The following sections describe the initial configuration
tasks you need to perform to get your primary and secondary security
server up and running.
The primary security server requires the following basic configuration tasks:
Add
an Administrative Principal |
 |
Use the HP Kerberos Administrator (kadminl_ui) instead of the command-line administrator (kadminl) to add the principal account. For more information
on using the HP Kerberos Administrator and the command-line administrator,
see “The
kadmin and kadminl Utilities”.
Though it is possible to use the kadmin option to create an administrative principal,
you cannot use kadmin to assign administrative privileges. If you want
to use the kadmin utilities to manage your administrative principals,
use a text editor to add the required entries to the file.
|
| |
|
 | NOTE: You must log on as a root user,
on the primary security server, to add an administrative principal. |
|
| |
|
For the first administrative principal, HP recommends that
you assign all permissions, indicated by * in admin_acl_file. For more information, see “The
admin_acl_file File”.
You can add an administrative principal through the HP Kerberos Administrator
GUI, or through the command-line interface.
To add
an Administrative Principal Using the HP Kerberos Administrator
Following steps show you how to add an administrative principal
using the HP Kerberos Administrator:
Invoke the HP Kerberos
Administrator using the command kadminl_ui.
Add a new principal to the default
realm using the following syntax:
# identifier/admin@DEFAULT_REALM
Assign the password.
Use the Edit>Edit
Administrative Permissions menu to assign all administrative
permissions to the principal.
On the Attributes tab, clear
the Require Password Change checkbox to
disable the password change requirement.
You can also disable the password change requirement
by setting the NoReqChangePwd setting in the principal’s password policy file
to 1.
|
| |
|
| NOTE: By default, the principal account requires a password
change at the first logon. However, kadmin does not permit password changes, unless you have
explicit permissions to change your password. |
|
| |
|
Save your changes and close the
HP Kerberos Administrator.
For more information on using the HP Kerberos Administrator,
see “HP
Kerberos Administrator”.
To Add
an Administrative Principal Through the Command Line
Following steps show how to add an administrative principal
through the command-line interface:
Run the kadmin command-line administrator.
Add a new principal to the default
realm using the following syntax:
command: add
Name of Principal to add: admin
Enter password:password
Re-enter password for verification:password
Enter policy name (Press enter key to apply default policy):
Principal added |
For more information on assigning administrative privileges
to principals, see “Manual
Administration Using kadmin”.
Define
Secondary Security Server Network Locations |
|
To configure propagation, alter the Kerberos configuration
files to define server network locations. For more information,
see Chapter 9 “Propagating
the Kerberos Server”.
For each secondary security server installed on your network,
edit the krb.conf file on the primary security server by adding
an entry to define the role of this secondary security server in
the realm. For more information on the configuration files, see “The krb.conf File”.
Printable version
