Password Synchronization

Password Synchronization makes it easy for users to maintain one user name and password for Windows domains and UNIX systems, synchronizing the passwords when one of them changes.

Password Synchronization

Depending on how Password Synchronization and the UNIX servers are configured, synchronization can be one way or two way.

Before you begin using Password Synchronization, see “Checklist: Deploying Password Synchronization” in the Identity Management for UNIX Help.

In this section

  • Overview of Password Synchronization

  • Best Practices for Password Synchronization

  • Password Synchronization Setup

  • Password Synchronization Concepts

  • Troubleshooting Password Synchronization

  • Command-line Utility in Password Synchronization


Overview of Password Synchronization

Understanding Password Synchronization

Password Synchronization helps integrate Windows and UNIX networks by simplifying the process of maintaining secure passwords in both environments. Users are freed of the difficulty of maintaining separate passwords for their Windows and UNIX accounts or having to remember to change the password wherever it is used. With Password Synchronization, whenever a user's password is changed on a Windows-based computer or domain, the password can also be automatically changed on every UNIX host on which the user has an account. Password Synchronization can also be configured to change the user's Windows password automatically when the user's UNIX password is changed.

This enables you to administer passwords from a single computer, which simplifies work for administrators as well as individual users. Password Synchronization is also flexible: administrators can exclude specific users and computers from synchronization. Password Synchronization can synchronize passwords on stand-alone Windows-based computers (such as computers running Windows 2000 Server that do not belong to a domain) or for an entire Windows-based domain. Similarly, Password Synchronization can be used to manage passwords on individual UNIX hosts or on all computers in a Network Information Service (NIS) domain.

How Password Synchronization works

Password Synchronization propagates passwords securely by transmitting only encrypted passwords over TCP/IP sockets. This eliminates the need to use nonsecure methods (such as scripts) to administer passwords remotely. Passwords are also synchronized immediately. This means that, unlike methods such as rdist, which batches password propagation, there is no appreciable delay between the time that a password is changed on one system and when it is changed on all other affected systems. This eliminates confusion and frustration for active users. Importantly, it eliminates a potential security risk if a password must be changed to block a user's access to the network. To enhance network security further, different encryption keys can be used for each Windows-based computer and UNIX host pair.

Password Synchronization is a combination of three software components:

  • The Password Synchronization service running on one or more Windows-based computers

  • The Password Synchronization daemon running on one or more UNIX computers

  • The Password Synchronization pluggable authentication module (PAM) installed on one or more UNIX computers.

When Password Synchronization is configured for Windows-to-UNIX synchronization and a password is changed on a Windows-based computer running Password Synchronization, the Password Synchronization service determines whether the user's password is to be synchronized on UNIX computers. If it is, the service encrypts the password and sends it to the Password Synchronization daemon on each computer with which the Windows-based computer is configured to be synchronized. The daemon then decrypts the password and changes the password on the UNIX host. If the UNIX host is an NIS master server and it is configured to do so, the daemon also runs make to propagate the password change throughout the NIS domain.

When Password Synchronization is configured for UNIX-to-Windows synchronization, passwords that are changed on UNIX hosts are synchronized on Windows-based computers and domains. The Password Synchronization PAM module makes this possible by intercepting the password change request on the UNIX host, encrypting the password, and then sending the password change request to the Password Synchronization service running on the Windows-based computers with which it is configured to be synchronized.

See Also

  • Password Synchronization
  • Step-by-Step Guide to Deploying Password Synchronization


Best Practices for Password Synchronization

Best practices

  • Install Password Synchronization on appropriate domain controllers To ensure consistent synchronization of domain passwords with UNIX passwords, Password Synchronization must be installed on the primary domain controller and, in the case of a Windows 2000 domain, all domain controllers in a domain.

    • If you add a domain controller to a domain, you should install Password Synchronization on the new domain controller as soon as possible and configure it to match the other domain controllers.

    • If you need to remove Password Synchronization from any domain controller, you should demote the server to a member server before uninstalling Password Synchronization.

  • Ensure consistent password policies If you are providing only for one-way password synchronization, make sure that the password policy on the computer from which passwords will be synchronized is at least as restrictive in all areas as the policy on the computer to which passwords are synchronized. For example, if you configure Windows-to-UNIX synchronization, the Windows password policy must be at least as restrictive as the policy of the UNIX computers with which it synchronizes passwords. If you are supporting two-way synchronization, the password policies must be equally restrictive on both systems. Inconsistent password policies can result in synchronization failure when a user changes a password on the less restrictive system; or the password might be changed on the more restrictive system, even if it does not conform to the system's policies.

    Make sure that Windows users are aware of any special password restrictions on the UNIX systems with which their passwords will be synchronized. For example, some versions of UNIX support a maximum password length of eight characters. For maximum compatibility with the default Windows password policy and these UNIX limitations, passwords should be seven or eight characters long unless you are sure that all UNIX systems can support longer passwords.

  • Configure Password Synchronization to provide the maximum protection for your users' passwords

    Follow these recommendations to maintain optimal security:

    • Explicitly list the users whose passwords are to be synchronized To provide maximum control over which users can synchronize passwords, do not use the ALL keyword with the SYNC_USERS list in sso.conf on the UNIX host. Instead, you should explicitly list each user for whom password synchronization is allowed or blocked. On the Windows-based computer running Password Synchronization, create the PasswordPropAllow group and add the accounts of users whose passwords you want to synchronize. For more information, see Controlling password synchronization for user accounts.

    • Do not synchronize passwords for disabled UNIX accounts On some versions of UNIX, changing the password of a disabled user account activates that account. Consequently, if a user has a disabled account on a UNIX computer that is configured to synchronize passwords with a Windows-based computer, the user or an administrator can activate the UNIX account by changing the user's Windows password. To prevent this, use the PasswordPropDeny group to block synchronization for disabled UNIX accounts.

      Also, when an administrator disables a UNIX account, the administrator should use the SYNC_USERS entry in sso.conf to block password synchronization for the account.

    • Avoid synchronizing administrator passwords Do not synchronize passwords for members of the Windows Administrators groups or the passwords of UNIX superuser or root accounts.

    • Perform the Windows Server 2003 Service Pack 1 (SP1) compatibility check when you enable Windows to NIS (Active Directory) password synchronization in the Password Synchronization Properties dialog box, Configuration tab. To protect the security of user account passwords in your enterprise, it is strongly recommended that you allow Password Synchronization to identify all domain controllers in the forest that are not running Windows Server 2003 SP1 or later releases.

      Password Synchronization prompts you to allow the compatibility check when you select Enable in the Windows to NIS (Active Directory) password synchronization area. With Windows Server 2003 SP1, or a later release installed on all the domain controllers in a forest, the risk of exposing user password hashes to unauthorized viewers is greatly reduced. When Windows Server 2003 SP1 is not the minimum functional level of all the domain controllers in a forest, it is possible for any authenticated user on the domain to view the password hash for any UNIX user whose account has been migrated to Active Directory Domain Services (AD DS).

      In the event an unauthorized user breaks the password hash for a UNIX-based user account in AD DS, the Windows-based password for the account is no longer secure.

When Password Synchronization is installed, members of the local Administrators group and the Domain Administrators group are added to the PasswordPropDeny group, which prevents their passwords from being synchronized. If you add a user to either the Administrators or Domain Administrators group, be sure to add the user to the PasswordPropDeny group as well.

Modify the SYNC_USERS statement in the sso.conf file on all UNIX-based systems to prevent the passwords of superusers from being synchronized.

  • Do not use the default port number and encryption key Preserving the default port number and encryption key makes it possible for an attacker to set up a spoofing UNIX host to capture passwords. You should protect the port number and encryption keys used to synchronize passwords as carefully as the passwords themselves.

  • Secure the sso.conf file The sso.conf file on each UNIX host contains important configuration information that could be used to compromise security. It is recommended that you set the mode bit mask of the file to 600.

  • Ensure that the directory identified by TEMP_FILE_PATH is properly protected The temporary files created on UNIX hosts by Password Synchronization contain information that could be used by an attacker to compromise system security. For this reason, you should ensure that any directory referenced by TEMP_FILE_PATH in sso.conf has read access only for the root account and cannot be accessed by any other users.

  • Ensure log files are appropriately protected On the UNIX host, Password Synchronization uses the syslogd daemon to log messages that result from synchronization operations. The resulting logs contain such information as the names of users whose passwords are being synchronized and with which computers, propagation errors, and so on. These log files should be protected to ensure that only administrators can view them.

