <systemitem
class="username">kate</systemitem>, you will receive the information from whichever domain is listed first in the look-up order. If you request information for <systemitem
class="username">kate(a)ldap.myhome.com</systemitem>, however, you will receive the correct user information.</para>
+ <para>
+ SSSD also provides a <option>filter_users</option> option, which you can use to exclude certain users from being fetched from the database. Refer to the <citetitle>sssd.conf(5)</citetitle> manual page for full details about this option.
+ </para>
</section>
<!--
<section
@@ -329,7 +332,7 @@ simple_allow_users = user1, user2</screen>
<secondary>in SSSD, rules</secondary>
</indexterm>
- <para>The Simple Access Provider adheres to three simple rules to determine which users should or should not be granted access, as follows:
+ <para>The Simple Access Provider adheres to the following three rules to determine which users should or should not be granted access:
<itemizedlist>
<listitem>
<para>
@@ -382,7 +385,7 @@ simple_allow_users = user1, user2</screen>
<para>The client then makes an SRV DNS query to retrieve a list of host names, their priorities, and weights. These queries are of the form _<replaceable>service</replaceable>._<replaceable>protocol</replaceable>._<replaceable>domain</replaceable>, for example, <literal>_ldap._tcp._redhat.com</literal>. The client then sorts this list according to the priorities and weights, and connects to the first server in this sorted list.</para>
- <para>For more information on SRV records, refer to the <ulink url="http://tools.ietf.org/html/rfc2782">RFC</ulink>.</para>
+ <para>For more information on SRV records, refer to <ulink url="http://tools.ietf.org/html/rfc2782">RFC 2782</ulink>.</para>
</section>
<section>
@@ -648,7 +651,7 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
</screen>
<note>
- <para>With <parameter>use_fully_qualified_names</parameter> set to <literal>FALSE</literal>, you can continue to use the fully-qualified name in your requests, but only the simplified version is displayed in the output.</para>
+ <para>If <parameter>use_fully_qualified_names</parameter> is set to <literal>FALSE</literal>, you can continue to use the fully-qualified name in your requests, but only the simplified version is displayed in the output.</para>
<para>SSSD can only parse <systemitem class="domainname">name@domain</systemitem>, not <systemitem
class="domainname">name@realm</systemitem>. You can, however, use the same name for both your domain and your realm.</para>
</note>
@@ -658,7 +661,11 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
<option>auth_provider <type>(string)</type>
</option>
</para>
- <para>The authentication provider used for the domain. Currently supported authentication providers are:
+ <para>
+ The authentication provider used for the domain. The default value for this option is the value of <option>id_provider</option> if it is set and can handle authentication requests.
+ </para>
+ <para>
+ Currently supported authentication providers are:
<itemizedlist>
<listitem>
<para>ldap — for native LDAP authentication. Refer to the sssd-ldap(5) manual page for more information on configuring LDAP.</para>
@@ -675,9 +682,6 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
</para>
</listitem>
</itemizedlist>
- <para>
- The default value for <option>auth_provider</option> is the value of <option>id_provider</option> if it is set and can handle authentication requests.
- </para>
</section>
<section
@@ -895,7 +899,7 @@ ldap_group_gid_number = msSFU30GidNumber</screen>
</indexterm>
<para>
- SSSD currently only supports LDAP and Kerberos as authentication providers. If you prefer to use SSSD (for example, to take advantage of its caching functionality), but SSSD does not support your authentication method natively, you can set up a proxy authentication provider. This could be the case if you use fingerprint scanners or smart cards as part of your authentication process.
+ SSSD currently only supports LDAP and Kerberos as authentication providers. If you prefer to use SSSD (for example, to take advantage of its caching functionality), but SSSD does not support your authentication method, you can set up a proxy authentication provider. This could be the case if you use fingerprint scanners or smart cards as part of your authentication process.
