commit bab41052945b8e10b556e6b7b5862d5c9c18fc79
Author: Martin Prpic <mprpic(a)redhat.com>
Date: Wed Jun 23 17:08:44 2010 +0200
added the authconfig tool section
en-US/.markdown | 1 +
en-US/Authentication_Configuration.xml | 280 +++++++++++++++++++++++++++++++-
2 files changed, 275 insertions(+), 6 deletions(-)
---
diff --git a/en-US/.markdown b/en-US/.markdown
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/en-US/.markdown
@@ -0,0 +1 @@
+
diff --git a/en-US/Authentication_Configuration.xml
b/en-US/Authentication_Configuration.xml
index 95e64b1..6015c71 100644
--- a/en-US/Authentication_Configuration.xml
+++ b/en-US/Authentication_Configuration.xml
@@ -1,10 +1,278 @@
<?xml version='1.0'?>
<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
]>
-<chapter
- id="ch-Authentication_Configuration">
+<chapter id="ch-Authentication_Configuration">
<title>Authentication Configuration</title>
- <xi:include
-
xmlns:xi="http://www.w3.org/2001/XInclude"
- href="SSSD.xml" />
-</chapter>
+ <section id="sect-The_Authentication_Configuration_Tool">
+ <title>The Authentication Configuration Tool</title>
+ <indexterm significance="normal">
+ <primary>
+ <application>Authentication Configuration Tool</application>
+ </primary>
+ </indexterm>
+ <indexterm significance="normal">
+ <primary>authentication</primary>
+ </indexterm>
+ <para>When a user logs in to a &MAJOROS; system, the username and password
combination must be verified, or <firstterm>authenticated</firstterm>, as a
valid and active user. Sometimes the information to verify the user is located on the
local system, and other times the system defers the authentication to a user database on a
remote system.</para>
+ <para>The <application>Authentication Configuration
Tool</application> provides a graphical interface for configuring user information
retrieval from LDAP, NIS, and Winbind user account databases. This tool also allows you to
configure Kerberos to be used as the authentication protocol when using LDAP or
NIS.</para>
+ <note>
+ <title>Note</title>
+ <para>If you configured a medium or high security level during installation
(or with the <application>Security Level Configuration Tool</application>),
then the firewall will prevent NIS (Network Information Service) authentication.
<remark>Is this still true?</remark>
+ </para>
+ </note>
+ <indexterm significance="normal">
+ <primary>
+ <command>system-config-authentication</command>
+ </primary>
+ <see>
+ <application>Authentication Configuration Tool</application>
+ </see>
+ </indexterm>
+ <indexterm significance="normal">
+ <primary>
+ <command>authconfig</command>
+ </primary>
+ <see>
+ <application>Authentication Configuration Tool</application>
+ </see>
+ </indexterm>
+ <para>To start the graphical version of the <application>Authentication
Configuration Tool</application> from the desktop, select the System (on the panel)
> <guimenuitem>Administration</guimenuitem> >
<guimenuitem>Authentication</guimenuitem> or type the command
<command>system-config-authentication</command> at a shell prompt (for
example, in an <application>XTerm</application> or a
<application>GNOME</application> terminal).</para>
+ <important>
+ <title>Important</title>
+ <para>After exiting the authentication program, any changes you made take
effect immediately.</para>
+ </important>
+ <section
id="sect-The_Authentication_Configuration_Tool-Identity_and_Authentication">
+ <title>Identity & Authentication</title>
+ <para>
+ The <guilabel>Identity & Authentication</guilabel> tab allows
you to configure how users should be authenticated, and has several options for each
method of authentication. To select which user account database should be used, select an
option from the drop-down list.
