docs-commits June 2010

docs-commits@lists.fedoraproject.org

11 participants
420 discussions

[deployment-guide/comm-rel: 11/13] NetConf: +imgs; +doc on Wireless connections
by dsilas 20 Jun '10

20 Jun '10

commit b9e66da9906eac475c4e6b29cbafecec5fcad7e2 Author: Douglas Silas <dhensley(a)redhat.com> Date: Sun Jun 20 23:29:50 2010 +0200 NetConf: +imgs; +doc on Wireless connections en-US/Network_Configuration.xml | 263 +++++++++++++++----- ...work_Configuration-NM-Connect_automatically.png | Bin 0 -> 19915 bytes ...iguration-NM-Wireless_Auto_Connections_List.png | Bin 0 -> 83527 bytes ...uration-NM-Wireless_authentication_required.png | Bin 0 -> 70411 bytes ..._Configuration-NM_applet-signal_strength_75.png | Bin 0 -> 2292 bytes 5 files changed, 206 insertions(+), 57 deletions(-) --- diff --git a/en-US/Network_Configuration.xml b/en-US/Network_Configuration.xml index 60fb7b6..44be9bf 100644 --- a/en-US/Network_Configuration.xml +++ b/en-US/Network_Configuration.xml @@ -73,7 +73,7 @@ NetworkManager (pid 1527) is running... <para>If you do not see the <application>NetworkManager</application> applet in the GNOME panel, and assuming that the <application>NetworkManager</application> package is installed on your system, you can start the applet by running the following command as a normal user (not root):</para> <screen>~]$ <command>nm-applet &</command> </screen> - <para>After running this command, the applet will appear in your Notification Area. You can ensure that the applet runs each time you log in by clicking <menuchoice><guimenu>System</guimenu> + <para>After running this command, the applet appears in your Notification Area. You can ensure that the applet runs each time you log in by clicking <menuchoice><guimenu>System</guimenu> <guisubmenu>Preferences</guisubmenu> <guimenuitem>Startup Applications</guimenuitem> </menuchoice> to open the <guilabel>Startup Applications Preferences</guilabel> window. Then, select the <guilabel>Startup Programs</guilabel> tab and check the box next to <application>NetworkManager</application>.</para> @@ -111,8 +111,8 @@ NetworkManager (pid 1527) is running... </mediaobject> </section> <section - id="sec-Configuring_New_Connections"> - <title>Configuring New Connections</title> + id="sec-Configuring_New_and_Editing_Existing_Connections"> + <title>Configuring New and Editing Existing Connections</title> <para>Next, right-click on the <application>NetworkManager</application> applet to open its context menu, which is the main point of entry for interacting with <application>NetworkManager</application> to configure connections.</para> <mediaobject id="mediaobj-Network_Configuration-NM-right-click_menu"> @@ -144,13 +144,39 @@ NetworkManager (pid 1527) is running... </mediaobject> </section> <section + id="sec-Connecting_to_a_Network_Automatically"> + <title>Connecting to a Network Automatically</title> + <para>For any connection type you add or configure, you can choose whether you want <application>NetworkManager</application> to try to connect to that network automatically when it is available.</para> + <procedure + id="procedure-Configuring_NetworkManager_to_Connect_to_a_Network_Automatically_When_Detected"> + <title>Configuring NetworkManager to Connect to a Network Automatically When Detected</title> + <step> + <para>Right-click on the <application>NetworkManager</application> applet icon in the Notification Area and click <guilabel>Edit Connections</guilabel>. The <guilabel>Network Connections</guilabel> window appears.</para> + </step> + <step> + <para>Select the tab for the type of network connection you want to configure.</para> + </step> + <step> + <para>Select the specific connection that you want to configure and click <guibutton>Edit</guibutton>.</para> + </step> + <step> + <para>Check <guilabel>Connect automatically</guilabel> to cause <application>NetworkManager</application> to auto-connect to the connection whenever <application>NetworkManager</application> detects that it is available. Uncheck the checkbox if you do not want <application>NetworkManager</application> to connect automatically. If the box is unchecked, you will have to select that connection manually in the <application>NetworkManager</application> applet's left-click menu to cause it to connect.</para> + </step> + </procedure> + </section> + <section id="sec-User_and_System_Connections"> <title>User and System Connections</title> <para> - <application>NetworkManager</application> allows users to modify network connections so that they are <emphasis>user connections</emphasis> or <emphasis>system connections</emphasis>. Users may or may not need root privileges to create and modify system connections; this is determined by the system-specific policy that the administrator has configured. <application>NetworkManager</application>'s default policy enables users to create and modify user connections, but requires them to have root privileges to add, modify or delete system connections.</para> - <para>User connections are so called because they are specific to the user who creates them. In contrast to system connections, whose configurations are stored under the <filename>/etc/sysconfig/networking/</filename> directory (mainly in <filename>ifcfg-<replaceable><network_type></replaceable> - </filename> interface configuration files), user connection settings are stored in GConf and the GNOME keyring, and are available only during login sessions for the user who created them. Thus, logging out of the desktop session causes user-specific connections to become unavailable. Because of this property, users may wish to configure VPN connections as user connections for security purposes.</para> - <para>System connections, on the other hand, become available at boot time and can be used without logging in to a desktop session.</para> + <application>NetworkManager</application> connections are always either <emphasis>user connections</emphasis> or <emphasis>system connections</emphasis>. Depending on the system-specific policy that the administrator has configured, users may need root privileges to create and modify system connections. <application>NetworkManager</application>'s default policy enables users to create and modify user connections, but requires them to have root privileges to add, modify or delete system connections.</para> + <para>User connections are so-called because they are specific to the user who creates them. In contrast to system connections, whose configurations are stored under the <filename>/etc/sysconfig/networking/</filename> directory (mainly in <filename>ifcfg-<replaceable><network_type></replaceable> + </filename> interface configuration files), user connection settings are stored in the GConf configuration database and the GNOME keyring, and are only available during login sessions for the user who created them. Thus, logging out of the desktop session causes user-specific connections to become unavailable.</para> + <note + id="note-Tip-Increase_security_by_making_VPN_connections_user-specific"> + <title>Tip: Increase security by making VPN connections user-specific</title> + <para>Because <application>NetworkManager</application> uses the GConf and GNOME keyring applications to store user connection settings, and because these settings are specific to your desktop session, it is highly recommended to configure your personal VPN connections as user connections. If you do so, other non-root users on the system cannot view or access these connections in any way.</para> + </note> + <para>System connections, on the other hand, become available at boot time and can be used by other users on the system without first logging in to a desktop session.</para> <para> <application>NetworkManager</application> can quickly and conveniently convert user to system connections and vice versa. Converting a user connection to a system connection causes <application>NetworkManager</application> to create the relevant interface configuration files under the <filename>/etc/sysconfig/networking/</filename> directory, and to delete the GConf settings from the user's session. Conversely, converting a system to a user-specific connection causes <application>NetworkManager</application> to remove the system-wide configuration files and create the corresponding GConf/GNOME keyring settings.</para> <mediaobject @@ -165,8 +191,28 @@ NetworkManager (pid 1527) is running... <para>The <guilabel>Available to all users</guilabel> checkbox controls whether connections are user-specific or system-wide</para> </caption> </mediaobject> - <para>When editing a connection from the <guilabel>Network Connections</guilabel> window, checking the <guilabel>Available to all users</guilabel> checkbox at the bottom of the <guilabel>Editing <replaceable>connection_name</replaceable> - </guilabel> window and clicking <guilabel>Apply</guilabel> will make it a sysem connection. Unchecking that checkbox will make it a user connection. Depending on the aforementioned policy setting, <application>NetworkManager</application> may invoke <application>PolicyKit</application> to ensure you have the appropriate privileges, in which case you will be prompted for the root password.</para> + <procedure + id="procedure-Changing_a_Connection_to_be_User-Specific_instead_of_System-Wide_or_Vice-Versa"> + <title>Changing a Connection to be User-Specific instead of System-Wide, or Vice-Versa</title> + <note + id="note-Depending_on_the_systems_policy_root_privileges_may_be_required"> + <title>Depending on the system's policy, root privileges may be required</title> + <para>As discussed, you may need root privileges on the system in order to change whether a connection is user-specific or system-wide.</para> + </note> + <step> + <para>Right-click on the <application>NetworkManager</application> applet icon in the Notification Area and click <guilabel>Edit Connections</guilabel>. The <guilabel>Network Connections</guilabel> window appears.</para> + </step> + <step> + <para>Select the tab for the type of network connection you want to configure.</para> + </step> + <step> + <para>Select the specific connection that you want to configure and click <guibutton>Edit</guibutton>.</para> + </step> + <step> + <para>Check the <guilabel>Available to all users</guilabel> checkbox to ask <application>NetworkManager</application> to make the connection a system-wide connection. Depending on system policy, you may then be prompted for the root password by the <application>PolicyKit</application> application. If so, enter the root password to finalize the change.</para> + <para>Conversely, uncheck the <guilabel>Available to all users</guilabel> checkbox to make the connection user-specific.</para> + </step> + </procedure> </section> </section> <section @@ -177,7 +223,7 @@ NetworkManager (pid 1527) is running... <title>Establishing a Wired (Ethernet) Connection</title> <para>To establish an Ethernet connection, you need a network interface card (an NIC), a network cable (usually a Cat-5 cable), and a network to connect to (usually the Internet, through a router).</para> <para>You can configure a wired connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>Wired</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref - linkend="sec-Configuring_New_Connections"/>.</para> + linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para> <mediaobject id="mediaobj-Network_Configuration-NM-Editing_Wired_Connection_1"> <imageobject> @@ -190,19 +236,31 @@ NetworkManager (pid 1527) is running... <para>Editing the newly-created Wired connection 1</para> </caption> </mediaobject> - <para> - <application>NetworkManager</application> creates a single wired connection by default on all systems. It is labeled <guilabel>System eth0</guilabel>. It is recommended not to <guibutton>Edit</guibutton> or <guibutton>Delete</guibutton> the default <guilabel>System eth0</guilabel> connection, and the functionality to do so may be disabled in &MAJOROS;. Instead, you should create a new wired connection by ensuring the <guilabel>Wired</guilabel> tab is selected and then clicking the <guibutton>Add</guibutton> button.</para> + <para>The system startup scripts create and configure a single wired connection called <guilabel>System eth0</guilabel> by default on all systems. Although you can edit <guilabel>System eth0</guilabel>, creating a new wired connection for your custom settings is recommended. You can create a new wired connection by selecting the <guilabel>Wired</guilabel> tab and clicking the <guibutton>Add</guibutton> button.</para> <note id="note-The_dialog_for_adding_and_editing_connections_is_the_same"> <title>The dialog for adding and editing connections is the same</title> <para>When you add a new connection by clicking the <guibutton>Add</guibutton> button, <application>NetworkManager</application> creates a new configuration file for that connection and then opens the same dialog that is used for editing an existing connection. There is no difference between these dialogs. In effect, you are always editing a connection; the difference only lies in whether that connection previously existed or was just created by <application>NetworkManager</application> when you clicked <guibutton>Add</guibutton>.</para> </note> -  <bridgehead id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wired">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead> - <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to most connection types: <guilabel>Connection name</guilabel>, <guilabel>Connect automatically</guilabel> and <guilabel>Available to all users</guilabel>.</para> - <para>You can customize the name under which the connection is listed in the <guilabel>Network Connections</guilabel> window by editing the <guilabel>Connection name</guilabel> text field. For example, you could create a custom wired connection for the office with different configuration settings and name it <replaceable>Office Ethernet</replaceable>. Click the <guilabel>Connect automatically</guilabel> checkbox if you want <application>NetworkManager</application> to always attempt to use the connection being edited when you have an Ethernet cable plugged into the computer. Finally, at the bottom of the dialog box, you can specify whether the connection you are configuring should be user-specific or system-wide. Refer to <xref - linkend="sec-User_and_System_Connections"/> for more information on this setting.</para> + <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para> + <itemizedlist> + <listitem> + <para> + <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>Wired</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box. For example, you could create a wired connection with custom settings for the office called <replaceable>Wired Office</replaceable>.</para> + </listitem> + <listitem> + <para> + <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref + linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para> + </listitem> + <listitem> + <para> + <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref + linkend="sec-User_and_System_Connections"/> for details.</para> + </listitem> + </itemizedlist> <bridgehead id="bh-Configuring_the_Wired_Tab">Configuring the Wired Tab</bridgehead> <para>The final two configurable settings are located within the <guilabel>Wired</guilabel> tab itself: the first is a text-entry field where you can specify a MAC (Media Access Control) address, and the second allows you to specify the MTU (Maximum Transmission Unit) value. Normally, you can leave the <guilabel>MAC address</guilabel> field blank and the <guilabel>MTU</guilabel> set to <userinput>automatic</userinput>. These defaults will suffice unless you are associating a wired connection with a second or specific NIC, or performing advanced networking. In such cases, refer to the following descriptions:</para> @@ -241,20 +299,21 @@ NetworkManager (pid 1527) is running... id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-Wired">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead> <para>Once you have finished editing your new wired connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para> - <para>At this point, you have created a new, functional wired connection. If you need to, you can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog. Then:</para> + <para>At this point, you have created a new wired connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para> + <para>Then, to configure:</para> <itemizedlist> <listitem> - <para>to configure <firstterm>port-based Network Access Control</firstterm> (PNAC), click the <guilabel>802.1x Security</guilabel> tab and proceed to <xref + <para>port-based Network Access Control (PNAC), click the <guilabel>802.1x Security</guilabel> tab and proceed to <xref linkend="sec-Configuring_802.1x_Security"/>; </para> </listitem> <listitem> - <para>to configure IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref + <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref linkend="sec-Configuring_IPv4_Settings"/>; or, </para> </listitem> <listitem> - <para>to configure IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref + <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref linkend="sec-Configuring_IPv6_Settings"/>. </para> </listitem> @@ -263,21 +322,81 @@ NetworkManager (pid 1527) is running... <section id="sec-Establishing_a_Wireless_Connection"> <title>Establishing a Wireless Connection</title> - <remark>What is a <replaceable><type></replaceable> connection</remark> - <para>To establish a wireless connection, you need:</para> + <para> + <application>NetworkManager</application> makes configuring a wireless (also known as wi-fi or 802.1<replaceable>a/b/g/n</replaceable>) connection quick and simple. To establish a wireless connection, you need:</para> <itemizedlist> <listitem> <para>a computer capable of wi-fi connectivity (such as a laptop with an integrated 802.1<replaceable>x</replaceable> card or chip);</para> </listitem> <listitem> - <para>a wireless access point to connect to (such as a wireless router);</para> + <para>a wireless access point to connect to (such as a wireless router); and,</para> </listitem> <listitem> - <para>and, depending on the security settings of the access point, an authentication secret such as a key, passphrase, or digital certificate.</para> + <para>if the access point is secured, an authentication secret such as a key, passphrase, or digital certificate.</para> </listitem> </itemizedlist> - <para>You can configure a wireless connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>Wireless</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref - linkend="sec-Configuring_New_Connections"/>.</para> + <para>To configure a mobile broadband (such as 3G) connection instead of a wireless one, refer to <xref + linkend="sec-Establishing_a_Mobile_Broadband_Connection"/>.</para> +  + <bridgehead + id="bh-Quickly_Connecting_to_an_Available_Access_Point">Quickly Connecting to an Available Access Point</bridgehead> + <para>The easiest way to connect to an available access point is to left-click on the <application>NetworkManager</application> applet, locate the SSID of the access point in the list of <guilabel>Available</guilabel> networks, and click on it. If the access point is secured, a dialog prompts you for authentication.</para> + <mediaobject + id="mediaobj-Network_Configuration-NM-Wireless_authentication_required"> + <imageobject> + <imagedata + align="center" + fileref="images/Network_Configuration-NM-Wireless_authentication_required.png" + format="PNG" /> + </imageobject> + <caption> + <para>Authenticating with a wireless access point</para> + </caption> + </mediaobject> + <para> + <application>NetworkManager</application> tries to auto-detect the type of security used by the access point. If there are multiple possibilities, <application>NetworkManager</application> guesses the security type and presents it in the <guilabel>Wireless security</guilabel> dropdown. To see if there are multiple choices, click the <guilabel>Wireless security</guilabel> dropdown menu and select the type of security the access point is using. If you are unsure, try connecting to each type in turn. Finally, enter the key or passphrase in the <guilabel>Password</guilabel> field. Certain password types, such as a 40-bit WEP or 128-bit WPA key, are invalid unless they are of a requisite length. The <guilabel>Connect</guilabel> button will remain inactive until you enter a key of the length required for the selected security type. To learn more about wireless security, refer to <xref + linkend="sec-Configuring_Wireless_Security"/>.</para> + <para>If <application>NetworkManager</application> connects to the access point succesfully, its applet icon will change into a graphical indicator of the wireless connection's signal strength.</para> + <mediaobject + id="mediaobj-Network_Configuration-NM_applet-signal_strength_75"> + <imageobject> + <imagedata + align="center" + fileref="images/Network_Configuration-NM_applet-signal_strength_75.png" + format="PNG" /> + </imageobject> + <caption> + <para>Applet icon indicating a wireless connection signal strength of 75%</para> + </caption> + </mediaobject> + <para>You can also edit the settings for one of these auto-created access point connections just as if you had <guilabel>Add</guilabel>ded it yourself. The <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window lists all of the connections you have ever tried to connect to: <application>NetworkManager</application> names each of them <computeroutput>Auto <replaceable><SSID></replaceable> + </computeroutput>, where SSID is the <firstterm>Service Set identifier</firstterm> of the access point.</para> + <mediaobject + id="mediaobj-Network_Configuration-NM-Wireless_Auto_Connections_List"> + <imageobject> + <imagedata + align="center" + fileref="images/Network_Configuration-NM-Wireless_Auto_Connections_List.png" + format="PNG" /> + </imageobject> + <caption> + <para>Previous access points that have been connected to</para> + </caption> + </mediaobject> + <bridgehead + id="bh-Connecting_to_a_Hidden_Wireless_Network">Connecting to a Hidden Wireless Network</bridgehead> + <para>All access points have a <firstterm>Service Set identifier</firstterm> (SSID) to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID, authentication method, and secrets.</para> + <para>To connect to a hidden wireless network, left-click <application>NetworkManager</application>'s applet icon and select <guilabel>Connect to Hidden Wireless Network...</guilabel> to cause a dialog to appear. If you have connected to the hidden network before, use the <guilabel>Connection</guilabel> dropdown to select it, and click <guibutton>Connect</guibutton>. If you have not, leave the <guilabel>Connection</guilabel> dropdown as <guimenuitem>New...</guimenuitem>, enter the SSID of the hidden network, select its <guilabel>Wireless security</guilabel> method, enter the correct authentication secrets, and click <guibutton>Connect</guibutton>.</para> + <para>For more information on wireless security settings, refer to <xref + linkend="sec-Configuring_Wireless_Security"/>.</para> + <bridgehead + id="bh-Editing_a_Connection_or_Creating_a_Completely_New_One">Editing a Connection, or Creating a Completely New One</bridgehead> + <para>You can edit an existing connection that you have tried or succeeded in connecting to in the past by opening the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel>, selecting the connection by name (words which follow <computeroutput>Auto</computeroutput> refer to the SSID of an access point), and clicking <guilabel>Edit</guilabel>.</para> + <para>You can create a new connection by opening the <guilabel>Network Connections</guilabel> window, selecting the <guilabel>Wireless</guilabel> tab, and clicking the <guilabel>Add</guilabel> button.</para> + <para>For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref + linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para> <mediaobject id="mediaobj-Network_Configuration-NM-Editing_Wireless_Connection_1"> <imageobject> @@ -292,41 +411,35 @@ NetworkManager (pid 1527) is running... </mediaobject> <bridgehead id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wireless">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead> - <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to most connection types: <guilabel>Connection name</guilabel>, <guilabel>Connect automatically</guilabel> and <guilabel>Available to all users</guilabel>.</para> - <para>You can customize the name under which the connection is listed in the <guilabel>Network Connections</guilabel> window by editing the <guilabel>Connection name</guilabel> text field. For example, you could create a custom wireless connection and, for its name, use a memorable combination of its SSID and physical location. Click the <guilabel>Connect automatically</guilabel> checkbox if you want <application>NetworkManager</application> to always attempt to use the connection being edited when the wireless access point is available. Finally, at the bottom of the dialog box, you can specify a user-specific or system-wide connection. Refer to <xref - linkend="sec-User_and_System_Connections"/> for more information on this setting.</para> - <bridgehead - id="bh-Configuring_the_Wireless_Tab">Configuring the Wireless Tab</bridgehead> - <remark>describe tab-specific settings here</remark> - <bridgehead - id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-wireless">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead> - <para>Once you have finished editing your new wireless connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref - linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para> - <para>At this point, you have created a new, functional wireless connection. If you need to, you can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog. Then:</para> + <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para> <itemizedlist> <listitem> - <para>to configure wireless security settings, click the <guilabel>Wireless Security</guilabel> tab and proceed to <xref - linkend="sec-Configuring_Wireless_Security"/>; - </para> + <para> + <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>Wireless</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box. By default, wireless connections are named the same as the <firstterm>SSID</firstterm> of the wireless access point. You can rename the wireless connection without affecting its ability to connect, but it is recommended to retain the SSID name.</para> </listitem> <listitem> - <para>to configure IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref - linkend="sec-Configuring_IPv4_Settings"/>; or, - </para> + <para> + <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref + linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para> </listitem> <listitem> - <para>to configure IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref - linkend="sec-Configuring_IPv6_Settings"/>. - </para> + <para> + <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref + linkend="sec-User_and_System_Connections"/> for details.</para> </listitem> </itemizedlist> + <bridgehead + id="bh-Configuring_the_Wireless_Tab">Configuring the Wireless Tab</bridgehead> + <remark>describe tab-specific settings here</remark> <variablelist> <varlistentry> <term> <guilabel>SSID</guilabel> </term> <listitem> - <para></para> + <para>All access points have a <firstterm>Service Set identifier</firstterm> to identify them. However, an access point may be configured not to broadcast its SSID, in which case it is <emphasis>hidden</emphasis>, and will not show up in <application>NetworkManager</application>'s list of <guilabel>Available</guilabel> networks. You can still connect to a wireless access point that is hiding its SSID as long as you know its SSID (and authentication secrets).</para> + <para>For information on connecting to a hidden wireless network, refer to <xref + linkend="bh-Connecting_to_a_Hidden_Wireless_Network"/>.</para> </listitem> </varlistentry> <varlistentry> @@ -365,6 +478,28 @@ NetworkManager (pid 1527) is running... </listitem> </varlistentry> </variablelist> + <bridgehead + id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-wireless">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead> + <para>Once you have finished editing the wireless connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can successfully connect to your the modified connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref + linkend="sec-Connecting_to_a_Network"/> for details on selecting and connecting to a network.</para> + <para>You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para> + <para>Then, to configure:</para> + <itemizedlist> + <listitem> + <para>security authentication for the wireless connection, click the <guilabel>Wireless Security</guilabel> tab and proceed to <xref + linkend="sec-Configuring_Wireless_Security"/>;</para> + </listitem> + <listitem> + <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv4_Settings"/>; or, + </para> + </listitem> + <listitem> + <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv6_Settings"/>. + </para> + </listitem> + </itemizedlist> </section> <section id="sec-Establishing_a_Mobile_Broadband_Connection"> @@ -372,32 +507,46 @@ NetworkManager (pid 1527) is running... <remark>What is a <replaceable><type></replaceable> connection</remark> <remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark> <para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref - linkend="sec-Interacting_with_NetworkManager"/>.</para> + linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>.</para> <remark>image editing a <replaceable><type></replaceable> connection; caption: Editing the newly-created <replaceable><type></replaceable> connection 1</remark> <bridgehead id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-tab_name">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead> - <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to most connection types: <guilabel>Connection name</guilabel>, <guilabel>Connect automatically</guilabel> and <guilabel>Available to all users</guilabel>.</para> - <para>You can customize the name under which the connection is listed in the <guilabel>Network Connections</guilabel> window by editing the <guilabel>Connection name</guilabel> text field. For example, you could create a custom <replaceable><type></replaceable> connection for the office with different configuration settings and name it <replaceable>name</replaceable>. Click the <guilabel>Connect automatically</guilabel> checkbox if you want <application>NetworkManager</application> to always attempt to use the connection being edited when <remark>you have an Ethernet cable plugged into the computer</remark>. Finally, at the bottom of the dialog box, you can specify a user-specific or system-wide connection. Refer to <xref - linkend="sec-User_and_System_Connections"/> for more information on this setting.</para> + <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to all connection types:</para> + <itemizedlist> + <listitem> + <para> + <guilabel>Connection name</guilabel> — You can customize the name under which this connection is listed in the <guilabel>tab</guilabel> tab of the <guilabel>Network Connections</guilabel> window by entering a descriptive name in the text-entry box.</para> + </listitem> + <listitem> + <para> + <guilabel>Connect automatically</guilabel> — Check this box if you want <application>NetworkManager</application> to auto-connect to the this connection when it is—or becomes—available. Refer to <xref + linkend="sec-Connecting_to_a_Network_Automatically"/> for more information.</para> + </listitem> + <listitem> + <para> + <guilabel>Available to all users</guilabel> — check this box to create a connection available to all users on the system. Changing this setting may require root privileges. Refer to <xref + linkend="sec-User_and_System_Connections"/> for details.</para> + </listitem> + </itemizedlist> <bridgehead>Configuring the <replaceable><tab></replaceable> Tab</bridgehead> <remark>describe tab-specific settings here</remark> <bridgehead id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-tab_name">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead> <para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para> - <para>At this point, you have created a new, functional <replaceable><type></replaceable> connection. If you need to, you can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog. Then:</para> + <para>At this point, you have created a new <replaceable><type></replaceable> connection. You can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog.</para> + <para>Then, to configure:</para> <itemizedlist> <listitem> - <para>to configure <remark>settings type</remark>, click the <guilabel>tab_name</guilabel> tab and proceed to <remark>xref</remark>; - </para> + <para>;</para> </listitem> <listitem> - <para>to configure IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref + <para>IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref linkend="sec-Configuring_IPv4_Settings"/>; or, </para> </listitem> <listitem> - <para>to configure IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref + <para>IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref linkend="sec-Configuring_IPv6_Settings"/>. </para> </listitem> @@ -635,7 +784,7 @@ NetworkManager (pid 1527) is running... <para>802.1x security is most often associated with securing wireless networks (WLANs), but can also be used to prevent intruders with physical access to the network (LAN) from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but but for various reasons this practice is both impractical and insecure, and thus is no longer recommended. Instead, 802.1x security is used to ensure a logically-secure network through port-based authentication.</para> <para>802.1x provides a framework for WLAN and LAN access control and serves as an envelope for carrying one of the Extensible Authentication Protocol (EAP) types. An EAP type is a protocol that defines how WLAN security is achieved on the network.</para> <para>You can configure 802.1x security for a wired or wireless connection type by opening the <guilabel>Network Connections</guilabel> window (refer to <xref - linkend="sec-Interacting_with_NetworkManager"/>) and following the applicable procedure:</para> + linkend="sec-Configuring_New_and_Editing_Existing_Connections"/>) and following the applicable procedure:</para> <procedure id="procedure-For_a_wired_connection..."> <title>For a wired connection...</title> diff --git a/en-US/images/Network_Configuration-NM-Connect_automatically.png b/en-US/images/Network_Configuration-NM-Connect_automatically.png new file mode 100644 index 0000000..7be39e5 Binary files /dev/null and b/en-US/images/Network_Configuration-NM-Connect_automatically.png differ diff --git a/en-US/images/Network_Configuration-NM-Wireless_Auto_Connections_List.png b/en-US/images/Network_Configuration-NM-Wireless_Auto_Connections_List.png new file mode 100644 index 0000000..56baee0 Binary files /dev/null and b/en-US/images/Network_Configuration-NM-Wireless_Auto_Connections_List.png differ diff --git a/en-US/images/Network_Configuration-NM-Wireless_authentication_required.png b/en-US/images/Network_Configuration-NM-Wireless_authentication_required.png new file mode 100644 index 0000000..be2b3f3 Binary files /dev/null and b/en-US/images/Network_Configuration-NM-Wireless_authentication_required.png differ diff --git a/en-US/images/Network_Configuration-NM_applet-signal_strength_75.png b/en-US/images/Network_Configuration-NM_applet-signal_strength_75.png new file mode 100644 index 0000000..2f4c41b Binary files /dev/null and b/en-US/images/Network_Configuration-NM_applet-signal_strength_75.png differ

