Symantec Veritas Cluster Server One, Installation Manual

Page: 95 / 210

95 Setting up authentication plug-ins for VCS One
Extending the credential expiry period
Extending the credential expiry period
By default, logged-in VCS One users have a credential that expires in 24-hours.
Users who need to run commands from within client-side scripts may require
longer-term credentials.
You may change the default 24-hour expiry period to a larger value (such as two
years) at the system level. Increasing the default value makes your job easier if
the number of users with distinct passwords is relatively large.
You may change the expiry period in the authentication broker. With this
approach, a user provides their password only once. They can run VCS One
(“ha”) commands without providing it until the end of the expiry period.
If you use this method, you must collect the credentials for these users quickly,
before the expiry period can be reset to the original limit. When you are
finished, you must reset the expiry period to its original setting. No matter how
quickly you complete this process, there is a time window when other users can
log in at the same time and acquire long-term credentials. Also, AT does not
support revoking a granted credential.
Due to these issues, change the expiry period in the authentication broker only
as a last resort and when the systems are not being used by users who should not
have an extended expiry period.
To extend the expiry period
1 Display the current expiry period by entering the following command:
# /opt/VRTSvcsone/bin/haat showexpiryintervals -p plugin_name
where
plugin_name
is the authentication plug-in name (that is, vx,
unixpwd, nis, nisplus, ldap, or pam).
2 Increase the expiry period by entering the following command:
# /opt/VRTSvcsone/bin/haat setexpiryintervals -p plugin_name \
-t user -e seconds
where
seconds
indicates an expiry period in seconds. To set it for two
years, use 63,072,000 seconds.
3 Verify the change by entering the following command:
# /opt/VRTSvcsone/bin/haat showexpiryintervals -p plugin_name
4 Have the users get new credentials.
5 Reset the expiry period to its original value. Enter the following:
# /opt/VRTSvcsone/bin/haat setexpiryintervals -p plugin_name \
-t user -e 86400
6 where 86,400 indicates an expiry period of 86,400 seconds (24 hours).
Verify the change. Enter the following:
# /opt/VRTSvcsone/bin/haat showexpiryintervals -p plugin_name