</para>
<itemizedlist>
<listitem>
@@ -967,6 +971,7 @@ krb5_auth_timeout = 15
<para>This example describes the minimum options that must be configured when using Kerberos authentication. Refer to the <citetitle>sssd-krb5(5)</citetitle> manual page for a full description of all the options that apply to configuring Kerberos authentication.</para>
</section>
+ <!--
<section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_SASL_GSSAPI_Authentication">
<title>Setting up SASL/GSSAPI Authentication</title>
<indexterm>
@@ -975,7 +980,7 @@ krb5_auth_timeout = 15
</indexterm>
<para>dummy text</para>
<remark>https://bugzilla.redhat.com/show_bug.cgi?id=601870</remark>
- </section>
+ </section>-->
<!--<section
id="chap-SSSD_User_Guide-Using_the_SSSD_Management_Tools">
@@ -1110,7 +1115,7 @@ GroupE:*:518:UserE
<formalpara
id="form-SSSD_User_Guide-Using_SSSD_Log_Files-Producing_More_Verbose_Log_Files">
<title>Producing More Verbose Log Files</title>
- <para>If you are unable to identify and resolve any problems with SSSD after inspection of the default log files, you can configure SSSD to produce more verbose files. You can set the <option>debug_level</option> option in the <filename>/etc/sssd/sssd.conf</filename> for the domain that is causing concern, and then restart SSSD. Refer to the <citetitle>sssd.conf(5)</citetitle> manual page for more information on how to set the <option>debug_level</option> for a specfic domain.</para>
+ <para>If you are unable to identify and resolve any problems with SSSD after inspection of the default log files, you can configure SSSD to produce more verbose files. You can set the <option>debug_level</option> option in the <filename>/etc/sssd/sssd.conf</filename> for the domain that is causing concern, and then restart SSSD. Refer to the <citetitle>sssd.conf(5)</citetitle> manual page for more information on how to set the <option>debug_level</option> for a specific domain.</para>
</formalpara>
<para>All log files include timestamps on debug messages by default. This can make it easier to understand any errors that may occur, why they occurred, and how to address them. If necessary, you can disable these timestamps by setting the appropriate parameter to <literal>FALSE</literal> in the <filename>/etc/sssd/sssd.conf</filename> file:</para>
@@ -1251,7 +1256,7 @@ passwd: all authentication tokens updated successfully.
<section
id="sect-SSSD_User_Guide-Additional_Resources-Manual_Pages">
<title>Manual Pages</title>
- <para>SSSD ships with a number of manual pages, all of which provide additional information about specfic aspects of SSSD, such as configuration files, commands, and available options. SSSD currently provides the following manual pages:</para>
+ <para>SSSD ships with a number of manual pages, all of which provide additional information about specific aspects of SSSD, such as configuration files, commands, and available options. SSSD currently provides the following manual pages:</para>
<itemizedlist>
<listitem>
<para>
13 years, 11 months
[deployment-guide/comm-rel: 36/74] last minute changes from tech review
by dsilas
commit ae4fe644dd55d90a860170f693c3520f228629db
Author: David O'Brien <davido(a)redhat.com>
Date: Fri Jun 25 11:51:09 2010 +1000
last minute changes from tech review
en-US/SSSD.xml | 223 ++++++++++++++++++++++++++++++--------------------------
1 files changed, 121 insertions(+), 102 deletions(-)
---
diff --git a/en-US/SSSD.xml b/en-US/SSSD.xml
index 05e73fb..dc1099d 100644
--- a/en-US/SSSD.xml
+++ b/en-US/SSSD.xml
@@ -15,7 +15,7 @@
<section id="sect-SSSD_User_Guide-Introduction-What_is_SSSD">
<title>What is SSSD?</title>
<para>
- The System Security Services Daemon (SSSD) is a service which provides access to different identity and authentication providers. You can configure SSSD to use a native LDAP domain (that is, an LDAP identity provider with LDAP authentication), or an LDAP identity provider with Kerberos authentication. It provides an NSS and PAM interface to the system, a pluggable back-end system to connect to multiple different account sources, as well as a D-Bus interface.
+ The System Security Services Daemon (SSSD) is a service which provides access to different identity and authentication providers. You can configure SSSD to use a native LDAP domain (that is, an LDAP identity provider with LDAP authentication), or an LDAP identity provider with Kerberos authentication. It provides an NSS and PAM interface to the system, a pluggable back-end system to connect to multiple different account sources.
</para>
<para>
SSSD is also extensible; you can configure it to use new identity sources and authentication mechanisms should they arise.
@@ -145,9 +145,9 @@
<section id="sect-SSSD_User_Guide-Installing_SSSD-Upgrading_from_a_Previous_Version">
<title>Upgrading from a Previous Version</title>
- <para>Beginning with version 0.6.0, SSSD uses a different and simplified configuration file format, referred to as "Version 2". Consequently, existing configuration files need to be migrated to the new format. SSSD provides a script to automate the migration process.</para>
- <para>SSSD checks the value of the <parameter>config_file_version</parameter> parameter during the startup procedure. If this value is correct, the installation continues,otherwise it aborts.</para>
- <para>The revised format of the configuration file is described in <xref
+
+
+ <para>The format of the configuration file is described in <xref
linkend="sect-SSSD_User_Guide-SSSD_Example_Configuration_Files-SSSD_Configuration_File_Format"/>
</para>
@@ -251,7 +251,6 @@ group: files sss
</warning>
<para>To enable your system to use SSSD for PAM, you need to edit the default PAM configuration file. On &MAJOROS;—based systems, this is the <filename>/etc/pam.d/system-auth</filename> file. Edit this file to reflect the following example, and then restart <systemitem class="daemon">sssd</systemitem>:</para>
- <remark>Validate the following example, especially comments about auto-generation.</remark>