1 0

[deployment-guide/comm-rel: 10/13] NetConfig: delete table xref'ing tabs and sections
by dsilas 20 Jun '10

20 Jun '10

commit 1fc07155a4d29b172f08a2994f3cb2cf7d350e14 Author: Douglas Silas <dhensley(a)redhat.com> Date: Sun Jun 20 17:12:56 2010 +0200 NetConfig: delete table xref'ing tabs and sections en-US/Network_Configuration.xml | 244 --------------------------------------- 1 files changed, 0 insertions(+), 244 deletions(-) --- diff --git a/en-US/Network_Configuration.xml b/en-US/Network_Configuration.xml index 1a212cf..60fb7b6 100644 --- a/en-US/Network_Configuration.xml +++ b/en-US/Network_Configuration.xml @@ -172,250 +172,6 @@ NetworkManager (pid 1527) is running... <section id="sec-Establishing_Connections"> <title>Establishing Connections</title> - <para></para> - <table - id="table-Configuration_Types_by_NetworkManager_Connection" - frame="all"> - <title>Configuration Types by NetworkManager Connection</title> - <tgroup - cols="6" - colsep="1" - rowsep="1"> - <colspec - align="right" - colnum="1" - colname="col1"/> - <colspec - align="left" - colnum="2" - colname="col2"/> - <colspec - align="left" - colname="col3" - colnum="3"/> - <colspec - align="left" - colnum="4" - colname="col4"/> - <colspec - align="left" - colnum="5" - colname="col5"/> - <colspec - align="left" - colnum="6" - colname="col6"/> - <thead> - <row> - <entry></entry> - <entry - align="center" - valign="middle">Wired</entry> - <entry - align="center" - valign="middle">Wireless</entry> - <entry - align="center" - valign="middle">Mobile Broadband</entry> - <entry - align="center" - valign="middle">VPN</entry> - <entry - align="center" - valign="middle">DSL</entry> - </row> - </thead> - <tbody> - <row> - <entry - valign="middle">Wired</entry> - <entry - valign="middle"> - <xref - linkend="sec-Establishing_a_Wired_Ethernet_Connection"/> - </entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - </row> - <row> - <entry - valign="middle">802.1x Security</entry> - <entry - valign="middle"> - <xref - linkend="sec-Configuring_802.1x_Security"/> - </entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - </row> - <row> - <entry - valign="middle">Wireless</entry> - <entry - valign="middle"></entry> - <entry - valign="middle"> - </entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - </row> - <row> - <entry - valign="middle">Wireless Security</entry> - <entry - valign="middle"></entry> - <entry - valign="middle"> - <xref - linkend="sec-Configuring_Wireless_Security"/> - </entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - </row> - <row> - <entry - valign="middle">Mobile Broadband</entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"> - </entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - </row> - <row> - <entry - valign="middle">PPP Settings</entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"> - <xref - linkend="sec-Configuring_PPP_Point-to-Point_Settings"/> - </entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - </row> - <row> - <entry - valign="middle">VPN</entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"> - </entry> - <entry - valign="middle"></entry> - </row> - <row> - <entry - valign="middle">DSL</entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"> - </entry> - </row> - <row> - <entry - valign="middle">IPv4 Settings</entry> - <entry - align="center" - nameend="col6" - namest="col2" - valign="middle"> - <xref - linkend="sec-Configuring_IPv4_Settings"/> - </entry> -  - </row> - <row> - <entry - valign="middle">IPv6 Settings</entry> - <entry - align="center" - nameend="col3" - namest="col2" - valign="middle"> - <xref - linkend="sec-Configuring_IPv6_Settings"/> - </entry> -  - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - <entry - valign="middle"></entry> - </row> - </tbody> - </tgroup> - </table> <section id="sec-Establishing_a_Wired_Ethernet_Connection"> <title>Establishing a Wired (Ethernet) Connection</title>

1 0

[deployment-guide/comm-rel: 9/13] Merge branch 'master' of git+ssh://git.engineering.redhat.com/srv/git/users/dhensley/Deployment_Guid
by dsilas 20 Jun '10

20 Jun '10

commit 8e7e774cb90e8769e3ffccd5d7b7d43acba9ece6 Merge: dc77852... a6ce117... Author: Douglas Silas <dhensley(a)redhat.com> Date: Sun Jun 20 16:48:17 2010 +0200 Merge branch 'master' of git+ssh://git.engineering.redhat.com/srv/git/users/dhensley/Deployment_Guide en-US/SSSD.xml | 33 +++++++++++++++++++++------------ 1 files changed, 21 insertions(+), 12 deletions(-) ---

