|
 |
 |
 |
Back
to Strong Auth Index Page | Computing
Division| Fermilab at
Work | Fermilab
Home
|
||||||||
|
Strong Authentication at Fermilab | |||||||
Table of Contents
About this Manual
Purpose and Intended Audiences
Part I Getting Started
Chapter 1: Introduction to Strong Authentication at Fermilab
1.1 Computing on the World Wide Web
1.3 Why has Fermilab implemented strong authentication?
1.4 What do you need to know and do ?
1.5 What advantages does Kerberos provide?
1.6 What advantages does Kerberos have over other possible solutions?
1.8 How do you obtain a Kerberos Principal?
Chapter 2: Fermilab Computing Policy Issues
2.1 The Strong Authentication Policy in a Nutshell
2.2 Authentication Guidelines for On-site vs. Off-site Machines
2.4 Obtaining an Exemption from the Policy
Chapter 3: Kerberos Principals and Passwords
3.1.1 Choosing a Principal Name
3.2.2 Choosing a Kerberos Password
3.3 Changing your Kerberos Password
3.3.2 Windows (with WRQ® Reflection software installed)
3.3.3 Windows (with Exceed 7.0 and MIT Kerberos)
Part II User's Guide
Chapter 4: Accessing Kerberized Machines (Fermilab-Supported Methods)
4.1 Logging In at the Console of a Kerberized UNIX Machine
4.1.1 Using Standard UNIX Login Program
4.1.2 Using Kerberos Login Program
4.1.3 If you don't have a principal yet...
4.1.4 Machines Running Mixed Mode Kerberos
4.2 Connecting from One Kerberized Machine to Another
4.3 Connecting via Kerberized SSH
4.4 Connecting from a NonKerberized Machine: Portal Mode
4.4.3 Programs for Initiating CRYPTOCard Login
4.4.4 Portal Mode FTP when you can't see the Challenge
4.5 Logging into a UNIX Account that's not your own
4.6 Logging In Through WRQ® Reflection Software from Windows
4.6.1 Authenticate Locally via the Kerberos Manager
4.6.2 Run a telnet Session to Kerberized Host
4.6.3 Run an FTP Session to Kerberized Host
4.7 Windows AFS Client for File Transfers to AFS Space
4.7.1 How does AFS Appear on your Desktop?
Chapter 5: Using your CRYPTOCard
5.1 How does your CRYPTOCard Work?
5.2 Caring for your CRYPTOCard
5.4 The First Thing to do: Reset your PIN
5.5 Log in Using CRYPTOCard (the First Time)
5.5.2 New Style Card (March 2002)
5.6 Log in Using CRYPTOCard (Subsequently)
5.6.2 New Style Card (March 2002)
5.7 Reauthenticate using your CRYPTOCard
5.8.2 New Style Card (March 2002)
Chapter 6: Logging In from Off-Site
6.1 Description of Choices for Off-Site Machines
6.2 In a Pinch: Download Client-Only Version of Kerberos
6.5 Network Address Translation
Chapter 7: Accessing Kerberized Machines (Community-Supported Methods)
7.1 Logging In Through Kerberized Exceed 7 Software from Windows
7.2 Logging In from a Macintosh
Chapter 8: Troubleshooting your Authentication Problems
Chapter 9: Using Kerberos
9.1 Ticket Properties and Options
9.1.1 Default Ticket Flags and Lifetimes
9.1.3 Tickets for Root Instance of Kerberos Principal
9.2.1 Obtaining Tickets (Authenticating to Kerberos)
9.2.6 Update Tickets on Remote Terminal Sessions
9.3 Account Access by Multiple Users
9.4 Using Root Instance of your Principal
9.4.1 What is a Root Instance of a Principal?
9.4.2 How do You Use your /root Principal?
9.4.3 How Should You NOT Use It?
9.4.4 How do you Maintain Credentials for your Normal Principal while Using the /root Principal?
Chapter 10: Miscellaneous Topics for the User
10.2 Usage Notes for PC's with WRQ® Reflection Installed
10.2.2 Using Matrix through X Windows Interface
10.3.1 Specific-User Processes (cron Jobs)
10.3.2 Processes Running as root
10.3.3 Non-root, Non-Specific-User Processes
10.4 Sending Data from Unstrengthened to Strengthened Machines
Part III User's Reference Manual
Chapter 11: Encrypted vs. Unencrypted Connections
11.1 How do you know if your connection is encrypted?
11.1.1 Connecting from Kerberized UNIX/Linux Desktops
11.1.2 Connecting over a CRYPTOCard ssh Session
11.1.3 Connecting over a CRYPTOCard telnet Session
11.1.4 Connecting over a CRYPTOCard ftp Session
11.1.5 Connecting from an X Terminal
11.1.6 Connecting from a PC Running Windows
11.1.7 Macintosh: MIT Kerberos and BetterTelnet
11.2 If it's unencrypted, what do I do when I need to reauthenticate?
Chapter 12: Kerberos Command Descriptions
12.2.2 Option/Argument Descriptions
Chapter 13: Network Programs Available on Kerberized Machines
13.8 Kerberized ssh and slogin
Part IV System Administrator's Guide "A": Recommended and Supported Implementations