  • Restart the Password Synchronization daemon after changing its configuration When you make changes to the Password Synchronization daemon configuration file (sso.conf), you must stop and restart the daemon for configuration changes to take effect.

  • Configure systems to handle user name case sensitivity correctly Unless you rigorously enforce a policy to ensure that Windows and UNIX user names match in both spelling and case, verify that the CASE_IGNORE_NAME option in the sso.conf file is set to 1 (the default). UNIX user names are case sensitive; therefore, passwords might not synchronize properly if the user names do not match exactly, because the Password Synchronization daemon is unable to associate the Windows user name with the corresponding UNIX user name.

  • Make sure that password file type and name are consistent When you configure the Password Synchronization daemon, verify that the password file type (specified by USE_SHADOW) and path name (set by FILE_PATH) are appropriate for each other. For example, on most systems, if USE_SHADOW is set to 0 (to indicate that the passwd file is used for synchronization), then the FILE_PATH option should be set to /etc/passwd. However, if USE_SHADOW is set to 1 (to indicate that the shadow file is used instead), then the FILE_PATH option should be set to /etc/shadow. (On IBM AIX systems, the path and name of the shadow file is /etc/security/passwd.)


Password Synchronization Setup

In this section

  • Setting the password encryption key

  • Setting default synchronization

  • Setting the default port

  • Adding or removing computers for synchronization

  • Setting computer-specific synchronization properties

  • Setting auditing options

  • Controlling password synchronization for user accounts


Setting the password encryption key

Setting the default encryption key

Important

This setting affects the default encryption key for UNIX hosts when they are added for synchronization, as well as the port used for UNIX-to-Windows synchronization. If you change this setting, you must edit the /etc/sso.conf file to specify the same encryption key on UNIX hosts that are configured for UNIX-to-Windows password synchronization with the computer on which you complete this procedure.

To set the default encryption key

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. In the Encryption and decryption key area of the General tab, enter a key you want to use, or click Generate key to have Password Synchronization create a new key for you.

    For maximum security, you should use a key that is the maximum 21 characters in length.

  5. To save your changes, click Apply.
Note

To perform this task in the command line environment, see psadmin.

For more information about setting the password encryption key, see Password Encryption.


Setting default synchronization

Setting default synchronization

The settings in this procedure affect the default synchronization for UNIX hosts when they are added for synchronization. Settings you change in this procedure do not affect computers that have already been added for synchronization.

To set default synchronization

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. In the Direction of password synchronization area of the General tab, select the direction in which you want passwords to be synchronized.

    • To allow password synchronization from Windows-based computers to UNIX-based computers, select Windows to UNIX.

    • To allow password synchronization from UNIX-based computers to Windows-based computers, select UNIX to Windows.

  5. Click Apply to save your changes.
Note

To perform this task in the command line environment, see psadmin.


Setting the default port

Setting the default port

This setting affects the default port number for UNIX hosts when they are added for synchronization, as well as the port used for UNIX-to-Windows synchronization.

If you change this setting, you must edit the /etc/sso.conf file to specify the same port on UNIX hosts that are configured for UNIX-to-Windows password synchronization with this computer.

To set the default port

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. In the Port configuration area of the General tab, provide a new port number if needed.

    Note

    For maximum security, use a port number other than the default (6677). Before changing the default port number on a computer that is running a firewall program, check your firewall settings to verify that the firewall allows the new port number but blocks the previous port number.

  5. Click Apply.
Note

To perform this task in the command line environment, see psadmin.


Adding or removing computers for synchronization

Adding or removing computers for synchronization

In addition to adding a UNIX-based computer to the list of UNIX-based computers participating in password synchronization, if you want to change the user's password on the UNIX computer when the corresponding Windows user's password is changed, you must install the Password Synchronization single sign-on daemon (SSOD) on the UNIX-based computer. For more information, see Install the Password Synchronization daemon on UNIX-based computers.

If you want to change the Windows user's password when the corresponding UNIX-based computer user's password is changed, you must install the pluggable authentication module (PAM) on the UNIX-based computer. For more information, see Install the Password Synchronization pluggable authentication module.

Adding a computer for synchronization

To add a computer for synchronization

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, under the Password Synchronization node, click UNIX Computers, and then do one of the following.

    • Right-click UNIX Computers, and then click Add Computer.

    • Click Add Computer in the Actions pane.

    • On the Action menu, click Add Computer.

  4. In the Computer name text box of the Add Computer dialog box, provide the name or IP address of a UNIX-based computer.

  5. In the Direction of password synchronization area, select the direction of password synchronization for this computer.

  6. If necessary, specify a different encryption key than the default key, or click Generate key to have Password Synchronization generate a new key for synchronization with this computer.

  7. If necessary, change the port number this computer monitors for password changes. The default is 6677.

  8. Click OK.

Removing a computer from synchronization

To remove a computer from synchronization

  1. Open the Identity Management for UNIX snap-in by clicking Start, pointing to All Programs, and then clicking Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, under the Password Synchronization node, click UNIX Computers.

  4. In the results pane, select the UNIX-based computer that you want to remove from synchronization.

  5. With the computer selected in the results pane, do one of the following:

    • Right-click the computer, and then click Delete.

    • Click Delete in the Actions pane.

    • On the Action menu, click Delete.

  6. If you are certain you want to delete the computer from synchronization, click OK when prompted.
Note

To perform this task in the command line environment, see psadmin.


Setting computer-specific synchronization properties

Setting computer-specific synchronization properties

Before setting computer-specific synchronization properties in Password Synchronization, edit the sso.conf file on the UNIX-based computer to specify the same settings. For information about assigning computer-specific settings in the sso.conf file, see Use sso.conf to configure Password Synchronization on UNIX-based computers.

To set computer-specific synchronization properties

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, under the Password Synchronization node, click UNIX Computers.

  4. In the results pane, select the UNIX-based computer for which you want to configure properties.

  5. With the computer selected in the results pane, do one of the following:

    • Right-click the computer, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  6. On the Properties dialog box for the computer, select the direction of synchronization you want.

  7. If necessary, modify the existing password encryption key for the computer, or generate a new key.

  8. If necessary, specify a different port number that the computer monitors for password changes.

    The default port number is 6677.

  9. Click OK when your changes are complete.
Note

To perform this task in the command line environment, see psadmin.


Setting auditing options

Setting auditing options for Password Synchronization

To set auditing options for Password Synchronization

  1. Open the Identity Management for UNIX management console by clicking Start, pointing to Administrative Tools, and then clicking Microsoft Identity Management for UNIX.

    You can also open the Identity Management for UNIX management console from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Microsoft Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage by using the procedure in Connect to another computer you want to manage.

  3. In the hierarchy pane, click Password Synchronization, and then do one of the following.

    • Right-click Password Synchronization, and then click Properties.

    • Click Properties in the Actions pane.

    • On the Action menu, click Properties.

  4. On the Configuration tab of the Properties dialog box, select Enable extensive logging to instruct Password Synchronization to log detailed steps of synchronization retries.

    Clear the Enable extensive logging check box if you want Password Synchronization logs to contain fewer details about synchronization attempts.

  5. Click OK.
Note

To perform this task in the command line environment, see psadmin.


Controlling password synchronization for user accounts

Controlling password synchronization for user accounts

You can control which users' passwords are synchronized by creating two local user groups: PasswordPropAllow and PasswordPropDeny. (Use Active Directory Users and Computers to create the two groups.)

In the PasswordPropAllow group, add the user names for which passwords should be synchronized. In the PasswordPropDeny group, add user names for which passwords should not be synchronized.

Passwords are synchronized for users who are in PasswordPropAllow and are not in PasswordPropDeny.

If PasswordPropAllow does not exist, the effect is the same as if it did exist with all user names in it. If PasswordPropDeny does not exist, the effect is the same as if it did exist with no user names in it.

These rules apply to synchronization from Windows to UNIX and from UNIX to Windows. If a user's password cannot be synchronized from Windows to UNIX, it cannot be synchronized from UNIX to Windows.

You can ensure that the passwords for certain users are never synchronized, even if synchronization is allowed by the Password Synchronization server. To ensure that a UNIX user account will never have its password synchronized with the Windows password, edit the sso.conf file to place the user name of the account, preceded by a minus sign (–), after SYNC_USERS=. For example, to ensure that the password of the root account is never synchronized with a Windows account by that name, make sure that the following line appears in sso.conf:

SYNC_USERS=–root

To control password synchronization for user accounts

  1. Open Active Directory Users and Computers.

    To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

    You can also open Active Directory Users and Computers from within Server Manager, by expanding Roles and then Active Directory Domain Services in the hierarchy pane, and then selecting Active Directory Users and Computers.

