pegasus/src/Executor/notes.txt - diff

Return to notes.txt CVS log

Up to [Pegasus] / pegasus / src / Executor

Diff for /pegasus/src/Executor/notes.txt between version 1.1 and 1.1.4.3

version 1.1, 2006/12/28 03:59:20

version 1.1.4.3, 2007/04/20 14:39:14

Line 0

Line 1

1. The user that runs cimervermain is determined by the

PEGASUS_CIMSERVERMAIN_USER constant defined in

2. All files but the repository are owned by root. The cimservermain

process may read the root owned files, but it must ask the executor

to modify them.

3. Cimservermain owns the local-domain socket file (/tmp/cimxml.socket).

4. The executor now detects whether the CIM server is already running.

5. For logging purposes, the executor uses "cimserver" as its syslog

identifier.

6. Setting up PAM authentiction (non-standalone).

First compile with PEGASUS_PAM_AUTHENTICATION.

Next install the PAM configuration file.

% cd $PEGASUS_ROOT

% cp rpm/wbem /etc/pam.d

% chmod 0644 /etc/pam.d/wbem

7. To build for standalone PAM authentication, compile with these:

PEGASUS_PAM_AUTHENTICATION

PEGASUS_USE_PAM_STANDALONE_PROC

8. To run cimserver to use PAM, use these configuration parameters.

enableAuthentication=true

9. To build SSL support, compile with these.

OPENSSL_HOME=/usr

PEGASUS_HAS_SSL=true

10. To run cimerver to use SSL, use these configuration parameters.

enableHttpsConnection=true

enableAuthentication=true

sslClientVerificationMode=optional

sslTrustStoreUserName=root

11. To add a user to cimserver.passwd, use the following format (the given

user must be a real system user).

jsmith:AB5bZ.JX9fQzA

Use the following program to generate the password (at least on

Linux).

#define _XOPEN_SOURCE

#include <unistd.h>

#include <stdio.h>

int main()

{

printf("%s\n", crypt("changeme", "AB"));

return 0;

}

Compile and link the program as follows.

% gcc -o mkpasswd mkpasswd.cpp -lcrypt

12. The KerberosAuthenticationHandler.h and all Kerberos authentication

logic is not part of the Pegasus repository.

13. The following authentication schemes were rewritten and are now

part of the executor.

- PAM Basic Authentication

- PAM Basic Authentication, using cimservera program.

- Secure Local Authenticaiton

- Secure Basic (uses cimserver.passwd file).

The following authentication schemes still reside in cimservermain.

- SSL peer authentication

- Kerberos (source not available to Pegasus).

14. Note that using "secure basic" authentication and "SSL peer

authentication" togehter breaks the end-to-end tests (validate

user fails since the user is not in the cimserver.passwd file).

15. The install script is responsible for propertly setting ownership

of all files (including the Pegasus repository).

Legend:

Removed from v.1.1
changed lines
	Added in v.1.1.4.3

No CVS admin address has been configured