Red Hat DIRECTORY SERVER 8.1 - USING THE ADMIN SERVER Using Instructions

Using the admin server
Table of Contents

Advertisement

Quick Links

Red Hat Directory
Server 8.1
Using the Admin Server
with Red Hat Directory Server
Ella Deon Lackey

Advertisement

Table of Contents
loading

Summary of Contents for Red Hat DIRECTORY SERVER 8.1 - USING THE ADMIN SERVER

  • Page 1 Red Hat Directory Server 8.1 Using the Admin Server with Red Hat Directory Server Ella Deon Lackey...
  • Page 2 Using the Admin Server Red Hat Directory Server 8.1 Using the Admin Server with Red Hat Directory Server Edition 8.1.1 Author Ella Deon Lackey Copyright © 2009 Red Hat, Inc. Copyright © 2009 Red Hat, Inc.. This material may only be distributed subject to the terms and conditions set forth in the Open Publication License, V1.0 or later (the latest version of the OPL is presently available at http://www.opencontent.org/openpub/).
  • Page 3: Table Of Contents

    Preface 1. Examples and Formatting ....................v 1.1. Command and File Examples ................v 1.2. Tool Locations ...................... v 1.3. LDAP Locations ....................v 1.4. Text Formatting and Styles ................... v 2. Additional Reading ......................vi 3. Giving Feedback ......................vii 4.
  • Page 4 Using the Admin Server 4.1. sec-activate ........................ 49 4.2. modutil ........................49 Index...
  • Page 5: Preface

    Preface The Admin Server Guide provides information on using a support administrative server with identity management projects including Red Hat Directory Server and Red Hat Certificate System. The Admin Server runs the Java consoles used by those servers, as well as providing web services and storing configuration information for those services.
  • Page 6: Additional Reading

    Preface Formatting Style Purpose Monospace is used for commands, package Monospace font names, files and directory paths, and any text displayed in a prompt. This type of formatting is used for anything Monospace entered or returned in a command prompt. with a background Italicized text...
  • Page 7: Giving Feedback

    If there is any error in this Using the Admin Server or there is any way to improve the documentation, please let us know. Bugs can be filed against the documentation for Red Hat Directory Server through Bugzilla, http://bugzilla.redhat.com/bugzilla. Make the bug report as specific as possible, so we can be more effective in correcting any issues: •...
  • Page 8: Documentation History

    We appreciate receiving any feedback — requests for new sections, corrections, improvements, enhancements, even new ways of delivering the documentation or new styles of docs. You are welcome to contact Red Hat Content Services directly at mailto:docs@redhat.com. 4. Documentation History Revision 8.1.1...
  • Page 9: Introduction To Red Hat Admin Server

    Chapter 1. Introduction to Red Hat Admin Server Identity management and directory services with Red Hat Directory Server use three components, working in tandem: • A Java-based management console • An administration server which also functions as a web server •...
  • Page 10 Chapter 1. Introduction to Red Hat Admin Server information. These databases can be kept in the same Directory Server instance, but it is also possible to break these services into separate Directory Server instances. In that case, a Directory Server instance's configuration are stored in a separate Directory Server, called the Configuration Directory Server, and user data is stored in the User Directory Server.
  • Page 11: Admin Server Configuration

    Chapter 2. Admin Server Configuration The Admin Server is a separate server from Red Hat Directory Server or Red Hat Certificate System, although they work interdependently. The Admin Server processes, file locations, and configuration options are also separate. This chapter covers the Admin Server information, including starting and stopping the Admin Server, enabling SSL, viewing logs, and changing Admin Server configuration properties, such as the server port number.
  • Page 12: Starting And Stopping The Admin Server

    Admin Server to start on boot. For HP-UX, check the operating system documentation for details on adding these scripts. 2.2.1. Starting and Stopping Admin Server from the Console 1. Start the Console, and open the Admin Console. /usr/bin/redhat-idm-console -a http://localhost:9830 2. In the Tasks tab, click Restart Server or Stop Server.
  • Page 13: Starting And Stopping Admin Server From The Command Line

