Installing and Administering Internet Services

350 Chapter 11
Secure Internet Services
Overview of the Secure Environment and the Kerberos V5 Protocol
• The HP P/SS can be configured to run with security clients using the
Secure Internet Services and fulfill the role of the KDC. An HP P/SS
security server node runs the HP P/SS security daemon secd. This
node can be configured as the only member of a single-node P/SS
domain, or as a member of a multi-node domain with HP P/SS clients.
For more information on how to configure an HP P/SS, see Planning
and Configuring Praesidium/Security Service.
The HP P/SS security server is shown as node F in Figure 11-2.
• The Non-HP Kerberos V5 KDC can be configured to run with security
clients using the Secure Internet Services. A non-HP Kerberos V5
KDC is any non-HP KDC that implements the Kerberos V5 protocol
(described in RFC 1510).
For more information, refer to your KDC provider’s documentation.
The Non-HP Kerberos V5 KDC is shown as node G in Figure 11-3.
Types of Security Clients Using Secure Internet
Services
• The HP DCE client is a node configured into a DCE cell using the
dce_config utility. The HP DCE file set DCE-Core.DCE-CORE-RUN,
which is automatically installed, must be configured on this client.
The HP Secure Internet Services mechanism must be enabled on this
client.
The Kerberos utilities kinit, klist, and kdestroy are supplied by
HP on this client. However, this client generally obtains credentials
using the dce_login command, rather than the Kerberos kinit
command. This client can use dcecp and other administrative tools
for Kerberos-related management tasks.
For more information, see Using HP DCE 9000 Security with
Kerberos Applications, available in postscript and ASCII form in the
directory /opt/dce/newconfig/RelNotes/ in the files
krbWhitePaper.ps and krbWhitePaper.text.
The HP DCE client is shown as node B in Figure 11-2.
• The HP P/SS client is a node configured into a P/SS domain using the
dess_config utility. The HP P/SS file set
DESS-Core.DESS-CORE-RUN, which is automatically installed, must
be configured on this client. The HP Secure Internet Services
mechanism must be enabled on this client.