Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Руководство администратора

Страница: 378 / 840

Automated Enrollment
378 Red Hat Certificate System Administrator’s Guide • September 2005
• Adds the necessary schema for pins to the LDAP directory.
• Adds a pin manager user who has read-write permissions to the pins that are set up.
• Sets up ACIs to allow for pin removal once the pin has been used, giving read-write
permissions for pins to the pin manager, and preventing users from creating or
changing pins.
• Creates pins in each user entry.
The pin tool is located in the following directory:
<server_root>/bin/cert/tools
This tool comes with its own documentation in this location, and is also documented in the
CS Command-Line Tools Guide .
To use the pin tool:
1.
Go to the following directory:
<server_root>/bin/cert/tools
2.
Open the
setpin.conf
file in a text editor.
3.
Follow the instructions outlined in the file and make the appropriate changes.
Typically, you will need to update the Directory Server’s host name, Directory
Manager’s bind password, and PIN manager’s password.
4.
Run the
setpin
command with its
optfile
option pointing to the
setpin.conf
file
(
setpin optfile=setpin.conf
).
The tool modifies the schema with a new attribute (by default,
pin
) and a new object
class (by default,
pinPerson
), creates a
pinmanager
user, and sets the ACI to allow
only the
pinmanager
user to modify the
pin
attribute.
5.
If you want to generate PINs for specific user entries, or want to provide your own
PINs, you can add these pins using an input file. For information on constructing an
input file, see the PIN Generator documentation.
6.
Run the
setpin
command to create hashed pins in the directory.
You can run the tool first without the
write
option to generate a list of pins without
actually changing the directory.
For example:
./setpin host=yourhost port=9446 length=11 input=infile
output=outfile write "binddn=cn=pinmanager,o=example.com"
bindpw="netscape" basedn=o=netscape.com "filter=(uid=u*)"