    Starting and Stopping Admin Server from the Command Line When the Admin Server is successfully started or stopped from the Console, the server displays a message box stating that the server has either started or shut down. 2.2.2. Starting and Stopping Admin Server from the Command Line There are two ways to start, stop, or restart the Admin Server: •...
  • Page 14: Opening The Admin Server Console

    2.3. Opening the Admin Server Console There is a simple script to launch the main Console. On Red Hat Enterprise Linux, run the following: /usr/bin/redhat-idm-console HP-UX has a different location for the script: /opt/dirsrv/bin/redhat-idm-console When the login screen opens, the Admin Server prompts for the username, password, and Admin Server location.
  • Page 15 The a option is a convenience, particularly for logging into a Directory Server for the first time. On subsequent logins, the URL is saved. If the Admin Server port number is not passed with the redhat-idm-console command, then the server prompts for it at the Console login screen.
  • Page 16: Viewing Logs

    Chapter 2. Admin Server Configuration java -version 2.4. Viewing Logs Log files monitor activity for Admin Server and can help troubleshoot server problems. Admin Server logs use the Common Logfile Format, a broadly supported format that provides information about the server.
  • Page 17: Viewing Logs In The Command Line

    Viewing Logs in the Command Line 2.4.2. Viewing Logs in the Command Line The access log, by default, is at /var/log/dirsrv/admin-serv/access. To view the access log, open it in an editor such as vi. Access logs show connections to the Admin Server based on the IP address of the client, the username, and the method that the request was sent.
  • Page 18: Changing The Log Name In The Console

    Chapter 2. Admin Server Configuration [Mon Dec 22 23:44:59 2008] [notice] [client 127.0.0.1] admserv_host_ip_check: ap_get_remote_host could not resolve 127.0.0.1 [Mon Dec 22 23:44:59 2008] [notice] [client 127.0.0.1] admserv_host_ip_check: host [localhost.localdomain] did not match pattern [*.example.com] -will scan aliases [Mon Dec 22 23:44:59 2008] [notice] [client 127.0.0.1] admserv_host_ip_check: host alias [localhost] did not match pattern [*.example.com] [Mon Dec 22 23:44:59 2008] [notice] [client 127.0.0.1]...
  • Page 19: Changing The Log Location In The Command Line

    Changing the Log Location in the Command Line 5. Click OK to save the changes. 6. Open the Tasks tab, and click the Restart Server button to restart the server and apply the changes. 2.4.4. Changing the Log Location in the Command Line The access and error log files' names and locations can be changed to rotate the files.
  • Page 20: Setting The Logs To Show Hostnames Instead Of Ip Addresses

    Chapter 2. Admin Server Configuration 3. Edit the console.conf file. For the access log, edit the path and filename in the CustomLog parameter. For the error log, edit the path and filename in the ErrorLog parameter. CustomLog /var/log/dirsrv/admin-serv//access_new common ErrorLog /var/log/dirsrv/admin-serv//error_new Leave the term common after the access log path;...
  • Page 21: Changing The Port Number In The Command Line

    Changing the Port Number in the Command Line 4. Enter the port number for the Admin Server instance in the Port field. The Admin Server port number has a default number of 9830. 5. Click OK. 6. Open the Tasks tab, and click the Restart Server button to restart the server and apply the changes.
  • Page 22: Setting Host Restrictions

    Chapter 2. Admin Server Configuration version:1 dn: cn=configuration, cn=admin-serv-example, cn=Red Hat Administration Server, cn=Server Group, cn=server.example.com, ou=example.com, o=NetscapeRoot b. The Admin Server entry can be edited using ldapmodify. The port number is set in the nsServerPort attribute. For example: /usr/lib/mozldap/ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: cn=configuration, cn=admin-serv-example, cn=Red Hat Administration Server, cn=Server Group, cn=server.example.com,...
  • Page 23 Setting Host Restrictions in the Console 4. The Connection Restrictions area displays a list of hosts allowed to connect to the Admin Server. The drop-down list specifies whether the list entries are added by DNS name or by IP address. The list is evaluated first by host names, and then by IP addresses. 5.
  • Page 24: Setting Host Restrictions In The Command Line

    Chapter 2. Admin Server Configuration When specifying IP address restrictions, include all three separating dots. If you do not, the Admin Server returns an error message. 7. Click OK to close the Add... dialog box, and then click the Save button to save the new host. 8.
  • Page 25: Changing The Admin User's Name And Password

