Chat now with support
Chat with Support

Safeguard Authentication Services 4.1.5 - Administration Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Authentication Services Unix administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment Integrating with other applications Managing Unix hosts with Group Policy
Authentication Services Group Policy
Group Policy Concepts Unix policies One Identity policies
Integrating with GPMC
Display specifiers Troubleshooting

Kerberos ticket caches

The Authentication Services PAM module uses the Kerberos protocol to authenticate users against Active Directory. The Kerberos protocol allows users to obtain a Ticket Granting Ticket (TGT) that can then be used to obtain other tickets to authenticate to services. Once the TGT has been obtained it can be used as a single sign-on mechanism that does not require users to repeatedly enter their password.

By default, when a user establishes a login session by means of a service configured to use the Authentication Services PAM module, the ticket is cached by default in the /tmp directory; the name of the cache file is krb5cc_<uid> where uid is the User ID (UID) of the account.

Configuring AIX

AIX does not support NSS in the same way that most other Unix versions do. On AIX there is no /etc/nsswitch.conf or support for NSS modules. AIX uses the Loadable Authentication Module (LAM) system to support name service lookups and authentication. As of AIX 5.3 all native binaries support PAM, but are configured for LAM by default. Authentication Services supports both a LAM module and a PAM module on AIX. Configuring the PAM module on AIX is the same as for any other platform. This section explains how to configure the LAM module.

When you join the domain, Authentication Services automatically configures the AIX system to use the Authentication Services LAM module for authentication as well as name service lookups. The modified files are /usr/lib/security/methods.cfg and /etc/security/user.

Using VASTOOL to configure AIX

vastool can automatically update the AIX configuration files on your system.

To modify the AIX configuration

  1. To configure AIX to use Authentication Services for authentication and name service resolution, run the following command as root:
    vastool configure irs
  2. To remove the Authentication Services AIX module configuration, run the following command as root:
    vastool unconfigure irs
  3. After modifying the AIX configuration, restart any affected system services or reboot.

Enabling diagnostic logging

Debug logging configuration depends on your platform and the subsystem you are troubleshooting. Some issues can span multiple subsystems.

Authentication Services vasd daemon

To enable Authentication Services daemon debug output, set the debug-level setting in the [vasd] section of vas.conf. Unless instructed otherwise by Technical Support, the recommended level is 5 for investigating issues. (Refer to the vas.conf man page for details on debug log settings.)

vasd logs events to syslog using the DAEMON facility. vasd dynamically picks up the change for both enabling and disabling without requiring a restart.

Authentication

Note: For both PAM and LAM, regardless of debug level, Authentication Services outputs a success or failure message to AUTH (AUTHPRIV on Linux or Mac OS X) a line similar to:

<syslog prefix>: pam_vas: Authentication <succeeded> for <Active Directory> user:
<user1> account: <user1@example.com> service: <sshd> reason: <N/A> Access Control
Identifier(NT Name):<EXAMPLE1\user1>

The message indicates if the authentication was successful or failed, was disconnected, what type of account, if failed a general message as to why, what service if PAM, and the NT style name of the account used to authenticate against.

PAM

To enable PAM debug output, you must set the debug option for the Authentication Services PAM module in the pam.conf file. This consists of adding 'debug trace' to each pam_vas3 line in the appropriate file(s) for the system. (For more information, refer to the pam.conf man page for your platform.)

When you enable debug output, Authentication Services logs PAM output authentication events to syslog using the AUTH facility (AUTHPRIV on Mac OS X and Linux). Normally this does not require a restart of an application to start debugging.

Note: On HP-UX, Solaris, and AIX you can obtain additional PAM debug information by running touch /etc/pam_debug. This enables PAM library level debugging. To disable it, remove the "touched" file.

LAM

If you are using LAM for authentication on AIX, you can enable authentication debug output by running:

touch /var/opt/quest/vas/.qas_auth_dbg

When you enable this debug option, Authentication Services logs LAM authentication events to /tmp/qas_module.log.

Identity

This includes debugging NSS on Linux, HP-UX, and SolarisSolaris and LAM identification on AIX. To enable full debugging of the Authentication Services identity library for the operating system, run the following:

touch /var/opt/quest/vas/.qas_id_dbg

This enables debug globally for the system. Disable it by removing the "touched" file. Enabling and disabling applies within 30 seconds.

You can also enable debugging for a single application to send output to stderr by defining the environment variable QAS_ID_DBG_STDERR. For example, in a Bourne shell, enter:

QAS_ID_DBG_STDERR=1 getent passwd

The output includes a line that lists input, result, and time spent in the call. Enable only this line by running

touch /var/opt/quest/vas/.qas_id_call

You can also use the environment variable, QAS_ID_CALL_STDERR to log the result line of the above debug.

This output is useful for profiling the volume/type of calls the Authentication Services identity interface is receiving.

Output is written to the /tmp/qas_module.log file for both options.

Note: The /tmp/qas_module.log file is world writable making it possible for any user to write output to it. Thus, One Identity recommends that you change the permissions once debug is disabled.

vastool

Authentication Services command line tools accept a -d parameter to indicate the level of debug output (1-5) you want to print to the console. To see more output, specify a higher value to the -d parameter. For example, to see extra diagnostic information when you join the domain, enter:

/opt/quest/bin/vastool -u administrator -d5 join example.com

Note: When you have debug enabled, it can affect performance.

Related Documents