<programlisting>#%PAM-1.0
# This file is auto-generated.
@@ -281,9 +280,7 @@ session sufficient pam_sss.so
session required pam_unix.so
</programlisting>
-<remark>Need to validate the following para.</remark>
- <para>You can also use <command>authconfig</command> to set up your PAM configuration to use SSSD. Select <guilabel>Use LDAP Authentication</guilabel>, and then replace <filename>pam_ldap.so</filename> with <filename>pam_sss.so</filename> in all files below <filename>/etc/pam.d</filename> or in the <filename>/etc/pam.conf</filename> file.</para>
<formalpara id="form-SSSD_User_Guide-Configuring_PAM-Using_include_Statements_in_PAM_Configurations">
<title>Using include Statements in PAM Configurations</title>
@@ -315,9 +312,7 @@ session optional pam_console.so
By using the Simple Access Provider, you can continue to support a number of network logins to maintain common network accounts on company or department laptops, but you might want to restrict the use of a particular laptop to one or two users. This means that even if a different user authenticated successfully against the same authentication provider, the Simple Access Provider would prevent that user from gaining access.
</para>
</formalpara>
- <para>
- The Simple Access Provider is also useful if you have two domains configured that have some overlapping users. In this scenario, you can specify <option>simple_deny_users</option> in one domain for a set of users, thereby guaranteeing that those users will be handled by the other domain.
- </para>
+
<para>
The following example demonstrates the use of the Simple Access Provider to grant access to two users. This example assumes that SSSD is correctly configured and <systemitem class="domainname">example.com</systemitem> is one of the domains specified in the <literal>[sssd]</literal> section, and only shows the Simple Access Provider-specific options.
@@ -368,11 +363,13 @@ simple_allow_users = user1, user2</screen>
<para>For example, if you have configured a native LDAP domain, you could specify the following as your <parameter>ldap_uri</parameter> values:</para>
<screen>ldap_uri = ldap://ldap0.mydomain.org, ldap://ldap1.mydomain.org, ldap://ldap2.mydomain.org</screen>
- <para>In this configuration, <uri>ldap://ldap0.mydomain.org</uri> functions as the primary server. If this server fails, the SSSD failover mechanism first attempts to connect to <uri>ldap1.mydomain.org</uri>, and if that is unavailable, it then attempts to connect to <uri>ldap2.mydomain.org</uri>. If the primary server is restored, the failover mechanism automatically restores operations to use that server instead of any failover servers.</para>
+ <para>In this configuration, <uri>ldap://ldap0.mydomain.org</uri> functions as the primary server. If this server fails, the SSSD failover mechanism first attempts to connect to <uri>ldap1.mydomain.org</uri>, and if that is unavailable, it then attempts to connect to <uri>ldap2.mydomain.org</uri>.</para>
<para>If the parameter that specifies which server to connect to for the specific domain (for example, <parameter>ldap_uri</parameter>, <parameter>krb5_kdcip</parameter>, …) is not specified, the back end defaults to using <replaceable>Use service discovery</replaceable>. Refer to <xref linkend="sect-SSSD_User_Guide-Configuring_Domains-Configuring_Failover-Using_SRV_Records_with_Failover"/> for more information on service discovery.</para>
- <important><para>Do not use multiple <parameter>ldap_uri</parameter> parameters to specify your failover servers. The failover servers must be entered as a comma-separated list of values for a single <parameter>ldap_uri</parameter> parameter. If you enter multiple <parameter>ldap_uri</parameter> parameters, SSSD only recognizes the last entry.</para></important>
+ <important><para>Do not use multiple <parameter>ldap_uri</parameter> parameters to specify your failover servers. The failover servers must be entered as a comma-separated list of values for a single <parameter>ldap_uri</parameter> parameter. If you enter multiple <parameter>ldap_uri</parameter> parameters, SSSD only recognizes the last entry.</para>
+ <para>Future versions of SSSD will throw an error upon receiving additional ldap_uri entries.</para>
+ </important>
<section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_Failover-Using_SRV_Records_with_Failover">
<title>Using SRV Records with Failover</title>
@@ -383,7 +380,10 @@ simple_allow_users = user1, user2</screen>
<para>A typical configuration would contain multiple such records, each with a different priority (for failover) and different weights (for load balancing).</para>
