One Identity Privileged Access Suite for Unix
Introducing One Identity Authentication Services
About Authentication Services licenses
System requirements
Installing and configuring Authentication Services
Windows management tools requirements
Unix agent requirements
Network requirements
Authentication Services Unix components
Authentication Services permissions matrix
Authentication Services encryption types
Management Console for Unix requirements
Install the management console
Install Authentication Services Windows components
Installing and joining from the Unix command line
Installing Authentication Services Windows components
Customizing installation options
Installing using msiexec.exe
Configure Active Directory for Authentication Services
Configure Unix agent components
The Authentication Services pre-installation diagnostic tool
The Authentication Services install script
Licensing Authentication Services
Creating the application configuration from the Unix command line
Joining the domain
Getting started with Authentication Services
Getting acquainted with the Control Center
Learning the basics
Troubleshooting
Adding a local group
Adding a local user account
Adding an Active Directory group account
Adding an Active Directory user account
Changing the default Unix attributes
Active Directory account administration
Enabling local user for AD authentication
Testing the mapped user login
Unix-enabling an Active Directory group
Unix-enabling an Active Directory user
Testing the Active Directory user login
Running reports
Use Authentication Services PowerShell
Change Auditor for Authentication Services
One Identity Defender
Getting help from technical support
Disaster recovery
Long startup delays on Windows
Pointer Record updates are rejected
Resolving DNS problems
Resolving preflight failures
Time synchronization problems
Unable to install or upgrade
Unable to join the domain
Unable to log in
vasypd has unsatisfied dependencies
Enterprise package deployment
Restarting Authentication Services services
Enterprise package deployment > Authentication Services agent upgrade commands > Restarting Authentication Services services
- The method for restarting services varies by platform:
- To restart Authentication Services on Linux or Solaris, enter:
/etc/init.d/vasd restart
- To restart Authentication Services on HP-UX, enter:
/sbin/init.d/vasd restart
- To restart Authentication Services on AIX, enter:
stopsrc -s vasd startsrc -s vasd
- To restart Authentication Services on Linux or Solaris, enter:
|
|
Note: Due to library changes between the Authentication Services 4.1 and 4.2, the system may need to be rebooted before all processes load the new libraries. |
Uninstalling the Authentication Services agent packages
To uninstall the Authentication Services agent packages
- Log in and open a root shell.
- Run the following commands to remove the packages.
See Additional configuration information that follows the table.
Table 33: Authentication Services: Agent uninstall commands Package Command RPM # rpm -e vasclnt DEB # dpkg -r vaslcnt Solaris # pkgrm vasclnt HP-UX # swremove vasclnt AIX # installp -u vasclnt Mac OS X /<mount>/Uninstall.app/Contents/MacOS/Uninstall' --console --force vasclnt
FreeBDS
pkg delete <package name>
Additional configuration information
- Linux: The rpm –e vasclnt and the dpkg -r vaslcnt commands run scripts that halt the daemon, unconfigure Authentication Services, flush, and delete the Authentication Services cache before finally removing the files.
- HP-UX: The swremove vasclnt command does not clean up the empty directories that the vasclnt package used. In order to clean these up, manually remove the /opt/quest directory after you uninstall.
Solaris 10 zones/containers support
Sun introduced Zones (or containers) in Solaris 10. Zones is a partitioning technology used to virtualize operating system services and provide an isolated and secure environment for running applications. There are two types of non-global zone root filesystem models:
- sparse root
- whole root
The sparse root zone model optimizes the sharing of objects while the whole root zone model provides the maximum configurability. Additional information on Solaris 10 and Zones can be found at www.sun.com.
Authentication Services and Solaris 10 Zones installation guidelines
Enterprise package deployment > Solaris 10 zones/containers support > Authentication Services and Solaris 10 Zones installation guidelines
To install Authentication Services in a Solaris 10 Zones configuration
- In Solaris 10 Zones, only the global zone is permitted to do time synchronization. Therefore, if you want to run Authentication Services in any Solaris Zone configuration, you must timesync the Global Zone with Active Directory. Time synchronization is a requirement of the Kerberos protocol and since Authentication Services is built on Kerberos, Authentication Services also has this requirement.
- The same version of Authentication Services should be installed in any combination of global, whole root, and sparse root zone configurations.
- To disable time synchronization for Authentication Services on the sparse zone, run the below command:
vastool configure vas vasd timesync-interval 0
- The following symlinks must exist in the global zone in order for the sparse zones to work correctly:
- /usr/lib/security/pam_vas3.so | /opt/quest/usr/lib/security/pam_vas3.so
- /usr/lib/security/sparcv9/pam_vas3.so | /opt/quest/usr/lib/security/sparcv9/pam_vas3.so
- /usr/lib/nss_vas4.so.1 | /opt/quest/lib/nss/nss_vas4.so.1
- /usr/lib/security/pam_vas3.so | /opt/quest/usr/lib/security/pam_vas3.so
Each zone must have its own unique copy of /etc and /var because Authentication Services stores zone-specific information in those locations. Sharing /etc and /var with the global zone is not a supported configuration.