Caché Installation Guide - InterSystems Documentation

Preparing the Security Environment
ktpass command-line tool on the domain controller; this is available as part of the Windows
support tools from Microsoft.
The command maps the account just set up to an account on the UNIX-based or OpenVMS
machine; it also generates a key for the account. The command must specify the following
parameters:
Parameter
-princ
-mapuser
-pass
-crypto
-out
Description
The principal name (in the form cache/@).
The name of the account created (in the form cache).
The password specified during account creation.
The encryption type to use (used the default, DES-CBC-CRC, unless
specified otherwise).
The keytab file you generate to transfer to the Caché server machine
and replace or merge with your existing keytab file.
Important:
The principal name on UNIX-based and OpenVMS platforms must take the
form shown in the table with the literal cache as the first part.
Once you have generated a key file, move it to a file on the Caché server with the following
characteristics:
• On MacOS and most versions of UNIX, the pathname is
/mgr/cache.keytab. On Tru64, the pathname is /krb5/v5srvtab;
on SuSE Linux, it is /etc/krb5.keytab.
On OpenVMS, the file is cache.keytab and is located in the manager's directory.
• It is owned by the user that owns the Caché installation and the group cacheusr.
• On UNIX and MacOS, its permissions are 640; on OpenVMS, its permissions are
[S:RWD,O:RWD,G:R,W:].
C.1.3 Create Service Accounts for Non-Windows Caché Servers
with a KDC
In a non-Windows environment, you must create service principal accounts for all UNIX,
Mac OS, or OpenVMS Caché servers using a UNIX, Mac OS, or OpenVMS KDC. Once you
have an operational KDC, you need to add a service principal account for each Caché server.
Caché Installation Guide 91