Centrify DirectControl Best Practices - Cerberis

CENTRIFY WHITE PAPERCENTRALIZED MANAGEMENT FOR UNIX, LINUX, MAC AND JAVA WITH ACTIVE DIRECTORY AND DIRECTCONTROL• LDAP 389/TCP/UDP• LDAP GC 3268/TCP• Kerberos Auth 88/UDP• Kerberos Change Password 464/TCP/UDP• DNS 53/TCP/UDP• SMB 445/TCP/UDPOther possible ports required:• RPC 135/TCP This is ONLY needed if you want to enable joining by nonadministrative users. This traffic is initated by the unix server to contact the activedirectory server.• SNTP (Simple network time protocol) UDP 123. DirectControl must maintaintime sync with the domain controller. You can close this port provided your externalservers can get accurate time updates.Illumi Clinics has chosen to allow members of the “UNIX Operators” Active DirectoryGroup to join computers to Active Directory, and to use Active Directory as the source ofNTP updates. Therefore, Illumi Clinics must open all of the aforementioned portsbetween the UNIX computers and the Active Directory Domain Controllers.3.8.2 Solution: changing file permissionsSome Zone designs will inherently result in changing a user’s primary UID or GID, orthe GID associated with a group. Illumi Clinics, for example, decided to reconcile UIDcollisions within a potential Zone by assigning the user or group the most common UIDor GID, and if that didn’t reconcile the collision, to assign a new UID or GID starting at50000. Each user and group must have a distinct UID and GID within a given Zone.Centrify provides a utility, ‘adfixid’, to reconcile file permissions for users and groups onindividual UNIX computers. It is a best practice to use adfixid to correct file permissionsbefore users log on to computers where their UID or GID has changed.adfixid must be installed and executed as root. As of version 3.0.2, the installation filesare included in the DirectControl installation packages for each platform.Installation:# gunzip -c centrifydc-adfixid--.tgz | ( cd / && tar xf- )By default, adfixid will preview the duplicated users and groups between the individualUNIX computer and the currently joined Zone. For example, Tetsu Ishii runs adfixid onfinserv, which is joined to Zone1:© CENTRIFY CORPORATION 2004-2007. ALL RIGHTS RESERVED. PAGE 27