    Changing the Admin User's Name and Password dn: cn=configuration, cn=admin-serv-example, cn=Red Hat Administration Server, cn=Server Group, cn=server.example.com, ou=example.com, o=NetscapeRoot changetype:modify replace:nsAdminAccessAddresses nsAdminAccessAddresses:72.5.*.* Hit Enter twice to submit the operation, and then Control+C to close ldapmodify. The nsAdminAccessAddresses value can use wildcards to allow ranges. For example, to allow all IP addresses: nsAdminAccessAddresses:* To allow only a subset of addresses on a local network:...
  • Page 26 Chapter 2. Admin Server Configuration of administrative tasks, such as starting, stopping, and restarting servers in a local server group. The Administration Server Administrator is created for the purpose of logging into the Console when the Directory Server is not running. The Administration Server Administrator does not have an LDAP entry;...
  • Page 27: Working With Ssl

    Working with SSL 5. Click Save. 2.8. Working with SSL The Admin Server can run over HTTPS (secure HTTP) if SSL is enabled on the server. There are steps to enabling SSL: 1. Generating and submitting a certificate request. 2. Receiving and installing the certificate. 3.
  • Page 28 Chapter 2. Admin Server Configuration 2. Create a certificate request. a. Select the Server Certs tab, and click the Request button. Click Next. b. Enter the Requester Information in the blank text fields, then click Next.
  • Page 29 Requesting and Installing a Server Certificate • Server Name. The fully qualified hostname of the Directory Server as it is used in DNS and reverse DNS lookups; for example, server.example.com. The server name is critical for client-side validation to work, which prevents man-in-the-middle attacks. IMPORTANT This must be a valid hostname that can be resolved correctly by all Admin Server clients, or TLS/SSL will not work.
  • Page 30 Chapter 2. Admin Server Configuration The Next button is grayed out until a password is supplied. 3. The Request Submission dialog box provides two ways to submit a request: directly to the CA (if there is one internally) or manually. To submit the request manually, select Copy to Clipboard or Save to File to save the certificate request which will be submitted to the CA.
  • Page 31 Requesting and Installing a Server Certificate OSUExLDAqBgVBAoTI25ldHNjYXBlIGNvbW11bmljYXRpb25zIGNvcnBvcmF 0aW9uMRwwGgYDVQQDExNtZWxsb24ubmV0c2NhcGUuY29tMIGfMA0GCSqGSI b3DQEBAQUAA4GNADCBiQKBgQCwAbskGh6SKYOgHy+UCSLnm3ok3X3u83Us7 ug0EfgSLR0f+K41eNqqRftGR83emqPLDOf0ZLTLjVGJaH4Jn4l1gG+JDf/n /zMyahxtV7+mT8GOFFigFfuxaxMjr2j7IvELlxQ4IfZgWwqCm4qQecv3G+N 9YdbjveMVXW0v4XwIDAQABoAAwDQYK ------END NEW CERTIFICATE REQUEST----- 4. Wait for the CA to respond with the server certificate; this can be as short as a few hours for an internal CA or as long as several weeks for a third-party CA. 5.
  • Page 32: Installing A Ca Certificate

    Chapter 2. Admin Server Configuration b. Select the Server Certs tab, and click Install. c. Give the absolute path to the certificate (In this file radio button) or paste the certificate text in the text box (In the following encoded text block radio button), then click Next. d.
  • Page 33 Installing a CA Certificate 2. Go to the CA Certs tab, and click Install.
  • Page 34 Chapter 2. Admin Server Configuration 3. If the CA's certificate is saved to a file, enter the path in the field provided. Alternatively, copy and paste the certificate, including the headers, into the text box. Click Next.
  • Page 35: Enabling Ssl

    Enabling SSL 4. Click Next to move through the panels that show the CA certificate information and the certificate name. 5. Select the purpose of trusting this certificate authority; it is possible to select both options: • Accepting connections from clients (Client Authentication). The server checks that the client's certificate has been issued by a trusted certificate authority.
  • Page 36 Chapter 2. Admin Server Configuration 4. Select the Enable SSL for this server checkbox. 5. Select the Use this cipher family: RSA checkbox. 6. Choose the security device where the key is stored. By default, the key is stored in the local key database, Internal (Software-based).
  • Page 37: Creating A Password File For The Admin Server