  2. In the hierarchy pane of the Active Directory Users and Computers snap-in, right-click Users.

  3. Point to New, and then click Group.

  4. Name the group PasswordPropAllow.

  5. In the Group scope area, select Domain local.

  6. In the Group type area, select Security.

  7. Click OK.

  8. Repeat the entire procedure through Step 7 to create a second group, but name the second group PasswordPropDeny.

  9. In the results pane, right-click the new PasswordPropAllow group, and then click Properties.

  10. On the Members tab of the PasswordPropAllow Properties dialog box, add the names of users for whom passwords should be synchronized. Click OK to close the Properties dialog box when your additions are complete.

  11. On the Members tab of the PasswordPropDeny Properties dialog box, add the names of users for whom passwords should not be synchronized. Click OK to close the Properties dialog box when your additions are complete.
Note

There is no command-line method for this procedure.

Additional references

Use sso.conf to configure Password Synchronization on UNIX-based computers


Password Synchronization Concepts

In this section

Synchronizing Passwords with an NIS Domain

Password Encryption


Synchronizing Passwords with an NIS Domain

Synchronizing passwords with an NIS domain

By using Password Synchronization, you can provide one-way (Windows-to-UNIX) and two-way password synchronization between Windows domains and Network Information Service (NIS) domains. You can do this regardless of whether the master server of the NIS domain is running a UNIX-based operating system or is a Windows-based computer running Server for NIS.

If the NIS master server is running a UNIX-based operating system, all that is required to provide one-way synchronization is to install Password Synchronization on all Windows-based computers (for example, on the domain controllers) from which you want to synchronize passwords, and then install the single sign-on daemon (SSOD) on the NIS master server. You then edit the sso.conf file on the NIS master server to do the following:

  • Set USE_NIS to 1.

  • Set NIS_UPDATE_PATH to specify the location of the NIS makefile.

This instructs the SSOD to run the makefile and push the changed maps whenever a password change request is received from the Windows domain. For more information and additional instructions, see Install the Password Synchronization daemon on UNIX-based computers.

If Server for NIS is the master server for the NIS domain, you can provide one-way password synchronization from Windows to UNIX by selecting Enable in the Windows to NIS (Active Directory) password synchronization area of the Configuration tab in the Password Synchronization Properties dialog box. Because enabling Windows to NIS (Active Directory) password synchronization can expose passwords to greater risk of unauthorized use, selecting Enable prompts you to run a compatibility check of all domain controllers in the forest, to verify that they have the minimum security features to help protect user passwords.

If you need to synchronize passwords with UNIX computers that are not part of the NIS domain, install Password Synchronization on Windows-based Active Directory Domain Services domain controllers and configure the UNIX computers as described earlier in this topic.

You can provide UNIX-to-Windows synchronization for both types of NIS domains by doing the following.

  • If the NIS master server is running a UNIX-based operating system, configure the server for one-way synchronization as described earlier in this topic.

  • Install Password Synchronization on all domain controllers. If the NIS master server is running a UNIX-based operating system, configure Password Synchronization on Windows-based servers for two-way synchronization with the master server. Finally, add each NIS client to the list of computers with which Password Synchronization works, taking care to enable UNIX-to-Windows synchronization and disable Windows-to-UNIX synchronization. Windows-to-UNIX synchronization should be enabled only for the NIS master server. For more information about adding and configuring computers, see Adding or removing computers for synchronization and Setting computer-specific synchronization properties.

  • Install the Password Synchronization pluggable authentication module (PAM) on each NIS client, and then copy the sso.conf file from the master server to the /etc directory of those clients. For more information, see Install the Password Synchronization pluggable authentication module.

  • If the NIS master server is a Windows-based computer running Server for NIS, copy Sso.cfg to one of the NIS clients, set SYNC_HOSTS to specify the computer running Server for NIS as the Windows-based computer with which to synchronize passwords, and then copy the file to the other UNIX clients. See Use sso.conf to configure Password Synchronization on UNIX-based computers to learn more about settings in this file.

  • Configure each UNIX computer to allow users to use the yppasswd command to change their passwords. To do this, replace the yppasswd binary file on the UNIX computer with a link to the passwd binary file, and then edit the /etc/nsswitch.conf file to replace the passwd and shadow lines with the following:

    passwd:  files [NOTFOUND=continue] nis
shadow:  files [NOTFOUND=continue] nis
    After you do this, when a user runs the yppasswd command to change the user's password, it is actually the passwd binary file that is run to change the password. If the user's passwd entry is not found in the local passwd and shadow files, the NIS password is changed instead.


Password Encryption

Password encryption

A Windows-based computer can send and receive updated passwords to and from a UNIX-based computer as encrypted text only. The Password Synchronization single sign-on daemon (SSOD) receives the encrypted password and decrypts it before requesting the password change on the UNIX host. Similarly, if Password Synchronization is configured to support UNIX-to-Windows synchronization, the pluggable authentication module (PAM) encrypts the password before sending it to Password Synchronization on the Windows-based computer, which then decrypts the password before requesting the password change on the Windows-based computer.

The password can be successfully decrypted only if Password Synchronization and the SSOD or PAM module use the same encryption key to encrypt and decrypt the password. Before installing the SSOD on any UNIX computer, you must first set the default encryption key. You must then specify the same key in the sso.conf file when you install the SSOD on each UNIX host. This will ensure that Password Synchronization and the SSOD on the UNIX hosts will use the same encryption key. For more information about setting the default encryption key, see Setting the password encryption key. For information about installing and configuring the SSOD, see Install the Password Synchronization daemon on UNIX-based computers.

For added security, you can specify an encryption key that is used only between a particular Windows-based computer and a UNIX host. For information about configuring Password Synchronization to use a computer-specific encryption key, see Setting computer-specific synchronization properties. For information about setting the computer-specific encryption key on the UNIX computer, see use Use sso.conf to configure Password Synchronization on UNIX-based computers.

Encryption key requirements

The encryption key must meet the following requirements:

  • It must be 16 to 21 characters long (21 is recommended).

  • It must contain characters from at least three of the following four groups:

    • Uppercase English letters (A–Z)

    • Lowercase English letters (a–z)

    • Westernized Arabic numerals (0–9)

    • Punctuation symbols ` ~ ! @ # $ % ^ & * _ – + = | \ { } [ ] : ; \ " ' < > . ?

  • It must not contain a left or right parentheses (that is a "(" or ")" character), a comma (,), or a blank space ( ).


Troubleshooting Password Synchronization

Troubleshooting

What trouble are you having?

  • User cannot log on to UNIX system after changing Windows password

  • Passwords fail to synchronize in a Windows domain, seemingly at random

  • User's password is changed on some, but not all, computers

  • Error ID 4104 is recorded in the event log for a system account, which usually has a name ending with a dollar sign ($)

  • An error message about the encryption key is recorded in Event Viewer after Password Synchronization installation completes

  • I cannot stop the single sign-on daemon (SSOD) using kill -TERM on Linux

User cannot log on to UNIX system after changing Windows password

Cause: Windows does not report a problem if an attempt to synchronize a UNIX password with a new Windows password fails.

Solution: Check the Windows event log to determine why the attempt to change the password on the UNIX system failed.

Passwords fail to synchronize in a Windows domain, seemingly at random

Cause: Password Synchronization is not configured identically on all domain controllers in the domain. As a result, if a nonconforming domain controller accepts a user's password change, it might not be able to change the password on UNIX computers.

Solution: Ensure that Password Synchronization is configured identically on all domain controllers, particularly host settings and default settings for encryption keys and ports.

User's password is changed on some, but not all, computers

Cause: Password policies are more restrictive on some computers, user names do not match between Windows and UNIX computers, or the user changed the password on a UNIX computer when two-way synchronization is not set up.

Solution: Ensure that password policies on Windows and UNIX computers that synchronize passwords are similar. Otherwise, if the user changes the password on the less restrictive computer, the more restrictive system might not accept the new password. Password policies that govern minimum and maximum length, character case and alphanumeric mix, expiration, and reuse must be as close as possible between Windows and UNIX computers that synchronize passwords. Also, Windows and UNIX system administrators must ensure that user names, including case, are identical on the Windows and UNIX computers.

