Chat now with support
Chat with Support

Safeguard Authentication Services 5.1.1 - Installation Guide

Privileged Access Suite for Unix Introducing One Identity Safeguard Authentication Services Installing and configuring Safeguard Authentication Services Installing and joining from the Unix command line Getting started with Safeguard Authentication Services Troubleshooting Enterprise package deployment

Resolving preflight failures

If one of the preflight checks fail, preflight prints a suggested resolution. The following table provides additional problem resolution information. The checks are listed by the associated command-line flags.

Table 26: Install checks
Preflight option Check Resolution

--os-patch

Checks for supported operating system and correct operating system patches. Install the Safeguard Authentication Services agent on a supported operating system that has the required operating system patches. Click www.oneidentity.com/products/authentication-services/ to view a list of supported Unix and Linux platforms that run Safeguard Authentication Services.

--disk-space

Checks for sufficient disk space to install Safeguard Authentication Services. Free up more disk space. Safeguard Authentication Services requires disk space in /opt, /etc, and /var to install.
Table 27: Join checks
Preflight option Check Resolution

--tld

Checks that the DNS Top Level Domain (TLD) is not '.local'. Ensure that mDNS is disabled in /etc/nsswitch.conf or use a domain other than .local.

--hostname

Checks that the hostname of the system is not 'localhost'. One Identity recommends that you have a unique hostname in order to maintain uniqueness of computer names in Active Directory. Another option is to ignore this check and use -n computer_name when joining. See the vastool man page for more information.

--name-service

Checks if the name service is configured to use DNS. Ensure your host is configured to use DNS properly. Consult your platform documentation to determine the proper method to enable DNS for hostname resolution. See Resolving DNS problems for solutions.

--host-resolve

Ensures that the host can resolve names using DNS. Check your /etc/resolv.conf file to ensure that name server entries are correct and reachable. Make sure that UDP port 53 (DNS) is open. This check attempts to resolve the domain name and can fail if your DNS configuration is invalid. This check expects to find properly formatted IPv4 addresses. Invalid or unreachable name server entries will cause delays even though the check will pass if at least one valid name server is found. If you notice delays when running this check, make sure that your name server configuration does not reference invalid name servers. See Resolving DNS problems for solutions.

--srv-records

Checks for a nameserver that has the appropriate DNS SRV records for Active Directory. SRV records advertise various Active Directory services. Your configured name server must provide SRV records in order for Safeguard Authentication Services to take advantage of automatic detection and fail over. Ensure that UDP port 53 (DNS) is open.

--dc

Detects a writable domain controller with UDP port 389 open.

If a domain controller is passed on the preflight command line, preflight checks that UDP port 389 is open and that the domain controller is writable. In this case, you may be able to specify a different domain controller.

If you do not pass in the name of a domain controller, this check attempts to locate a writable domain controller using DNS SRV records. Ensure that your DNS SRV records are up to date in the configured DNS server. Safeguard Authentication Services can work with read-only domain controllers, but the computer object must have already been created with the proper settings in Active Directory.

--site

Detects Active Directory site, if available. This check warns you if Safeguard Authentication Services was unable to locate an Active Directory site based on your computer's network address. A site configuration is not necessary, but Safeguard Authentication Services performs better if site information is configured in Active Directory. To resolve this problem, configure a site in Active Directory.

--kerberos-password

Checks if TCP port 464 is open for Kerberos kpasswd. Ensure that TCP port 464 (kpasswd) is open. This port must be open in order for Safeguard Authentication Services to set the computer object's password.

--kerberos-traffic

Checks if UDP port 88 and TCP port 88 are open for Kerberos traffic. These ports are the main Kerberos communication channels; they must be open for Safeguard Authentication Services to authenticate to Active Directory. By default Safeguard Authentication Services uses TCP, but may be configured to prefer UDP.

--ldap

Checks if TCP port 389 is open for LDAP. This port must be open for Safeguard Authentication Services to communicate with domain controllers using LDAP. This communication is GSS SASL encrypted and signed.