1 0

[deployment-guide/comm-rel: 8/13] NetConfig: reorganize, revamp, add Wired and Wireless sections
by dsilas 20 Jun '10

20 Jun '10

commit dc77852b861aa994fdfa692069abe30bfacf6309 Author: Douglas Silas <dhensley(a)redhat.com> Date: Sun Jun 20 16:47:00 2010 +0200 NetConfig: reorganize, revamp, add Wired and Wireless sections add NM applet state images; write Wired and Wireless sections; reorganize into Establishing Connections and Configuring Connections sections en-US/Network_Configuration.xml | 847 +++++++++++++------- .../Network_Configuration-NM-All_applet_states.png | Bin 0 -> 11378 bytes ...Configuration-NM-Editing_Wired_Connection_1.png | Bin 0 -> 56373 bytes ...figuration-NM-Editing_Wireless_Connection_1.png | Bin 0 -> 76055 bytes 4 files changed, 568 insertions(+), 279 deletions(-) --- diff --git a/en-US/Network_Configuration.xml b/en-US/Network_Configuration.xml index 16a5764..1a212cf 100644 --- a/en-US/Network_Configuration.xml +++ b/en-US/Network_Configuration.xml @@ -1,27 +1,22 @@ <?xml version='1.0'?> <!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ -]> -</entry> <entry valign="middle"></entry> <entry @@ -266,7 +284,7 @@ NetworkManager (pid 1527) is running... <entry valign="middle"> <xref - linkend="sec-Configuring_the_Wireless_Security_Tab"/> + linkend="sec-Configuring_Wireless_Security"/> </entry> <entry valign="middle"></entry> @@ -284,9 +302,8 @@ NetworkManager (pid 1527) is running... valign="middle"></entry> <entry valign="middle"> - <xref - linkend="sec-Configuring_the_Mobile_Broadband_Tab"/> - </entry> + </entry> <entry valign="middle"></entry> <entry @@ -302,7 +319,7 @@ NetworkManager (pid 1527) is running... <entry valign="middle"> <xref - linkend="sec-Configuring_the_PPP_Settings_Tab"/> + linkend="sec-Configuring_PPP_Point-to-Point_Settings"/> </entry> <entry valign="middle"></entry> @@ -320,9 +337,8 @@ NetworkManager (pid 1527) is running... valign="middle"></entry> <entry valign="middle"> - <xref - linkend="sec-Configuring_the_VPN_Tab"/> - </entry> + </entry> <entry valign="middle"></entry> </row> @@ -339,9 +355,8 @@ NetworkManager (pid 1527) is running... valign="middle"></entry> <entry valign="middle"> - <xref - linkend="sec-Configuring_the_DSL_Tab"/> - </entry> + </entry> </row> <row> <entry @@ -352,7 +367,7 @@ NetworkManager (pid 1527) is running... namest="col2" valign="middle"> <xref - linkend="sec-Configuring_the_IPv4_Settings_Tab"/> + linkend="sec-Configuring_IPv4_Settings"/> </entry>  + <bridgehead + id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wired">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead> + <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to most connection types: <guilabel>Connection name</guilabel>, <guilabel>Connect automatically</guilabel> and <guilabel>Available to all users</guilabel>.</para> + <para>You can customize the name under which the connection is listed in the <guilabel>Network Connections</guilabel> window by editing the <guilabel>Connection name</guilabel> text field. For example, you could create a custom wired connection for the office with different configuration settings and name it <replaceable>Office Ethernet</replaceable>. Click the <guilabel>Connect automatically</guilabel> checkbox if you want <application>NetworkManager</application> to always attempt to use the connection being edited when you have an Ethernet cable plugged into the computer. Finally, at the bottom of the dialog box, you can specify whether the connection you are configuring should be user-specific or system-wide. Refer to <xref + linkend="sec-User_and_System_Connections"/> for more information on this setting.</para> + <bridgehead + id="bh-Configuring_the_Wired_Tab">Configuring the Wired Tab</bridgehead> + <para>The final two configurable settings are located within the <guilabel>Wired</guilabel> tab itself: the first is a text-entry field where you can specify a MAC (Media Access Control) address, and the second allows you to specify the MTU (Maximum Transmission Unit) value. Normally, you can leave the <guilabel>MAC address</guilabel> field blank and the <guilabel>MTU</guilabel> set to <userinput>automatic</userinput>. These defaults will suffice unless you are associating a wired connection with a second or specific NIC, or performing advanced networking. In such cases, refer to the following descriptions:</para> <variablelist> <varlistentry> <term> - <guilabel>Addresses</guilabel> - </term> - <listitem> - <para> - <guimenuitem>Address</guimenuitem> — </para> - <para> - <guimenuitem>Prefix</guimenuitem> — </para> - <para> - <guimenuitem>Gateway</guimenuitem> — </para> - <para> - <guimenuitem>Metric</guimenuitem> — </para> - </listitem> - </varlistentry> - <varlistentry> - <term> - <guilabel>Ignore automatically obtained routes</guilabel> + <guilabel>MAC Address</guilabel> </term> <listitem> - <para></para> + <para>Network hardware such as a Network Interface Card (NIC) has a unique MAC (Media Access Control) address that identifies it to the system. Running the <command>ip addr + </command> command will show the MAC address associated with each interface. For example, in the following <command>ip addr</command> output, the MAC address for the eth0 interface (which is <computeroutput> 52:54:00:26:9e:f1</computeroutput>) immediately follows the <computeroutput>link/ether</computeroutput> keyword:</para> + <screen>~]# <command>ip addr</command> +1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 + link/ether <emphasis>52:54:00:26:9e:f1</emphasis> brd ff:ff:ff:ff:ff:ff + inet 192.168.122.251/24 brd 192.168.122.255 scope global eth0 + inet6 fe80::5054:ff:fe26:9ef1/64 scope link + valid_lft forever preferred_lft forever</screen> + <para>A single system can have one or more NICs installed on it. The <guilabel>MAC address</guilabel> field therefore allows you to associate a specific NIC with a specific connection (or connections). As mentioned, you can determine the MAC address using the <command>ip addr</command> command, and then copy and paste that value into the <guilabel>MAC address</guilabel> text-entry field.</para> </listitem> </varlistentry> <varlistentry> <term> - <guilabel>Use this connection only for resources on its network</guilabel> + <guilabel>MTU</guilabel> </term> <listitem> - <para></para> + <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.</para> </listitem> </varlistentry> </variablelist> + <bridgehead + id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-Wired">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead> + <para>Once you have finished editing your new wired connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref + linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para> + <para>At this point, you have created a new, functional wired connection. If you need to, you can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog. Then:</para> + <itemizedlist> + <listitem> + <para>to configure <firstterm>port-based Network Access Control</firstterm> (PNAC), click the <guilabel>802.1x Security</guilabel> tab and proceed to <xref + linkend="sec-Configuring_802.1x_Security"/>; + </para> + </listitem> + <listitem> + <para>to configure IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv4_Settings"/>; or, + </para> + </listitem> + <listitem> + <para>to configure IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv6_Settings"/>. + </para> + </listitem> + </itemizedlist> </section> - </section> - <section - id="sec-Configuring_NetworkManager_Connection_Settings"> - <title>Configuring NetworkManager Connection Settings</title> <section - id="sec-Configuring_the_Wired_Tab"> - <title>Configuring the Wired Tab</title> - <para>The <guilabel>Wired</guilabel> tab contains two configurable parameters: one for the MAC (Media Access Control) address, and another for the MTU (Maximum Transmission Unit) value:</para> + id="sec-Establishing_a_Wireless_Connection"> + <title>Establishing a Wireless Connection</title> + <remark>What is a <replaceable><type></replaceable> connection</remark> + <para>To establish a wireless connection, you need:</para> + <itemizedlist> + <listitem> + <para>a computer capable of wi-fi connectivity (such as a laptop with an integrated 802.1<replaceable>x</replaceable> card or chip);</para> + </listitem> + <listitem> + <para>a wireless access point to connect to (such as a wireless router);</para> + </listitem> + <listitem> + <para>and, depending on the security settings of the access point, an authentication secret such as a key, passphrase, or digital certificate.</para> + </listitem> + </itemizedlist> + <para>You can configure a wireless connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>Wireless</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref + linkend="sec-Configuring_New_Connections"/>.</para> <mediaobject - id="mediaobj-Network_Configuration-NM-Edit_System_eth0-Wired"> + id="mediaobj-Network_Configuration-NM-Editing_Wireless_Connection_1"> <imageobject> <imagedata align="center" - fileref="images/Network_Configuration-NM-Edit_System_eth0-Wired.png" + fileref="images/Network_Configuration-NM-Editing_Wireless_Connection_1.png" format="PNG" /> </imageobject> <caption> - <para>Editing the System eth0 wired network connection</para> + <para>Editing the newly-created Wireless connection 1</para> </caption> </mediaobject> + <bridgehead + id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-wireless">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead> + <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to most connection types: <guilabel>Connection name</guilabel>, <guilabel>Connect automatically</guilabel> and <guilabel>Available to all users</guilabel>.</para> + <para>You can customize the name under which the connection is listed in the <guilabel>Network Connections</guilabel> window by editing the <guilabel>Connection name</guilabel> text field. For example, you could create a custom wireless connection and, for its name, use a memorable combination of its SSID and physical location. Click the <guilabel>Connect automatically</guilabel> checkbox if you want <application>NetworkManager</application> to always attempt to use the connection being edited when the wireless access point is available. Finally, at the bottom of the dialog box, you can specify a user-specific or system-wide connection. Refer to <xref + linkend="sec-User_and_System_Connections"/> for more information on this setting.</para> + <bridgehead + id="bh-Configuring_the_Wireless_Tab">Configuring the Wireless Tab</bridgehead> + <remark>describe tab-specific settings here</remark> + <bridgehead + id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-wireless">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead> + <para>Once you have finished editing your new wireless connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref + linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para> + <para>At this point, you have created a new, functional wireless connection. If you need to, you can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog. Then:</para> + <itemizedlist> + <listitem> + <para>to configure wireless security settings, click the <guilabel>Wireless Security</guilabel> tab and proceed to <xref + linkend="sec-Configuring_Wireless_Security"/>; + </para> + </listitem> + <listitem> + <para>to configure IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv4_Settings"/>; or, + </para> + </listitem> + <listitem> + <para>to configure IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv6_Settings"/>. + </para> + </listitem> + </itemizedlist> <variablelist> <varlistentry> <term> - <guilabel>MAC Address</guilabel> - </term> - <listitem> - <para>Network hardware such as a Network Interface Card (NIC) has a unique MAC (Media Access Control) address that identifies it to the system. Running the <command>ifconfig</command> command will show the MAC address associated with each interface: <computeroutput>HWaddr 00:1C:25:14:4A:E0</computeroutput> for example.</para> - </listitem> - </varlistentry> - <varlistentry> - <term> - <guilabel>MTU</guilabel> + <guilabel>SSID</guilabel> </term> <listitem> - <para>The MTU (Maximum Transmission Unit) value represents the size in bytes of the largest packet that the connection will use to transmit. This value defaults to <constant>1500</constant> when using IPv4, or a variable number <constant>1280</constant> or higher for IPv6, and does not generally need to be specified or changed.</para> + <para></para> </listitem> </varlistentry> - </variablelist> - </section> - <section - id="sec-Configuring_the_802.1x_Security_Tab"> - <title>Configuring the 802.1x Security Tab</title> - <para>802.1x security is most often associated with securing wireless networks, but can also be used to prevent intruders with physical access to the network from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but this practice is impractical and insecure, and thus not recommended. Instead, 802.1x security is used to ensure a logically secure network.</para> - <variablelist> <varlistentry> <term> - <guilabel>Authentication</guilabel> + <guilabel>Mode</guilabel> </term> <listitem> <para> - <guimenuitem>TLS</guimenuitem> — (Transport Layer Security)</para> - <para> - <guimenuitem>Tunneled TLS</guimenuitem> — </para> + <guimenuitem>Infrastructure</guimenuitem> — </para> <para> - <guimenuitem>Protected EAP (PEAP)</guimenuitem> — </para> + <guimenuitem>Ad-hoc</guimenuitem> — </para> </listitem> </varlistentry> <varlistentry> <term> - <guilabel>Identity</guilabel> + <guilabel>BSSID</guilabel> </term> <listitem> <para></para> @@ -542,7 +594,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>User certificate</guilabel> + <guilabel>MAC address</guilabel> </term> <listitem> <para></para> @@ -550,15 +602,54 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>CA certificate</guilabel> + <guilabel>MTU</guilabel> </term> <listitem> <para></para> </listitem> </varlistentry> + </variablelist> + </section> + <section + id="sec-Establishing_a_Mobile_Broadband_Connection"> + <title>Establishing a Mobile Broadband Connection</title> + <remark>What is a <replaceable><type></replaceable> connection</remark> + <remark>To establish a wireless connection, you need a computer capable of wi-fi connectivity, a wireless access point to connect to, and the passphrase of the access point unless it is open and unsecured.</remark> + <para>You can configure a <replaceable><type></replaceable> connection by opening the <guilabel>Network Connections</guilabel> window and selecting the <guilabel>tab</guilabel> tab. For more information on opening the <guilabel>Network Connections</guilabel> window via <application>NetworkManager</application>'s Notification Area applet, or by running a shell command, refer to <xref + linkend="sec-Interacting_with_NetworkManager"/>.</para> + <remark>image editing a <replaceable><type></replaceable> connection; caption: Editing the newly-created <replaceable><type></replaceable> connection 1</remark> + <bridgehead + id="bh-Configuring_the_Connection_Name_Auto-Connect_Behavior_and_Availability_Settings-tab_name">Configuring the Connection Name, Auto-Connect Behavior, and Availability Settings</bridgehead> + <para>Three settings in the <guilabel>Editing</guilabel> dialog are common to most connection types: <guilabel>Connection name</guilabel>, <guilabel>Connect automatically</guilabel> and <guilabel>Available to all users</guilabel>.</para> + <para>You can customize the name under which the connection is listed in the <guilabel>Network Connections</guilabel> window by editing the <guilabel>Connection name</guilabel> text field. For example, you could create a custom <replaceable><type></replaceable> connection for the office with different configuration settings and name it <replaceable>name</replaceable>. Click the <guilabel>Connect automatically</guilabel> checkbox if you want <application>NetworkManager</application> to always attempt to use the connection being edited when <remark>you have an Ethernet cable plugged into the computer</remark>. Finally, at the bottom of the dialog box, you can specify a user-specific or system-wide connection. Refer to <xref + linkend="sec-User_and_System_Connections"/> for more information on this setting.</para> + <bridgehead>Configuring the <replaceable><tab></replaceable> Tab</bridgehead> + <remark>describe tab-specific settings here</remark> + <bridgehead + id="bh-Saving_Your_New_or_Modified_Connection_and_Making_Further_Configurations-tab_name">Saving Your New (or Modified) Connection and Making Further Configurations</bridgehead> + <para>Once you have finished editing your new <replaceable><type></replaceable> connection, click the <guibutton>Apply</guibutton> button and <application>NetworkManager</application> will immediately save your customized configuration. Given a correct configuration, you can connect to your new or customized connection by selecting it from the <application>NetworkManager</application> Notification Area applet. See <xref + linkend="sec-Connecting_to_a_Network"/> for information on using your new or altered connection.