Error ID 4104 is recorded in the event log for a system account, which usually has a name ending with a dollar sign ($)

Cause: This error does not indicate a problem. It is logged when a backup domain controller or domain member server resets its secure channel with the domain. When this happens, the server password is also reset. Password Synchronization intercepts these password change requests; because they are for computer accounts rather than for user or group accounts, Password Synchronization logs error number 4104.

Solution: No corrective measures are necessary.

An error message about the encryption key is recorded in Event Viewer after Password Synchronization installation completes

Cause: This error does not indicate a problem; it is a reminder for the Password Synchronization administrator to change the default encryption key. Changing the default encryption key is a security best practice for Password Synchronization, and helps prevent unauthorized users from obtaining passwords. Typically, the description text of this error message is "Default encryption key is insecure. Please generate new encryption key." For more information about best practices, see Best Practices for Password Synchronization.

Solution: Set a new encryption key by using the procedure in the topic Setting the password encryption key.

I cannot stop the single sign-on daemon (SSOD) using kill -TERM on Linux

Cause: This is a known limitation.

Solution: Use kill 9 SSOD_PID instead.


Command-line Utility in Password Synchronization

The following command-line utility is available to administer Password Synchronization.

Command-line Utility in Password Synchronization

psadmin


psadmin

psadmin

NAME

psadmin - Windows command-line utility to manage Password Synchronization

SYNOPSIS

psadmin [computername] [common_option] [add | delete | list]
psadmin [computername] [common_option] config [config_option]

DESCRIPTION

The psadmin Windows command-line utility manages the Password Synchronization component of Identity Management for UNIX, either on a specified computer, or globally. The specific action that psadmin performs depends on the command argument you specify.

In addition to specific command arguments, psadmin accepts the following common options and arguments, represented by common_option in the command synopsis:

Term | Definition
-u username | The account name of the user whose password synchronization behavior you want to modify or view.
-p password | The password for the user account whose password synchronization behavior you want to modify or view.
-? | Displays usage information for the command.

The following configuration options are accepted by psadmin:

Term Definition

-comp name

Computer to which configuration options are applied. If -comp is unspecified, Password Synchronization modifies the default configuration settings. If -comp is the only option specified, then Password Synchronization configuration of the specified computer is displayed.

-enable direction

Specifies the direction of password synchronization. The variable direction can contain one of the following values:

WintoUnix: Synchronize password changes from computers that run Windows operating systems to computers that run UNIX operating systems.

UnixToWin: Synchronize password changes from computers that run UNIX operating systems to computers that run Windows operating systems.

BothDir: Enable two-way password synchronization.

-key keyvalue

Sets the encryption and decryption key for the computer specified by -comp. If keyvalue is random, Password Synchronization uses a random encryption key.

-port number

Sets the port number for the specified computer.

-retry number

Specifies the number of retries allowed. Because this option is a global setting, it can be used only when -comp is not used.

-interval secs

Specifies the elapsed time period, in seconds, between retries. Because this option is a global setting, it can be used only when -comp is not used.

-log [yes | no]

Enables or disables logging. Because this option is a global setting, it can be used only when -comp is not used.

-?

Displays psadmin usage and arguments.

The following command arguments are accepted by psadmin:

Term | Definition
add computername | Adds the specified computer to the list of computers participating in password synchronization.
delete computername | Deletes the specified computer from the list of computers participating in password synchronization.
list | Displays the list of computers participating in Password Synchronization.
syncSNIS [yes | no] | Enable (yes) or disable (no) automatic synchronization of passwords in the Windows to UNIX direction for all NIS accounts that have been migrated to Active Directory Domain Services (AD DS). If you add the syncSNIS parameter to the psadmin command with a "yes" value, you are prompted to perform the Windows Server 2003 Service Pack 1 (SP1) compatibility check. It is strongly recommended that you perform this check as a security best practice. For more information about the compatibility check, see Best Practices for Password Synchronization.


Remove Identity Management for UNIX Components

Identity Management for UNIX is considered a role service, or a software subcomponent, of the Active Directory Domain Services server role.

To remove Identity Management for UNIX

Using the Windows interface

Using Windows PowerShell

Using a command line

Remove Identity Management for UNIX by using the Windows interface

To remove Identity Management for UNIX by using the Windows interface

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the tree pane, expand Roles.

  3. On the role home page for AD DS, in the Roles section, in the list of common tasks, click Remove Role Services.

  4. On the Select Role Services page of the Remove Role Services Wizard, clear the check box for Identity Management for UNIX or the parts of Identity Management for UNIX that you want to remove, and then click Next.

  5. After verifying your selections on the Confirm Removal Selections page, click Remove.

    The computer must be restarted after the removal of Identity Management for UNIX finishes.
Notes
  • You must be a member of the Administrators group on the local computer to remove Identity Management for UNIX components.
  • Server Manager is available only to members of the Administrators group on the local computer. By default, Server Manager opens when an administrator logs on to the computer. You can open Server Manager from the Start menu, the Quick Launch bar, or in Administrative Tools.

Remove Identity Management for UNIX by using Windows PowerShell

You can use the Windows PowerShell set of cmdlets for Server Manager to remove Identity Management for UNIX.

To remove Identity Management for UNIX by using Windows PowerShell

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Load the Server Manager module into the Windows PowerShell session before working with Server Manager cmdlets. Type the following, and then press Enter.

    Import-Module Servermanager

    Note

    Windows PowerShell cmdlets are not case-sensitive.

  3. Do one of the following.

    • To remove all Identity Management for UNIX components, type the following, and then press Enter. Remove-WindowsFeature ADDS-Identity-Mgmt -restart

    • To remove only Password Synchronization, type the following, and then press Enter. Remove-WindowsFeature ADDS-Password-Sync -restart

    • To remove only Server for NIS, type the following, and then press Enter. Add-WindowsFeature ADDS-NIS -restart

    A restart of the computer is required after you remove Identity Management for UNIX. The -restart parameter restarts the computer automatically after removal is completed.
Note

Add the -whatIf parameter to your command to instruct Server Manager to show the list of all software that is removed by default by the command. Running the command together with the -whatIf parameter does not result in an actual removal; the command results show only what would be removed during an actual removal.

Remove Identity Management for UNIX by using a command line

Server Manager command line tools let you install or remove roles, role services, or features in a Windows Command Prompt. Identity Management for UNIX can be removed by using the Server Manager line command because it is a role service of the Active Directory Domain Services role.

You can run the Server Manager line command, ServerManagerCmd.exe, from any directory on the local computer. You must be a member of the Administrators group on the local computer to run the Server Manager command.

Important

Because of security restrictions imposed by User Account Control in Windows Server 2008 R2, you must run ServerManagerCmd.exe in a Command Prompt window opened with elevated user rights. To do this, right-click the Command Prompt executable, or the Command Prompt object on the Start menu, and then click Run as administrator.

Note

Other parameters are available for this command, such as -restart, which automatically restarts the computer after removal if it is required by the programs that you have removed. The -restart parameter is added to commands in this section, because the computer must be restarted after the removal of Identity Management for UNIX completes. We recommend that you read about additional Server Manager command line parameters in the topic "Overview of Server Manager Commands" in the Server Manager Help.

To remove Identity Management for UNIX by using a command line

  • In a Command Prompt window opened with elevated user rights, type one of the following and press ENTER.

    • ServerManagerCmd.exe -remove ADDS-Identity-Management -restart to remove all Identity Management for UNIX

    • ServerManagerCmd.exe -remove ADDS-NIS -restart to remove Server for NIS only

    • ServerManagerCmd.exe -remove ADDS-Password-Sync -restart to remove Password Synchronization only

    Note

    Add the -whatIf parameter to your command to instruct Server Manager to show the list of all software that is removed by default by the command. Running the command together with the -whatIf parameter does not result in an actual removal.The command results show only what would be removed during an actual removal.

Additional removal tasks

The single sign-on daemon (SSOD) is installed on all UNIX computers with which passwords are synchronized. If the UNIX computers are no longer synchronizing passwords with other Windows-based servers on the network running Password Synchronization, you can remove the SSOD files from the UNIX computers.

See Also

  • Identity Management for UNIX: How To...
  • Install Identity Management for UNIX Components


Identity Management for UNIX: How To...