- <para>The client then makes an SRV DNS query to retrieve a list of host names, their priorities, and weights. These queries are of the form _<replaceable>service</replaceable>._<replaceable>protocol</replaceable>._<replaceable>domain</replaceable>, for example, <literal>_ldap._tcp._redhat.com</literal>. The client then sorts this list according to the priorities and weights, and connects to the first server in this sorted list.</para></section>
+ <para>The client then makes an SRV DNS query to retrieve a list of host names, their priorities, and weights. These queries are of the form _<replaceable>service</replaceable>._<replaceable>protocol</replaceable>._<replaceable>domain</replaceable>, for example, <literal>_ldap._tcp._redhat.com</literal>. The client then sorts this list according to the priorities and weights, and connects to the first server in this sorted list.</para>
+
+ <para>For more information on SRV records, refer to the <ulink url="http://tools.ietf.org/html/rfc2782">RFC</ulink>.</para>
+ </section>
<section>
<title>How the Failover Mechanism Works</title>
@@ -571,9 +571,6 @@ krb5_realm = EXAMPLE.COM</screen>
<para>Specifies whether or not to enumerate (list) the users and groups of a domain.</para>
<para>Enumeration means that the entire set of available users and groups on the remote source is cached on the local machine. When enumeration is disabled, users and groups are only cached as they are requested. For performance reasons, it is recommended that you disable enumeration for domains with many users and groups.</para>
<para>The default value for this parameter is <literal>FALSE</literal>. Set this value to <literal>TRUE</literal> to enable enumeration of users and groups of a domain.</para>
- <important>
- <para>A minor security concern exists when enabling enumeration. With enumeration enabled, users can run the <command>getent passwd</command> command to retrieve the full list of users that could have access to the system. With enumeration disabled, users are required to know individual usernames in advance.</para>
- </important>
</listitem>
<listitem>
<para>
@@ -731,23 +728,24 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh
Append <option>‐‐help</option> to any of these commands for details about how to use them.</para>
</section>-->
- <section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_a_Native_LDAP_Domain">
- <title>Configuring a Native LDAP Domain</title>
- <indexterm>
- <primary>SSSD</primary>
- <secondary>Configuring a Native LDAP Domain for</secondary>
- </indexterm>
- <para>
- A native LDAP domain is one where the <option>id_provider</option> option is set to <literal>ldap</literal> (<option>id_provider = ldap</option>). Such a domain requires a running LDAP server against which to authenticate. This can be an open source LDAP server such as OpenLDAP or Microsoft Active Directory. SSSD currently supports Microsoft Active Directory 2003 (+Services For UNIX) and Active Directory 2008. In all cases, the client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file.
- </para>
- <para>
- SSSD does not support authentication over an unencrypted channel. Consequently, if you want to authenticate against an LDAP server, <systemitem class="protocol">TLS/SSL</systemitem> is required. If the LDAP server is used only as an identity provider, an encrypted channel is not needed.
- </para>
- <formalpara id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-How_to_Authenticate_Against_a_Native_LDAP_Domain">
- <title>How to Authenticate Against a Native LDAP Domain</title>
- <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para>
- </formalpara>
+ <section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_a_Native_LDAP_Domain">
+ <title>Configuring an LDAP Domain</title>
+ <indexterm>
+ <primary>SSSD</primary>
+ <secondary>Configuring an LDAP domain for</secondary>
+ </indexterm>
+ <para>
+ An LDAP domain is one where the <option>id_provider</option> option is set to <literal>ldap</literal> (<option>id_provider = ldap</option>). Such a domain requires a running LDAP server against which to authenticate. This can be an open source LDAP server such as OpenLDAP or Microsoft Active Directory. SSSD currently supports Microsoft Active Directory 2003 (+Services For UNIX) and Active Directory 2008. In all cases, the client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file.
+ </para>
+
+ <formalpara id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-How_to_Authenticate_Against_an_LDAP_Server">
+ <title>How to Authenticate Against an LDAP Server</title>
+ <para>
+ SSSD does not support authentication over an unencrypted channel. Consequently, if you want to authenticate against an LDAP server, <systemitem class="protocol">TLS/SSL</systemitem> is required. If the LDAP server is used only as an identity provider, an encrypted channel is not needed.
