Chapter 3. Kerberos; Overview; Authentication; Authorization - IBM RS/6000 SP Problem Determination Manual

This soft copy for use by IBM employees only.

Chapter 3. Kerberos

This chapter briefly describes the role of Kerberos on the RS/6000 SP.

3.1 Overview

The RS/6000 SP currently uses authentication services based on MIT Kerberos
version 4. Kerberos functions as a third party to authenticate the identities of
clients and servers. Kerberos on the RS/6000 SP is used to initially authenticate
the identity of the user and to provide information through which the server can
authenticate the identity of clients in a distributed environment. The underlying
mechanism for authenticating users and services is a ticket scheme.
For a more detailed explanation of how Kerberos works, see Chapter 14,
"Understanding Secure Authentication," in RS/6000 Scalable POWERparallel
Systems: PSSP Version 2 Technical Presentation , SG24-4542.

3.1.1 Authentication

Authentication refers to the process of checking the correct identity of
transmissions; that is, the ability to validate the identity of a user or server.

3.1.2 Authorization

Authorization refers to the process of defining the functions that a user or
process is permitted to perform.
Kerberos provides authentication services that allow certain distributed services
within the SP system, and between it and other workstations (clients), to
securely control access to their services. The root user must use Kerberos
(taking on the role of the Kerberos administrator) when installing the SP system,
because the installation process includes the creation and modification of the
Kerberos security database.

3.1.3 Distributed Commands

Kerberos is also required to use the authenticated distributed commands such
as

3.1.4 Remote Commands

Kerberos provides authenticated (Kerberized) versions of
/usr/lpp/ssp/rcmds/bin directory. Customers wishing to use the .rhosts
mechanism to restrict access to clients can still do so by using the standard AIX
versions of these commands in the /usr/bin directory.

3.1.5 .rhosts

Using Kerberos avoids the need for the root user to have a .rhosts file to control
access to network services such as
Kerberos is a method of authentication that is not related to any AIX
authentication system, nor is it used as an additional login verification.
Therefore, if someone (other than the system administrator) can log into the
Control Workstation as root, they can destroy the Kerberos database.
©
Copyright IBM Corp. 1996
dsh p*
, the commands and
sysctl
.
rsh rcp
and .
rsh rcp
and in the
71