In this section

  • Connect to another computer you want to manage

  • Install Identity Management for UNIX Components

  • Start or stop Identity Management for UNIX components

  • Remove Identity Management for UNIX Components


Use sso.conf to configure Password Synchronization on UNIX-based computers

Use sso.conf to configure Password Synchronization on the UNIX-based computer

To change settings and customize how Password Synchronization works on a UNIX-based computer, you change settings in the sso.conf file. For information about installing the sso.conf file, see Install the Password Synchronization daemon on UNIX-based computers.

The following table describes the values you can set in the sso.conf file.

Value Description

CASE_IGNORE_NAME

Specifies whether Password Synchronization will ignore differences in uppercase and lowercase letters in user names when it compares Windows and UNIX user names. To allow case-insensitive comparisons, set this entry to 1 (the default). To force Password Synchronization to use case-sensitive comparisons, set this entry to 0.

ENCRYPT_KEY

Specifies the default key used to encrypt passwords exchanged with Windows servers. You can use settings in the SYNC_HOSTS value to specify a different encryption key for a specific Windows server.

FILE_PATH

Specifies the full path and name of the passwd or shadow file (such as /etc/passwd). This file must contain the encrypted passwords for users, and the type of file (passwd or shadow) must be the same as specified by USE_SHADOW. On AIX systems, the path and name of the shadow file is /etc/security/passwd.

IGNORE_PROPAGATION_ERRORS

When set to 1, specifies that the Password Synchronization PAM module is to ignore any error that occurs when a Windows password is being changed and to continue synchronization with other hosts specified in SYNC_HOSTS.

NIS_UPDATE_PATH

Specifies the full path to the NIS makefile. This value is ignored unless USE_NIS is set to 1.

PORT_NUMBER

Specifies the default number of the port on which the Password Synchronization daemon will listen for password changes from Windows servers. You can use settings in the SYNC_HOSTS value to specify a different port number for a specific Windows server.

SYNC_DELAY

Specifies the number of seconds the Password Synchronization PAM module will wait between synchronization attempts.

SYNC_HOSTS

Specifies the Windows servers or domain controllers with which passwords are to be synchronized. In addition, you can specify a port number or encryption key (or both) for a specific server. Enclose each entry in parentheses and separate items with a blank space. You can have multiple entries on separate lines, each of which cannot exceed 269 characters. The total list of servers or domain controllers is generated by concatenating all entries. For example:

SYNC_HOSTS=(Marketing)
SYNC_HOSTS=(Sales,ASDFhjkl4321ZyXw) (Accounting,6678)
SYNC_HOSTS=(Shipping,6678,ASDFhjkl4321ZyXw)

synchronizes passwords with the Marketing server using the default port and encryption key, with the Sales server using ASDFhjkl4321ZyXw as the encryption key, with the Accounting server using 6678 as the port number, and with the Shipping server using 6678 as the port number and ASDFhjkl4321ZyXw as the encryption key.

If you use server-specific port number or encryption key settings, you must use the same values to configure Password Synchronization on the Windows server, or the passwords will not be synchronized.

SYNC_RETRIES

Specifies the number of times that the Password Synchronization PAM module will attempt to synchronize a password change with a Windows server or domain controller.

SYNC_USERS

Specifies UNIX users whose passwords are to be synchronized. You can specify ALL to synchronize passwords for all users or NONE to disable password synchronization for users. You can also specify particular users. If you specify one or more users preceded by plus signs (+), only those users will have their passwords synchronized. If you specify one or more users preceded by minus signs (–), all users except the specified users will have their passwords synchronized. For example, to allow only users bobg and kimr to synchronize their passwords, specify:

SYNC_USERS=+bobg +kimr

To prevent only root and bobg from having their passwords synchronized, specify:

SYNC_USERS=–root –bobg

The minus sign always takes precedence, regardless of the order in which entries appear. For example, the following specifies that the password for user chrisa will not be synchronized:

SYNC_USERS=+chrisa –chrisa +chrisa

TEMP_FILE_PATH

Specifies the full path of the directory to be used to hold a temporary file while the passwd or shadow file is updated. This should be the same directory in which the passwd or shadow file is located. For security reasons, only the administrator should have access to this directory.

USE_NIS

Set to 0 if Password Synchronization is not synchronizing with an Network Information Service (NIS) domain; set to 1 if Password Synchronization is synchronizing with an NIS domain. If USE_NIS is set to 1, specify a valid path for NIS_UPDATE_PATH.

USE_SHADOW

Set to 0 if the passwd file is to be used for synchronization; set to 1 if the shadow file is to be used.


Checklist: Deploying Password Synchronization

Password Synchronization helps integrate Windows and UNIX networks by simplifying the process of maintaining secure passwords in both environments. With Password Synchronization, you install utilities on your network's UNIX-based computers that detect user password changes on Windows-based computers or domains, then automatically update passwords on every UNIX host on which the users have accounts. You can also configure Password Synchronization to change the user's Windows password when the user's UNIX password is changed.

Notes

You can install Password Synchronization in any of the following three scenarios.

  • You want to synchronize passwords in an NIS domain for which the master server is a Windows-based computer running Server for NIS. See Setting up Password Synchronization for use with an NIS domain (Server for NIS master server) in this topic.

  • You want to synchronize passwords in an NIS domain for which the master server is a UNIX-based NIS server. See Setting up Password Synchronization for use with an NIS domain (UNIX-based master server) in this topic.

  • You want to synchronize passwords for users of standalone UNIX-based hosts who connect to Windows computers. See Setting up Password Synchronization for use with standalone UNIX-based hosts in this topic.

Password Synchronization can be installed only on an Active Directory Domain Services domain controller.

Setting up Password Synchronization for use with an NIS domain (Server for NIS master server)

 | Step | Reference
Check box | Read about Password Synchronization. | Overview of Password Synchronization
Check box | Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Check box | Install Password Synchronization on all domain controllers. | Install Identity Management for UNIX Components
Check box | Set the password encryption key. | Setting the password encryption key
Check box | Change other settings, as needed. Be sure to select the UNIX to Windows check box in the Direction of password synchronization area on the General tab of the Password Synchronization Properties dialog box. | Setting default synchronization; Setting computer-specific synchronization properties
Check box | Add UNIX-based computers with which passwords will be synchronized if they are not members of the Network Information Service (NIS) domain. For each computer, select the computer in the list, click Properties, clear the Synchronize password changes to this computer check box, select the Synchronize password changes from this computer check box, and then click OK. If you want to use non-default values, you can also specify values for the port number, encryption key, or both. | Adding or removing computers for synchronization

Setting up Password Synchronization for use with an NIS domain (UNIX-based master server)

 | Step | Reference
Check box | Read about Password Synchronization. | Overview of Password Synchronization
Check box | Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Check box | Install Password Synchronization on the appropriate Windows-based computers. If the passwords of local accounts on a server are to be synchronized, install Password Synchronization on the server. If Windows domain passwords are to be synchronized, install Password Synchronization on all domain controllers. | Install Identity Management for UNIX Components
Check box | Set the password encryption key. | Setting the password encryption key
Check box | Change other settings, as needed. Be sure to select the UNIX to Windows check box in the Direction of password synchronization area on the General tab of the Password Synchronization Properties dialog box. | Setting default synchronization; Setting computer-specific synchronization properties
Check box | Add the Network Information Service (NIS) master server to the list of computers with which the Windows-based computer will synchronize passwords. | Adding or removing computers for synchronization
Check box | Add UNIX-based computers with which passwords will be synchronized if they are not members of the Network Information Service (NIS) domain. For each computer, on the General tab of the Add Computer dialog box, clear the Synchronize password changes to this computer check box, select the Synchronize password changes from this computer check box, and then click OK. If you want to use non-default values, you can also specify values for the port number, encryption key, or both. | Adding or removing computers for synchronization
Check box | Specify which users have permissions to synchronize passwords. | Controlling password synchronization for user accounts
Check box | Ensure that the Password Synchronization configurations on all domain controllers in the domain are identical. |

Configuring UNIX-based computers to work with Password Synchronization

Step Reference
Check box

Install and configure the Password Synchronization single sign-on daemon (SSOD) on the NIS master server. Be sure to change the default encryption key in the sso.conf file to match the Password Synchronization encryption key set in preceding steps before copying it to the server, and edit sso.conf to specify the following:

  • USE_NIS=1

  • NIS_UPDATE_PATH=Makefile_path, where Makefile_path is the path and name of the NIS makefile, such as /var/yp/Makefile

Install the Password Synchronization daemon on UNIX-based computers

Check box

Copy the sso.conf file from the NIS master server to the /etc directory of each computer on which the Password Synchronization PAM module is installed.

