Bay Networks 5390, Administering, Page: 473 / 888

893-741-B A15-53
Using Model 5390 Security
Filters can apply to one particular physical interface on the Model 5390 server or to all Model 5390
interfaces and can affect incoming or outgoing packets. An interface is a SLIP port named asyn,
where n is the port number, a PPP port named asyn or synn (again, n is the port number), or the
Ethernet port (en0).
For more details on filtering, see Filtering starting on page A13-1.
Using Kerberos Authentication
The default ACP configuration authenticates a user by checking the user name and password against
entries in the acp_passwd file. You can configure ACP to use Kerberos instead of the default
authentication process.
When building the ACP/erpcd process, a Kerberos library routine (libkrb.a) is linked with the ACP
code. ACP prompts the user for a user name and password. However, instead of validating the user
name and password via the acp_passwd file, ACP opens a connection to the Kerberos server and
passes the user name and password to the Kerberos library routine for authentication. The Kerberos
library routine returns a ticket to ACP indicating whether or not the user is authenticated.
If the Kerberos server authenticates the user, it encrypts the ticket with the user’s password before
returning it to ACP. If the Kerberos server rejects the user, it returns an error code, and ACP refuses
the login attempt. In either case, ACP calls a separate Kerberos routine to destroy the returned ticket
after the validation process.
NOTE:
You need superuser privileges not only to configure the Model
5390 server for filtering but also to create or modify filters.