Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Safeguard Authentication Services 5.0.6 - Administration Guide

Table of Contents

Privileged Access Suite for Unix

About this guide

Introducing One Identity Safeguard Authentication Services

About licenses System requirements

Windows and cloud requirements

Windows components Windows permissions Configure Active Directory

Configuring Active Directory About Active Directory configuration Join the host to AD without the Safeguard Authentication Services application configuration Version 3 Compatibility Mode

Unix agent requirements

Unix components Permissions matrix Encryption types

Network requirements

Unix administration and configuration

Joining the domain

Joining the domain using VASTOOL

Automatically generate user attributes

Unattended joining using Offline Domain Join (ODJ) credentials Joining the domain using VASJOIN script

Using manual pages (man pages) The configuration file Unix login syntax Keytab files Handling platform limitations on user name length Configuring Name Service Switch (NSS)

Using VASTOOL to configure NSS Using NSCD Forcing lowercase names

Configuring PAM

Using VASTOOL to configure PAM Home directory creation Kerberos ticket caches

Configuring AIX

Using VASTOOL to configure AIX

Configuring SELinux

Using VASTOOL to configure SELinux

Enabling diagnostic logging Working with netgroups

Configuring netgroup support with name service Unconfiguring netgroup support with name service

Cache administration

Blackout period Disconnected authentication

Working with read-only domain controllers Cross-forest authentication One-way trust authentication Configuring services

Group managed service accounts (gMSA)

Creating a group managed service account (gMSA) Checking group managed service accounts (gMSA) with vastool Using group managed service accounts (gMSA) on Unix Uninstalling a group managed service account (gMSA)

Supporting legacy LDAP applications

Installing the LDAP proxy Configuring the LDAP proxy

Identity management

Planning your user identity deployment strategy User and group schema configuration

Configuring a custom schema mapping

Active Directory optimization (Best practice)

Managing Unix user accounts

Managing Unix users with MMC Managing user accounts from the Unix command line Managing users with Windows PowerShell

PowerShell cmdlets

Password management

Changing passwords

Changing passwords with VASTOOL Changing passwords with system utilities

Mapping local users to Active Directory users

Using map files to map users Mapping the root account Enable self-enrollment

Restarting services

Automatically generating Posix user identities

Migrating auto-generated identities to enterprise identities Migrating auto-generated group identities

Unix Personality Management

Unix Personality Management schema extension Joining the domain in Unix Personality Management mode

Overriding Unix account information

Managing Unix group accounts

Nested group support Managing Unix groups with MMC Managing groups from the Unix command line Managing groups with Windows PowerShell Overriding Unix group information

Local account migration to Active Directory AIX extended attribute support Unix Account Import Wizard

Import Source Selection Account matching rules Search base selection Account Association Final Review Results

Unix account management in large environments

User and group search paths Minimizing the size of the user cache

Migrating from NIS

Using Safeguard Authentication Services to augment or replace NIS RFC 2307 overview

RFC classes and attributes Limitations of RFC 2307 as implemented by Microsoft

Installing and configuring the Safeguard Authentication Services NIS components

Installing and configuring the Linux NIS client components Installing and configuring the Oracle Solaris NIS client components Installing and configuring the HP-UX NIS client components Installing and configuring the AIX NIS client components

NIS map search locations Deploying in a NIS environment

Starting the NIS Map Import Wizard

Import RFC 2307 NIS map objects from a local file Import RFC 2307 NIS map objects from an existing NIS server

Using NIS map command line administration utility

passwd, group, and netid maps Specific vs generic maps

The VASYP daemon

Maintaining netgroup data

Managing access control

About host access control Using "Logon To" for access control Setting up access control Configuring local file-based access control Resolving conflicts between the allow and deny files Per-service access control Configuring access control on ESX 4 Configuring Sudo access control

Enabling sudo_vas

Certificate distribution policy

Managing local file permissions

The Ownership Alignment Tool

Using OAT Installing OAT

Changing file ownership manually

Performing a cross-domain search OAT matching scripts Rollback changes

Changing file ownership using the script OAT file formats

Active Directory User Information file Active Directory Group Information file User map file Group map file Local User Override file Local Group Override file Files to Process List file Files to Exclude List file Processed Files List file

Certificate Autoenrollment

Certificate Autoenrollment on UNIX and Linux Certificate Autoenrollment requirements and setup

Java requirement: Unlimited Strength Jurisdiction Policy Files Installing certificate enrollment web services Configuring Certificate Services Client - Certificate Enrollment Policy Group Policy Configuring Certificate Services Client - Auto-Enrollment Group Policy Configuring Certificate Templates for autoenrollment