Check box

On each NIS client on which you installed the Password Synchronization pluggable authentication module (PAM), replace the yppasswd binary file with a link to the passwd binary file, and then edit the /etc/nsswitch.conf file to change the passwd and shadow lines of the file, as shown:

passwd:  files [NOTFOUND=continue] nis
shadow:  files [NOTFOUND=continue] nis

Install Identity Management for UNIX Components

Check box

Start the Password Synchronization daemon on the NIS master server.

Start or stop Identity Management for UNIX components

Setting up Password Synchronization for use with standalone UNIX-based hosts

 | Step | Reference
Check box | Read about Password Synchronization. | Overview of Password Synchronization
Check box | Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Check box | Install Password Synchronization on all Windows-based domain controllers. If the passwords of local accounts on a server are to be synchronized, install Password Synchronization on the server. If Windows domain passwords are to be synchronized, install Password Synchronization on all domain controllers. | Install Identity Management for UNIX Components
Check box | Set the password encryption key. | Setting the password encryption key
Check box | Change other settings, as needed. | Setting default synchronization; Setting computer-specific synchronization properties
Check box | Add UNIX-based computers with which passwords will be synchronized if they are not members of the Network Information Service (NIS) domain. For each computer, on the General tab of the Add Computer dialog box, clear the Synchronize password changes to this computer check box, select the Synchronize password changes from this computer check box, and then click OK. If you want to use non-default values, you can also specify values for the port number, encryption key, or both. | Adding or removing computers for synchronization
Check box | Ensure that the Password Synchronization configurations on all domain controllers in the domain are identical. |

Configuring UNIX-based standalone hosts to work with Password Synchronization

 | Step | Reference
Check box | Install and configure the Password Synchronization single sign-on daemon (SSOD) on all UNIX-based computers with which passwords will be synchronized. Be sure to change the default encryption key in the sso.conf file to match the Password Synchronization encryption key set in previous steps before copying it to the UNIX-based computers. | Install the Password Synchronization daemon on UNIX-based computers
Check box | Specify which users have permissions to synchronize passwords. | Controlling password synchronization for user accounts
Check box | Start the Password Synchronization daemon. | Start or stop Identity Management for UNIX components
Check box | Install and configure the Password Synchronization PAM on all UNIX-based computers from which password changes are to be synchronized with Windows passwords. | Install the Password Synchronization pluggable authentication module

Additional references

For more information about Password Synchronization, see:

  • The Windows Server TechCenter for Active Directory Domain Services (http://go.microsoft.com/fwlink/?LinkId=48547)


Start or stop Identity Management for UNIX components

This section contains procedures for starting and stopping Server for NIS and Password Synchronization.

In this section

  • To start Server for NIS

  • To stop Server for NIS

  • To start the Password Synchronization daemon

  • To stop the Password Synchronization daemon

  • Special considerations for starting or stopping Server for NIS

To start Server for NIS

Note

Server for NIS is enabled by default following installation. To change the Server for NIS service startup type to Automatic, use the following procedure.

To set the Server for NIS service startup type to Automatic

  1. Log on to the computer as a member of the Administrators group on which you want to run Server for NIS.

  2. On the Start menu, click Run, type services.msc, and then click OK to open the Services MMC.

    -- or --

    On the Start menu, click Administrative Tools, then click Services to open the Services MMC.

  3. In the results pane, double-click Server for NIS.

  4. On the General tab of the Server for NIS Properties dialog box, select Automatic from the Startup type drop-down menu.

  5. Click OK. Close the Services MMC.
  • Using the Windows interface

  • Using a command line

Using the Windows interface

To start Server for NIS by using Windows

  1. Open the Identity Management for UNIX management console.

    To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NIS, and then click Start.

Using a command line

To start Server for NIS by using a command line

  • At a command prompt, type:

    nisadmin [server] start [–u user [–p password]]

The following table describes the arguments used with the nisadmin command to start Server for NIS.

Argument | Description
server | The name of the server you want to start.
user | The name of the user who has administrative permissions on the server to be started, if different from the current user.
password | The password of the user who has administrator permissions on the server to be started, if different from the current user. If you type a user name but omit the password, you will be prompted for the password.
Note

To view the complete syntax for this command, at a command prompt, type the following: nisadmin /?

To stop Server for NIS

  • Using the Windows interface

  • Using a command line

Using the Windows interface

To stop Server for NIS by using Windows

  1. Open the Identity Management for UNIX management console.

    To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NIS, and then click Stop.

Using a command line

To stop Server for NIS by using a command line

  • At a command prompt, type:

    nisadmin [server] stop [–u user [–p password]]

The following table describes the command arguments used with the nisadmin command to stop Server for NIS.

Argument | Description
server | The name of the server you want to stop.
user | The name of the user who has administrator permissions on the server to be stopped, if different from the current user.
password | The password of the user who has administrator permissions on the server to be stopped, if different from the current user. If you type a user name but omit the password, you will be prompted for the password.
Note

To view the complete syntax for this command, at a command prompt, type the following: nisadmin /?

To start the Password Synchronization daemon

To start the Password Synchronization daemon

  • Run the single sign-on daemon (SSOD).
Note

There is no other method for this procedure.

The sso.conf file must be in the /etc/ directory.

If you see no errors, the daemon is running. If any failures occur during the initialization of the daemon, an error message is displayed on the console. Errors may also be logged to the Syslog file.

If you want the Password Synchronization service to start automatically, add the single sign-on daemon (SSOD) to your system startup files (typically Rc.local). This will start SSOD as root.

To stop the Password Synchronization daemon

To stop the Password Synchronization daemon

  • Send the process a TERM signal by typing and entering the following at a command line:

    kill –term pid

    where pid is the process identifier of the Password Synchronization single sign-on daemon (SSOD).

Special considerations for starting or stopping Server for NIS

When Server for NIS is stopped, it does not respond to Network Information Service (NIS) requests from clients, including requests for password changes.

When Server for NIS is stopped, you can continue to make changes to NIS map data by using Active Directory Users and Computers.

UNIX-based computers respond differently when Server for NIS is stopped, however. If the UNIX-based NIS server has failed, changes to maps made by using the make utility are not updated in the NIS database.

Additionally, when Server for NIS is stopped, NIS map changes are not propagated to UNIX-based subordinate NIS servers. However, subordinate NIS servers running on Windows-based Active Directory domain controllers continue to receive updates.

See Also

  • Identity Management for UNIX: How To...
  • Install Identity Management for UNIX Components


Connect to another computer you want to manage

To connect to another computer you want to manage

Perform the following steps to manage Identity Management for UNIX on a remote computer.

To connect to another computer

  1. Open Identity Management for UNIX.

    To open Identity Management for UNIX, click Start, point to Administrative Tools, and then click Identity Management for UNIX. You can also open Identity Management for UNIX from Server Manager by expanding Active Directory Domain Services in the hierarchy pane, and then selecting the Identity Management for UNIX node.

  2. Do one of the following:

    • Right-click the Microsoft Identity Management for UNIX node in the hierarchy pane, and then click Connect to another computer. On the Select Computer dialog box, select Another Computer.

    • In the Actions pane, click Connect to another computer, and then select Another Computer.

    • With the Microsoft Identity Management for UNIX node at the top of the hierarchy pane highlighted, click Connect to another computer on the Action menu. On the Select Computer dialog box, select Another Computer.

  3. In the box, type the name or IP address of the computer to use, or click Browse.

  4. When you have identified or found the computer you want, click OK.
Notes
  • You must be logged on with an account that is a member of the Administrators group on the remote computer.
  • There is no command-line method for this procedure.

See Also

  • Identity Management for UNIX: How To...


Install Identity Management for UNIX Components

Identity Management for UNIX is considered a role service, or a software subcomponent, of the Active Directory Domain Services (AD DS) server role.

To install Identity Management for UNIX components

Using the Windows interface

Using Windows PowerShell

Using a command line

Installing Identity Management for UNIX by using the Windows interface

Important

Server for NIS and Password Synchronization can be installed only on AD DS domain controllers.

To install Identity Management for UNIX components

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the tree pane, expand Roles.

  3. On the role home page for AD DS, in the Roles section, in the list of common tasks, click Add Role Services.

  4. On the Select Role Services page of the Add Role Services Wizard, select the Identity Management for UNIX role services that you want to install, and then click Next.

  5. If the wizard prompts you to install any other role services that are required by Identity Management for UNIX components, click Yes.

