Before you install Safeguard Authentication Services Defender on your host, ensure that you have:
Installed a Defender security server in your Active Directory domain.
Installed the Defender Microsoft Management Console (MMC) snap-in.
Installed Safeguard Authentication Services on your UNIX or Linux machine.
Assign the access node to the security server
Select the security policy for the access node
Add members to the access node
To integrate Defender with Safeguard Authentication Services, perform the tasks described in this section.
You use a security policy to specify which type of credential is to be sent to the Defender security server.
To create a security policy
Open Active Directory Users and Computers.
Right-click Defender and navigate to New > Defender Policy to launch the creation wizard.
Give the security policy a Name and Description, then click Next.
Select Token for Method and click Next.
Select None for the Method and click Next.
Continue through the rest of the wizard, accepting the defaults and click Finish.
An access node is used to associate a security policy and a Defender security server to a machine or subnet of machines. To complete this task, you must know the IP address of the machine or IP address and subnet mask of the subnet of machines that you would like to secure with Defender and Safeguard Authentication Services.
To create an Access node
Open Active Directory Users and Computers.
Right-click Defender and navigate to New > Defender Access Node to launch the creation wizard.
Give the access node a Name and Description, then click Next.
Select a Node Type of Radius Agent.
NOTE: pam_defender only works with Radius Agent.
Select the appropriate User ID for your environment based on the information below, then click Next.
The User ID you select must match the attribute that you are using in Safeguard Authentication Services for UNIX user name. Look in the Preferences of the Control Center to determine which attribute Safeguard Authentication Services is configured.
|
User IDs |
Description |
|---|---|
|
SAM Account Name |
This is the default UNIX user name for Safeguard Authentication Services 5.1.2. It refers to the sAMAccountName attribute of the user. |
|
User Principal Name |
Previous versions of Safeguard Authentication Services used this as the default UNIX user name. It refers to the userPrincipalName attribute of the user. |
|
Defender ID |
This refers to the defender-id attribute of the user, which is part of the Defender schema extension. You could configure this as the UNIX user name, but One Identity does not recommend that. |
|
Proper Name |
This refers to the cn attribute of the user. |
Enter the IP Address of the machine or subnet of machines.
Enter the Port to use to establish a connection with the Defender security server (the default for a Radius Agent is port 1812).
Change the Subnet Mask from 255.255.255.255 to the appropriate value if you plan to use a subnet of machines.
Enter a Shared Secret to use in radius communications with the Defender security server and click Next.
Click Finish to complete the wizard.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center