+ </para>
+ </formalpara>
+ <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para>
<screen># A native LDAP domain
[domain/LDAP]
@@ -765,19 +763,12 @@ tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
</screen>
- <formalpara><title>How to Authenticate Against a Microsoft Active Directory LDAP Domain</title>
- <indexterm>
- <primary>SSSD</primary>
- <secondary>Authenticating against Microsoft Active Directory</secondary>
- </indexterm>
- <para>dummy text</para>
- </formalpara>
- <formalpara>
+ <formalpara id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-Selecting_an_LDAP_Schema">
<title>Selecting an LDAP Schema</title>
<indexterm>
<primary>SSSD</primary>
- <secondary>Selecting an LDAP Schema for</secondary>
+ <secondary>Selecting an LDAP schema for</secondary>
</indexterm>
<para>
You can set the <parameter>ldap_schema</parameter> attribute to either <literal>rfc2307</literal> or <literal>rfc2307bis</literal>. These schema define how groups in <acronym>LDAP</acronym> are specified. In <citetitle>RFC 2307</citetitle>, group objects use a multi-valued attribute, <parameter>memberuid</parameter>, which lists the names of the users that belong to that group. In <citetitle>RFC 2307bis</citetitle>, instead of the <parameter>memberuid</parameter>, group objects use the <parameter>member</parameter> attribute. Rather than just the name of the user, this attribute contains the full Distinguished Name (DN) of another object in the LDAP database. This means that groups can have other groups as members. That is, it adds support for nested groups.
@@ -803,11 +794,11 @@ uid=500(f12server) gid=500(f12server) groups=500(f12server),510(f12tester)
Changes to this setting only affect how SSSD determines the groups to which a user belongs; there is no negative effect on the actual user data. If you do not know the correct value for this attribute, consult your System Administrator.
</para>
- <formalpara>
+ <formalpara id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-Specifying_Timeout_Values">
<title>Specifying Timeout Values</title>
<indexterm>
<primary>SSSD</primary>
- <secondary>Specifying Timeout Values for</secondary>
+ <secondary>Specifying timeout values for</secondary>
</indexterm>
<para>
SSSD supports a number of timeout values that apply when configuring an <acronym>LDAP</acronym> domain. These are described below.
@@ -855,72 +846,43 @@ uid=500(f12server) gid=500(f12server) groups=500(f12server),510(f12tester)
</formalpara>
</section>
- <section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_Kerberos_Authentication">
- <title>Setting up Kerberos Authentication</title>
+ <section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_a_Microsoft_Active_Directory_Domain">
+ <title>Configuring a Microsoft Active Directory Domain</title>
<indexterm>
<primary>SSSD</primary>
- <secondary>Setting up Kerberos authentication for</secondary>
+ <secondary>Configuring a Microsoft Active Directory Domain for</secondary>
</indexterm>
- <para>
- In order to set up Kerberos authentication, you need to know the address of your <firstterm>key distribution center</firstterm> (KDC) and the Kerberos domain. The client configuration is then stored in the <filename>/etc/sssd/sssd.conf</filename> file.
- </para>
+ <remark>https://bugzilla.redhat.com/show_bug.cgi?id=601870</remark>
- <para>
- The Kerberos 5 authentication back end does not contain an identity provider and must be paired with one in order to function properly (for example, <option>id_provider = ldap</option>). Some information required by the Kerberos 5 authentication back end must be supplied by the identity provider, such as the user's <firstterm>Kerberos Principal Name</firstterm> (UPN). The identity provider configuration should contain an entry to specify this UPN. Refer to the manual page for the applicable identity provider for details on how to configure the UPN.
- </para>
- <para>
- If the UPN is not available in the identity back end, SSSD will construct a UPN using the format <systemitem class="username">username@krb5_realm</systemitem>.
- </para>
+ <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para>
- <formalpara
- id="form-SSSD_User_Guide-Setting_Up_Kerberos_Authentication-How_to_Authenticate_Against_a_Kerberos_Back_End">
- <title>How to Authenticate Against a Kerberos Back End</title>
- <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para>
- </formalpara>
+<screen># Example LDAP domain where the LDAP server is an Active Directory server.