Using Certificate Autoenrollment

Configuring Certificate Autoenrollment manually

Configure a machine for Certificate Autoenrollment Configure a user for Certificate Autoenrollment

Trigger machine-based Certificate Autoenrollment

Troubleshooting Certificate Autoenrollment

Certificate Autoenrollment process exited with an error Enable full debug logging Pulse Certificate Autoenrollment processing Manually apply Group Policy

Command line tool

vascert command reference

vascert commands and arguments

Integrating with other applications

One Identity Starling integration

Starling Two-Factor Authentication requirements Setting up Starling users Joining Safeguard Authentication Services with Starling Configuring Starling to use a proxy server Starling Attributes: Configure LDAP attributes for use with push notifications Logging in with Starling Two-Factor Authentication Unjoining from Starling Disabling Starling 2FA for a specific PAM service

Defender integration

Defender installation prerequisites Installing Defender

Change Auditor for Authentication Services integration

Installing Change Auditor for Authentication Services

Application integration

Managing Unix hosts with Group Policy

Safeguard Authentication Services Group Policy

Administrative interface Unix agent technology

How Safeguard Authentication Services Group Policy works Group Policy framework for Unix Server-side extensions vgptool Client-side extensions Administrative templates on Unix Apply mode

Setting policy apply mode

Scripts Refresh Scripts policy

Configuring a refresh script

Startup Scripts policy

Configure a startup script

Creating or modifying a crontab file

Configuring a crontab entry

Configuring a Files policy Text Replacement Macros

Specifying a text replacement macro

Dynamic File Copy policy Login Prompt policy

Setting the Login Prompt policy

Message of the Day policy

Setting the Message of the Day policy

Samba Configuration policy Symbolic Link policy

Setting a new symbolic link

Adding a syslog entry

Adding a Sudo rule

One Identity policies

Quest OpenSSH Configuration policy Licensing policy

Adding a license file

Defender Settings policy

Enabling one-time password authentication for Unix

Privilege Manager for Unix policy

Privilege Manager for Unix policy files

Configuring Privilege Manager policy files

Privilege Manager Configuration policy

Configuring Privilege Manager configuration settings

Safeguard Authentication Services group policies

Group Policy Configuration policy

Configuring Group Policy options

Client-Side Extensions policy

Safeguard Authentication Services policies

Configuration policy Mapped User policy Service Access Control policy Account Override policies

User Account Override policy Group Account Override policy

Host Access Control policy

Configuring a User Allow Entry policy Configure a User Deny Entry policy

Display specifiers

Registering display specifiers Unregistering display specifiers Display specifier registration tables

Troubleshooting

Getting help from technical support Disaster recovery Long startup delays on Windows Pointer Record updates are rejected Resolving preflight failures Resolving DNS problems Time synchronization problems Unable to authenticate to Active Directory Unable to install or upgrade Unable to join the domain Unable to log in Unix Account tab is missing in ADUC vasypd has unsatisfied dependencies

Login Prompt policy

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Unix policies > Login Prompt policy

The Login Prompt policy allows administrators to configure the /etc/issue and /etc/issue.net files. These files define the welcome messages displayed to users logging in. Login Prompt policies can be overridden. If there are multiple Login Prompt policies, contents of /etc/issue is dictated by the lowest Login Prompt policy in the hierarchy or the highest enforced Login Prompt policy in the hierarchy.

Setting the Login Prompt policy

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Unix policies > Setting the Login Prompt policy

To set the Login Prompt policy

Start Group Policy Editor.
Select Unix Settings | Authentication Services | Client Configuration in the scope view.
Double click Login Prompt (/etc/issue).
The Login Prompt Properties dialog opens.
Type the text of the message into the text box or click Import to import the contents of a local or remote file.
Click OK.

Message of the Day policy

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Unix policies > Message of the Day policy

The Message of the Day policy displays a message to users logging in to a Unix workstation. This policy allows administrators to configure the /etc/motd file. Message of the Day policies can be overridden. If there are multiple Message of the Day policies, contents of /etc/motd is dictated by the lowest Message of the Day policy in the hierarchy or the highest enforced Message of the Day in the hierarchy.

Setting the Message of the Day policy

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Unix policies > Setting the Message of the Day policy

To set the Message of the Day policy

Start Group Policy Editor.
Select Unix Settings | Authentication Services | Client Configuration in the scope view.
Double click Message Of the Day.
The Message Of the Day Properties dialog opens.
Type the text of the message into the text box or click Import to import the contents of a local or remote file.
Click OK.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center