</para> + <para>At this point, you have created a new, functional <replaceable><type></replaceable> connection. If you need to, you can further configure your connection by selecting it in the <guilabel>Network Connections</guilabel> window and clicking <guilabel>Edit</guilabel> to return to the <guilabel>Editing</guilabel> dialog. Then:</para> + <itemizedlist> + <listitem> + <para>to configure <remark>settings type</remark>, click the <guilabel>tab_name</guilabel> tab and proceed to <remark>xref</remark>; + </para> + </listitem> + <listitem> + <para>to configure IPv4 settings for the connection, click the <guilabel>IPv4 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv4_Settings"/>; or, + </para> + </listitem> + <listitem> + <para>to configure IPv6 settings for the connection, click the <guilabel>IPv6 Settings</guilabel> tab and proceed to <xref + linkend="sec-Configuring_IPv6_Settings"/>. + </para> + </listitem> + </itemizedlist> + <variablelist> <varlistentry> <term> - <guilabel>Private key</guilabel> + <guilabel>Number</guilabel> </term> <listitem> <para></para> @@ -566,22 +657,15 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Private key password</guilabel> + <guilabel>Username</guilabel> </term> <listitem> <para></para> </listitem> </varlistentry> - </variablelist> - </section> - <section - id="sec-Configuring_the_Wireless_Tab"> - <title>Configuring the Wireless Tab</title> - <para></para> - <variablelist> <varlistentry> <term> - <guilabel>SSID</guilabel> + <guilabel>Password</guilabel> </term> <listitem> <para></para> @@ -589,18 +673,15 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Mode</guilabel> + <guilabel>APN</guilabel> </term> <listitem> - <para> - <guimenuitem>Infrastructure</guimenuitem> — </para> - <para> - <guimenuitem>Ad-hoc</guimenuitem> — </para> + <para></para> </listitem> </varlistentry> <varlistentry> <term> - <guilabel>BSSID</guilabel> + <guilabel>Network ID</guilabel> </term> <listitem> <para></para> @@ -608,7 +689,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>MAC address</guilabel> + <guilabel>Type</guilabel> </term> <listitem> <para></para> @@ -616,7 +697,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>MTU</guilabel> + <guilabel>PIN</guilabel> </term> <listitem> <para></para> @@ -625,47 +706,21 @@ NetworkManager (pid 1527) is running... </variablelist> </section> <section - id="sec-Configuring_the_Wireless_Security_Tab"> - <title>Configuring the Wireless Security Tab</title> + id="sec-Establishing_a_VPN_Connection"> + <title>Establishing a VPN Connection</title> <para></para> <variablelist> <varlistentry> <term> - <guilabel>Security</guilabel> + <guilabel>Gateway</guilabel> </term> <listitem> - <para> - <guimenuitem>None</guimenuitem> — </para> - <para> - <guimenuitem>WEP 40/128-bit Key</guimenuitem> — </para> - <para> - <guimenuitem>WEP 128-bit Passphrase</guimenuitem> — </para> - <para> - <guimenuitem>LEAP</guimenuitem> — </para> - <para> - <guimenuitem>Dynamic WEP (802.1x)</guimenuitem> — </para> - <para> - <guimenuitem>WPA & WPA2 Personal</guimenuitem> — </para> - <para> - <guimenuitem>WPA & WPA2 Enterprise</guimenuitem> — </para> - </listitem> - </varlistentry> - <varlistentry> - <term>Password</term> - <listitem> <para></para> </listitem> </varlistentry> - </variablelist> - </section> - <section - id="sec-Configuring_the_Mobile_Broadband_Tab"> - <title>Configuring the Mobile Broadband Tab</title> - <para></para> - <variablelist> <varlistentry> <term> - <guilabel>Number</guilabel> + <guilabel>Group name</guilabel> </term> <listitem> <para></para> @@ -673,7 +728,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Username</guilabel> + <guilabel>User password</guilabel> </term> <listitem> <para></para> @@ -681,7 +736,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Password</guilabel> + <guilabel>Group password</guilabel> </term> <listitem> <para></para> @@ -689,7 +744,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>APN</guilabel> + <guilabel>User name</guilabel> </term> <listitem> <para></para> @@ -697,7 +752,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Network ID</guilabel> + <guilabel>Domain</guilabel> </term> <listitem> <para></para> @@ -705,30 +760,42 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Type</guilabel> + <guilabel>Encryption Method</guilabel> </term> <listitem> - <para></para> + <para> + <guimenuitem>Secure (default)</guimenuitem> — </para> + <para> + <guimenuitem>Weak (use with caution)</guimenuitem> — </para> + <para> + <guimenuitem>None (completely insecure)</guimenuitem> — </para> </listitem> </varlistentry> <varlistentry> <term> - <guilabel>PIN</guilabel> + <guilabel>NAT traversal</guilabel> </term> <listitem> - <para></para> + <para> + <guimenuitem>Cisco UDP (default)</guimenuitem> — </para> + <para> + <guimenuitem>NAT-T</guimenuitem> — </para> + <para> + <guimenuitem>Disabled</guimenuitem> — </para> + <para> + <guilabel>Disable Dead Peer Detection</guilabel> — </para> </listitem> </varlistentry> </variablelist> </section> <section - id="sec-Configuring_the_PPP_Settings_Tab"> - <title>Configuring the PPP Settings Tab</title> + id="sec-Establishing_a_DSL_Connection"> + <title>Establishing a DSL Connection</title> <para></para> <variablelist> <varlistentry> <term> - <guilabel>Configure Methods</guilabel> + <guilabel>Username</guilabel> </term> <listitem> <para></para> @@ -736,7 +803,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Use point-to-point encryption (MPPE)</guilabel> + <guilabel>Service</guilabel> </term> <listitem> <para></para> @@ -744,23 +811,48 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Allow BSD data compression</guilabel> + <guilabel>Password</guilabel> </term> <listitem> <para></para> </listitem> </varlistentry> + </variablelist> + </section> + <section + id="sec-Establishing_Routes"> + <title>Establishing Routes</title> + <mediaobject + id="mediaobj-Network_Configuration-NM-System_eth0-Routes"> + <imageobject> + <imagedata + align="center" + fileref="images/Network_Configuration-NM-System_eth0-Routes.png" + format="PNG" /> + </imageobject> + <caption> + <para>Configuring static network routes</para> + </caption> + </mediaobject> + <variablelist> <varlistentry> <term> - <guilabel>Allow Deflate data compression</guilabel> + <guilabel>Addresses</guilabel> </term> <listitem> - <para></para> + <para> + <guimenuitem>Address</guimenuitem> — </para> + <para> + <guimenuitem>Prefix</guimenuitem> — </para> + <para> + <guimenuitem>Gateway</guimenuitem> — </para> + <para> + <guimenuitem>Metric</guimenuitem> — </para> </listitem> </varlistentry> <varlistentry> <term> - <guilabel>Use TCP header compression</guilabel> + <guilabel>Ignore automatically obtained routes</guilabel> </term> <listitem> <para></para> @@ -768,7 +860,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Send PPP echo packets</guilabel> + <guilabel>Use this connection only for resources on its network</guilabel> </term> <listitem> <para></para> @@ -776,38 +868,269 @@ NetworkManager (pid 1527) is running... </varlistentry> </variablelist> </section> + </section> + <section + id="sec-Configuring_Connection_Settings"> + <title>Configuring Connection Settings</title> <section - id="sec-Configuring_the_VPN_Tab"> - <title>Configuring the VPN Tab</title> - <para></para> - <variablelist> + id="sec-Configuring_802.1x_Security"> + <title>Configuring 802.1x Security</title> + <para>802.1x security is the name of the IEEE standard for port-based Network Access Control (PNAC). Simply put, 802.1x security is a way of defining a <firstterm>logical network</firstterm> out of a physical one. All clients who want to join the logical network must authenticate with the server (a router, for example) using the correct 802.1x authentication method.</para> + <para>802.1x security is most often associated with securing wireless networks (WLANs), but can also be used to prevent intruders with physical access to the network (LAN) from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but but for various reasons this practice is both impractical and insecure, and thus is no longer recommended. Instead, 802.1x security is used to ensure a logically-secure network through port-based authentication.</para> + <para>802.1x provides a framework for WLAN and LAN access control and serves as an envelope for carrying one of the Extensible Authentication Protocol (EAP) types. An EAP type is a protocol that defines how WLAN security is achieved on the network.</para> + <para>You can configure 802.1x security for a wired or wireless connection type by opening the <guilabel>Network Connections</guilabel> window (refer to <xref + linkend="sec-Interacting_with_NetworkManager"/>) and following the applicable procedure:</para> + <procedure + id="procedure-For_a_wired_connection..."> + <title>For a wired connection...</title> + <step> + <para>Select the <guilabel>Wired</guilabel> tab.</para> + </step> + <step> + <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para> + </step> + <step> + <para>Then select the <guilabel>802.1x Security</guilabel> tab and check the <guilabel>Use 802.1x security for this connection</guilabel> checkbox to enable settings configuration.</para> + </step> + <step> + <para>Proceed to </para> + </step> + </procedure> + <procedure + id="procedure-For_a_wireless_connection..."> + <title>For a wireless connection...</title> + <step> + <para>Select the <guilabel>Wireless</guilabel> tab.</para> + </step> + <step> + <para>Either click on <guibutton>Add</guibutton> to add a new network connection for which you want to configure 802.1x security, or select an existing connection and click <guibutton>Edit</guibutton>.</para> + </step> + <step> + <para>Then click the <guilabel>Security</guilabel> dropdown and choose one of the following security methods: <guimenuitem>LEAP</guimenuitem>, <guimenuitem>Dynamic WEP (802.1x)</guimenuitem>, or <guimenuitem>WPA & WPA2 Enterprise</guimenuitem>.</para> + </step> + <step> + <para>Refer to for descriptions of which EAP types correspond to your selection in the <guilabel>Security</guilabel> dropdown.</para> + </step> + </procedure> + + <section + id="sec-Configuring_TLS_Transport_Level_Security_Settings"> + <title>Configuring TLS (Transport Level Security) Settings</title> + <para>With Transport Level Security, the client and server mutually authenticate using the TLS protocol. The server demonstrates that it holds a digital certificate, the client proves its own identity using its client-side certificate, and key information is exchanged. Once authentication is complete, the TLS tunnel is no longer used. Instead, the client and server use the exchanged keys to encrypt data using AES, TKIP or WEP.</para> + <para>The fact that certificates must be distributed to all clients who want to authenticate means that the the EAP-TLS authentication method is very strong, but also more complicated to set up. Using TLS security requires the overhead of a public key infrastructure (PKI) to manage certificates. The benefit to TLS security is that a compromised password does not allow access to the (W)LAN: an intruder must also have access to the authenticating client's private key.</para> + <variablelist> + <varlistentry> + <term> + <guilabel>Identity</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>User certificate</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>CA certificate</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Private key</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Private key password</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + </variablelist> + </section> + <section + id="sec-Configuring_Tunneled_TLS_Settings"> + <title>Configuring Tunneled TLS Settings</title> + <para></para> + <remark>Which version of TTLS does NM use? v0 or v1?</remark> + <variablelist> + <varlistentry> + <term> + <guilabel>Anonymous identity</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>CA certificate</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Inner authentication</guilabel> + </term> + <listitem> + <para> + <guimenuitem>PAP</guimenuitem> — </para> + <para> + <guimenuitem>MSCHAP</guimenuitem> — </para> + <para> + <guimenuitem>MSCHAPv2</guimenuitem> — </para> + <para> + <guimenuitem>CHAP</guimenuitem> — </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Username</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Password</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + </variablelist> + </section> + <section + id="sec-Configuring_Protected_EAP_PEAP_Settings"> + <title>Configuring Protected EAP (PEAP) Settings</title> + <variablelist> + <varlistentry> + <term> + <guilabel>Anonymous Identity</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>CA certificate</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>PEAP version</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Inner authentication</guilabel> + </term> + <listitem> + <para> + <guimenuitem>MSCHAPv2</guimenuitem> — </para> + <para> + <guimenuitem>MD5</guimenuitem> — </para> + <para> + <guimenuitem>GTC</guimenuitem> — </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Username</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <guilabel>Password</guilabel> + </term> + <listitem> + <para></para> + </listitem> + </varlistentry> + </variablelist> + </section> + </section> + <section + id="sec-Configuring_Wireless_Security"> + <title>Configuring Wireless Security</title> + <variablelist> <varlistentry> <term> - <guilabel>Group name</guilabel> + <guilabel>Security</guilabel> </term> <listitem> - <para></para> + <para> + <guimenuitem>None</guimenuitem> — </para> + <para> + <guimenuitem>WEP 40/128-bit Key</guimenuitem> — </para> + <para> + <guimenuitem>WEP 128-bit Passphrase</guimenuitem> — </para> + <para> + <guimenuitem>LEAP</guimenuitem> — </para> + <para> + <guimenuitem>Dynamic WEP (802.1x)</guimenuitem> — </para> + <para> + <guimenuitem>WPA & WPA2 Personal</guimenuitem> — </para> + <para> + <guimenuitem>WPA & WPA2 Enterprise</guimenuitem> — </para> </listitem> </varlistentry> <varlistentry> - <term> - <guilabel>User password</guilabel> - </term> + <term>Password</term> <listitem> <para></para> </listitem> </varlistentry> + </variablelist> + </section> + <section + id="sec-Configuring_PPP_Point-to-Point_Settings"> + <title>Configuring PPP (Point-to-Point) Settings</title> + <para></para> + <variablelist> <varlistentry> <term> - <guilabel>Group password</guilabel> + <guilabel>Configure Methods</guilabel> </term> <listitem> <para></para> @@ -815,7 +1138,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>User name</guilabel> + <guilabel>Use point-to-point encryption (MPPE)</guilabel> </term> <listitem> <para></para> @@ -823,7 +1146,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Domain</guilabel> + <guilabel>Allow BSD data compression</guilabel> </term> <listitem> <para></para> @@ -831,42 +1154,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Encryption Method</guilabel> - </term> - <listitem> - <para> - <guimenuitem>Secure (default)</guimenuitem> — </para> - <para> - <guimenuitem>Weak (use with caution)</guimenuitem> — </para> - <para> - <guimenuitem>None (completely insecure)</guimenuitem> — </para> - </listitem> - </varlistentry> - <varlistentry> - <term> - <guilabel>NAT traversal</guilabel> - </term> - <listitem> - <para> - <guimenuitem>Cisco UDP (default)</guimenuitem> — </para> - <para> - <guimenuitem>NAT-T</guimenuitem> — </para> - <para> - <guimenuitem>Disabled</guimenuitem> — </para> - <para> - <guilabel>Disable Dead Peer Detection</guilabel> — </para> - </listitem> - </varlistentry> - </variablelist> - </section> - <section - id="sec-Configuring_the_DSL_Tab"> - <title>Configuring the DSL Tab</title> - <para></para> - <variablelist> - <varlistentry> - <term> - <guilabel>Username</guilabel> + <guilabel>Allow Deflate data compression</guilabel> </term> <listitem> <para></para> @@ -874,7 +1162,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Service</guilabel> + <guilabel>Use TCP header compression</guilabel> </term> <listitem> <para></para> @@ -882,7 +1170,7 @@ NetworkManager (pid 1527) is running... </varlistentry> <varlistentry> <term> - <guilabel>Password</guilabel> + <guilabel>Send PPP echo packets</guilabel> </term> <listitem> <para></para> @@ -891,8 +1179,8 @@ NetworkManager (pid 1527) is running... </variablelist> </section> <section - id="sec-Configuring_the_IPv4_Settings_Tab"> - <title>Configuring the IPv4 Settings Tab</title> + id="sec-Configuring_IPv4_Settings"> + <title>Configuring IPv4 Settings</title> <mediaobject id="mediaobj-Network_Configuration-NM-IPv4_Settings"> <imageobject> @@ -965,8 +1253,8 @@ NetworkManager (pid 1527) is running... </variablelist> </section> <section - id="sec-Configuring_the_IPv6_Settings_Tab"> - <title>Configuring the IPv6 Settings Tab</title> + id="sec-Configuring_IPv6_Settings"> + <title>Configuring IPv6 Settings</title> <variablelist> <varlistentry> <term> @@ -1006,8 +1294,9 @@ NetworkManager (pid 1527) is running... <section id="sec-NetworkManager_Architecture"> <title>NetworkManager Architecture</title> - <para>silas: incorporate relevant material in not too much detail from: <ulink - url="http://live.gnome.org/NetworkManagerConfiguration">wiki</ulink>.</para> + <para>See <ulink + url="http://live.gnome.org/NetworkManagerConfiguration"/> + </para> </section> </chapter> <!--<section diff --git a/en-US/images/Network_Configuration-NM-All_applet_states.png b/en-US/images/Network_Configuration-NM-All_applet_states.png new file mode 100644 index 0000000..e5c7782 Binary files /dev/null and b/en-US/images/Network_Configuration-NM-All_applet_states.png differ diff --git a/en-US/images/Network_Configuration-NM-Editing_Wired_Connection_1.png b/en-US/images/Network_Configuration-NM-Editing_Wired_Connection_1.png new file mode 100644 index 0000000..60dee58 Binary files /dev/null and b/en-US/images/Network_Configuration-NM-Editing_Wired_Connection_1.png differ diff --git a/en-US/images/Network_Configuration-NM-Editing_Wireless_Connection_1.png b/en-US/images/Network_Configuration-NM-Editing_Wireless_Connection_1.png new file mode 100644 index 0000000..d26d73a Binary files /dev/null and b/en-US/images/Network_Configuration-NM-Editing_Wireless_Connection_1.png differ