-<screen># A domain with identities provided by LDAP and authentication by Kerberos
-[domain/KRBDOMAIN]
+[domain/AD]
+description = LDAP domain with AD server
enumerate = false
+min_id = 1000
+;
id_provider = ldap
-chpass_provider = krb5
-ldap_uri = ldap://ldap.mydomain.org
-ldap_user_search_base = dc=mydomain,dc=org
-tls_reqcert = demand
-ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
-
-auth_provider = krb5
-krb5_kdcip = 192.168.1.1
-krb5_realm = EXAMPLE.COM
-krb5_changepw_principal = kadmin/changepw
-krb5_ccachedir = /tmp
-krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
-krb5_auth_timeout = 15
-</screen>
-
- <para>This example describes the minimum options that must be configured when using Kerberos authentication. Refer to the <citetitle>sssd-krb5(5)</citetitle> manual page for a full description of all the options that apply to configuring Kerberos authentication.</para>
- </section>
-
- <section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_SASL_GSSAPI_Authentication">
- <title>Setting up SASL/GSSAPI Authentication</title>
- <indexterm>
- <primary>SSSD</primary>
- <secondary>Setting up SASL/GSSAPI Authentication for</secondary>
- </indexterm>
- <para>dummy text</para>
- <remark>https://bugzilla.redhat.com/show_bug.cgi?id=601870</remark>
-
- </section>
-
- <section><title>Configuring a Microsoft Active Directory Domain</title>
- <indexterm>
- <primary>SSSD</primary>
- <secondary>Configuring a Microsoft Active Directory Domain for</secondary>
- </indexterm>
- <para>dummy text</para>
- <remark>https://bugzilla.redhat.com/show_bug.cgi?id=601870</remark>
-
-
+auth_provider = ldap
+ldap_uri = ldap://your.ad.server.com
+ldap_schema = rfc2307bis
+ldap_user_search_base = cn=users,dc=example,dc=com
+ldap_group_search_base = cn=users,dc=example,dc=com
+ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com
+ldap_default_authtok_type = password
+ldap_default_authtok = YOUR_PASSWORD
+ldap_user_object_class = person
+ldap_user_name = msSFU30Name
+ldap_user_uid_number = msSFU30UidNumber
+ldap_user_gid_number = msSFU30GidNumber
+ldap_user_home_directory = msSFU30HomeDirectory
+ldap_user_shell = msSFU30LoginShell
+ldap_user_principal = userPrincipalName
+ldap_group_object_class = group
+ldap_group_name = msSFU30Name
+ldap_group_gid_number = msSFU30GidNumber</screen>
</section>
@@ -958,6 +920,63 @@ krb5_auth_timeout = 15
</section>
+
+ <section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_Kerberos_Authentication">
+ <title>Setting up Kerberos Authentication</title>
+ <indexterm>
+ <primary>SSSD</primary>
+ <secondary>Setting up Kerberos authentication for</secondary>
+ </indexterm>
+
+ <para>
+ In order to set up Kerberos authentication, you need to know the address of your <firstterm>key distribution center</firstterm> (KDC) and the Kerberos domain. The client configuration is then stored in the <filename>/etc/sssd/sssd.conf</filename> file.
+ </para>
+
+ <para>
+ The Kerberos 5 authentication back end does not contain an identity provider and must be paired with one in order to function properly (for example, <option>id_provider = ldap</option>). Some information required by the Kerberos 5 authentication back end must be supplied by the identity provider, such as the user's <firstterm>Kerberos Principal Name</firstterm> (UPN). The identity provider configuration should contain an entry to specify this UPN. Refer to the manual page for the applicable identity provider for details on how to configure the UPN.
+ </para>
+ <para>
+ If the UPN is not available in the identity back end, SSSD will construct a UPN using the format <systemitem class="username">username@krb5_realm</systemitem>.
+ </para>
+
+ <formalpara
+ id="form-SSSD_User_Guide-Setting_Up_Kerberos_Authentication-How_to_Set_up_Kerberos_Authentication">
+ <title>How to Set up Kerberos Authentication</title>
+ <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para>
+ </formalpara>
+
+<screen># A domain with identities provided by LDAP and authentication by Kerberos
+[domain/KRBDOMAIN]
+enumerate = false
+id_provider = ldap
+chpass_provider = krb5
+ldap_uri = ldap://ldap.mydomain.org
+ldap_user_search_base = dc=mydomain,dc=org
+tls_reqcert = demand
+ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
+
+auth_provider = krb5
+krb5_kdcip = 192.168.1.1
+krb5_realm = EXAMPLE.COM
+krb5_changepw_principal = kadmin/changepw
+krb5_ccachedir = /tmp
+krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
+krb5_auth_timeout = 15
+</screen>
+
+ <para>This example describes the minimum options that must be configured when using Kerberos authentication. Refer to the <citetitle>sssd-krb5(5)</citetitle> manual page for a full description of all the options that apply to configuring Kerberos authentication.</para>
+ </section>
+
+ <section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_SASL_GSSAPI_Authentication">
+ <title>Setting up SASL/GSSAPI Authentication</title>
+ <indexterm>
+ <primary>SSSD</primary>
+ <secondary>Setting up SASL/GSSAPI authentication for</secondary>
+ </indexterm>
+ <para>dummy text</para>
+ <remark>https://bugzilla.redhat.com/show_bug.cgi?id=601870</remark>
+ </section>
+
<!--<section
id="chap-SSSD_User_Guide-Using_the_SSSD_Management_Tools">
<title>Using the SSSD Management Tools</title>
@@ -1093,9 +1112,9 @@ GroupE:*:518:UserE
<title>Producing More Verbose Log Files</title>
<para>If you are unable to identify and resolve any problems with SSSD after inspection of the default log files, you can configure SSSD to produce more verbose files. You can set the <option>debug_level</option> option in the <filename>/etc/sssd/sssd.conf</filename> for the domain that is causing concern, and then restart SSSD. Refer to the <citetitle>sssd.conf(5)</citetitle> manual page for more information on how to set the <option>debug_level</option> for a specfic domain.</para>
</formalpara>
- <para>All log files include timestamps on debug messages by default. This can make it easier to understand any errors that may occur, why they occurred, and how to address them. If necessary, you can disable these timestamps by setting the appropriate parameter to <literal>0</literal> in the <filename>/etc/sssd/sssd.conf</filename> file:</para>
+ <para>All log files include timestamps on debug messages by default. This can make it easier to understand any errors that may occur, why they occurred, and how to address them. If necessary, you can disable these timestamps by setting the appropriate parameter to <literal>FALSE</literal> in the <filename>/etc/sssd/sssd.conf</filename> file:</para>
- <screen>--debug-timestamps=0
+ <screen>--debug-timestamps=FALSE
</screen>
</section>
13 years, 11 months
[deployment-guide/comm-rel: 35/74] Corrected several typing errors.
