Apple Mac OS X Server Command-Line Specifikace Strana 46
- Strana / 295
- Tabulka s obsahem
- KNIHY
Hodnocené. / 5. Na základě hodnocení zákazníků
Kerberos was designed to solve network security problems. It never transmits the
user’s password across the network, nor does it save the password in the user’s
computer memory or on disk. Therefore, even if the Kerberos credentials are cracked
or compromised, the attacker does not learn the original password, so he or she can
potentially compromise only a small portion of the network.
In addition to superior password management, Kerberos is also mutually
authenticated. The client authenticates to the service, and the service authenticates to
the client. A man-in-the-middle or spoong attack is impossible when you are using
Kerberized services, and that means users can trust the services they are accessing.
Moving Beyond Passwords
Network authentication is dicult: To deploy a network authentication method, the
client and server must agree on the authentication method. Although it is possible for
client/server processes to agree on a custom authentication method, getting pervasive
adoption across a suite of network protocols, platforms, and clients is virtually
impossible.
For example, suppose you wanted to deploy smart cards as a network authentication
method. Without Kerberos, you’d have to change every client/server protocol to
support the new method. The list of protocols includes SMTP, POP, IMAP, AFP, SMB,
HTTP, FTP, IPP, SSH, QuickTime Streaming, DNS, LDAP, local directory domain, RPC, NFS,
AFS, WebDAV, and LPR, and goes on and on.
Considering all the software that does network authentication, deploying a new
authentication method across the entire suite of network protocols would be a
daunting task. Although this might be feasible for software from one vendor, you’d be
unlikely to get all vendors to change their client software to use your new method.
Further, you’d probably also want your authentication to work on multiple platforms
(such as Mac OS X, Windows, and UNIX).
Due to the design of Kerberos, a client/server binary/protocol that supports Kerberos
doesn’t even know how the user proves identity. Therefore you only need to change
the Kerberos client and the Kerberos server to accept a new proof of identity such as a
smart card. As a result, your entire Kerberos network has now adopted the new proof-
of-identity method, without deploying new versions of client and server software.
46 Chapter 3 Open Directory Authentication
- Mac OS X Server 1
- Contents 3
- 4 Contents 4
- Contents 5 5
- 6 Contents 6
- Contents 7 7
- 8 Contents 8
- Contents 9 9
- 10 Contents 10
- About This Guide 11
- What’s in This Guide 12
- Using Onscreen Help 13
- Documentation Map 14
- Viewing PDF Guides Onscreen 15
- Printing PDF Guides 15
- Getting Documentation Updates 15
- Directory Services with Open 17
- Directory 17
- A Historical Perspective 19
- Data Distribution 21
- Uses of Directory Data 22
- Access to Directory Services 23
- Inside a Directory Domain 23
- Search Policy Levels 31
- Two-Level Search Policies 32
- Multilevel Search Policies 33
- Automatic Search Policies 34
- Custom Search Policies 36
- Open Directory Authentication 37
- About Shadow Passwords 39
- About Crypt Passwords 39
- Oine Attacks on Passwords 40
- About Password Policies 42
- About Kerberos Authentication 43
- Single Sign-On Experience 45
- Secure Authentication 45
- Moving Beyond Passwords 46
- Multiplatform Authentication 47
- Centralized Authentication 47
- About Kerberized Services 47
- LDAP Bind Authentication 54
- Open Directory Planning and 55
- Management Tools 55
- Replica Sets 61
- Cascading Replication 61
- Replica Services 65
- Open Directory Security 72
- Server Admin 74
- Directory Utility 75
- Workgroup Manager 76
- Command-Line Tools 76
- Setting Up Open Directory 77
- Before You Begin 78
- Turning Open Directory On 79
- OF.KERBEROSREALM 99
- Managing User Authentication 104
- Using Workgroup Manager 104
- Composing a Password 105
- Changing a User’s Password 105
- Passwords 114
- Authentication 115
- Accounts Preferences 119
- Automated Client Conguration 120
- About Active Directory Access 158
- Attribute 167
- Directory Attribute 168
- Directory Forest 170
- Specifying NIS Settings 174
- Maintaining Open Directory 177
- Services 177
- Monitoring Open Directory 180
- Deleting Records 184
- Changing a User’s Short Name 185
- Importing Records of Any Type 186
- Parameter Description 198
- The path to the archive le 198
- Managing OpenLDAP 199
- Idle Rebinding Options 200
- Searching the LDAP Server 201
- Using LDIF Files 204
- Maintaining Kerberos 205
- Managing Principals 206
- Using Directory Service Tools 208
- Command-Line Parameters for 218
- Open Directory 218
- Â slap 219
- Â ldap 219
- Mac OS X Directory Data 220
- Group Auxiliary Object Class 223
- Mount Object Class 224
- Printer Object Class 224
- Computer Object Class 225
- ComputerList Object Class 225
- Conguration Object Class 226
- Preset Computer Object Class 226
- Preset Group Object Class 227
- Preset User Object Class 228
- Location Object Class 229
- Service Object Class 229
- Neighborhood Object Class 229
- ACL Object Class 230
- Resource Object Class 230
- Augment Object Class 230
- Automount Map Object Class 230
- Machine Attributes 241
- Active Directory 253
- Attribute Mappings for Users 254
- Mappings for Groups 258
- Mappings for Mounts 259
- Mappings for Computers 260
- Mappings for ComputerLists 262
- Mappings for Cong 263
- Attribute Mappings for Cong 264
- Mappings for People 265
- Mappings for PresetGroups 267
- Mappings for PresetUsers 268
- Mappings for Printers 270
- Mappings for AutoServerSetup 272
- Mappings for Locations 272
- Â ShadowHash; 276
- Index 287 287
- 288 Index 288
- Index 289 289
- 290 Index 290
- Index 291 291
- 292 Index 292
- Index 293 293
- 294 Index 294
- Index 295 295
Související produkty a manuály pro Servery Apple Mac OS X Server Command-Line
Servery Apple QuickTime Technické informace
(83 stránky)
(83 stránky)
Servery Apple Mac OS X Server File Services Specifikace
(158 stránky)
(158 stránky)
Servery Apple QuickTime Uživatelská příručka
(50 stránky)
(50 stránky)
Servery Apple QuickTime Specifikace
(28 stránky)
(28 stránky)
Servery Apple Workgroup 9120 Uživatelský manuál
(20 stránky)
(20 stránky)
Servery Apple Darwin Uživatelský manuál
(7 stránky)
(7 stránky)
Servery Apple Xserve RAID Specifikace
(25 stránky)
(25 stránky)
Servery Apple Darwin Uživatelský manuál
(68 stránky)
(68 stránky)
Servery Apple MAC PRO 3X108 Uživatelský manuál
(48 stránky)
(48 stránky)
Servery Apple Xserve Up Mac OS X Server Specifikace
(329 stránky)
(329 stránky)
American Energy Systems RT080 podręczniki
Instrukcje obsługi i podręczniki użytkownika dla Suszarnia American Energy Systems RT080.
Dostarczamy 1 pdf podręczników American Energy Systems RT080 do pobrania za darmo według typów dokumentów: Instrukcja Użytkownika
Komentáře k této Příručce