1 0

[deployment-guide/comm-rel: 7/13] [Bug 590513] SSSD default min_uid not compatible with older defaults
by dsilas 20 Jun '10

20 Jun '10

commit a6ce1179d1f09ce1f945cb95ddccedfe5853bd58 Author: David O'Brien <davido(a)redhat.com> Date: Fri Jun 18 13:14:20 2010 +1000 [Bug 590513] SSSD default min_uid not compatible with older defaults en-US/SSSD.xml | 33 +++++++++++++++++++++------------ 1 files changed, 21 insertions(+), 12 deletions(-) --- diff --git a/en-US/SSSD.xml b/en-US/SSSD.xml index 8aa89b9..05e73fb 100644 --- a/en-US/SSSD.xml +++ b/en-US/SSSD.xml @@ -559,7 +559,7 @@ krb5_realm = EXAMPLE.COM</screen> <para>If <option>min_id</option> is unspecified, it defaults to <literal>1</literal> for any back end. This default was chosen to provide compatibility with existing systems and to ease any migration attempts. LDAP administrators should be aware that granting identities in this range may conflict with users in the local <filename>/etc/passwd</filename> file. To avoid these conflicts, <option>min_id</option> should be set to <literal>1000</literal> or higher wherever possible. </para> <para> - This restriction applies to both UIDs and GIDs. + The <option>min_id</option> option determines the minimum acceptable value for both UID and GID numbers. Accounts with either UID or GID values below the <option>min_id</option> value are filtered out and not made available on the client. </para> </important> </listitem> @@ -683,7 +683,7 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh </para> </section> -  + </section> - </section> <!-- <section @@ -740,12 +738,16 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh <secondary>Configuring a Native LDAP Domain for</secondary> </indexterm> - <para>A native LDAP domain is one where the <option>id_provider</option> option is set to <literal>ldap</literal> (<option>id_provider = ldap</option>). Such a domain requires a running LDAP server against which to authenticate. The client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file.</para> - <para>SSSD does not support authentication over an unencrypted channel. Consequently, if you want to authenticate against an LDAP server, <systemitem class="protocol">TLS/SSL</systemitem> is required. If the LDAP server is used only as an identity provider, an encrypted channel is not needed.</para> - <formalpara id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-How_to_Authenticate_Against_a_Native_LDAP_Domain"> - <title>How to Authenticate Against a Native LDAP Domain</title> - <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para> - </formalpara> + <para> + A native LDAP domain is one where the <option>id_provider</option> option is set to <literal>ldap</literal> (<option>id_provider = ldap</option>). Such a domain requires a running LDAP server against which to authenticate. This can be an open source LDAP server such as OpenLDAP or Microsoft Active Directory. SSSD currently supports Microsoft Active Directory 2003 (+Services For UNIX) and Active Directory 2008. In all cases, the client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file. + </para> + <para> + SSSD does not support authentication over an unencrypted channel. Consequently, if you want to authenticate against an LDAP server, <systemitem class="protocol">TLS/SSL</systemitem> is required. If the LDAP server is used only as an identity provider, an encrypted channel is not needed. + </para> + <formalpara id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-How_to_Authenticate_Against_a_Native_LDAP_Domain"> + <title>How to Authenticate Against a Native LDAP Domain</title> + <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para> + </formalpara> <screen># A native LDAP domain [domain/LDAP] @@ -763,6 +765,13 @@ tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt </screen> + <formalpara><title>How to Authenticate Against a Microsoft Active Directory LDAP Domain</title> + <indexterm> + <primary>SSSD</primary> + <secondary>Authenticating against Microsoft Active Directory</secondary> + </indexterm> + <para>dummy text</para> + </formalpara> <formalpara> <title>Selecting an LDAP Schema</title>

1 0

[deployment-guide/comm-rel: 6/13] BZ590513 & BZ600446
by dsilas 20 Jun '10

20 Jun '10

commit 05ab6aa29fca53ed042b72bbbe55b7fddd74dad6 Author: David O'Brien <davido(a)redhat.com> Date: Thu Jun 17 13:50:40 2010 +1000 BZ590513 & BZ600446 en-US/SSSD.xml | 106 +++++++++++++++++++++++++++++++++++++++++++++---------- 1 files changed, 86 insertions(+), 20 deletions(-) --- diff --git a/en-US/SSSD.xml b/en-US/SSSD.xml index 8496191..8aa89b9 100644 --- a/en-US/SSSD.xml +++ b/en-US/SSSD.xml @@ -4,11 +4,24 @@ <section id="chap-SSSD_User_Guide-Introduction"> <title>The System Security Services Daemon (SSSD)</title> - <para>This chapter describes how to install and configure the System Security Services Daemon (SSSD), and how to use the features that it provides. It also provides information on the types of services that it supports and how to configure them, and introduces and describes the most important configuration options. Sample configuration files are also provided to help you optimize your deployment.</para> + + <para> + This chapter provides an introduction to the <firstterm>System Security Services Daemon (SSSD)</firstterm>, the main features that it provides, and discusses the requirements and any limitations of a typical SSSD deployment. + </para> + <para> + This chapter also describes how to install and configure SSSD, and how to use the features that it provides. It provides information on the types of services that it supports and how to configure them, and introduces and describes the most important configuration options. Sample configuration files are also provided to help you optimize your deployment. + </para> <section id="sect-SSSD_User_Guide-Introduction-What_is_SSSD"> <title>What is SSSD?</title> - <para>The System Security Services Daemon (SSSD) is a service which provides access to different identity and authentication providers. You can configure SSSD to use  an LDAP identity provider with LDAP authentication, or an LDAP identity provider with Kerberos authentication. SSSD is also extensible; you can configure it to use new identity sources and authentication mechanisms should they arise.</para> + <para> + The System Security Services Daemon (SSSD) is a service which provides access to different identity and authentication providers. You can configure SSSD to use a native LDAP domain (that is, an LDAP identity provider with LDAP authentication), or an LDAP identity provider with Kerberos authentication. It provides an NSS and PAM interface to the system, a pluggable back-end system to connect to multiple different account sources, as well as a D-Bus interface. + </para> + <para> + SSSD is also extensible; you can configure it to use new identity sources and authentication mechanisms should they arise. + </para> + +  </section> <section id="sect-SSSD_User_Guide-Introduction-SSSD_Features"> @@ -205,7 +218,7 @@ <section id="sect-SSSD_User_Guide-Setting_Up_SSSD-Configuring_SSSD"> <title>Configuring SSSD</title> - <para>The global configuration of SSSD is stored in the <filename>/etc/sssd/sssd.conf</filename> file. This file consists of various sections, each of which contains a number of key/value pairs. Some keys accept multiple values; use commas to separate multiple values for such keys. This configuration file uses data types of <type>string</type>, <type>integer</type> and <type>Boolean</type> (with values of <literal>TRUE</literal> or <literal>FALSE</literal>). Comments are indicated by either a hash sign (#) or a semicolon (;) in the first column. The following example illustrates some of this syntax:</para> + <para>The global configuration of SSSD is stored in the <filename>/etc/sssd/sssd.conf</filename> file. This file consists of various sections, each of which contains a number of key/value pairs. Some keys accept multiple values; use commas to separate multiple values for such keys. This configuration file uses data types of <type>string</type> (no quotes required), <type>integer</type> and <type>Boolean</type> (with values of <literal>TRUE</literal> or <literal>FALSE</literal>). Comments are indicated by either a hash sign (#) or a semicolon (;) in the first column. The following example illustrates some of this syntax:</para> <programlisting>[section] # Keys with single values @@ -294,7 +307,7 @@ session optional pam_console.so <secondary>configuring in SSSD</secondary> </indexterm> - <para>SSSD provides a rudimentary access control mechanism based on the implementation of access or deny lists of usernames. This mechanism is known as the <firstterm>Simple Access Provider</firstterm>, and is configured in the <literal>[domain/<<replaceable>NAME</replaceable>>]</literal> sections of the <filename>/etc/sssd/sssd.conf</filename> file. To enable the Simple Access Provider, you need to set the <parameter>access_provider</parameter> parameter to <literal>simple</literal>, and then add usernames as a comma-separated list to either the <parameter>simple_allow_users</parameter> or <parameter>simple_deny_users</parameter> parameters.</para> + <para>SSSD provides a rudimentary access control mechanism based on the implementation of access or deny lists of usernames. This mechanism is known as the <firstterm>Simple Access Provider</firstterm>, and is configured in the <literal>[domain/<<replaceable>NAME</replaceable>>]</literal> sections of the <filename>/etc/sssd/sssd.conf</filename> file. To enable the Simple Access Provider, you need to set the <option>access_provider</option> option to <literal>simple</literal>, and then add usernames as a comma-separated list to either the <option>simple_allow_users</option> or <option>simple_deny_users</option> options.</para> <formalpara> <title>Using the Simple Access Provider</title> @@ -303,7 +316,7 @@ session optional pam_console.so </para> </formalpara> <para> - The Simple Access Provider is also useful if you have two domains configured that have some overlapping users. In this scenario, you can specify <parameter>simple_deny_users</parameter> in one domain for a set of users, thereby guaranteeing that those users will be handled by the other domain. + The Simple Access Provider is also useful if you have two domains configured that have some overlapping users. In this scenario, you can specify <option>simple_deny_users</option> in one domain for a set of users, thereby guaranteeing that those users will be handled by the other domain. </para> <para> @@ -320,13 +333,30 @@ simple_allow_users = user1, user2</screen> <primary>Access Control</primary> <secondary>in SSSD, rules</secondary> </indexterm> + <para>The Simple Access Provider adheres to three simple rules to determine which users should or should not be granted access, as follows: <itemizedlist> - <listitem><para>If both lists are empty, access is granted</para></listitem> - <listitem><para>If <parameter>simple_allow_users</parameter> is set, only users from this list are allowed access. This setting supersedes the <parameter>simple_deny_users</parameter> list (which would be redundant).</para></listitem> - <listitem><para>If the <parameter>simple_allow_users</parameter> list is empty, users are allowed access unless they appear in the <parameter>simple_deny_users</parameter> list.</para></listitem> + <listitem> + <para> + If both lists are empty, access is granted. + </para> + </listitem> + <listitem> + <para> + If <option>simple_allow_users</option> is set, only users from this list are allowed access. This setting supersedes the <option>simple_deny_users</option> list (which would be redundant). + </para> + </listitem> + <listitem> + <para> + If the <option>simple_allow_users</option> list is empty, users are allowed access unless they appear in the <option>simple_deny_users</option> list. + </para> + </listitem> </itemizedlist> - <important><para>Defining both <parameter>simple_allow_users</parameter> and <parameter>simple_deny_users</parameter> is a configuration error. If this occurs, SSSD will throw an error when loading the back end and will fail to start.</para></important> + <important> + <para> + Defining both <option>simple_allow_users</option> and <option>simple_deny_users</option> is a configuration error. If this occurs, SSSD will output an error when loading the back end and will fail to start. + </para> + </important> </para> </formalpara> </section> @@ -424,7 +454,7 @@ simple_allow_users = user1, user2</screen> <option>enum_cache_timeout <type>(integer)</type> </option> </para> - <para>Specifies for how long <package>nss_sss</package> should cache enumerations (requests for information about all users).</para> + <para>Specifies for how long (in seconds) <package>nss_sss</package> should cache enumerations (requests for information about all users).</para> </listitem> <listitem> <para> @@ -440,7 +470,7 @@ simple_allow_users = user1, user2</screen> <option>entry_negative_timeout <type>(integer)</type> </option> </para> - <para>Specifies for how long <package>nss_sss</package> should cache negative cache hits (that is, queries for invalid database entries, like nonexistent ones) before asking the back end again.</para> + <para>Specifies for how long (in seconds) <package>nss_sss</package> should cache negative cache hits (that is, queries for invalid database entries, like nonexistent ones) before asking the back end again.</para> </listitem> <listitem> <para> @@ -524,10 +554,14 @@ krb5_realm = EXAMPLE.COM</screen> <option>min_id,max_id <type>(integer)</type> </option> </para> - <para>Specifies the UID limits for the domain. If a domain contains entries that are outside these limits, they are ignored.</para> - <note> - <para>If <option>min_id</option> is unspecified, it defaults to 1000 for any back end.</para> - </note> + <para>Specifies the UID and GID limits for the domain. If a domain contains entries that are outside these limits, they are ignored.</para> + <important> + <para>If <option>min_id</option> is unspecified, it defaults to <literal>1</literal> for any back end. This default was chosen to provide compatibility with existing systems and to ease any migration attempts. LDAP administrators should be aware that granting identities in this range may conflict with users in the local <filename>/etc/passwd</filename> file. To avoid these conflicts, <option>min_id</option> should be set to <literal>1000</literal> or higher wherever possible. + </para> + <para> + This restriction applies to both UIDs and GIDs. + </para> + </important> </listitem> <listitem> <para> @@ -630,18 +664,23 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh <para>The authentication provider used for the domain. Currently supported authentication providers are: <itemizedlist> <listitem> - <para>ldap — for native LDAP authentication. Refer to sssd-ldap(5) for more information on configuring LDAP.</para> + <para>ldap — for native LDAP authentication. Refer to the sssd-ldap(5) manual page for more information on configuring LDAP.</para> </listitem> <listitem> - <para>krb5 — for Kerberos authentication. Refer to sssd-krb5(5) for more information on configuring Kerberos.</para> + <para>krb5 — for Kerberos authentication. Refer to the sssd-krb5(5) manual page for more information on configuring Kerberos.</para> </listitem> <listitem> <para>proxy — for relaying authentication to some other PAM target.</para> </listitem> + <listitem> + <para>none — explicitly disables authentication.</para></listitem> </itemizedlist> </para> </listitem> </itemizedlist> + <para> + The default value for <option>auth_provider</option> is the value of <option>id_provider</option> if it is set and can handle authentication requests. + </para> </section> <!--<section @@ -710,7 +749,7 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh <screen># A native LDAP domain [domain/LDAP] -enumerate = true +enumerate = false cache_credentials = TRUE id_provider = ldap @@ -741,7 +780,7 @@ ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt </para> <para> - For example, when using <citetitle>RFC 2307bis</citetitle> and you have configured both primary and secondary groups, or are using nested groups, you can us the <command>id</command> command to display these groups: + For example, when using <citetitle>RFC 2307bis</citetitle> and you have configured both primary and secondary groups, or are using nested groups, you can use the <command>id</command> command to display these groups: </para> <screen>[f12server@ipaserver ~]$ id uid=500(f12server) gid=500(f12server) groups=500(f12server),510(f12tester) @@ -800,7 +839,11 @@ uid=500(f12server) gid=500(f12server) groups=500(f12server),510(f12tester) </para> </formalpara> - <para>Refer to the <citetitle>sssd-ldap(5)</citetitle> manual page for a full description of all the options that apply to a native <acronym>LDAP</acronym> domain.</para> + <formalpara><title>More Information</title> + <para> + Refer to the <citetitle>sssd-ldap(5)</citetitle> manual page for a full description of all the options that apply to a native <acronym>LDAP</acronym> domain. + </para> + </formalpara> </section> <section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_Kerberos_Authentication"> @@ -849,6 +892,29 @@ krb5_auth_timeout = 15 <para>This example describes the minimum options that must be configured when using Kerberos authentication. Refer to the <citetitle>sssd-krb5(5)</citetitle> manual page for a full description of all the options that apply to configuring Kerberos authentication.</para> </section> + <section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_SASL_GSSAPI_Authentication"> + <title>Setting up SASL/GSSAPI Authentication</title> + <indexterm> + <primary>SSSD</primary> + <secondary>Setting up SASL/GSSAPI Authentication for</secondary> + </indexterm> + <para>dummy text</para> + <remark>https://bugzilla.redhat.com/show_bug.cgi?id=601870</remark> + + </section> + + <section><title>Configuring a Microsoft Active Directory Domain</title> + <indexterm> + <primary>SSSD</primary> + <secondary>Configuring a Microsoft Active Directory Domain for</secondary> + </indexterm> + <para>dummy text</para> + <remark>https://bugzilla.redhat.com/show_bug.cgi?id=601870</remark> + + + + </section> + <section id="sect-SSSD_User_Guide-Domain_Configuration_Options-Configuring_a_Proxy_Domain"> <title>Configuring a Proxy Domain</title>

1 0

[deployment-guide/comm-rel: 5/13] trac #492: Purging SSSD cache. Other minor updates
by dsilas 20 Jun '10