by dsilas
commit 233e9f8b7ac43c5d76baf36edd234aa08ab456f5
Author: Jaromir Hradilek <jhradile(a)redhat.com>
Date: Thu Jun 24 19:04:51 2010 +0200
Corrected several typing errors.
God bless the spell checker...
en-US/Keyboard_Configuration.xml | 10 +++++-----
1 files changed, 5 insertions(+), 5 deletions(-)
---
diff --git a/en-US/Keyboard_Configuration.xml b/en-US/Keyboard_Configuration.xml
index ee7780c..6f7dbeb 100644
--- a/en-US/Keyboard_Configuration.xml
+++ b/en-US/Keyboard_Configuration.xml
@@ -55,7 +55,7 @@
</mediaobject>
</figure>
<para>
- Currently, there are two ways how to chose the keyboard layout: you can either find it by the country it is associated with (the <guilabel>By country</guilabel> tab), or you can select it by the language (the <guilabel>By language</guilabel> tab). In either case, first select the desired country or language from the <guilabel>Country</guilabel> or <guilabel>Language</guilabel> pulldown menu, then specify the variant from the <guilabel>Variants</guilabel> menu. The preview of the layout changes imediately. To confirm the selection, click <guibutton>Add</guibutton>.
+ Currently, there are two ways how to chose the keyboard layout: you can either find it by the country it is associated with (the <guilabel>By country</guilabel> tab), or you can select it by the language (the <guilabel>By language</guilabel> tab). In either case, first select the desired country or language from the <guilabel>Country</guilabel> or <guilabel>Language</guilabel> pulldown menu, then specify the variant from the <guilabel>Variants</guilabel> menu. The preview of the layout changes immediately. To confirm the selection, click <guibutton>Add</guibutton>.
</para>
<figure id="fig-keyboard-layouts-default">
<title>Selecting the default layout</title>
@@ -69,7 +69,7 @@
</mediaobject>
</figure>
<para>
- Finally, to make the new layout the default, select the radio button next to its name. The changes take effect immediately. Note that there is a text-entry field at the bottom of the window where you can safely test your settings. Once you are satisfied, click <guibutton>Close</guibutton> to close the window.
+ The layout should appear in the list. To make it the default, select the radio button next to its name. The changes take effect immediately. Note that there is a text-entry field at the bottom of the window where you can safely test your settings. Once you are satisfied, click <guibutton>Close</guibutton> to close the window.
</para>
<figure id="fig-keyboard-layouts-layout-test">
<title>Testing the layout</title>
@@ -85,7 +85,7 @@
<note>
<title>Suggestion: Disable Separate Layout for Each Window</title>
<para>
- By default, changing the keyboard layout affects the active window only. This means that if you change the layout and switch to another window, this window will use the old one, which might be confusing. To turn this unfortunate behavior off, unselect the <guilabel>Separate layout for each window</guilabel> checkbox.
+ By default, changing the keyboard layout affects the active window only. This means that if you change the layout and switch to another window, this window will use the old one, which might be confusing. To turn this unfortunate behavior off, unselect the <guilabel>Separate layout for each window</guilabel> check box.
</para>
<mediaobject>
<imageobject>
@@ -96,7 +96,7 @@
</textobject>
</mediaobject>
<para>
- Doing this has its drawbacks though, as you will no longer be able to chose the default layout by selecting the radio buton as shown in <xref linkend="fig-keyboard-layouts-default" />. To make the layout the default, simply drag it at the beginning of the list.