    Creating a Password File for the Admin Server 9. Set whether to require client authentication to the Admin Server. Client authentication means that the server checks that the client's certificate has been issued by a trusted CA. 10. Click Save. 2.8.4.
  • Page 38: Changing Directory Server Settings

    Chapter 2. Admin Server Configuration 1. Open the Admin Server configuration directory. cd /etc/dirsrv/admin-serv 2. Create a password file named password.conf. The file should include a line with the token name and password, in the form token:password. For example: internal:secret For the NSS software crypto module (the default software database), the token is always called internal.
  • Page 39: Changing The Configuration Directory Host Or Port

    Changing the Configuration Directory Host or Port 2.9.1. Changing the Configuration Directory Host or Port Configuration data are stored under o=NetscapeRoot in the Configuration Directory. The configuration database contains server settings such as network topology information and server instance entries. When server configuration changes are stored in the configuration directory subtree. WARNING Changing the Directory Server host name or port number impacts the rest of the servers in the server group.
  • Page 40 Chapter 2. Admin Server Configuration There can be multiple user directories in a single deployment because using multiple user directories enhances overall performance for organizations which are geographically spread out, which have high usage, or have discrete divisions which benefit from individual directories. Admin Server can be configured to authenticate users against multiple user directories.
  • Page 41 Changing the User Directory Host or Port NOTE If more than one location is given in the LDAP Host and Port field, the settings for the remaining fields will apply to all of those instances. • Check the Secure Connection box to use SSL to connect to the user directory. Only select this if the Directory Server is already configured to use SSL.
  • Page 43: Admin Express

    Chapter 3. Admin Express 3.1. Managing Servers in Admin Express Admin Express provides a quick, simple web-based gateway to do basic management of servers. There are three tasks that can be performed through Admin Express: • Stopping and starting the server •...
  • Page 44: Viewing Server Logs

    Chapter 3. Admin Express the Admin Express On/Off buttons because Admin Express requires access to both the Admin Server and Configuration Directory Server in order to function. Other Directory Server instances can be safely stopped and restarted through Admin Express. 3.1.3.
  • Page 45: Monitoring Replication From Admin Express

    Monitoring Replication from Admin Express Figure 3.3. Checking Server Information The Directory Server information is located in the /etc/dirsrv/slapd-instance_name/ dse.ldif file; the Admin Server information is located in .conf files in the /etc/dirsrv/admin- serv directory. 3.1.5. Monitoring Replication from Admin Express Admin Express has an option to monitor replication status in real-time, meaning that it shows the number of updates, times the most recent updates were sent, error and success messages, replication schedule, the replicated directory suffix, and other information.
  • Page 46 Chapter 3. Admin Express The configuration file should be readable by the Admin Server user and no other users, so consider resetting the permissions on the file: chmod 0400 filename To view in-progress status of replication in Admin Express: 1. Create a configuration file. The configuration file lists all of the servers to monitor for replication, giving their hostname, port, the bind credentials to use, and then optional settings for aliases and time lag colors.
  • Page 47 Monitoring Replication from Admin Express Figure 3.4. Viewing Replication Status 5. Click OK. The Replication Status page shows the status for sending updates to every consumer listed in the configuration file. Figure 3.5. Viewing Replication Status Table Description Table header The table header shows the replica ID of the supplier replica, the replicated suffix root (such as dc=example,dc=com), and the maximum...
  • Page 48: Configuring Admin Express

    Chapter 3. Admin Express Table Description Last Modify Time Gives the time of the last update for the consumer (the time the last CSN entry was sent). Supplier Gives the name of the supplier sending updates to that consumer; this can be useful if a consumer receives updates from multiple suppliers or there are multiple suppliers being monitored on the Replication Status page.
  • Page 49: Admin Express Configuration Files