20 Jun '10

commit 40b453284e9adffaf8ee0505a86791082d204c42 Author: David O'Brien <davido(a)redhat.com> Date: Wed May 26 22:05:52 2010 +1000 trac #492: Purging SSSD cache. Other minor updates en-US/SSSD.xml | 330 ++++++++++++++++++++++++++++++++++++-------------------- 1 files changed, 213 insertions(+), 117 deletions(-) --- diff --git a/en-US/SSSD.xml b/en-US/SSSD.xml index ec949b0..8496191 100644 --- a/en-US/SSSD.xml +++ b/en-US/SSSD.xml @@ -4,40 +4,78 @@ <section id="chap-SSSD_User_Guide-Introduction"> <title>The System Security Services Daemon (SSSD)</title> - <para>This chapter describes how to install and configure the System Security Services Daemon (SSSD), and how to use the features that it provides. It also provides information on the types of services that it supports and how to configure them, and it introduces and describes the most important configuration options. Sample configuration files are also provided to help you optimize your deployment.</para> - <section - id="sect-SSSD_User_Guide-Introduction-What_is_SSSD"> + <para>This chapter describes how to install and configure the System Security Services Daemon (SSSD), and how to use the features that it provides. It also provides information on the types of services that it supports and how to configure them, and introduces and describes the most important configuration options. Sample configuration files are also provided to help you optimize your deployment.</para> + + <section id="sect-SSSD_User_Guide-Introduction-What_is_SSSD"> <title>What is SSSD?</title> <para>The System Security Services Daemon (SSSD) is a service which provides access to different identity and authentication providers. You can configure SSSD to use  an LDAP identity provider with LDAP authentication, or an LDAP identity provider with Kerberos authentication. SSSD is also extensible; you can configure it to use new identity sources and authentication mechanisms should they arise.</para> </section> - <section - id="sect-SSSD_User_Guide-Introduction-SSSD_Features"> + <section id="sect-SSSD_User_Guide-Introduction-SSSD_Features"> <title>SSSD Features</title> - <section - id="sect-SSSD_User_Guide-SSSD_Features-Performing_Offline_Authentication"> + + <section id="sect-SSSD_User_Guide-SSSD_Features-Performing_Offline_Authentication"> <title>Performing Offline Authentication</title> <para>One of the primary benefits of SSSD is offline authentication. This solves the case of users having a separate corporate account and a local machine account because of the common requirement to implement a Virtual Private Network (<abbrev>VPN</abbrev>).</para> <para>SSSD can cache remote identities and authentication credentials. This means that you can still authenticate with these remote identities even when a machine is offline. In an SSSD system, you only need to manage one account.</para> </section> - <section - id="sect-SSSD_User_Guide-SSSD_Features-Reducing_Server_Load"> + <section id="sect-SSSD_User_Guide-SSSD_Features-Reducing_Server_Load"> <title>Reducing Server Load</title> <para>The use of SSSD also helps to reduce the load on identification servers. For example, using <package>nss_ldap</package>, every client application that needs to request user information opens its own connection to the LDAP server. Managing these multiple connections can lead to a heavy load on the LDAP server. In an SSSD system, only the SSSD Data Provider process actually communicates with the LDAP server, reducing the load to one connection per client system.</para> </section> - <section - id="sect-SSSD_User_Guide-SSSD_Features-Specifying_Multiple_Domains"> + <section id="sect-SSSD_User_Guide-SSSD_Features-Specifying_Multiple_Domains"> + <title>Specifying Multiple Domains</title> - <para>You can use SSSD to specify multiple domains of the same type. Compare this to an <filename>nsswitch.conf</filename> file configuration, with which you can only request user information from a single server of any particular type (LDAP, NIS, etc.). With SSSD, you can create multiple domains of the same, or of different types of identity provider.</para> - <para>Beginning with version 0.6.0, SSSD maintains a separate database file for each domain. This means that each domain has its own cache, and in the event that problems occur and maintenance is necessary, it is very easy to purge the cache for a single domain, by stopping sssd and deleting the corresponding cache file. These cache files are stored in the <filename>/var/lib/sss/db/</filename> directory.</para> + <indexterm> + <primary>multiple domains</primary> + <secondary>specifying in SSSD</secondary> + </indexterm> + + <para> + You can use SSSD to specify multiple domains of the same type. Compare this to an <filename>nsswitch.conf</filename> file configuration, with which you can only request user information from a single server of any particular type (LDAP, NIS, etc.). With SSSD, you can create multiple domains of the same, or of different types of identity provider. + </para> + <para> + Beginning with version 0.6.0, SSSD maintains a separate database file for each domain. This means that each domain has its own cache, and in the event that problems occur and maintenance is necessary, it is very easy to purge the cache for a single domain, by stopping <systemitem class="daemon">sssd</systemitem> and deleting the corresponding cache file. These cache files are stored in the <filename>/var/lib/sss/db/</filename> directory. + </para> + + + <para> + All cache files are named according to the domain that they represent, for example <filename>cache_<replaceable>DOMAINNAME</replaceable>.ldb</filename>. + </para> + + <formalpara> + <title>Considerations Associated with Deleting Cache Files</title> + <indexterm> + <primary>deleting cache files</primary> + <secondary>in SSSD</secondary> + </indexterm> + + <para> + Deleting a domain's cache file can have some unexpected side effects. You should be aware of the following before you proceed: + <itemizedlist> + <listitem> + <para> + Deleting the cache file also deletes all user data (both identification and cached credentials). Consequently, you should not proceed unless you are online and can authenticate with your username against the domain's servers, because offline authentication will fail. + </para> + </listitem> + <listitem> + <para> + If you are online and change your configuration to reference a different identity provider, SSSD will recognize users from both providers until the cached entries from the original provider time out. + </para> + <para> + To avoid this situation, you can either purge the cache or use a different domain name for the new provider (this is the recommended practice). Changing the domain name means that when you restart SSSD it will create a new cache file (with the new name) and the old file will be ignored. + </para> + </listitem> + </itemizedlist> + </para> + </formalpara>  - <para>All cache files are named according to the domain that they represent, for example <filename>cache_<replaceable>DOMAINNAME</replaceable>.ldb</filename>.</para> + </section> - <section - id="sect-SSSD_User_Guide-SSSD_Features-Differentiating_Like_named_Users"> + <section id="sect-SSSD_User_Guide-SSSD_Features-Differentiating_Like_named_Users"> <title>Differentiating Like-named Users</title> <para>SSSD supports the differentiation of like-named users in different domains. For example, you can differentiate the user <systemitem class="username">kate</systemitem> in the <systemitem @@ -71,41 +109,41 @@ <para>SSSD also introduces the concept of nested groups. SSSD groups are fully POSIX-compatible, and can contain other groups as members. Any users who are members of child groups are automatically members of parent groups. This can provide significant time savings and reduced administrative overhead for system administrators.</para> </section>--> - <section - id="sect-SSSD_User_Guide-SSSD_Features-Integrating_with_Other_Products"> + <section id="sect-SSSD_User_Guide-SSSD_Features-Integrating_with_Other_Products"> <title>Integrating with Other Products</title> <para>Beyond the offline authentication, multiple domain management and other features already described, SSSD is also designed to integrate with and enhance the functionality of IPA clients. In an environment with the latest version of IPA installed, SSSD provides added functionality, including host-based access control, and password migration from an LDAP-only environment into the LDAP/Kerberos 5 environment employed by IPA.</para> </section> </section> - <section - id="chap-SSSD_User_Guide-Setting_Up_SSSD"> + <section id="chap-SSSD_User_Guide-Setting_Up_SSSD"> <title>Setting Up SSSD</title> <para>This section describes how to install SSSD, how to run the service, and how to configure it for each type of supported information provider.</para> - <section - id="sect-SSSD_User_Guide-Setting_Up_SSSD-Installing_SSSD"> + + <section id="sect-SSSD_User_Guide-Setting_Up_SSSD-Installing_SSSD"> <title>Installing SSSD</title> <para>Run the following command to install SSSD and any dependencies, including the SSSD Client:</para> <para> <command># yum install sssd</command> </para> - <para>SSSD requires very few dependencies and should install very quickly, depending on the speed of your network connection.</para> - <section - id="sect-SSSD_User_Guide-Installing_SSSD-Upgrading_from_a_Previous_Version"> + <para> + SSSD requires very few dependencies and should install very quickly, depending on the speed of your network connection. + </para> + + <section id="sect-SSSD_User_Guide-Installing_SSSD-Upgrading_from_a_Previous_Version"> <title>Upgrading from a Previous Version</title> <para>Beginning with version 0.6.0, SSSD uses a different and simplified configuration file format, referred to as "Version 2". Consequently, existing configuration files need to be migrated to the new format. SSSD provides a script to automate the migration process.</para> <para>SSSD checks the value of the <parameter>config_file_version</parameter> parameter during the startup procedure. If this value is correct, the installation continues,otherwise it aborts.</para> <para>The revised format of the configuration file is described in <xref linkend="sect-SSSD_User_Guide-SSSD_Example_Configuration_Files-SSSD_Configuration_File_Format"/> </para> - <formalpara - id="form-SSSD_User_Guide-Upgrading_from_a_Previous_Version-Upgrading_Using_RPM_Packages"> + + <formalpara id="form-SSSD_User_Guide-Upgrading_from_a_Previous_Version-Upgrading_Using_RPM_Packages"> <title>Upgrading Using RPM Packages</title> <para>If you are upgrading using RPM packages, the script will run automatically when you upgrade to the new version. This will upgrade the <filename>/etc/sssd/sssd.conf</filename> file to the new format, and copy the existing version to <filename>/etc/sssd/sssd.conf.bak</filename>.</para> </formalpara> - <formalpara - id="form-SSSD_User_Guide-Upgrading_from_a_Previous_Version-Upgrading_Manually"> + + <formalpara id="form-SSSD_User_Guide-Upgrading_from_a_Previous_Version-Upgrading_Manually"> <title>Upgrading Manually</title> <para>It may be necessary to run the upgrade script manually, either because you built SSSD from source files, or because you are using a platform that does not support the use of RPM packages. The synopsis for the script is as follows:</para> </formalpara> @@ -147,8 +185,7 @@ </itemizedlist> </section> - <section - id="sect-SSSD_User_Guide-Installing_SSSD-Starting_and_Stopping_SSSD"> + <section id="sect-SSSD_User_Guide-Installing_SSSD-Starting_and_Stopping_SSSD"> <title>Starting and Stopping SSSD</title> <note> <para>Before you start SSSD for the first time, you need to configure at least one domain. Refer to <xref @@ -166,12 +203,11 @@ </section> - <section - id="sect-SSSD_User_Guide-Setting_Up_SSSD-Configuring_SSSD"> + <section id="sect-SSSD_User_Guide-Setting_Up_SSSD-Configuring_SSSD"> <title>Configuring SSSD</title> <para>The global configuration of SSSD is stored in the <filename>/etc/sssd/sssd.conf</filename> file. This file consists of various sections, each of which contains a number of key/value pairs. Some keys accept multiple values; use commas to separate multiple values for such keys. This configuration file uses data types of <type>string</type>, <type>integer</type> and <type>Boolean</type> (with values of <literal>TRUE</literal> or <literal>FALSE</literal>). Comments are indicated by either a hash sign (#) or a semicolon (;) in the first column. The following example illustrates some of this syntax:</para> - <programlisting>[section] +<programlisting>[section] # Keys with single values key1 = value key2 = val2 @@ -186,26 +222,25 @@ key10 = val10,val11 </note> <para>Refer to the <citetitle>sssd.conf(5)</citetitle> manual page for more information on global SSSD configuration options.</para> - <section - id="sect-SSSD_User_Guide-Configuring_SSSD-Configuring_NSS"> + <section id="sect-SSSD_User_Guide-Configuring_SSSD-Configuring_NSS"> <title>Configuring NSS</title> <para>SSSD provides a new NSS module, <systemitem>nss_sss</systemitem>, so that you can configure your system to use SSSD to retrieve user information. Edit the <filename>/etc/nsswitch.conf</filename> file for your system to use the <systemitem>sss</systemitem> name database. For example:</para> - <programlisting>passwd: files sss +<programlisting>passwd: files sss group: files sss </programlisting> </section> - <section - id="sect-SSSD_User_Guide-Configuring_SSSD-Configuring_PAM"> + <section id="sect-SSSD_User_Guide-Configuring_SSSD-Configuring_PAM"> <title>Configuring PAM</title> <warning> <para>Use extreme care when changing your PAM configuration. A mistake in the PAM configuration file can lock you out of the system completely. Always back up your configuration files before performing any changes, and keep a session open so that you can revert any changes you make should the need arise.</para> </warning> - <para>To enable your system to use SSSD for PAM, you need to edit the default PAM configuration file. On &MAJOROS;—based systems, this is the <filename>/etc/pam.d/system-auth</filename> file. Edit this file to reflect the following example, and then restart <systemitem - class="daemon">sssd</systemitem>:</para> + <para>To enable your system to use SSSD for PAM, you need to edit the default PAM configuration file. On &MAJOROS;—based systems, this is the <filename>/etc/pam.d/system-auth</filename> file. Edit this file to reflect the following example, and then restart <systemitem class="daemon">sssd</systemitem>:</para> + + <remark>Validate the following example, especially comments about auto-generation.</remark> - <programlisting>#%PAM-1.0 +<programlisting>#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so @@ -237,8 +272,7 @@ session required pam_unix.so <para>You can also use <command>authconfig</command> to set up your PAM configuration to use SSSD. Select <guilabel>Use LDAP Authentication</guilabel>, and then replace <filename>pam_ldap.so</filename> with <filename>pam_sss.so</filename> in all files below <filename>/etc/pam.d</filename> or in the <filename>/etc/pam.conf</filename> file.</para> - <formalpara - id="form-SSSD_User_Guide-Configuring_PAM-Using_include_Statements_in_PAM_Configurations"> + <formalpara id="form-SSSD_User_Guide-Configuring_PAM-Using_include_Statements_in_PAM_Configurations"> <title>Using include Statements in PAM Configurations</title> <para>Recent PAM implementations allow you to use <literal>include</literal> statements in PAM configurations. For example:</para> </formalpara> @@ -253,7 +287,8 @@ session optional pam_console.so </note> </section> - <section><title>Configuring Access Control</title> + <section> + <title>Configuring Access Control</title> <indexterm> <primary>Access Control</primary> <secondary>configuring in SSSD</secondary> @@ -261,18 +296,30 @@ session optional pam_console.so <para>SSSD provides a rudimentary access control mechanism based on the implementation of access or deny lists of usernames. This mechanism is known as the <firstterm>Simple Access Provider</firstterm>, and is configured in the <literal>[domain/<<replaceable>NAME</replaceable>>]</literal> sections of the <filename>/etc/sssd/sssd.conf</filename> file. To enable the Simple Access Provider, you need to set the <parameter>access_provider</parameter> parameter to <literal>simple</literal>, and then add usernames as a comma-separated list to either the <parameter>simple_allow_users</parameter> or <parameter>simple_deny_users</parameter> parameters.</para> - <formalpara><title>Using the Simple Access Provider</title> - <para>By using the Simple Access Provider, you can continue to support a number of network logins to maintain common network accounts on company or department laptops, but you might want to restrict the use of a particular laptop to one or two users. This means that even if a different user authenticated successfully against the same authentication provider, the Simple Access Provider would prevent that user from gaining access.</para> + <formalpara> + <title>Using the Simple Access Provider</title> + <para> + By using the Simple Access Provider, you can continue to support a number of network logins to maintain common network accounts on company or department laptops, but you might want to restrict the use of a particular laptop to one or two users. This means that even if a different user authenticated successfully against the same authentication provider, the Simple Access Provider would prevent that user from gaining access. + </para> </formalpara> - <para>The Simple Access Provider is also useful if you have two domains configured that have some overlapping users. In this scenario, you can specify <parameter>simple_deny_users</parameter> in one domain for a set of users, thereby guaranteeing that those users will be handled by the other domain.</para> + <para> + The Simple Access Provider is also useful if you have two domains configured that have some overlapping users. In this scenario, you can specify <parameter>simple_deny_users</parameter> in one domain for a set of users, thereby guaranteeing that those users will be handled by the other domain. + </para> - <para>The following example demonstrates the use of the Simple Access Provider to grant access to two users. This example assumes that SSSD is correctly configured and <systemitem class="domainname">example.com</systemitem> is one of the domains specified in the <literal>[sssd]</literal> section, and only shows the Simple Access Provider-specific options.</para> + <para> + The following example demonstrates the use of the Simple Access Provider to grant access to two users. This example assumes that SSSD is correctly configured and <systemitem class="domainname">example.com</systemitem> is one of the domains specified in the <literal>[sssd]</literal> section, and only shows the Simple Access Provider-specific options. + </para> <screen>[domain/example.com] access_provider = simple simple_allow_users = user1, user2</screen> - <formalpara><title>Access Control Rules</title> + <formalpara> + <title>Access Control Rules</title> + <indexterm> + <primary>Access Control</primary> + <secondary>in SSSD, rules</secondary> + </indexterm> <para>The Simple Access Provider adheres to three simple rules to determine which users should or should not be granted access, as follows: <itemizedlist> <listitem><para>If both lists are empty, access is granted</para></listitem> @@ -284,8 +331,7 @@ simple_allow_users = user1, user2</screen> </formalpara> </section> - <section - id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_Failover"> + <section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_Failover"> <title>Configuring Failover</title> <para>The failover feature allows back ends to automatically switch to a different server if the primary server fails. These servers are entered as a case-insensitive, comma-separated list in the <literal>[domain/<<replaceable>NAME</replaceable>>]</literal> sections of the <filename>/etc/sssd/sssd.conf</filename> file, and listed in order of preference. This list can contain any number of servers.</para> @@ -313,30 +359,26 @@ simple_allow_users = user1, user2</screen> <title>How the Failover Mechanism Works</title> <para>The failover mechanism distinguishes between machines and services. The back end first tries to resolve the hostname of a given machine; if this resolution attempt fails, the machine is considered offline. No further attempts are made to connect to this machine for any other service. If the resolution attempt succeeds, the back end tries to connect to a service on this machine. If the service connection attempt fails, then only this particular service is considered offline and the back end automatically switches over to the next service. The machine is still considered online and might still be tried for another service.</para> - <para>Further connection attempts are made to machines or services marked as offline after a specified period of time; this is currently hard coded to 30 seconds. If there are no more machines to try, the back end as a whole switches to offline mode, and then attempts to reconnect every 30 seconds.