opsi manual opsi version 4.0.2 - opsi Download - uib

opsi manual opsi version 4.0.2
which is readable with administrative privileges only.
The opsi-host-key is stored at the server in the used backend (e.g at /etc/opsi/pckeys).
95 / 193
In addition to this authentication, you may tell the opsiconfd to check if the client IP address matches the given
FQDN. To activate this check, set at the /etc/opsi/opsiconfd.conf:
verify ip = yes
and reload the opsiconfd:
/etc/init.d/opsiconfd reload
Caution
Do not use this feature if you are not really sure, that your name resolution works properly in both directions for
all clients.
12.6 Server authentication at the client
Since opsi 4.0.1 there are different possibilities to check the trustworthiness of the contacted server.
Caution
Do not use them in combination. Choose only one way or you will be locked out from your client.
12.6.1 Variant 1: verify_server_cert
At the first contact to a opsi-server, the client will accept the given SSL certificate and store it at
C:\opsi.org\opsiclientd\server-certs.
On any subsequent contact, the client creates a random string and uses the public key of the stored certificate to
encrypt this string (and the own access parameters). These encrypted data will be sent to the server.
The server uses the private key of its own SSL certificate to decrypt the data and sends the decrypted random string
back to the client.
Now the client checks if the correct string was sent back. If not, the communication to the server will be aborted.
You can prevent this way that somebody directs your clients to a wrong server, e.g. by manipulating the DNS. If you
setup a new server, you may migrate the SSL certificate from the old to the new server without problems. And you
must not deploy any certification authority (CA).
The disadvantage of this method is, that a man-in-the-middle attack is still possible.
This security method checks the communication between client and opsi-config-server.
Using the opsi WAN extension and as clientconfig.depot.protocol webdav, also the communication to the opsidepot-server
is checked.
Section 15.3.1
To activate this check, set at the opsiclientd.conf in the section [global] the option:
verify_server_cert = true
Run the following command at your opsi-config-server to to create this configuration entry for all clients:
opsi-admin -d method config_createBool opsiclientd.global.verify_server_cert "verify_server_cert" false