    Admin Express Configuration Files 3.2.2. Admin Express Configuration Files The behavior for Admin Express is mostly set through the web server configuration and should not be edited. The other Admin Express configuration is set through directives which insert data or form fields.
  • Page 50 Chapter 3. Admin Express All of the formatting for the page is set inline. The text files are inserted using the INCLUDEIFEXISTS directive. <tr valign="TOP"> <td> </td> <td bgcolor="#9999cc" colspan="4"> <font color="white" size="+1"><font face="Verdana, sans-serif">Services for Administrators</font></font></td> <td> </td> </tr> <tr valign="TOP">...
  • Page 51 Admin Express Configuration Files Figure 3.8. Monitoring Replication View Page Elements The text for the table headings, labels, and page sections are set in the Perl script. For example: #Print the header of consumer print "\n<tr class=bgColor16>\n"; print "<th nowrap>Receiver</th>\n"; print "<th nowrap>Time Lag</th>\n";...
  • Page 52 Chapter 3. Admin Express print ".text8 {color: #0099cc; font-size: 11px; font-weight: bold;}\n"; print ".text28 {color: #ffcc33; font-size: 12px; font-weight: bold;}\n"; print ".areatitle {font-weight: bold; color: #ffffff; font-family: Arial, Helvetica, sans-serif}\n"; print ".page-title {font-weight: bold; font-size: larger; font-family: Arial, Helvetica, sans-serif}\n"; print ".page-subtitle {font-weight: bold;...
  • Page 53 Admin Express Configuration Files <br> <table BORDER=0 CELLSPACING=2 CELLPADDING=2 WIDTH="100%"> <!-- ID_TITLE --> <p> <!-- SHOW_DATA --> <p> <font face="PrimaSans BT, Verdana, sans-serif"><font size=-1>Additional Information:</font></font> <p> <!-- CHECK_UPGRADE --> <p> <!-- SHOW_URL --> </table> <!-- HELPBUTTON --> </body> 3.2.2.4. Files for the Server Logs Page There are two files formatting the server logs page: •...
  • Page 54: Admin Express Directives

    Chapter 3. Admin Express Figure 3.10. Log View Page Elements The page information is set through the inserted directives. The server instance name is set in the ID_TITLE directive. The log is displayed through the ACCESS_LOG directives. The form at the top is formatted with directive pairs, one which sets the descriptive text and the other inserting the field type.
  • Page 55 Admin Express Directives Directive Description Example BEGINELEM Marks the opening of form input <!-- BEGINELEM --> elements. This is always paired with ENDELEM. CHECK_UPGRADE <!-- CHECK_UPGRADE --> ELEM Inserts a text element. This has <!-- ELEM txt="Field name here: one argument, txt=, which "...
  • Page 56 Chapter 3. Admin Express Directive Description Example STRING_TO_VIEW Inserts a form field to use to set <!-- STRING_TO_VIEW --> the search string for the logs. SUBMIT Inserts a three-button set: to <!-- SUBMIT --> save or submit the form; to reset the form;...
  • Page 57: Admin Server Command-Line Tools

