HP Visualize J5000 hp enterprise file system: planning and configuring hp DCE/ - Page 153

command. See Authenticating to DCE

Get HP Visualize J5000 - Workstation PDF manuals and user guides View all HP Visualize J5000 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 153 highlights

The DFS/NFS Secure Gateway Configuring Gateway Server Machines • dfs_login allows users of the NFS client to establish an authenticated session by obtaining DCE credentials on a Gateway Server machine. (See "Authenticating to DCE from an NFS Client" for information about using this command.) • dfs_logout allows users on the NFS client to end an authenticated session established with the dfs_login command. (See "Authenticating to DCE from an NFS Client" for information about using this command.) The dfs_login and dfs_logout commands use version 5 of Kerberos to communicate with the DCE Security Service. 4 Create the Kerberos configuration file named /krb5/krb.conf. The dfs_login command reads this file to determine the name of a DCE Security Server that it can contact. This file must be identical to the /krb5/krb.conf file on machines in the host DCE cell; copy it from a machine in the DCE cell. 5 Create the Kerberos configuration file named /krb5/krb.realms. The Kerberos runtime uses the information in this file to translate Internet domains to the corresponding Kerberos realms. In the file, the Kerberos realm has the same name as the DCE cell. Each line of the file must have the following format: domain krb-realm where domain is the name of the local Internet domain, and krb-realm is the name of the Kerberos realm (the name of the DCE cell to be accessed). For example, in the following krb.realms file, def.com is the name of the Internet domain, and abc.com is the name of the DCE cell. If machines from multiple domains are to contact the DCE cell, you need a separate line for each domain. Note that realm names are case-sensitive. .DEF.COM abc.com 6 If you use the /etc/services file in your environment, add the following entry for the dfsgw service to the /etc/services file on the machine: dfsgw 438/udp dlog where dfsgw is the name of the service, 438 is the port at which the service receives RPCs, udp is the protocol the service uses to communicate, and dlog is an alias for the dfsgw service. If you use an NIS Services map in your environment, you added an entry to the services map file when you configured the first Gateway Server process. You do not need to add the entry to the services map when you configure NFS clients. 153

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
153
The DFS/NFS Secure Gateway
Configuring Gateway Server Machines
•
dfs_login
allows users of the NFS client to establish an authenticated
session by obtaining DCE credentials on a Gateway Server machine. (See
“Authenticating to DCE from an NFS Client” for information about using
this command.)
•
dfs_logout
allows users on the NFS client to end an authenticated session
established with the
dfs_login
command. (See “Authenticating to DCE
from an NFS Client” for information about using this command.)
The
dfs_login
and
dfs_logout
commands use version 5 of Kerberos to
communicate with the DCE Security Service.
4
Create the Kerberos configuration file named
/krb5/krb.conf
. The
dfs_login
command reads this file to determine the name of a DCE Security Server that
it can contact. This file must be identical to the
/krb5/krb.conf
file on
machines in the host DCE cell; copy it from a machine in the DCE cell.
5
Create the Kerberos configuration file named
/krb5/krb.realms
. The
Kerberos runtime uses the information in this file to translate Internet
domains to the corresponding Kerberos realms. In the file, the Kerberos realm
has the same name as the DCE cell. Each line of the file must have the
following format:
domain
krb-realm
where
domain
is the name of the local Internet domain, and
krb-realm
is the
name of the Kerberos realm (the name of the DCE cell to be accessed). For
example, in the following
krb.realms
file,
def.com
is the name of the
Internet domain, and
abc.com
is the name of the DCE cell. If machines from
multiple domains are to contact the DCE cell, you need a separate line for
each domain. Note that realm names are case-sensitive.
.DEF.COM
abc.com
6
If you use the
/etc/services
file
in your environment, add the following entry
for the
dfsgw
service to the
/etc/services
file on the machine:
dfsgw 438/udp dlog
where
dfsgw
is the name of the service,
438
is the port at which the service
receives RPCs,
udp
is the protocol the service uses to communicate, and
dlog
is an alias for the
dfsgw
service.
If you use an NIS Services map
in your environment, you added an entry to
the services map file when you configured the first Gateway Server process.
You do
not
need to add the entry to the services map when you configure
NFS clients.