</para></section> + <para>Further connection attempts are made to machines or services marked as offline after a specified period of time; this is currently hard coded to 30 seconds. If there are no more machines to try, the back end as a whole switches to offline mode, and then attempts to reconnect every 30 seconds.</para> + </section> </section> - </section> </section> - <section - id="chap-SSSD_User_Guide-Configuring_Services"> + <section id="chap-SSSD_User_Guide-Configuring_Services"> <title>Configuring Services</title> - <para>Individual pieces of SSSD functionality are provided by special SSSD services that are started and stopped together with SSSD. The services provided by SSSD have their own configuration sections. The <literal>[sssd]</literal> section also lists the services that are active and should be started when <systemitem - class="daemon">sssd</systemitem> starts within the <command>services</command> directive.</para> + <para>Individual pieces of SSSD functionality are provided by special SSSD services that are started and stopped together with SSSD. The services provided by SSSD have their own configuration sections. The <literal>[sssd]</literal> section also lists the services that are active and should be started when <systemitem class="daemon">sssd</systemitem> starts within the <command>services</command> directive.</para> <para>SSSD currently provides several services:</para> <itemizedlist> <listitem> <para> - <systemitem - class="service">NSS</systemitem> — An NSS provider service that answers NSS requests from the <systemitem>nss_sss</systemitem> module.</para> + <systemitem class="service">NSS</systemitem> — An NSS provider service that answers NSS requests from the <systemitem>nss_sss</systemitem> module.</para> </listitem> <listitem> <para> - <systemitem - class="service">PAM</systemitem> — A PAM provider service that manages a PAM conversation through the <systemitem>pam_sss</systemitem> PAM module.</para> + <systemitem class="service">PAM</systemitem> — A PAM provider service that manages a PAM conversation through the <systemitem>pam_sss</systemitem> PAM module.</para> </listitem> <listitem> <para> @@ -344,12 +386,10 @@ simple_allow_users = user1, user2</screen> class="service">monitor</systemitem> — A special service that monitors all other SSSD services, and starts or restarts them as needed. Its options are specified in the <literal>[sssd]</literal> section of the <filename>/etc/sssd/sssd.conf</filename> configuration file.</para> </listitem> </itemizedlist> - <section - id="sect-SSSD_User_Guide-Configuring_Services-Configuration_Options"> + <section id="sect-SSSD_User_Guide-Configuring_Services-Configuration_Options"> <title>Configuration Options</title> <para>The following sections cover the most important SSSD configuration options. Refer to the <citetitle>sssd.conf(5)</citetitle> manual page that ships with SSSD for information on all the available configuration options.</para> - <section - id="sect-SSSD_User_Guide-Configuration_Options-General_Configuration_Options"> + <section id="sect-SSSD_User_Guide-Configuration_Options-General_Configuration_Options"> <title>General Configuration Options</title> <itemizedlist> <listitem> @@ -375,8 +415,7 @@ simple_allow_users = user1, user2</screen> </itemizedlist> </section> - <section - id="sect-SSSD_User_Guide-Configuration_Options-NSS_Configuration_Options"> + <section id="sect-SSSD_User_Guide-Configuration_Options-NSS_Configuration_Options"> <title>NSS Configuration Options</title> <para>Use the following options to configure the Name Service Switch (NSS) service. Refer to the <citetitle>sssd.conf(5)</citetitle> manual page for full details about each option.</para> <itemizedlist> @@ -421,8 +460,7 @@ simple_allow_users = user1, user2</screen> </itemizedlist> </section> - <section - id="sect-SSSD_User_Guide-Configuration_Options-PAM_Configuration_Options"> + <section id="sect-SSSD_User_Guide-Configuration_Options-PAM_Configuration_Options"> <title>PAM Configuration Options</title> <para>Use these options to configure the <systemitem role="module">Pluggable Authentication Module</systemitem> (<acronym>PAM</acronym>) service.</para> <itemizedlist> @@ -440,8 +478,7 @@ simple_allow_users = user1, user2</screen> </section> - <section - id="chap-SSSD_User_Guide-Configuring_Domains"> + <section id="chap-SSSD_User_Guide-Configuring_Domains"> <title>Configuring Domains</title> <para>A domain is a database of user information. SSSD can use more than one domain at the same time, but at least one must be configured for SSSD to start. Using SSSD domains, it is possible to use several LDAP servers providing several unique namespaces. You can specify not only where users' identity information is stored, but how users authenticate against each of the specified domains.</para> <para>SSSD supports the following identity and authentication combinations: @@ -451,11 +488,11 @@ simple_allow_users = user1, user2</screen> <para>This combination uses SSSD's own special identity and authentication provider. Refer to <xref linkend="sect-SSSD_User_Guide-Configuring_Domains-Configuring_the_Local_SSSD_Domain_Database_Provider"/> for information on how to configure SSSD to use this identity and authentication method.</para> </listitem>--> <listitem> - <para>LDAP/LDAP</para> + <para><link linkend="sect-SSSD_User_Guide-Configuring_Domains-Configuring_a_Native_LDAP_Domain">LDAP/LDAP</link></para> <para>This combination uses an LDAP back end as both the identity and authentication provider.</para> </listitem> <listitem> - <para>LDAP/KRB5</para> + <para><link linkend="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_Kerberos_Authentication">LDAP/KRB5</link></para> <para>This combination uses an LDAP back end as the identity provider, and uses Kerberos to provide authentication.</para> </listitem> <listitem> @@ -474,13 +511,11 @@ krb5_kdcip = 192.168.1.1 krb5_realm = EXAMPLE.COM</screen> - <section - id="sect-SSSD_User_Guide-Configuring_Domains-Domain_Configuration_Options"> + <section id="sect-SSSD_User_Guide-Configuring_Domains-Domain_Configuration_Options"> <title>Domain Configuration Options</title> <para>You can add new domain configurations to the <literal>[domain/<<replaceable>NAME</replaceable>>]</literal> sections of the <filename>/etc/sssd/sssd.conf</filename> file, and then add the list of domains to the <parameter>domains</parameter> attribute of the <literal>[sssd]</literal> section, in the order you want them to be queried.</para> - <section - id="sect-SSSD_User_Guide-Domain_Configuration_Options-General_Domain_Configuration_Options"> + <section id="sect-SSSD_User_Guide-Domain_Configuration_Options-General_Domain_Configuration_Options"> <title>General Domain Configuration Options</title> <para>You can use the following configuration options in a domain configuration section:</para> <itemizedlist> @@ -502,6 +537,9 @@ krb5_realm = EXAMPLE.COM</screen> <para>Specifies whether or not to enumerate (list) the users and groups of a domain.</para> <para>Enumeration means that the entire set of available users and groups on the remote source is cached on the local machine. When enumeration is disabled, users and groups are only cached as they are requested. For performance reasons, it is recommended that you disable enumeration for domains with many users and groups.</para> <para>The default value for this parameter is <literal>FALSE</literal>. Set this value to <literal>TRUE</literal> to enable enumeration of users and groups of a domain.</para> + <important> + <para>A minor security concern exists when enabling enumeration. With enumeration enabled, users can run the <command>getent passwd</command> command to retrieve the full list of users that could have access to the system. With enumeration disabled, users are required to know individual usernames in advance.</para> + </important> </listitem> <listitem> <para> @@ -534,16 +572,14 @@ krb5_realm = EXAMPLE.COM</screen> <para>proxy — Support a legacy <systemitem class="service">NSS</systemitem> provider (for example, <package>nss_nis</package>).</para> <note> <para>SSSD needs to know which legacy NSS library to load in order to start successfully. If you set <option>id_provider</option> to <literal>proxy</literal>, ensure that you also specify a value for <option>proxy_lib_name</option>. Refer to <xref - linkend="sect-SSSD_User_Guide-Domain_Configuration_Options-Proxy_Configuration_Options"/> for information on this attribute.</para> + linkend="sect-SSSD_User_Guide-Domain_Configuration_Options-Configuring_a_Proxy_Domain"/> for information on this attribute.</para> </note> </listitem> <listitem> - <para>local — <systemitem - class="service">SSSD</systemitem> internal local provider.</para> + <para>local — <systemitem class="service">SSSD</systemitem> internal local provider.</para> </listitem> <listitem> - <para>ldap — <systemitem - class="service">LDAP</systemitem> provider.</para> + <para>ldap — <systemitem class="service">LDAP</systemitem> provider.</para> </listitem> </itemizedlist> </para> @@ -582,8 +618,7 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh </screen> <note> <para>With <parameter>use_fully_qualified_names</parameter> set to <literal>FALSE</literal>, you can continue to use the fully-qualified name in your requests, but only the simplified version is displayed in the output.</para> - <para>SSSD can only parse <systemitem - class="domainname">name@domain</systemitem>, not <systemitem + <para>SSSD can only parse <systemitem class="domainname">name@domain</systemitem>, not <systemitem class="domainname">name@realm</systemitem>. You can, however, use the same name for both your domain and your realm.</para> </note> </listitem> @@ -609,7 +644,7 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh </itemizedlist> </section> - <section +  + + </section>  - <section - id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_a_Native_LDAP_Domain"> + <section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_a_Native_LDAP_Domain"> <title>Configuring a Native LDAP Domain</title> <indexterm> - <primary>LDAP</primary> - <secondary>SSSD and</secondary> - <tertiary>Configuring a Native LDAP Domain</tertiary> + <primary>SSSD</primary> + <secondary>Configuring a Native LDAP Domain for</secondary> </indexterm> - <para>A native LDAP domain requires a running LDAP server against which to authenticate. The client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file.</para> - <para>SSSD does not support authentication over an unencrypted channel. Consequently, if you want to authenticate against an LDAP server, <systemitem - class="protocol">TLS/SSL</systemitem> is required. If the LDAP server is used only as an identity provider, an encrypted channel is not needed.</para> - <formalpara - id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-How_to_Authenticate_Against_a_Native_LDAP_Domain"> + + <para>A native LDAP domain is one where the <option>id_provider</option> option is set to <literal>ldap</literal> (<option>id_provider = ldap</option>). Such a domain requires a running LDAP server against which to authenticate. The client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file.</para> + <para>SSSD does not support authentication over an unencrypted channel. Consequently, if you want to authenticate against an LDAP server, <systemitem class="protocol">TLS/SSL</systemitem> is required. If the LDAP server is used only as an identity provider, an encrypted channel is not needed.</para> + <formalpara id="form-SSSD_User_Guide-Configuring_a_Native_LDAP_Domain-How_to_Authenticate_Against_a_Native_LDAP_Domain"> <title>How to Authenticate Against a Native LDAP Domain</title> <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para> </formalpara> @@ -693,25 +727,39 @@ ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt <formalpara> <title>Selecting an LDAP Schema</title> - <indexterm> - <primary>LDAP</primary> - <secondary>SSSD and</secondary> - <tertiary>Selecting an LDAP Schema</tertiary> + <indexterm> + <primary>SSSD</primary> + <secondary>Selecting an LDAP Schema for</secondary> </indexterm> <para> - You can set the <parameter>ldap_schema</parameter> attribute to either <literal>rfc2307</literal> or <literal>rfc2307bis</literal>. These schema define how groups in <acronym>LDAP</acronym> are specified. In <citetitle>RFC 2307</citetitle>, group objects use a multi-valued attribute, <parameter>memberuid</parameter>, which lists the names of the users that belong to that group. In <citetitle>RFC 2307bis</citetitle>, instead of the <parameter>memberuid</parameter>, group objects use the <parameter>member</parameter> attribute. Rather than just the name of the user, this attribute contains the full Distinguished Name (DN) of another object in the <acronym>LDAP</acronym> database. This means that groups can have other groups as members. That is, it adds support for nested groups. + You can set the <parameter>ldap_schema</parameter> attribute to either <literal>rfc2307</literal> or <literal>rfc2307bis</literal>. These schema define how groups in <acronym>LDAP</acronym> are specified. In <citetitle>RFC 2307</citetitle>, group objects use a multi-valued attribute, <parameter>memberuid</parameter>, which lists the names of the users that belong to that group. In <citetitle>RFC 2307bis</citetitle>, instead of the <parameter>memberuid</parameter>, group objects use the <parameter>member</parameter> attribute. Rather than just the name of the user, this attribute contains the full Distinguished Name (DN) of another object in the LDAP database. This means that groups can have other groups as members. That is, it adds support for nested groups. </para> </formalpara> + + <para> + SSSD assumes by default that your LDAP server is using <citetitle>RFC 2307</citetitle>. If your LDAP server is using <citetitle>RFC 2307bis</citetitle>, and you do not update the <filename>/etc/sssd/sssd.conf</filename> file accordingly, this can impact how your users and groups are displayed. It also means that some groups will not be available and network resources may be inaccessible even though you have permissions to use them. + </para> + + <para> + For example, when using <citetitle>RFC 2307bis</citetitle> and you have configured both primary and secondary groups, or are using nested groups, you can us the <command>id</command> command to display these groups: + </para> + <screen>[f12server@ipaserver ~]$ id +uid=500(f12server) gid=500(f12server) groups=500(f12server),510(f12tester) +</screen> + + <para> + If instead you have configured your client to use <citetitle>RFC 2307</citetitle> then only the primary group is displayed. + </para> + <para> Changes to this setting only affect how SSSD determines the groups to which a user belongs; there is no negative effect on the actual user data. If you do not know the correct value for this attribute, consult your System Administrator. </para> <formalpara> <title>Specifying Timeout Values</title> - <indexterm> - <primary>LDAP</primary> - <secondary>SSSD and</secondary> - <tertiary>Specifying Timeout Values</tertiary> + <indexterm> + <primary>SSSD</primary> + <secondary>Specifying Timeout Values for</secondary> </indexterm> <para> SSSD supports a number of timeout values that apply when configuring an <acronym>LDAP</acronym> domain. These are described below. @@ -724,7 +772,7 @@ ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt Defaults to five when <option>enumerate</option> = <literal>False</literal> </para> <para> - Defaults to 30 when <option>enumerate</option> = <literal>True</literal>. This option is forced to a minumum of 30 in this case. + Defaults to 30 when <option>enumerate</option> = <literal>True</literal>. This option is forced to a minimum of 30 in this case. </para> <note> <para> @@ -755,17 +803,31 @@ ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt <para>Refer to the <citetitle>sssd-ldap(5)</citetitle> manual page for a full description of all the options that apply to a native <acronym>LDAP</acronym> domain.</para> </section> - <section - id="sect-SSSD_User_Guide-Configuring_Domains-Setting_Up_Authentication_Against_a_Kerberos_Server"> - <title>Setting Up Authentication Against a Kerberos Server</title> - <para>In order to set up Kerberos authentication, you need to know the address of your KDC and the Kerberos domain. The client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file.</para> + <section id="sect-SSSD_User_Guide-Configuring_Domains-Setting_up_Kerberos_Authentication"> + <title>Setting up Kerberos Authentication</title> + <indexterm> + <primary>SSSD</primary> + <secondary>Setting up Kerberos authentication for</secondary> + </indexterm> + + <para> + In order to set up Kerberos authentication, you need to know the address of your <firstterm>key distribution center</firstterm> (KDC) and the Kerberos domain. The client configuration is then stored in the <filename>/etc/sssd/sssd.conf</filename> file. + </para> + + <para> + The Kerberos 5 authentication back end does not contain an identity provider and must be paired with one in order to function properly (for example, <option>id_provider = ldap</option>). Some information required by the Kerberos 5 authentication back end must be supplied by the identity provider, such as the user's <firstterm>Kerberos Principal Name</firstterm> (UPN). The identity provider configuration should contain an entry to specify this UPN. Refer to the manual page for the applicable identity provider for details on how to configure the UPN. + </para> + <para> + If the UPN is not available in the identity back end, SSSD will construct a UPN using the format <systemitem class="username">username@krb5_realm</systemitem>. + </para> + <formalpara - id="form-SSSD_User_Guide-Setting_Up_Authentication_Against_a_Kerberos_Server-How_to_Authenticate_Against_a_Kerberos_Domain"> - <title>How to Authenticate Against a Kerberos Domain</title> + id="form-SSSD_User_Guide-Setting_Up_Kerberos_Authentication-How_to_Authenticate_Against_a_Kerberos_Back_End"> + <title>How to Authenticate Against a Kerberos Back End</title> <para>Edit your <filename>/etc/sssd/sssd.conf</filename> file to reflect the following example:</para> </formalpara> - <screen># A domain with identities provided by LDAP and authentication by Kerberos +<screen># A domain with identities provided by LDAP and authentication by Kerberos [domain/KRBDOMAIN] enumerate = false id_provider = ldap @@ -778,13 +840,47 @@ ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt auth_provider = krb5 krb5_kdcip = 192.168.1.1 krb5_realm = EXAMPLE.COM -krb5_changepw_principle = kadmin/changepw +krb5_changepw_principal = kadmin/changepw krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_auth_timeout = 15 </screen> - <para>Refer to the <citetitle>sssd-krb5(5)</citetitle> manual page for a full description of all the parameters that apply to configuring Kerberos authentication.</para> + + <para>This example describes the minimum options that must be configured when using Kerberos authentication. Refer to the <citetitle>sssd-krb5(5)</citetitle> manual page for a full description of all the options that apply to configuring Kerberos authentication.</para> + </section> + + + <section id="sect-SSSD_User_Guide-Domain_Configuration_Options-Configuring_a_Proxy_Domain"> + <title>Configuring a Proxy Domain</title> + <indexterm> + <primary>SSSD</primary> + <secondary>Configuring a proxy domain for</secondary> + </indexterm> + + <para> + SSSD currently only supports LDAP and Kerberos as authentication providers. If you prefer to use SSSD (for example, to take advantage of its caching functionality), but SSSD does not support your authentication method natively, you can set up a proxy authentication provider. This could be the case if you use fingerprint scanners or smart cards as part of your authentication process. + </para> + <itemizedlist> + <listitem> + <para> + <option>proxy_pam_target</option> + <type>(string)</type> + </para> + <para>This option is only used when the <option>auth_provider</option> option is set to <literal>proxy</literal>, and specifies the proxy target that <acronym>PAM</acronym> proxies to.</para> + <para>This option has no default value. If proxy authentication is required, you need to specify your own <acronym>PAM</acronym> target. This corresponds to a file containing <acronym>PAM</acronym> stack information in the system's default <acronym>PAM</acronym> configuration directory. On &MAJOROS;-based systems, this is the <filename>/etc/pam.d/</filename> directory.</para> + </listitem> + <listitem> + <para> + <option>proxy_lib_name</option> + <type>(string)</type> + </para> + <para>This option is only used when the <option>id_provider</option> option is set to <literal>proxy</literal>, and specifies which existing NSS library to proxy identity requests through.</para> + + <para>This option has no default value. You need to manually specify an existing library to take advantage of this option. For example, set this value to <literal>nis</literal> to use the existing <filename>libnss_nis.so</filename> file.</para> + </listitem> + </itemizedlist> </section> + </section> <!--<section