    Chapter 4. Admin Server Command-Line Tools Red Hat Admin Server has command-line utilities which make it easier to manage the Admin Server without having to launch the Admin Console. This chapter explains where to find and how to use the Admin Server tools. 4.1.
  • Page 58 Chapter 4. Admin Server Command-Line Tools • Creating key3.db, cert8.db, and secmod.db security databases. Security module database management is part of a process that typically involves managing key databases (key3.db files) and certificate databases (cert8.db files). The key, certificate, and PKCS #11 module management process generally begins with creating the keys and key database necessary to generate and manage certificates and the certificate database.
  • Page 59 modutil Tasks Description Allowed Options term password is equivalent to a personal identification number (PIN). -dbdir dbFolder -create Creates new secmod.db, key3.db, and cert8.db files. If any of these security databases already exist in a specified directory, the modutil tool displays an error message.
  • Page 60 Chapter 4. Admin Server Command-Line Tools Tasks Description Allowed Options library and other files, such as documentation. The JAR file uses the Netscape Server PKCS #11 JAR format. JAR Information File more information on creating JAR files. -list [moduleName] Shows basic information about the contents of the secmod.db file.
  • Page 61 modutil Option Description default provider is listed as undefined. The following mechanisms are currently available: • RSA • DSA • RC2, RC4, and RC5 • AES • DES • DH • SHA1 and SHA256 • SSL and TLS • MD2 and MD5 •...
  • Page 62 Chapter 4. Admin Server Command-Line Tools Option Description temporary folder is not specified, the current folder is used. Table 4.2. Options for modutil JAR Information File JAR (Java Archive) is a platform-independent file format that aggregates many files into one. JAR files are used by modutil to install PKCS #11 modules.
  • Page 63 modutil ForwardCompatible { IRIX:6.2:mips SUNOS:5.5.1:sparc } Platforms { Linux:2.0.32:x86 { ModuleName { "Fortezza Module" } ModuleFile { win32/fort32.dll } DefaultMechanismFlags{0x00000001 } CipherEnableFlags{ 0x00000001 } Files { win32/setup.exe { Executable RelativePath { %temp%/setup.exe } win32/setup.hlp { RelativePath { %temp%/setup.hlp } win32/setup.cab { RelativePath { %temp%/setup.cab } Linux:2.0.32:x86 { EquivalentPlatform {WINNT::x86}...
  • Page 64 Chapter 4. Admin Server Command-Line Tools Keys are case-insensitive strings that are grouped into three categories: Global Keys • Per-Platform Keys • Per-File Keys • Global Keys Global keys define the platform-specific sections of the JAR information file. There are two global keys: ForwardCompatible and Platforms.
  • Page 65 modutil ModuleName is a required key that specifies the common name for the module. This name acts as a reference to the module for Red Hat Communicator, the modutil tool, servers, or any other program that uses the Red Hat security module database. ModuleFile is a required key that names the PKCS #11 module file (.so) for this platform.
  • Page 66 Chapter 4. Admin Server Command-Line Tools run time, %root% is replaced with a folder in which files should be installed, such as the server's root folder. The %temp% folder is created at the beginning of the installation and destroyed at the end. The purpose of %temp% is to hold executable files (such as setup programs) or files that are used by these programs.
  • Page 67 modutil Examples of Using modutil Creating Database Files • Displaying Module Information • Setting a Default Provider • Enabling a Slot • Enabling FIPS Compliance • Adding a Cryptographic Module • Installing a Cryptographic Module from a JAR File • Changing the Password on a Token •...
  • Page 68 Chapter 4. Admin Server Command-Line Tools Setting a Default Provider To make a specific module the default provider for the RSA, DSA, and RC2 security mechanisms: modutil -default "Cryptographic Module" -dbdir /etc/dirsrv/admin-serv - mechanisms RSA:DSA:RC2 WARNING: Performing this operation while the browser is running could cause corruption of your security databases.
  • Page 69 modutil corruption of your security databases. If the browser is currently running, you should exit browser before continuing this operation. Type 'q <enter>' to abort, or <enter> to continue: Using database directory /etc/dirsrv/admin-serv... Module "Cryptorific Module" added to database. Installing a Cryptographic Module from a JAR File To install a module using a JAR file, first create the JAR file script.
  • Page 70 Chapter 4. Admin Server Command-Line Tools OU="www.verisign.com/repository/CPS Incorp. by Ref.,LIAB.LTD(c)9 6", OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign, OU=VeriSign Object Signing CA - Class 3 Organization, OU="VeriSign, Inc.", O=VeriSign Trust Network **ISSUER NAME**, OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign, OU=VeriSign Object Signing CA - Class 3 Organization, OU="VeriSign, Inc.", O=VeriSign Trust Network ---------------------------------------------- Do you wish to continue this installation? (y/n)
  • Page 71 Index defined, 17 administrators changing username, 17 resetting passwords, 17 authentication, 6 access log changing location and name in the command line, 11 certificates, 19 in the Console, 10 installing, 24 defined, 8 Configuration Administrator viewing in command line, 9 defined, 17 viewing in Console, 8 configuration directory...
  • Page 72 Index per-file keys, 57 restart per-platform keys, 56 Admin Server, 4 syntax, 55 sec-activate, 49 logs SSL, 19 changing location and name Admin Server password file, 29 in the command line, 11 certificates, 19 in the Console, 10 installing certificates, 24 viewing access, 8, 9 using with Admin Server, 27 viewing error, 8, 9, 9...

This manual is also suitable for:

8.1

Table of Contents