IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

highly
secure
password,
such
as
a
randomly
generated
password,
is
preferred.
The
location
of
the
keytab
file
is
arbitrary.
Retain
this
password,
for
use
in
a
later
step
to
test
your
Kerberos
configuration
(when
testing
authentication
from
a
UNIX
machine
to
the
Active
Directory
Key
Distribution
Center).
2.
Transfer
the
keytab
file
to
the
UNIX
system.
Ensure
that
a
secure
transfer
method
is
used.
The
recommended
location
is:
/var/pdweb/keytab-instance_name/keytab_file_name
3.
For
best
security
practice,
delete
the
keytab
file
from
the
Windows
system.
4.
On
the
UNIX
system,
assign
ownership
of
the
file
to
ivmgr,
and
restrict
permissions
on
the
keytab
file
so
that
only
the
owner
can
access
it.
For
example:
#
chown
ivmgr
keytab_file
#
chgrp
ivmgr
keytab_file
#
chmod
600
keytab_file
5.
For
UNIX
servers,
repeat
the
above
steps
for
each
WebSEAL
server
instance.
Step
3:
Install
Kerberos
runtime
client
(UNIX
only)
The
WebSEAL
server
system
must
have
a
Kerberos
runtime
installed.
On
Windows
systems,
the
Kerberos
runtime
client
is
part
of
the
operating
system.
No
additional
packages
are
required.
On
UNIX
systems,
install
the
appropriate
package:
v
AIX
IBM
Network
Authentication
Service
Client.
This
client
can
be
found
in
the
AIX
expansion
pack.
v
Solaris
–
IBM
Network
Authentication
Service
Client.
This
client
is
included
on
the
Tivoli
Access
Manager
Web
Security
CD.
Use
pkgadd
to
install.
–
SUN
Kerberos
Client
SUNWkr5cl.
This
is
required
by
the
IBM
Network
Authentication
Service
Client.
This
package
is
part
of
the
SEAM
package,
and
can
be
downloaded
from
the
Sun
Web
site.
Step
4:
Configure
Kerberos
client
(UNIX
only)
The
Kerberos
client
installed
in
the
previous
step
must
be
configured.
This
requires
creation
or
modification
of
a
Kerberos
configuration
file.
On
Solaris
and
AIX
the
file
is:
/etc/krb5/krb5.conf
Complete
the
instructions
that
apply
to
your
operating
system:
AIX
Use
the
mkkrb5clnt
utility.
This
utility
creates
and
completes
/etc/krb5/krb5.conf.
1.
Run
mkkrb5clnt.
The
syntax
is:
mkkrb5clnt
-r
Active_Directory_domain
-c
Active_Directory_controller_DNS
-s
Active_Directory_controller_DNS
-d
local_DNS_domain
For
example:
mkkrb5clnt
-r
IBM.COM
-c
dc1.ibm.com
-s
dc1.ibm.com
-d
dns.com
240
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide