Centrify DirectControl Best Practices - Cerberis

More documents

Recommendations

Info

CENTRIFY WHITE PAPERCENTRALIZED MANAGEMENT FOR UNIX, LINUX, MAC AND JAVA WITH ACTIVE DIRECTORY AND DIRECTCONTROLDirectory. “justino” would match “justino”, not “justino.aranda” or “jaranda”.Illumi Clinics standard is that the UNIX username matches the “Pre-Windows 2000username”. These passwd and group files will later be imported using the DirectControlConsole.Justino must also then check that each user is not a member of more than 16 groups in asingle Zone. This is atypical in traditional UNIX environments as it is a historical UNIXlimitation. Additionally, no single group should have more than 120 users in any singleZone. Once again, this is a historical UNIX limitation, not a limit of DirectControl.Figure 3-2This illustrates how a user’s group membership is determined within a given Zone:• Tetsu’s user account is stored in Active Directory.• His primary GID for the current Zone is 10, which is not defined in the Zone. GID10 is defined in /etc/group, as ‘staff’.• Tetsu is a member of four Active Directory groups – Domain Users, Helpdesk,UNIX Operations, and Project X. Only two of these groups – UNIX Operations andProject X – have a UNIX profile defined in the illustrated Zone.Finally, Justino must confirm that all groups to be loaded into Active Directory do notcontain local users. This is a logical limitation of Active Directory.© CENTRIFY CORPORATION 2004-2007. ALL RIGHTS RESERVED. PAGE 14
CENTRIFY WHITE PAPERCENTRALIZED MANAGEMENT FOR UNIX, LINUX, MAC AND JAVA WITH ACTIVE DIRECTORY AND DIRECTCONTROLFigure 3-3This illustrates how a local group – ‘opsteam’ – can contain members from both ActiveDirectory and the local /etc/passwd file:• opsteam is defined in /etc/group with a GID of 140.• Users root, postgres, and adm are local users defined in /etc/passwd.• Users justino, alyssia, testsu and clyde have UNIX profiles in the current Zone.Note: this design does not apply to AIX. Please refer to the release notes for the AIXplatform to understand how AIX handles local groups and Active Directory groups.Note that this limitation only applies to DirectControl 3.x and earlier.© CENTRIFY CORPORATION 2004-2007. ALL RIGHTS RESERVED. PAGE 15
Page 1 and 2: WHITE PAPERCENTRIFY CORP.Centrify D
Page 3 and 4: CENTRIFY WHITE PAPERCENTRALIZED MAN

Centrify DirectControl Best Practices - Cerberis

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?