Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Safeguard Authentication Services 5.1.1 - Administration Guide

Table of Contents

Privileged Access Suite for Unix

About this guide

Introducing One Identity Safeguard Authentication Services

About licenses System requirements

Windows and cloud requirements

Windows components Windows permissions Configure Active Directory

Configuring Active Directory About Active Directory configuration Join the host to AD without the Safeguard Authentication Services application configuration Version 3 Compatibility Mode

Unix agent requirements

Unix components Permissions matrix Encryption types

Network requirements

Unix administration and configuration

Joining the domain

Joining the domain using VASTOOL

Automatically generate user attributes

Unattended joining using Offline Domain Join (ODJ) credentials Joining the domain using VASJOIN script

Using manual pages (man pages) The configuration file Unix login syntax Keytab files Handling platform limitations on user name length Configuring Name Service Switch (NSS)

Using VASTOOL to configure NSS Using NSCD Forcing lowercase names

Configuring PAM

Using VASTOOL to configure PAM Home directory creation Kerberos ticket caches

Configuring AIX

Using VASTOOL to configure AIX

Configuring SELinux

Using VASTOOL to configure SELinux

Enabling diagnostic logging Working with netgroups

Configuring netgroup support with name service Unconfiguring netgroup support with name service

Cache administration

Blackout period Disconnected authentication

Working with read-only domain controllers Cross-forest authentication One-way trust authentication Configuring services

Group managed service accounts (gMSA)

Creating a group managed service account (gMSA) Checking group managed service accounts (gMSA) with vastool Using group managed service accounts (gMSA) on Unix Uninstalling a group managed service account (gMSA)

Supporting legacy LDAP applications

Installing the LDAP proxy Configuring the LDAP proxy

Identity management

Planning your user identity deployment strategy User and group schema configuration

Configuring a custom schema mapping

Active Directory optimization (Best practice)

Managing Unix user accounts

Managing Unix users with MMC Managing user accounts from the Unix command line Managing users with Windows PowerShell

PowerShell cmdlets

Password management

Changing passwords

Changing passwords with VASTOOL Changing passwords with system utilities

Mapping local users to Active Directory users

Using map files to map users Mapping the root account Enable self-enrollment

Restarting services

Automatically generating Posix user identities

Migrating auto-generated identities to enterprise identities Migrating auto-generated group identities

Unix Personality Management

Unix Personality Management schema extension Joining the domain in Unix Personality Management mode

Overriding Unix account information

Managing Unix group accounts

Nested group support Managing Unix groups with MMC Managing groups from the Unix command line Managing groups with Windows PowerShell Overriding Unix group information

Local account migration to Active Directory AIX extended attribute support Unix Account Import Wizard

Import Source Selection Account matching rules Search base selection Account Association Final Review Results

Unix account management in large environments

User and group search paths Minimizing the size of the user cache

Migrating from NIS

Using Safeguard Authentication Services to augment or replace NIS RFC 2307 overview

RFC classes and attributes Limitations of RFC 2307 as implemented by Microsoft

Installing and configuring the Safeguard Authentication Services NIS components

Installing and configuring the Linux NIS client components Installing and configuring the Oracle Solaris NIS client components Installing and configuring the HP-UX NIS client components Installing and configuring the AIX NIS client components

NIS map search locations Deploying in a NIS environment

Starting the NIS Map Import Wizard

Import RFC 2307 NIS map objects from a local file Import RFC 2307 NIS map objects from an existing NIS server

Using NIS map command line administration utility

passwd, group, and netid maps Specific vs generic maps

The VASYP daemon

Maintaining netgroup data

Managing access control

About host access control Using "Logon To" for access control Setting up access control Configuring local file-based access control Resolving conflicts between the allow and deny files Per-service access control Configuring access control on ESX 4 Configuring Sudo access control

Enabling sudo_vas

Certificate distribution policy

Managing local file permissions

The Ownership Alignment Tool

Using OAT Installing OAT

Changing file ownership manually

Performing a cross-domain search OAT matching scripts Rollback changes

Changing file ownership using the script OAT file formats

Active Directory User Information file Active Directory Group Information file User map file Group map file Local User Override file Local Group Override file Files to Process List file Files to Exclude List file Processed Files List file

Certificate Autoenrollment

Certificate Autoenrollment on UNIX and Linux Certificate Autoenrollment requirements and setup

Java requirement: Unlimited Strength Jurisdiction Policy Files Installing certificate enrollment web services Configuring Certificate Services Client - Certificate Enrollment Policy Group Policy Configuring Certificate Services Client - Auto-Enrollment Group Policy Configuring Certificate Templates for autoenrollment