  6. After verifying your selections on the Confirm Installation Selections page, click Install.

    The computer must be restarted after the installation of Identity Management for UNIX finishes.
Notes
  • You must be a member of the Administrators group on the local computer to install Identity Management for UNIX components.
  • Server Manager is available only to members of the Administrators group on the local computer. By default, Server Manager opens when an administrator logs on to the computer. You can open Server Manager from the Start menu, the Quick Launch bar, or from Administrative Tools.

Installing Identity Management for UNIX by using Windows PowerShell

You can use the Windows PowerShell set of cmdlets for Server Manager to install Identity Management for UNIX.

To install Identity Management for UNIX by using Windows PowerShell

  1. Open a Windows PowerShell session with elevated user rights. To do this, click Start, click All Programs, click Accessories, click Windows PowerShell, right-click the Windows PowerShell shortcut, and then click Run as administrator.

  2. Load the Server Manager module into the Windows PowerShell session before working with Server Manager cmdlets. Type the following, and then press Enter.

    Import-Module Servermanager

    Note

    Windows PowerShell cmdlets are not case-sensitive.

  3. Do one of the following.

    • To install all Identity Management for UNIX components, type the following, and then press Enter. Add-WindowsFeature ADDS-Identity-Mgmt -restart

    • To install only Password Synchronization, type the following, and then press Enter. Add-WindowsFeature ADDS-Password-Sync -restart

    • To install only Server for NIS, type the following, and then press Enter. Add-WindowsFeature ADDS-NIS -restart

    A restart of the computer is required when you install Identity Management for UNIX. The -restart parameter restarts the computer automatically after installation is complete.

    Note

    Add the -whatIf parameter to your command to instruct Server Manager to show the list of all software that is installed by default as a result of the command. Running the command with the -whatIf parameter does not result in an actual installation; the command results show only what would be installed by an actual installation.

Installing Identity Management for UNIX by using a command line

Server Manager command line tools allow you to install or remove roles, role services, or features in a Windows Command Prompt. Identity Management for UNIX can be installed by using the Server Manager line command because it is a role service of the Active Directory Domain Services role.

You can run the Server Manager line command, ServerManagerCmd.exe, from within any directory on the local computer. You must be a member of the Administrators group on the local computer to run the Server Manager command.

Important

Because of security restrictions imposed by User Account Control in Windows Server 2008 R2, you must run ServerManagerCmd.exe in a Command Prompt window opened with elevated user rights. To do this, right-click the Command Prompt executable, or the Command Prompt object on the Start menu, and then click Run as administrator.

Note

Other parameters are available for this command, such as -restart, which automatically restarts the computer after installation if it is required by the programs you have installed. It is recommended that you read about additional Server Manager command line parameters in the topic "Overview of Server Manager Commands" in the Server Manager Help.

To install Identity Management for UNIX by using a command line

  1. Open a Command Prompt window with elevated user rights. To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2. Type one of the following, and then press ENTER.

    • ServerManagerCmd.exe -install ADDS-Identity-Management -restart to install all of Identity Management for UNIX

    • ServerManagerCmd.exe - install ADDS-NIS -restart to install Server for NIS

    • ServerManagerCmd.exe - install ADDS-Password-Sync -restart to install Password Synchronization

    A restart of the computer is required when you install Identity Management for UNIX. The -restart parameter restarts the computer automatically after installation is finished.

    Note

    Add the -whatIf parameter to your command to instruct Server Manager to show the list of all software that is installed by default by the command. Running the command together with the -whatIf parameter does not result in an actual installation. The command results show only what would be installed by an actual installation.

Special considerations for installing or removing Server for NIS

The NIS domain

Upon installation, Server for NIS creates a Network Information Service (NIS) domain that has the same name as the AD DS domain. Administrators can add users, groups, or computers to this domain. Moreover, administrators can migrate UNIX NIS domain data to Server for NIS and designate the Server for NIS computer as the master NIS server for the migrated domain.

Removing Server for NIS in master mode

If you remove Server for NIS while it is running on a master server, you must verify that another server is assigned the tasks of the master server. If other Windows-based subordinate NIS servers are in the domains supported by the master server that you remove, you must assign one of these servers the role of master server. Server for NIS cannot be a subordinate server to a master NIS server that is running on a UNIX-based operating system.

Removing Server for NIS in subordinate mode

If you remove Server for NIS while it is running as a subordinate server, the domain controller on which it was running will continue to receive NIS map updates through AD DS Synchronization.

Additional Configuration

Server for NIS and Password Synchronization require some additional configuration before they can operate in your enterprise. Password Synchronization requires the installation of specific components on UNIX hosts that will participate in password synchronization.

For more information about additional configuration steps, see the Checklists for these technologies:

  • Checklist: Deploying Server for NIS

  • Checklist: Migrating NIS Maps to Active Directory Domain Services

  • Checklist: Deploying Password Synchronization


Install the Password Synchronization pluggable authentication module

This section contains instructions on installing the pluggable authentication module (PAM) on computers running any of the following four UNIX-based operating system families:

  • IBM AIX

  • Hewlett-Packard HP-UX

  • Red Hat Enterprise Linux

  • Sun Solaris

To install the pluggable authentication module (PAM) on AIX

Perform the following steps to install the PAM on computers running IBM AIX.

To install the PAM on AIX

  1. Copy the file pam_sso.aix from \Unix\Bins on the Windows Server® 2008 R2 product disc to /usr/lib/ on the computer running IBM AIX.

  2. Change the file name to pam_sso.aix.1.

  3. On the computer running AIX, log on as root, and then run the following command:

    chown root /usr/lib/pam_sso.aix.1 chmod 555 /usr/lib/pam_sso.aix.1

  4. If necessary, create the /etc/pam.conf file according to your network requirements, setting the owner to root and the base permissions to 644. For more information about creating the pam.conf file, see "Pluggable Authentication Modules" in System Management Guides: Security Guide in your AIX documentation.

    The following is a sample pam.conf file

    #
# Authentication management
#
OTHER   auth     required       /usr/lib/security/pam_aix

#
# Account management
#
OTHER   account  required       /usr/lib/security/pam_aix

#
# Session management
#
OTHER   session  required       /usr/lib/security/pam_aix

  5. Open /etc/pam.conf by using a text editor.

  6. In the Password management section, add the following line:

    passwd password required /usr/lib/security/pam_sso.aix.1

    The following is a sample pam.conf file with this line added.

    #
# Authentication management
#
OTHER   auth     required       /usr/lib/security/pam_aix

#
# Account management
#
OTHER   account  required       /usr/lib/security/pam_aix

#
# Session management
#
OTHER   session  required       /usr/lib/security/pam_aix

#
# Password management
#
passwd   password required       /usr/lib/security/pam_sso.aix.1

  7. Open /usr/lib/security/methods.cfg by using a text editor, and add the following lines at the end of the file:

    PAM: program = /usr/lib/security/PAM

    PAMfiles: options = auth=PAM,db=BUILTIN

  8. Open /etc/security/user with a text editor and add authentication information for the specific users whose passwords you want to synchronize. For example:

    user1:    admin = false    SYSTEM = PAMfiles[*] AND "compat"    registry = PAMfiles
Note

You can choose to change the default section of /etc/security/user to allow all users to synchronize their passwords. In this case, to restrict access to Password Synchronization, you can use the SYNC_USERS attribute in the /etc/sso.conf file to restrict access. For more information, see Use sso.conf to configure Password Synchronization on UNIX-based computers. To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 6.

To install the pluggable authentication module (PAM) on HP-UX

Perform the following steps to install the PAM on computers running Hewlett-Packard HP-UX.

To install the PAM on HP-UX

  1. Copy pam_sso.hpx from \Unix\Bins on the Windows Server 2008 R2 product disc to /usr/lib/security on the UNIX computer.

  2. Change the file name to pam_sso.hp.1, and then set its file-mode bits to 544.

    Note

    The file-mode bits for pam_sso.hp.1 must be set to 544 (o:r-x,g:r--,w:r--) or it will not function properly.

  3. On the computer running HP-UX, open /etc/pam.conf by using a text editor.

  4. In the Password management section, locate the following line:

    other    password required      /usr/lib/security/libpam_unix.1

  5. Immediately after the line located in the previous step, add the following line:

    other password required /usr/lib/security/pam_sso.hp.1
Note

To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 5. Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer.

Sample HP-UX PAM configuration file

The following file samples show a typical configuration. Actual contents of these files may vary, depending on your system configuration.