+ Doing this has its drawbacks though, as you will no longer be able to chose the default layout by selecting the radio button as shown in <xref linkend="fig-keyboard-layouts-default" />. To make the layout the default, simply drag it at the beginning of the list.
</para>
<mediaobject>
<imageobject>
@@ -182,7 +182,7 @@
</mediaobject>
</figure>
<para>
- To increase or decrease the amount of time you want to be allowed to type before the break is enforced, click the up or down button next to the <guilabel>Work interval lasts</guilabel> label respectively. You can do the same with the <guilabel>Break interval lasts</guilabel> setting to alter the length of the break itself. Finally, select the <guilabel>Allow postponing of breaks</guilabel> checkbox if you want to be able to delay the break in case you need to finish the work. The changes take effect immediately.
+ To increase or decrease the amount of time you want to be allowed to type before the break is enforced, click the up or down button next to the <guilabel>Work interval lasts</guilabel> label respectively. You can do the same with the <guilabel>Break interval lasts</guilabel> setting to alter the length of the break itself. Finally, select the <guilabel>Allow postponing of breaks</guilabel> check box if you want to be able to delay the break in case you need to finish the work. The changes take effect immediately.
</para>
<figure id="fig-keyboard-break-take">
<title>Taking a break</title>
13 years, 11 months
[deployment-guide/comm-rel: 34/74] Added basic indexing.
by dsilas
commit a7a41572a8828d881e69a39e3870cec1b4ecaf61
Author: Jaromir Hradilek <jhradile(a)redhat.com>
Date: Thu Jun 24 18:45:30 2010 +0200
Added basic indexing.
en-US/Keyboard_Configuration.xml | 27 +++++++++++++++++++++++++++
1 files changed, 27 insertions(+), 0 deletions(-)
---
diff --git a/en-US/Keyboard_Configuration.xml b/en-US/Keyboard_Configuration.xml
index b9e90ab..ee7780c 100644
--- a/en-US/Keyboard_Configuration.xml
+++ b/en-US/Keyboard_Configuration.xml
@@ -3,11 +3,26 @@
]>
<chapter id="ch-Keyboard_Configuration">
<title>Keyboard Configuration</title>
+ <indexterm>
+ <primary>keyboard configuration</primary>
+ </indexterm>
<para>
This chapter describes how to change the keyboard layout, as well as how to add the <application>Keyboard Indicator</application> applet to the panel. It also covers the option to enforce a typing break, and explains both advantages and disadvantages of doing so.
</para>
<section id="s1-keyboard-layout">
<title>Changing the Keyboard Layout</title>
+ <indexterm>
+ <primary><application>Keyboard Preferences</application></primary>
+ <see>keyboard configuration</see>
+ </indexterm>
+ <indexterm>
+ <primary>keyboard configuration</primary>
+ <secondary><application>Keyboard Preferences</application> utility</secondary>
+ </indexterm>
+ <indexterm>
+ <primary>keyboard configuration</primary>
+ <secondary>layout</secondary>
+ </indexterm>
<para>
The installation program allowed you to configure a keyboard layout for your system. However, the default settings may not always suit your current needs. To configure a different keyboard layout after the installation, use the <application>Keyboard Preferences</application> tool.
</para>
@@ -95,6 +110,14 @@
</section>
<section id="s1-keyboard-indicator">
<title>Adding the Keyboard Layout Indicator</title>
+ <indexterm>
+ <primary><application>Keyboard Indicator</application></primary>
+ <see>keyboard configuration</see>
+ </indexterm>
+ <indexterm>
+ <primary>keyboard configuration</primary>
+ <secondary><application>Keyboard Indicator</application> applet</secondary>
+ </indexterm>
<para>
If you want to see what keyboard layout you are currently using, or you would like to switch between different layouts with a single mouse click, add the <application>Keyboard Indicator</application> applet to the panel. To do so, right-click the empty space on the main panel, and select the <guimenuitem>Add to Panel...</guimenuitem> option from the pulldown menu.
</para>
@@ -140,6 +163,10 @@
</section>
<section id="s1-keyboard-break">
<title>Setting Up a Typing Break</title>
+ <indexterm>
+ <primary>keyboard configuration</primary>
+ <secondary>typing break</secondary>
+ </indexterm>
<para>
Typing for a long period of time can be not only tiresome, but it can also increase the risk of serious health problems, such as the carpal tunnel syndrome. One way of preventing this is to configure the system to enforce the typing break. Simply select <menuchoice><guimenu>System</guimenu><guisubmenu>Preferences</guisubmenu><guimenuitem>Keyboard</guimenuitem></menuchoice> from the panel, click the <guilabel>Typing Break</guilabel> tab, and select the <guilabel>Lock screen to enforce typing break</guilabel> check box.
</para>
13 years, 11 months