4 Setting Up Authentication Servers and Clients Using YaST #

Start YaST as root and select Network Services › Authentication Server to invoke the configuration wizard.

Configure the Global Settings of your LDAP server (you can change these settings later)—see Figure 4.1, “YaST Authentication Server Configuration”:

Figure 4.1: YaST Authentication Server Configuration #

 

1. Set LDAP to be started.

2. If the LDAP server should announce its services via SLP, check Register at an SLP Daemon.

3. Configure Firewall Settings.

4. Click Next.

Select the server type: Stand-alone server, Master server in a replication setup, or Replica (slave) server.

Select security options (TLS Settings).

It is strongly recommended to Enable TLS. For more information, see Procedure 4.2, “Editing Authentication Server Configuration”, Step 4.

Warning: Authentication Without Encryption

When using authentication without enabling transport encryption using TLS, the password will be transmitted in the clear.

Also consider using LDAP over SSL with certificates.

Confirm Basic Database Settings with entering an LDAP Administrator Password and then clicking Next—see Figure 4.2, “YaST LDAP Server—New Database”.

Figure 4.2: YaST LDAP Server—New Database #

 

In the Kerberos Authentication dialog, decide whether to enable Kerberos authentication or not (you can change these settings later)—see Figure 4.3, “YaST Kerberos Authentication”.

Figure 4.3: YaST Kerberos Authentication #

 

Choose whether Kerberos support is needed or not. If you enable it, also specify your Realm. Then confirm with Next.

1. The Advanced Configuration allows you to specify various aspects such as Maximum ticket life time or ports to use.

Finally, check the Authentication Server Configuration Summary and click Finish to exit the configuration wizard.

With Log Level Settings, configure the degree of logging activity (verbosity) of the LDAP server. From the predefined list, select or deselect logging options according to your needs. The more options are enabled, the larger your log files grow.

Configure which connection types the server should offer under Allow/Disallow Features. Choose from:

Allow/Disallow Features also lets you configure the server flags. Choose from:

To configure secure communication between client and server, proceed with TLS Settings:

1. Activate Enable TLS to enable TLS and SSL encryption of the client/server communication.

2. Either Import Certificate by specifying the exact path to its location or enable the Use Common Server Certificate. If the Use Common Server Certificate is not available, because it has not been created during installation, go for Launch CA Management Module first—for more information, see Section 18.2, “YaST Modules for CA Management”.

Select the Databases item in the left part of the dialog.

Click Add Database to add a new database.

Specify the requested data:

In the next dialog, configure replication settings.

In the next dialog, enable enforcement of password policies to provide extra security to your LDAP server:

1. Check Enable Password Policies to be able to specify a password policy.

2. Activate Hash Clear Text Passwords to have clear text passwords be hashed before they are written to the database whenever they are added or modified.

3. Disclose "Account Locked" Status provides a relevant error message for bind requests to locked accounts.

   

   Warning: Locked Accounts in Security Sensitive Environments

   Do not use the Disclose "Account Locked" Status option if your environment is sensitive to security issues, because the “Locked Account” error message provides security-sensitive information that can be exploited by a potential attacker.

4. Enter the DN of the default policy object. To use a DN other than the one suggested by YaST, enter your choice. Otherwise, accept the default settings.

Complete the database configuration by clicking Finish.

Enter the LDAP server password. In the navigation tree below Databases expand your database object and activate the Password Policy Configuration item.

Make sure Enable Password Policies is activated. Then click Edit Policy.

Configure the password change policies:

1. Determine the number of passwords stored in the password history. Saved passwords may not be reused by the user.

2. Determine if users can change their passwords and if they will need to change their passwords after a reset by the administrator. Require the old password for password changes (optional).

3. Determine whether and to what extent passwords should be subject to quality checking. Set the minimum password length that must be met before a password is valid. If you select Accept Uncheckable Passwords, users are allowed to use encrypted passwords, even though the quality checks cannot be performed. If you opt for Only Accept Checked Passwords only those passwords that pass the quality tests are accepted as valid.

Configure the password time-limit policies:

1. Determine the minimum password time-limit (the time that needs to pass between two valid password changes) and the maximum password time limit.

2. Determine the time between a password expiration warning and the actual password expiration.

3. Set the number of postponement uses of an expired password before the password expires permanently.

Configure the lockout policies:

1. Enable password locking.

2. Determine the number of bind failures that trigger a password lock.

3. Determine the duration of the password lock.

4. Determine the length of time that password failures are kept in the cache before they are purged.

Apply your password policy settings with OK.