opsi manual opsi version 4.0.2 - opsi Download - uib

opsi manual opsi version 4.0.2
96 / 193
Now you can activate this using the opsi-configed at the Server configuration or at the Host parameter of seleted
clients by chaning the value from false to true.
Caution
Be very careful with activating "verify_server_cert", for in case of improper configuration your clients will refuse
the connection!
12.6.2 Variant 2: verify_server_cert_by_ca
This variant works just like SSL certificates are checked in your browser.
The given SSL certificate will be accepted, if it is issued for the exact FQDN (commonName) of the server (or if the
DNS verifies that this is the FQDN matching the IP address of the server) and the certificate is issued and signed by
the uib gmbh.
Is one of these conditions not true, the communication to the server will be aborted.
This method is more secure than the first one. But you will have to buy the certificates from uib gmbh. For prizes
and conditions have a look at the prize list of uib gmbh:
http://uib.de/en/opsi_support/index.html
Any profits from selling these certificates will be invested in the maintenance of the opsi security.
To activate this security method, set at the opsiclientd.conf in the section [global] the option:
verify_server_cert_by_ca = true
Run the following command at your opsi-config-server to to create this configuration entry for all clients:
opsi-admin -d method config_createBool opsiclientd.global.verify_server_cert_by_ca "verify_server_cert_by_ca" false
Now you can activate this using the opsi-configed at the Server configuration or at the Host parameter of seleted
clients by chaning the value from false to true.
Caution
Be very careful with activating "verify_server_cert_by_ca", for in case of improper configuration your clients will
refuse the connection!
12.7 Authentication at the control server of the client
The opsiclientd provides a web service interface, which allows remote control of the opsiclientd and thus remote control
of the client.
(Section 7.3.9).
In order to access this interface authentication is required. You may authenticate as a local administrator with a not
empty password, or with an empty user name and the opsi-host-key as password.
12.8 Admin network configuration
The idea of an admin network is to ban any administrative access from the standard production network and allow
these accesses only from a special admin network.
With opsi all opsi-clients need restricted access to the opsi web service, which allows them to read and change their
own data. Administrative access with further privileges is granted to members of the unix group opsiadmin only.