+ </para>
+ <para>
+ The following list explains what each option configures:
+ </para>
+ <bridgehead>LDAP</bridgehead>
+ <para>The <guilabel>LDAP</guilabel> option instructs the system
to retrieve user information via LDAP. It contains the following specifications:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>LDAP Search Base DN</guilabel> — Specifies that user
information should be retrieved using the listed Distinguished Name (DN).</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>LDAP Server</guilabel> — Specifies the IP address of
the <systemitem class="service">LDAP</systemitem>server.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Use TLS to encrypt connections</guilabel> — When
enabled, <systemitem class="protocol">Transport Layer
Security</systemitem> will be used to encrypt passwords sent to the <systemitem
class="service">LDAP</systemitem> server. The <guibutton>Download
CA Certificate</guibutton> option allows you to specify a URL from which to download
a valid <firstterm>CA (Certificate Authority) Certificate</firstterm>. A valid
CA Certificate must be in PEM (Privacy Enhanced Mail) format.</para>
+ <important>
+ <title>Important</title>
+ <para>
+ The <guilabel>Use TLS to encrypt connections</guilabel>
option must not be ticked if an <systemitem
class="protocol">ldaps://</systemitem> server address is specified in
the <guilabel>LDAP Server</guilabel> field.
+ </para>
+ </important>
+ <para>For more information about CA Certificates, refer to <citetitle
pubwork="section">Section 22.8.2, "An Overview of Certificates and
Security"</citetitle> in the <citetitle>Deployment
Guide</citetitle><!--TBD6: link to the Section 22.8.2, “An Overview of
Certificates and Security” section of the Deployment Guide -->.</para>
+ </listitem>
+ </itemizedlist>
+ <para>The <filename>openldap-clients</filename> package must be
installed for this option to work.</para>
+ <para>For more information about LDAP, refer to <citetitle
pubwork="chapter">Chapter 25, "Lightweight Directory Access Protocol
(LDAP)"</citetitle> in the <citetitle>Deployment
Guide</citetitle><!-- TBD6: link to the Chapter 25, "Lightweight Directory
Access Protocol (LDAP)" chapter in DG. -->
+ </para>
+ <para>
+ LDAP provides the following methods of authentication:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Kerberos password</guilabel> — This option enables
Kerberos authentication. It contains the following specifications:
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Realm</guilabel> — Configures the realm for the
Kerberos server. The realm is the network that uses Kerberos, composed of one or more KDCs
and a potentially large number of clients.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>KDCs</guilabel> — Defines the Key
Distribution Centers (KDC), which are servers that issue Kerberos tickets.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Admin Servers</guilabel> — Specifies the
administration server(s) running <command>kadmind</command>.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </para>
+ <para>
+ The <guimenu>Kerberos Settings</guimenu> dialog also allows you
to use DNS to resolve hosts to realms and locate KDCs for realms.
+ </para>
+ <para>
+ The <filename>krb5-libs</filename> and
<filename>krb5-workstation</filename> packages must be installed for this
option to work. For more information about Kerberos, refer to <citetitle
pubwork="section">Section 43.6, “Kerberos”</citetitle> in the
<citetitle>Deployment Guide</citetitle><!-- TBD6: link to the Section 43.6,
“Kerberos” section in DG -->.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>LDAP password</guilabel> — This option instructs
standard PAM-enabled applications to use LDAP authentication with options specified in the
User Account Configuration of LDAP. When using this option, you must provide an
<systemitem class="protocol">ldaps://</systemitem> server address or
use TLS for LDAP authentication.
+ </para>
+ </listitem>
+ </itemizedlist>
+
+ <bridgehead>NIS</bridgehead>
+ <para>
+ The <guilabel>NIS</guilabel> option configures the system to connect to
an NIS server (as an NIS client) for user and password authentication. To configure this
option, specify the NIS domain and NIS server. If the NIS server is not specified, the
daemon attempts to find it via broadcast.
