立即与支持人员聊天
与支持团队交流

Safeguard Authentication Services 5.0.3 - Administration Guide

Privileged Access Suite for Unix Introducing One Identity Safeguard Authentication Services Unix administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment Integrating with other applications Managing Unix hosts with Group Policy
Safeguard Authentication Services Group Policy
Group Policy Concepts Unix policies One Identity policies
Display specifiers Troubleshooting Glossary

Configuring netgroup support with name service

To configure Safeguard Authentication Services to resolve netgroup data from the name service module

  1. Run the following command as root to configure Safeguard Authentication Services for netgroup support:
    vastool configure vas vasd netgroup-mode NSS
  2. Run the following command as root to configure the Safeguard Authentication Services name service module:
    1. On Linux, Oracle Solaris, or HP-UX:
      vastool configure nss netgroup
    2. On AIX:
      vastool configure irs netgroup

      Note: To create a netgroup map, if needed, you can enter the following at the command line:

      nisedit -u <admin> add -m netgroup -f an /etc/netgroup style file>

      For more information about the nisedit tool, see Using NIS map command line administration utility.

  3. Load the netgroup caches by running the following command as root:
    vastool flush netgroup
  4. To test the netgroup configuration run the following command:

    vastool nss getnetgrent <netgroup name>

Unconfiguring netgroup support with name service

To prevent Safeguard Authentication Services from resolving netgroup data from the name service module

  1. Run the following command as root to remove name service netgroup support:
    vastool configure vas vasd netgroup-mode
  2. Run the following command as root to configure the Safeguard Authentication Services name service module:
    1. On Linux, Oracle Solaris, or HP-UX:
      vastool unconfigure nss netgroup
    2. On AIX:
      vastool unconfigure irs netgroup
  3. Run the following command as root to configure the Safeguard Authentication Services name service module:
    1. On Linux, Oracle Solaris, or HP-UX:
      vastool configure nss
  4. Flush the netgroup caches by running the following command as root:
    vastool flush netgroup

Cache administration

To minimize network traffic and load on Active Directory, Safeguard Authentication Services maintains a local cache of user and group data.

You can force Safeguard Authentication Services to immediately reload the cache by running the following command as root:

vastool flush

Note: When you run vastool flush the entire user and group cache database is reloaded from Active Directory. This can generate a significant amount of network traffic so use this command sparingly.

Blackout period

It is not uncommon for systems to generate hundreds of user and group lookup requests per second. Because of this, Safeguard Authentication Services enforces a "blackout period" during which all name service requests are resolved from the local cache. By default, the blackout period is set to 10 minutes. This means that changes to Unix account information in Active Directory may take up to 10 minutes to propagate to Safeguard Authentication Services clients.

There are two events that cause Safeguard Authentication Services to update the local cache:

  • A user logs in
  • The blackout period expires

You can adjust the blackout period by changing the update-interval setting in the [vasd] section of vas.conf. For an example, refer to the vas.conf man page. See Using manual pages (man pages) for information about accessing the vas.conf man page. In small installations (less than 100 hosts or less than 100 users) you can safely reduce the blackout period. In larger installations it is recommended that the blackout period remain at the default value or set to 30 minutes or 1 hour.

Regardless of the blackout period, you can reset the blackout period timer by signaling vasd with SIGHUP, using the vasd init script to restart vasd, or by executing vastool flush.

To force Safeguard Authentication Services to update the cache immediately regardless of the blackout period, run this command:

vastool flush -f {users|groups}
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级