Using Certificate Autoenrollment

Configuring Certificate Autoenrollment manually

Configure a machine for Certificate Autoenrollment Configure a user for Certificate Autoenrollment

Trigger machine-based Certificate Autoenrollment

Troubleshooting Certificate Autoenrollment

Certificate Autoenrollment process exited with an error Enable full debug logging Pulse Certificate Autoenrollment processing Manually apply Group Policy

Command line tool

vascert command reference

vascert commands and arguments

Integrating with other applications

Defender integration

Defender installation prerequisites Installing Defender

Change Auditor for Authentication Services integration

Installing Change Auditor for Authentication Services

Application integration

Managing Unix hosts with Group Policy

Safeguard Authentication Services Group Policy

Administrative interface Unix agent technology

How Safeguard Authentication Services Group Policy works Group Policy framework for Unix Server-side extensions vgptool Client-side extensions Administrative templates on Unix Apply mode

Setting policy apply mode

Scripts Refresh Scripts policy

Configuring a refresh script

Startup Scripts policy

Configure a startup script

Creating or modifying a crontab file

Configuring a crontab entry

Configuring a Files policy Text Replacement Macros

Specifying a text replacement macro

Dynamic File Copy policy Login Prompt policy

Setting the Login Prompt policy

Message of the Day policy

Setting the Message of the Day policy

Samba Configuration policy Symbolic Link policy

Setting a new symbolic link

Custom Service Configuration Syslog policy

Adding a syslog entry

Adding a Sudo rule

One Identity policies

Quest OpenSSH Configuration policy Licensing policy

Adding a license file

Defender Settings policy

Enabling one-time password authentication for Unix

Privilege Manager for Unix policy

Privilege Manager for Unix policy files

Configuring Privilege Manager policy files

Privilege Manager Configuration policy

Configuring Privilege Manager configuration settings

Safeguard Authentication Services group policies

Group Policy Configuration policy

Configuring Group Policy options

Client-Side Extensions policy

Safeguard Authentication Services policies

Configuration policy Mapped User policy Service Access Control policy Account Override policies

User Account Override policy Group Account Override policy

Host Access Control policy

Configuring a User Allow Entry policy Configure a User Deny Entry policy

Display specifiers

Registering display specifiers Unregistering display specifiers Display specifier registration tables

Troubleshooting

Getting help from technical support Disaster recovery Long startup delays on Windows Pointer Record updates are rejected Resolving preflight failures Resolving DNS problems Time synchronization problems Unable to authenticate to Active Directory Unable to install or upgrade Unable to join the domain Unable to log in Unix Account tab is missing in ADUC vasypd has unsatisfied dependencies

Concepts

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Concepts

Group Policy consists of both agent and server software. You install the agent software on Unix computers and use it to apply Group Policy settings. The server software extends existing Microsoft frameworks for managing Group Policy. After installing the Group Policy agent-side extensions, administrators interact mostly with the server-side extensions which enable Unix policy configuration.

How Safeguard Authentication Services Group Policy works

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Concepts > How Safeguard Authentication Services Group Policy works

Safeguard Authentication Services Group Policy is a built-in component of Safeguard Authentication Services. After joining the domain, Unix hosts display as computer objects in Active Directory just like Windows servers and workstations. Group Policy Objects link to Unix computer objects in the same way as they link to Windows computer objects.

Group Policy allows Unix hosts to participate in the WindowsGroup Policy infrastructure. Group Policy uses the Kerberos and LDAP infrastructure provided by Safeguard Authentication Services to implement Group Policy on Unix in a way that mirrors the Windows Group Policy implementation.

Group Policy framework for Unix

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Concepts > Group Policy framework for Unix

Group Policy consists of server-side extensions to the Group Policy Object Editor and Unix client-side software. Using the Group Policy extensions to the Group Policy Object Editor (GPOE), administrators can create and edit Unix policies. The Group Policy agent is responsible for reading policy configuration data and applying policies to Unix hosts.

Server-side extensions

Managing Unix hosts with Group Policy > Safeguard Authentication Services Group Policy > Concepts > Server-side extensions

Server-side extensions are software packages that extend the functionality of existing Microsoft Group Policy management tools. Group Policy provides one extension for the Group Policy Object Editor (GPOE):

Namespace extensions
Group Policy extends the namespace of the Group Policy Object Editor: that is, Group Policy adds several Unix-specific nodes to the scope and resultant views of the Group Policy Object Editor.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center