Safeguard Authentication Services must be able to communicate with Active Directory, including domain controllers, global catalogs, and DNS servers using Kerberos, LDAP, and DNS protocols. The following table summarizes the network ports that must be open and their function.
Table 8: Network ports
|
389 |
Used for LDAP searches against Active Directory Domain Controllers. TCP is normally used, but UDP is used when detecting Active Directory site membership. |
|
3268 |
Used for LDAP searches against Active Directory Global Catalogs. TCP is always used when searching against the Global Catalog. |
|
88 |
Used for Kerberos authentication and Kerberos service ticket requests against Active Directory Domain Controllers. TCP is used by default. |
|
464 |
Used for changing and setting passwords against Active Directory using the Kerberos change password protocol. Safeguard Authentication Services always uses TCP for password operations. |
|
53 |
Used for DNS. Since Safeguard Authentication Services uses DNS to locate domain controllers, DNS servers used by the UNIX hosts must serve Active Directory DNS SRV records. Both UDP and TCP are used. |
|
123 |
UDP only. Used for time-synchronization with Active Directory. |
|
445 |
CIFS port used to enable the client to retrieve configured group policy. |
NOTE: Safeguard Authentication Services, by default, operates as a client, initiating connections. It does not require any firewall exceptions for incoming traffic.
Installing and configuring Safeguard Authentication Services
This section describes how to extend the authentication, authorization, and administration infrastructure of Active Directory to the rest of your enterprise to allow UNIX, Linux, and macOS systems to act as full citizens within Active Directory.
To extend the authentication, authorization, and administration infrastructure of Active Directory to the rest of your enterprise, allowing UNIX, Linux, and macOS systems to act as full citizens within Active Directory:
-
Install and configure Safeguard Authentication Services.
-
Install Safeguard Authentication Services Windows components.
-
Configure Active Directory for Safeguard Authentication Services (one time only).
-
Configure UNIX Agent Components
Prepare the UNIX hosts for Active Directory user access:
-
Add and profile a host.
-
Check the host for readiness to join Active Directory.
-
Install Safeguard Authentication Services agent software packages on the host to allow Active Directory user access.
NOTE: For users to authenticate on UNIX, Linux, and macOS hosts with Active Directory credentials, your UNIX hosts must have the Safeguard Authentication Services agent installed.
-
Join the host to Active Directory.
One Identity recommends that you install the Windows components and configure Active Directory before you install the UNIX components.
Related Topics
Installing Windows components
Customizing installation options
Installing and using msiexec.exe
Install Safeguard Authentication Services on each Windows Workstation you plan to use to administer UNIX data in Active Directory.
To install the Safeguard Authentication Services Windows components
-
From the Autorun Setup tab, click Safeguard Authentication Services to launch the setup wizard.
-
In the Software License Agreement dialog, accept the terms of the End User License Agreement and click Install.
The Safeguard Authentication Services Setup wizard installs all Safeguard Authentication Services components by default.
To only install specific components, click the Customize installation options link. For more information, see For more information, see Customizing installation options..
-
Once the installation completes successfully, click Finish or Launch Control Center.