+ </para>
+ <para>The <package>ypbind</package> package must be installed
for this option to work. If the NIS user account databse is used, the <systemitem
class="daemon">portmap</systemitem> and <systemitem
class="daemon">ypbind</systemitem> services are started and are also
enabled to start at boot time.</para>
+ <para>For more information about NIS, refer to <citetitle
pubwork="section">"Section 43.2.3, Securing NIS"</citetitle>
in the <citetitle>Deployment Guide</citetitle><!-- TBD6: link to Section
43.2.3, “Securing NIS” section of the DG -->.</para>
+ <para>
+ NIS provides the following methods of authentication:
+ </para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Kerberos password</guilabel> — This option enables
Kerberos authentication. For more information about configuration of the Kerberos
authentication method, refer to previous section on LDAP<!-- TBD6: link to the Kerberos
password option in the previous section on LDAP -->
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>NIS password</guilabel> — TODO <remark>How
does NIS password authenticate? Does it store password info on the NIS server and access
that?</remark>
+ </para>
+ </listitem>
+ </itemizedlist>
+
+ <bridgehead>Winbind</bridgehead>
+ <para>The <guilabel>Winbind</guilabel> option configures the
system to connect to a Windows Active Directory or a Windows domain controller. User
information from the specified directory or domain controller can then be accessed, and
server authentication options can be configured. It contains the following
specifications:</para>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Winbind Domain</guilabel> — Specifies the Windows
Active Directory or domain controller to connect to.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Security Model</guilabel> — Allows you to select a
security model, which configures how clients should respond to Samba. The drop-down list
allows you to select any of the following:
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>ads</guilabel> — This mode instructs Samba to
act as a domain member in an Active Directory Server (ADS) realm. To operate in this mode,
the <filename>krb5-server</filename> package must be installed, and Kerberos
must be configured properly.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>domain</guilabel> — In this mode, Samba will
attempt to validate the username/password by authenticating it through a Windows NT
Primary or Backup Domain Controller, similar to how a Windows NT Server
would.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>server</guilabel> — In this mode, Samba will
attempt to validate the username/password by authenticating it through another SMB server
(for example, a Windows NT Server). If the attempt fails, the
<guilabel>user</guilabel> mode will take effect instead.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>user</guilabel> — This is the default mode.
With this level of security, a client must first log in with a valid username and
password. Encrypted passwords can also be used in this security mode.</para>
+ </listitem>
+ </itemizedlist>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Winbind ADS Realm</guilabel> — When the
<guilabel>ads</guilabel> Security Model is selected, this allows you to
specify the ADS Realm the Samba server should act as a domain member of.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Winbind Domain Controllers</guilabel> — Use this
option to specify which domain controller <command>winbind</command> should
use. For more information about domain controllers, please refer to <citetitle
pubwork="section">Section 20.6.3, "Domain
Controller"</citetitle>of the<citetitle>Deployment
Guide</citetitle> <!-- TBD6: link to Section 20.6.3, “Domain Controller” section
of the DG-->
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Template Shell</guilabel> — When filling out the user
information for a Windows NT user, the <command>winbindd</command> daemon uses
the value chosen here to to specify the login shell for that user.</para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Allow offline login</guilabel> — TODO
<remark>What does this option do?</remark>
+ </para>
+ </listitem>
+ </itemizedlist>
+
+
+ <para>For more information about the
<command>winbindd</command> service, refer to <citetitle
pubwork="section">Section 20.2, "Samba Daemons and Related
Services"</citetitle> in the <citetitle>Deployment
Guide</citetitle>. <!--TBD6 : linke to section Section 20.2, “Samba Daemons and
Related Services” in the DG -->
+ </para>
+ <para>
+ Winbind provides only one method of authentication, <guilabel>Winbind
password</guilabel>. This method of authentication uses the options specified in the
User Account Configuration of Winbind to connect to a Windows Active Directory or a
Windows domain controller.