Chapter 14: Installing Fermi Kerberos on a UNIX (non-Linux) System
14.1 Before You Install Kerberos
14.1.1 Obtain a Kerberos Principal
14.1.2 Create an Account that Matches your Principal
14.1.3 Understand your Installation Options
14.1.4 Install UPS/UPD (Recommended)
14.1.5 Install Kerberized SSH (Recommended)
14.1.6 Do you Need to Allow Incoming Kerberos Connections?
14.1.7 Synchronize your Machine with Time Server
14.1.8 Determine Kerberos Access Mode(s)
14.2 Installing Fermi Kerberos using UPS/UPD
Chapter 15: Installing Fermi Kerberos on a Linux System
15.1 Before You Install Kerberos
15.1.1 Choose your Installation Method
15.1.2 Differences between the UPS/UPD and RPM Kerberos Products
15.1.3 Follow Same Pre-install Steps as for UNIX
15.1.5 PAM and Passwords for Desktop Environment Applications
15.2 Kerberos and SSH RPM Installation
Chapter 16: Kerberized UNIX System Administration Issues
16.1 Alterations Made to your System when Fermi Kerberos is Installed
16.2 Setting Defaults for Tickets/Applications
16.4 Portal Mode Configuration
16.5 Register yourself as an Administrator
16.6 User Accounts and Passwords
16.6.2 Determine if a Particular Principal Exists
16.6.4 Providing Access to Sensitive Accounts
16.8 Searching KDC Log Files and the Principal List
16.9 Changing a Machine's Node Name
16.9.2 Using Kerberos Utilities
16.10 Installing Service Host Keys
16.11 Static IP vs. DHCP Addresses
16.12 Multiple IP Addresses or Node Names
Chapter 17: The Kerberos Configuration File: krb5.conf
17.1 What does krb5.conf Control?
17.2 Reinstall krb5conf Using UPD
17.3 Obtain krb5conf without Using UPD
Chapter 18: Additional UNIX Sysadmin Information for Off-Site Installations
18.2 Obtaining the krb5.conf File
18.3 When your Node is in a Different Domain
18.4 Connecting from One Off-Site Domain to Another
Chapter 19: Installing and Configuring WRQ® Reflection on a Windows System
19.2 Automated Installation of WRQ® Reflection v12.0.0
19.3 Configuration for Addressless Tickets
19.5 Configuring WRQ® Reflection Kerberos Manager v9.0.0
19.6 Configuring WRQ® Reflection
19.7 Configuring WRQ® Reflection OpenSSH Connections
19.7.3 Create a Template Configuration
19.8 Configuring WRQ® Reflection telnet Connections
19.8.3 Create a Template Configuration
19.8.4 Connect to Host with X Application Startup
19.9 Configuring WRQ® Reflection FTP Connections
19.9.1 Create a Profile for FTP to Kerberized Host
19.9.2 Connect to nonKerberized Host
Part V System Administrator's Guide "B": Community-Supported Implementations
Chapter 20: Installing Kerberos on a non-Fermi-Supported Linux System
20.1 Before You Install Kerberos
20.1.1 Obtain a Kerberos Principal
20.1.2 Do you Need to Allow Incoming Kerberos Connections?
20.1.3 Create an Account that Matches your Principal
20.1.4 Synchronize your Machine with Time Server
20.3 Installing Fermi Kerberos
20.3.1 Download Modified Source from CVS
20.3.2 Download Tar File from KITS
Chapter 21: Installing MIT Kerberos on Windows, for use with Exceed 7 and FileZilla
21.1.1 Obtain a Kerberos Principal
21.1.2 Install Exceed and FileZilla
21.3 Configuring Kerberos using Leash32
21.5 Configuring the Exceed 7 Telnet Application
21.5.1 Create a new Telnet Profile for Kerberized Host
21.5.2 Create a new Telnet Profile for nonKerberized Host
21.5.3 Connect to Kerberized Host using Telnet Profile
21.5.4 Connect to nonKerberized Host using Telnet Profile
Chapter 22: Installing Heimdal Kerberos for use with Cygwin
22.1 Obtain a Kerberos Principal
Chapter 23: Installing and Configuring MIT Kerberos on a Macintosh System
23.1.4 Authenticate to Kerberos
23.2 Installing MIT Kerberos for Mac OS 9 and Earlier
23.2.1 Changes in MIT Kerberos for Macintosh 4.0
23.2.2 Download Kerberos from the MIT Web Site
23.2.3 Items that Appear on your Desktop
23.2.4 Installation Instructions
23.3 Configuring the Kerberos Software v4 for Mac
23.7 Authenticating to Kerberos
23.7.1 Authenticate via Kerberos Control Panel
23.7.3 Time Synchronization (Pre-OS X 10)
Part VI Appendices
Appendix A. Implementation Details of Strong Authentication at Fermilab
A.1 What is "Strong Authentication"?
A.2 Goals of Strong Authentication at Fermilab
A.3 The Authentication Model Implemented at Fermilab
A.3.2 Relationships between the Realms
A.4 Features of Strong Authentication at Fermilab
Appendix B. About the Kerberos Network Authentication Service
B.1.2 About Kerberos Authentication
B.3 Fermi vs. Standard MIT Kerberos
B.4 The Authentication Process
Appendix C. More about Choosing a Principal Name
C.1 Guidelines for Choosing a Kerberos Principal
C.2 If your Principal and Login Name do not Match
Glossary
Index
|
|||||||
| Back to Strong Auth Index Page | Computing Division| Fermilab at Work | Fermilab Home | |||||||