#
# PAM configuration
#
# Authentication management
#
login    auth required  /usr/lib/security/libpam_unix.1
su       auth required  /usr/lib/security/libpam_unix.1
dtlogin  auth required  /usr/lib/security/libpam_unix.1
dtaction auth required  /usr/lib/security/libpam_unix.1
ftp      auth required  /usr/lib/security/libpam_unix.1
OTHER    auth required  /usr/lib/security/libpam_unix.1
#
# Account management
#
login    account required       /usr/lib/security/libpam_unix.1
su       account required       /usr/lib/security/libpam_unix.1
dtlogin  account required       /usr/lib/security/libpam_unix.1
dtaction account required       /usr/lib/security/libpam_unix.1
ftp      account required       /usr/lib/security/libpam_unix.1
#
OTHER    account required       /usr/lib/security/libpam_unix.1
#
# Session management
#
login    session required       /usr/lib/security/libpam_unix.1
dtlogin  session required       /usr/lib/security/libpam_unix.1
dtaction session required       /usr/lib/security/libpam_unix.1
OTHER    session required       /usr/lib/security/libpam_unix.1
#
# Password management
#
login    password required      /usr/lib/security/libpam_unix.1
dtlogin  password required      /usr/lib/security/libpam_unix.1
dtaction password required      /usr/lib/security/libpam_unix.1
other    password required      /usr/lib/security/libpam_unix.1
other    password required      /usr/lib/security/pam_sso.hp.1

To install the pluggable authentication module (PAM) on Linux

Perform the following steps to install the PAM on computers running Linux.

To install the PAM on Linux

  1. Copy pam_sso.rhl from \Unix\Bins on the Windows Server 2008 R2 product disc to /lib/security on the UNIX computer, and change its name to pam_sso.so.1.

  2. On the UNIX computer, copy /etc/pam.d/system-auth to /etc/pam.d/ssod.

  3. Open /etc/pam.d/system-auth with a text editor, and locate the following line:

    password…..required…../lib/security/pam_cracklib.so…..retry=3

  4. After the line in the previous step, add the following line:

    password required /lib/security/pam_sso.so.1

  5. Locate and delete the following line:

    Password    required    /lib/security/pam_deny.so

  6. Save the modified file.
Note

These instructions apply to the typical Linux configuration. If you have configured PAM support differently, you might have to adjust these instructions to your specific configuration. To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.d/system-auth that you added in step 4. Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer.

Sample Linux PAM configuration file

The following file samples show a typical configuration. Actual contents of these files may vary, depending on your system configuration.

/etc/pam.d/passwd

#%PAM-1.0
auth       required     /lib/security/pam_stack.so service=system-auth
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth

/etc/pam.d/ssod

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/pam_unix.so nullok use_authtok shadow
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

/etc/pam.d/system-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3 type=
password    required      /lib/security/pam_sso.so.1
password    sufficient    /lib/security/pam_unix.so nullok use_authtok shadow
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

To install the pluggable authentication module (PAM) on Solaris

Perform the following steps to install the PAM on computers running Sun Solaris.

To install the PAM on Solaris

  1. Copy pam_sso.sol from the \Unix\Bins folder on the Windows Server 2008 R2 product disc to the /usr/lib/security directory on the UNIX computer, and change its name to pam_sso.so.1.

  2. On the UNIX computer, open /etc/pam.conf with a text editor.

  3. In the Password management section, locate the following line:

    other password required /usr/lib/security/$ISA/pam_unix.so.1

  4. Immediately following the line located in the step 3, add the following line:

    other password required /usr/lib/security/$ISA/pam_sso.so.1
Note

To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 4. Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer.

Sample Solaris PAM configuration file

The following file samples show a typical configuration. Actual contents of these files may vary, depending on your system configuration.

#
#ident  "@(#)pam.conf   1.14    99/09/16 SMI"
#
# Copyright (c) 1996-1999, Sun Microsystems, Inc.
# All Rights Reserved.
#
# PAM configuration
#
# Authentication management
#
login   auth required   /usr/lib/security/$ISA/pam_unix.so.1
login   auth required   /usr/lib/security/$ISA/pam_dial_auth.so.1
#
rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
rlogin  auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
dtlogin auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
rsh     auth required   /usr/lib/security/$ISA/pam_rhosts_auth.so.1
other   auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
# Account management
#
login   account requisite       /usr/lib/security/$ISA/pam_roles.so.1
login   account required        /usr/lib/security/$ISA/pam_unix.so.1
#
dtlogin account requisite       /usr/lib/security/$ISA/pam_roles.so.1
dtlogin account required        /usr/lib/security/$ISA/pam_unix.so.1
#
other   account requisite       /usr/lib/security/$ISA/pam_roles.so.1
other   account required        /usr/lib/security/$ISA/pam_unix.so.1
#
# Session management
#
other   session required        /usr/lib/security/$ISA/pam_unix.so.1
#
# Password management
#

other   password required       /usr/lib/security/$ISA/pam_unix.so.1
other  password required        /usr/lib/security/$ISA/pam_sso.so.1
dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1

#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#login  auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin        auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#other  auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin        account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  session optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass


Install the Password Synchronization daemon on UNIX-based computers

The Password Synchronization daemon must be installed on computers running a UNIX-based operating system to enable Password Synchronization to change users' passwords on those computers.

Supported UNIX-based operating systems

Password Synchronization supports synchronization with UNIX computers running any of the following operating systems:

  • Hewlett Packard HP UX 11i v1

  • IBM® AIX® version 5L 5.2 and 5L 5.3

  • Linux

    • Novell® SUSE® Linux Enterprise Server 10

    • Red Hat® Enterprise Linux® 4 server

  • SunSM Microsystems Solaris™ 10, Scalable Processor Architecture (SPARC)-compatible versions only

To install the Password Synchronization daemon

Important

The sso.conf file contains encryption keys and other sensitive information. For this reason, it must be accessible only by system administrators.

Perform the following steps to install the Password Synchronization daemon on UNIX-based computers.

To install the Password Syncronization daemon

  1. Download the file ssod.tar.gz from the Web site UNIX Side Components for Identity Management for UNIX (http://go.microsoft.com/fwlink/?LinkId=59120). Save the file to /usr/bin or /usr/local/bin on the UNIX computer, and change its name to ssod. The name of the source binary file depends on the version of UNIX you are using.

    • If the computer is running Hewlett-Packard HP-UX, the source binary file name is ssod.hpx.

    • If the computer is running Novell SUSE Linux Enterprise Server, the source binary file name is ssod.sus.

    • If the computer is running Red Hat Enterprise Linux, the source binary file name is ssod.rhl.

    • If the computer is running Sun Microsystems Solaris, the source binary file name is ssod.sol.

    • If the computer is running IBM AIX, the source binary file name is ssod.aix.

  2. Using a binary file copying method such as File Transfer Protocol (FTP) to avoid corrupting CR/LF (carriage-return/line-feed) pairs, copy Sso.cfg from \Unix\Bins on the computer running Windows Server® 2008 R2 to /etc on the UNIX computer, and change the file name to sso.conf.

  3. Open sso.conf by using a text editor.

  4. If you have changed the default encryption key, edit the following line to specify the new default key. This value must match the default key specified on all domain controllers with which this computer will synchronize passwords:

    ENCRYPT_KEY=encryptionKey

  5. If you have changed the default port, edit the following line to specify the new port. This value must match the port number specified on all domain controllers with which this computer will synchronize passwords.

    PORT_NUMBER=portNumber

  6. Edit the following line to specify one domain controller in each Windows domain with which the computer must synchronize passwords. If you have specified a nondefault port number or encryption key for the UNIX-based computer when configuring Password Synchronization on the Windows domain controllers, specify that value where indicated; otherwise, leave the value blank:

    SYNC_HOSTS=(domainController[, portNumber [, encryptionKey]]) ...

    Each entry in the list must be enclosed by parentheses and separated from the next entry by a blank space.

  7. If the computer is a Network Information Service (NIS) master server, and if you want passwords to be synchronized throughout the NIS domain, edit the following line as shown to enable NIS synchronization:

    USE_NIS=1

    Also, if required, edit the following line to specify the location of the NIS makefile:

    NIS_UPDATE_PATH=makefilePath

  8. Set the file permissions of sso.conf to read and write for the root user only, and deny access to all other users.

  9. If the computer is running a Linux-based operating system, copy /etc/pam.d/system-auth to /etc/pam.d/ssod.