F5 ARX-VE, Planning Manual

Page: 41 / 64

Preparing for Use in an Active Directory Domain
ARX Site Planning Guide 1 - 35
*** slot_0 primary control station ***
[nasadmin@emc01 ‐ mgt nasadmin]$ server_file server_2 ‐ get passwd passwd.new
server_2 : done
[nasadmin@emc01 ‐ mgt nasadmin]$ vi passwd.new
Add the following line to the bottom of the “passwd.new” file:
jqpublic::0:0:jqpublic:/:/bin/bash
Then install the new passwd file and exit the EMC CLI:
[nasadmin@emc01 ‐ mgt nasadmin]$ server_file server_2 ‐ put passwd.new passwd
server_2 : done
[nasadmin@emc01 ‐ mgt nasadmin]$ exit
Connection to 192.168.25.51 closed.
rh1:/# ...
Preparing for Use in an Active Directory Domain
This section applies to Windows installations that support Active Directory
(AD) domains. These installations use Kerberos authentication and require
some special configuration at the Domain Controller (DC) machine.
Figure 1.12 shows how the ARX acts as a resource proxy between clients
and servers. In its role as a proxy, it must carry the identity of a client user
through to the back-end servers. This allows for already-established Access
Control Lists (ACLs) to continue their role in controlling access to files.
This also makes the ARX transparent to users in an AD domain. The ARX
authenticates a client once, using Kerberos, then uses the client’s credentials
to access any server that contains a requested file.