+ </para>
+
+ </section>
+ <section
id="sect-The_Authentication_Configuration_Tool-Advanced_Options">
+ <title>Advanced Options</title>
+ <para>
+ The Advanced Options tab allows you to configure the following:
+ </para>
+ <bridgehead>Local Authentication Options</bridgehead>
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Enable fingerprint reader support</guilabel> — By
checking this option, you enable fingerprint authentication to log in by scanning your
finger with the fingerprint reader.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Enable local access control</guilabel> — When
enabled, <filename>/etc/security/access.conf</filename> is consulted for
authorization of a user.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Password Hashing Algorithm</guilabel> — This option
lets you specify which hashing or cryptographic algorithm should be used to encrypt
locally stored passwords.
+ </para>
+ </listitem>
+ </itemizedlist>
+ <bridgehead>Other Authentication Options</bridgehead>
+ <para>
+ <guilabel>Create home directories on the first login</guilabel> —
When enabled, a home directory of a user is created automatically on his first login if it
does not already exist.
+ </para>
+ <bridgehead>Smart Card Authentication Options</bridgehead>
+ <para>
+ <guilabel>Enable smart card support</guilabel> — This option
enables smart card authentication. Smart card authentication allows you to log in using a
certificate and a key associated with a smart card.
+ </para>
+ <para>
+ When the <guilabel>Enable smart card support</guilabel> option is
checked, the following options can be specified:
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Card Removal Action</guilabel> — This option defines
what action the system performs when the card is removed from the card reader during an
active session. Two alternatives are available:
+ <itemizedlist>
+ <listitem>
+ <para>
+ <guilabel>Ignore</guilabel> — The card removal is ignored
and the system continues to function as normal.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Lock</guilabel> — The current session is
immediately locked.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ <guilabel>Require smart card login</guilabel> — Requires the
user to login and authenticate with a smart card. It essentially disables any other type
of password authentication. This option should not be selected until after you have
successfully logged in using a smart card.
+ </para>
+ </listitem>
+ </itemizedlist>
+ </para>
+ <para>
+ The <package>pam_pkcs11</package> and the
<package>coolkey</package> packages must be installed for this option to work.
For more information about smart cards, refer to <citetitle
pubwork="section">section "4.1. Enabling Smart Card Login on Red Hat
Enterprise Linux</citetitle>of the<citetitle>Managing Smart Cards with the
Enterprise Security Client</citetitle> guide<!-- TBD6: link to: section
"4.1. Enabling Smart Card Login on Red Hat Enterprise Linux" of the
"Managing Smart Cards with the Enterprise Security Client" guide found on
http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_L...
or section "2.3.2. Getting Started with your new Smart Card" of the
"Security Guide" found on
http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_L...
y_Guide/#sect-Security_Guide-Single_Sign_on_SSO-->
+
+ </para>
+ </section>
+ <section
id="sect-The_Authentication_Configuration_Tool-Command_Line_Version">
+ <title>Command Line Version</title>
+ <para>
+ The <application>Authentication Configuration Tool</application> can
also be run as a command line tool with no interface. The command line version can be used
in a configuration script or a kickstart script. The authentication options are summarized
in <!--<xref linkend="tb-authconfig-cmd-line"/>-->.
+ </para>
+ <note>
+ <title>Tip</title>
+ <para>These options can also be found in the
<command>authconfig</command> man page or by typing <command>authconfig
--help</command> at the shell prompt.</para>
+ </note>
+ <remark>I have some questions about the commands listed under
"authconfig --help". Is there a need for a "--enablemd5" option if the
option "--passalgo=<descrypt|bigcrypt|md5|sha256|sha512>" chooses
the algorithm to be used? Same goes for some commands that are not present in the new GUI,
like "--enablesmbauth" (and all SMB related commands),
"--enablehesiod" or "--enablewins". Are these features you can still
use but are not present in the GUI? </remark>
+
+ </section>
+ </section>
+
+ <xi:include
xmlns:xi="http://www.w3.org/2001/XInclude"
href="SSSD.xml" />
+ </chapter>
+