IBM RS/6000 SP, Руководство по определению проблем

Страница: 96 / 316

This soft copy for use by IBM employees only.
3.5.3 kpropd Daemon
The kpropd daemon only runs on secondary authentication servers (if one or
more have been set up). The authentication databases used by the secondary
authentication servers are copies of the primary database. The databases are
maintained by the kpropd daemon, which receives the database content in
encrypted form from a program, kprop, which runs on the primary server.
Secondary databases can be updated by scheduling execution of a script,
/usr/kerberos/ run-kprop, in the root crontab.
The kpropd daemon listens for requests on the krb_prop /tcp port. If this port is
not defined in the /etc/services file, it uses port 754.
3.5.4 /etc/services File
The /etc/services file used on PSSP 2.1.0 is not consistent with the previously
discussed naming convention for the Kerberos daemon services.
kerberos 88/tcp # Kerberos
kerberos 88/udp # Kerberos
kerberos-adm 749/tcp # kerberos administration
kerberos-adm 749/udp # kerberos administration
rfile 750/tcp
loadav 750/udp
pump 751/tcp
pump 751/udp
qrh 752/tcp
qrh 752/udp
rrh 753/tcp
rrh 753/udp
tell 754/tcp
tell 754/udp
Figure 24. Extract f r o m the /etc/services File
Users must be aware of these potential conflicts when using third party Kerberos
servers. If the kerberos and kadmind daemons are running, then the netstat -a
command should return the following:
root@sp21cw0 / > netstat -a &pipe. grep loadav
udp
0 0 *.loadav *.*
root@sp21cw0 / > netstat -a &pipe. grep pump
tcp
0 0 *.pump *.* LISTEN
Figure 25. Example Using netstat C o m m a n d
3.5.5 Databases
The authentication database is created by the command kdb_init, which is called
from the setup_authent script. The authentication database is made up of two
binary files:
• /var/kerberos/database/principal.pag
•
/var/kerberos/database/principal.dir
76
SP PD Guide