1 0

[deployment-guide/comm-rel: 4/13] Fix several LOCAL domain and config bugs
by dsilas 20 Jun '10

20 Jun '10

commit 979b3e31d6e67a9fd49f996e7938648c0d201a60 Author: David O'Brien <daobrien(a)daobrien.csb> Date: Thu May 20 14:08:55 2010 +1000 Fix several LOCAL domain and config bugs 593917 How rfc2307 and rfc2307bis impact group display 593505 ldap_search_timeout option Remove LOCAL domain, SSSD Management Tools and related sections Make a start on indexing en-US/SSSD.xml | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 files changed, 63 insertions(+), 5 deletions(-) --- diff --git a/en-US/SSSD.xml b/en-US/SSSD.xml index 29f161c..ec949b0 100644 --- a/en-US/SSSD.xml +++ b/en-US/SSSD.xml @@ -660,6 +660,11 @@ ipauser01:x:937315651:937315651:ipauser01:/home/ipauser01:/bin/sh <section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_a_Native_LDAP_Domain"> <title>Configuring a Native LDAP Domain</title> + <indexterm> + <primary>LDAP</primary> + <secondary>SSSD and</secondary> + <tertiary>Configuring a Native LDAP Domain</tertiary> + </indexterm> <para>A native LDAP domain requires a running LDAP server against which to authenticate. The client configuration is stored in the <filename>/etc/sssd/sssd.conf</filename> file.</para> <para>SSSD does not support authentication over an unencrypted channel. Consequently, if you want to authenticate against an LDAP server, <systemitem class="protocol">TLS/SSL</systemitem> is required. If the LDAP server is used only as an identity provider, an encrypted channel is not needed.</para> @@ -685,8 +690,14 @@ tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt </screen> + <formalpara> <title>Selecting an LDAP Schema</title> + <indexterm> + <primary>LDAP</primary> + <secondary>SSSD and</secondary> + <tertiary>Selecting an LDAP Schema</tertiary> + </indexterm> <para> You can set the <parameter>ldap_schema</parameter> attribute to either <literal>rfc2307</literal> or <literal>rfc2307bis</literal>. These schema define how groups in <acronym>LDAP</acronym> are specified. In <citetitle>RFC 2307</citetitle>, group objects use a multi-valued attribute, <parameter>memberuid</parameter>, which lists the names of the users that belong to that group. In <citetitle>RFC 2307bis</citetitle>, instead of the <parameter>memberuid</parameter>, group objects use the <parameter>member</parameter> attribute. Rather than just the name of the user, this attribute contains the full Distinguished Name (DN) of another object in the <acronym>LDAP</acronym> database. This means that groups can have other groups as members. That is, it adds support for nested groups. </para> @@ -695,7 +706,53 @@ ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt Changes to this setting only affect how SSSD determines the groups to which a user belongs; there is no negative effect on the actual user data. If you do not know the correct value for this attribute, consult your System Administrator. </para> - <para>Refer to the <citetitle>sssd-ldap(5)</citetitle> manual page for a full description of all the parameters that apply to a native <acronym>LDAP</acronym> domain.</para> + <formalpara> + <title>Specifying Timeout Values</title> + <indexterm> + <primary>LDAP</primary> + <secondary>SSSD and</secondary> + <tertiary>Specifying Timeout Values</tertiary> + </indexterm> + <para> + SSSD supports a number of timeout values that apply when configuring an <acronym>LDAP</acronym> domain. These are described below. + <itemizedlist> + <listitem> + <para> + <option>ldap_search_timeout (integer)</option> — Specifies the timeout (in seconds) that <acronym>LDAP</acronym> searches are allowed to run before they are cancelled and cached results are returned (and offline mode is entered). If not specified: + </para> + <para> + Defaults to five when <option>enumerate</option> = <literal>False</literal> + </para> + <para> + Defaults to 30 when <option>enumerate</option> = <literal>True</literal>. This option is forced to a minumum of 30 in this case. + </para> + <note> + <para> + This option is subject to change in future versions of SSSD, where it may be replaced by a series of timeouts for specific look-up types. + </para> + </note> + </listitem> + <listitem> + <para> + <option>ldap_network_timeout (integer)</option> — Specifies the timeout (in seconds) after which the <function>poll(2)</function>/<function>select(2)</function> following a <function>connect(2)</function> returns in case of no activity. + </para> + <para> + If not specified, defaults to five. + </para> + </listitem> + <listitem> + <para> + <option>ldap_opt_timeout (integer)</option> — Specifies the timeout (in seconds) after which calls to synchronous <acronym>LDAP</acronym> APIs will abort if no response is received. This option also controls the timeout when communicating with the KDC in case of a SASL bind. + </para> + <para> + If not specified, defaults to five. + </para> + </listitem> + </itemizedlist> + </para> + </formalpara> + + <para>Refer to the <citetitle>sssd-ldap(5)</citetitle> manual page for a full description of all the options that apply to a native <acronym>LDAP</acronym> domain.</para> </section> <section @@ -728,8 +785,9 @@ krb5_auth_timeout = 15 </screen> <para>Refer to the <citetitle>sssd-krb5(5)</citetitle> manual page for a full description of all the parameters that apply to configuring Kerberos authentication.</para> </section> + </section> - <section +  - </section> + <section id="chap-SSSD_User_Guide-Troubleshooting"> <title>Troubleshooting</title> @@ -1153,4 +1211,4 @@ proxy_auth_target = nis_pam_proxy </programlisting> </section> </section> -</section> \ No newline at end of file + \ No newline at end of file

1 0

[deployment-guide/comm-rel: 3/13] Trac #367; updates to Failover and Service Discovery
by dsilas 20 Jun '10

20 Jun '10

commit cf6822212ae74e844ad7673c1b1033b46f20ff2c Author: David O'Brien <daobrien(a)daobrien.csb> Date: Tue May 18 13:24:22 2010 +1000 Trac #367; updates to Failover and Service Discovery en-US/SSSD.xml | 26 +++++++++++++++++--------- 1 files changed, 17 insertions(+), 9 deletions(-) --- diff --git a/en-US/SSSD.xml b/en-US/SSSD.xml index 79703af..29f161c 100644 --- a/en-US/SSSD.xml +++ b/en-US/SSSD.xml @@ -264,8 +264,9 @@ session optional pam_console.so <formalpara><title>Using the Simple Access Provider</title> <para>By using the Simple Access Provider, you can continue to support a number of network logins to maintain common network accounts on company or department laptops, but you might want to restrict the use of a particular laptop to one or two users. This means that even if a different user authenticated successfully against the same authentication provider, the Simple Access Provider would prevent that user from gaining access.</para> </formalpara> + <para>The Simple Access Provider is also useful if you have two domains configured that have some overlapping users. In this scenario, you can specify <parameter>simple_deny_users</parameter> in one domain for a set of users, thereby guaranteeing that those users will be handled by the other domain.</para> - <para>The following example demonstrates the use of the Simple Access Provider to grant access to two users. This example assumes that SSSD is correctly configured and example.com is one of the domains specified in the <literal>[sssd]</literal> section, and only shows the Simple Access Provider-specific options.</para> + <para>The following example demonstrates the use of the Simple Access Provider to grant access to two users. This example assumes that SSSD is correctly configured and <systemitem class="domainname">example.com</systemitem> is one of the domains specified in the <literal>[sssd]</literal> section, and only shows the Simple Access Provider-specific options.</para> <screen>[domain/example.com] access_provider = simple @@ -278,7 +279,7 @@ simple_allow_users = user1, user2</screen> <listitem><para>If <parameter>simple_allow_users</parameter> is set, only users from this list are allowed access. This setting supersedes the <parameter>simple_deny_users</parameter> list (which would be redundant).</para></listitem> <listitem><para>If the <parameter>simple_allow_users</parameter> list is empty, users are allowed access unless they appear in the <parameter>simple_deny_users</parameter> list.</para></listitem> </itemizedlist> - <note><para>It is a configuration error if both <parameter>simple_allow_users</parameter> and <parameter>simple_deny_users</parameter> are defined.</para></note> + <important><para>Defining both <parameter>simple_allow_users</parameter> and <parameter>simple_deny_users</parameter> is a configuration error. If this occurs, SSSD will throw an error when loading the back end and will fail to start.</para></important> </para> </formalpara> </section> @@ -293,9 +294,11 @@ simple_allow_users = user1, user2</screen> <para>In this configuration, <uri>ldap://ldap0.mydomain.org</uri> functions as the primary server. If this server fails, the SSSD failover mechanism first attempts to connect to <uri>ldap1.mydomain.org</uri>, and if that is unavailable, it then attempts to connect to <uri>ldap2.mydomain.org</uri>. If the primary server is restored, the failover mechanism automatically restores operations to use that server instead of any failover servers.</para> - <warning><para>Do not use multiple <parameter>ldap_uri</parameter> parameters to specify your failover servers. The failover servers must be entered as a comma-separated list of values for a single <parameter>ldap_uri</parameter> parameter. If you enter multiple <parameter>ldap_uri</parameter> parameters, SSSD only recognizes the last entry.</para></warning> + <para>If the parameter that specifies which server to connect to for the specific domain (for example, <parameter>ldap_uri</parameter>, <parameter>krb5_kdcip</parameter>, …) is not specified, the back end defaults to using <replaceable>Use service discovery</replaceable>. Refer to <xref linkend="sect-SSSD_User_Guide-Configuring_Domains-Configuring_Failover-Using_SRV_Records_with_Failover"/> for more information on service discovery.</para> - <section> + <important><para>Do not use multiple <parameter>ldap_uri</parameter> parameters to specify your failover servers. The failover servers must be entered as a comma-separated list of values for a single <parameter>ldap_uri</parameter> parameter. If you enter multiple <parameter>ldap_uri</parameter> parameters, SSSD only recognizes the last entry.</para></important> + + <section id="sect-SSSD_User_Guide-Configuring_Domains-Configuring_Failover-Using_SRV_Records_with_Failover"> <title>Using SRV Records with Failover</title> <para>SSSD also supports the use of SRV records in its failover configuration. This means that you can specify a server that is later resolved into a list of specific servers using SRV requests. The <parameter>priority</parameter> and <parameter>weight</parameter> attributes of SRV records provide further opportunity for specifying which servers should be contacted first in the event that the primary server fails.</para> @@ -413,7 +416,7 @@ simple_allow_users = user1, user2</screen> <option>filter_users_in_groups <type>(Boolean)</type> </option> </para> - <para>Specifies that filtered users do not appear in group memberships. If not specified, defaults to <literal>TRUE</literal>.</para> + <para>If set to TRUE, specifies that users listed in the <option>filter_users</option> list do not appear in group memberships when performing group lookups. If set to FALSE, group lookups return all users that are members of that group. If not specified, defaults to <literal>TRUE</literal>.</para> </listitem> </itemizedlist> </section> @@ -682,12 +685,17 @@ tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt </screen> -<note> + <formalpara> + <title>Selecting an LDAP Schema</title> + <para> + You can set the <parameter>ldap_schema</parameter> attribute to either <literal>rfc2307</literal> or <literal>rfc2307bis</literal>. These schema define how groups in <acronym>LDAP</acronym> are specified. In <citetitle>RFC 2307</citetitle>, group objects use a multi-valued attribute, <parameter>memberuid</parameter>, which lists the names of the users that belong to that group. In <citetitle>RFC 2307bis</citetitle>, instead of the <parameter>memberuid</parameter>, group objects use the <parameter>member</parameter> attribute. Rather than just the name of the user, this attribute contains the full Distinguished Name (DN) of another object in the <acronym>LDAP</acronym> database. This means that groups can have other groups as members. That is, it adds support for nested groups. + </para> + </formalpara> <para> - The <parameter>ldap_schema</parameter> attribute can be set to either <literal>rfc2307</literal>, which uses the <parameter>memberuid</parameter> attribute for group membership, or to <parameter>rfc2307bis</parameter>, which uses the <parameter>member</parameter> attribute. Changes to this setting only affect how SSSD determines the groups to which a user belongs; there is no negative effect on the actual user data. If you do not know the correct value for this attribute, consult your System Administrator. + Changes to this setting only affect how SSSD determines the groups to which a user belongs; there is no negative effect on the actual user data. If you do not know the correct value for this attribute, consult your System Administrator. </para> -</note> - <para>Refer to the <citetitle>sssd-ldap(5)</citetitle> manual page for a full description of all the parameters that apply to a native LDAP domain.</para> + + <para>Refer to the <citetitle>sssd-ldap(5)</citetitle> manual page for a full description of all the parameters that apply to a native <acronym>LDAP</acronym> domain.</para> </section> <section

1 0

[deployment-guide/comm-rel: 2/13] Merge branch 'master' of git+ssh://git.engineering.redhat.com/srv/git/users/dhensley/Deployment_Guid
by dsilas 20 Jun '10

20 Jun '10

commit 4504037eab0eb3b3069f274b3df350e58b5221f5 Merge: 83e335d... acc1c0b... Author: Martin Prpic <mprpic(a)redhat.com> Date: Fri Jun 11 13:05:30 2010 +0200 Merge branch 'master' of git+ssh://git.engineering.redhat.com/srv/git/users/dhensley/Deployment_Guide Conflicts: en-US/Book_Info.xml en-US/Book_Info.xml | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ---

1 0

← Newer
1
...
9
10
11
12
13
14
15
...
42
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

docs-commits June 2010