--global-catalog

Checks whether the Global Catalog is accessible on TCP port 3268. Safeguard Authentication Services can function in a limited way without a global catalog server; however, Safeguard Authentication Services will be unable to resolve Active Directory users and groups from domains in the forest other than the one to which the host is joined. In addition, some searches may be slower. Make sure that TCP port 3268 (global catalog) is open and that you have configured at least one domain controller as a global catalog and that the global catalog server is up and reachable.

--timesync

Checks the machine's time is not skewed too far from Active Directory. If the time difference between the Unix host and the domain controller is too large, Kerberos traffic will not succeed. You can usually resolve this failure by running vastool timesync to synchronize time with the Active Directory domain. Port 123 UDP must be open in order to synchronize time with the domain controller. This check automatically synchronizes the time if you specify the -S option and run the application with root permissions.

--app-configuration

Checks for the Safeguard Authentication Services application configuration in Active Directory. This checks fails if you have not configured the Active Directory forest for Safeguard Authentication Services. Use Control Center (Windows) to create the necessary application configuration. This check can also fail due to an invalid username/password or if there is a time synchronization problem between the Unix host and the domain controller.

--rodc

Checks against the given domain controller even if it is read-only, instead of selecting another domain controller. The --rodc option runs preflight against the given domain controller instead of picking a writable DC. The --rodc check affects the --kerberos-* and --ldap checks. If the --rodc check fails, resolve preflight port check failures.

Note: If you get a message that says Unable to locate Safeguard Authentication Services Application Configuration, you can ignore that error and proceed with the Safeguard Authentication Services installation. The Safeguard Authentication Services Active Directory Configuration Wizard starts automatically to help you configure Active Directory for Safeguard Authentication Services the first time you start the Control Center.

Table 28: Post-join checks
Preflight option Check Resolution

--ms-cifs

Checks if TCP port 445 is open for Microsoft Directory Services CIFS traffic. In order to use Group Policy on Unix, this port must be open to allow Safeguard Authentication Services to use the CIFS protocol to download Group Policy objects from domain controllers.

Time synchronization problems

Kerberos is a time-sensitive protocol. Your Unix hosts must be synchronized within five minutes of your Active Directory domain controllers. Run the following command as root to have Safeguard Authentication Services synchronize the local time with Active Directory:

vastool timesync 

Unable to install or upgrade

The most common installation or upgrade failure is that the Unix host cannot read the Safeguard Authentication Services application configuration in Active Directory. Ensure that you have followed the instructions in Configure Active Directory and that the configuration has been created successfully.

During an upgrade, you may see an error that Safeguard Authentication Services cannot upgrade because the application configuration cannot be located. If you previously joined to a specific domain controller, Safeguard Authentication Services disabled DNS SRV record lookups. This means that Safeguard Authentication Services cannot resolve other domains in the forest and may be unable to locate the application configuration. In this case, you must ensure that the domain controller you specified is a global catalog. Otherwise, you must create the Safeguard Authentication Services application configuration in the domain that you join or you must properly configure DNS to return SRV records and join normally, rather than specifying a domain controller when you join.

For more information, see About Active Directory configuration.

Unable to join the domain

If you are unable to join the domain, run the preflight utility to validate your environment.

For more information, see The pre-installation diagnostic tool..

Then, verify the following:

  • Check that the Active Directory account specified during join has rights to join the computer to the domain.
  • Check that the Unix host is able to properly resolve the domain name through DNS.

If you are joining to a specific domain controller you must ensure that Safeguard Authentication Services can locate and read the configuration information in Active Directory. You should do one of the following:

  • Make sure the domain controller you specify is a global catalog.
  • Create the Safeguard Authentication Services application configuration in the domain to which you are joining.

    For more information, see About Active Directory configuration..

  • Properly configure DNS to return srv-records and avoid joining to a specific domain controller.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating