Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
HP-UX AAA Server A.08.00.01 Administrator’s Guide: HP-UX 11i v2 and HP-UX 11i v3 > Chapter 3 Installing and Securing the HP-UX AAA Server

HP-UX AAA Server File Locations

» 

Technical documentation

Complete book in PDF
» Feedback
Content starts here

 » Table of Contents

 » Glossary

 » Index

Although HP-UX AAA Server can be run as root user, HP recommends running it as a non-root user.

A user and group, both named aaa, is created during installation. The HP-UX AAA Server can be run as non-root user, using the default aaa user created during installation, or any other user who is part of the aaa group.

IMPORTANT: Do not remove the default login aaa and group aaa created during installation, even if you prefer not to use them.

Table 3-1 File Locations Upon Installation

Directory

File

/opt/aaa/aatv

Server modules and plug-ins

/opt/aaa/bin

Server daemons and utilities:

  • las.test.sh: script to create simulated sessions for testing

  • radcheck: AAA Server test utility (like the ping command)

  • raddbginc: controls server debug output

  • radsignal: controls server debug output and rolls over the server log file and accounting stream

  • radiusd: AAA Server executable

  • rad_admin.sh: Tool to administer one or more HP-UX AAA Servers configured on the host

  • radpwtst: AAA test client utility

/opt/aaa/examples/config

Finite state machine, sample policy files:

  • *.fsm: Sample FSM tables

  • sqlaccess-acct.fsm: Sample FSM required to implement accounting without session management using SQL Access

  • sqlaccess-acct-sess.fsm: Sample FSM required to implement accounting with session management using SQL Access

  • *.grp: Sample decision files

  • OTP sample reference implementation files:

    • oath-request-ingress.grp

    • oath-reply-ingress.grp

    • oath-proxy-egress.grp

  • Dynamic Authorization Reference Implementation files:

    • client-request-init.grp.dynauth

    • client-reply-ingress.grp.dynauth

/opt/aaa/examples/sqlaccess/userdb

userdb: Contains the files required for management of users profile and tokens in SQL compliant database

/opt/aaa/examples/examples/sdk

Sample AATVs and plug-ins:

  • /opt/aaa/examples/sdk/ace/samplesc.c: Sample Challenge-Response Authentication AATV

  • /opt/aaa/examples/sdk/cis/checkCSI.c: Sample Pre-Authentication AATV

  • /opt/aaa/examples/sdk/sim_a3a8/sample_sim_a3a8.c: Sample EAP-SIM A3 or EAP-SIM A8 algorithm plug-in module

  • /opt/aaa/examples/sdk/aka_algo/sample_aka_algo.c: Sample EAP-AKA algorithm plug-in module

/opt/aaa/examples/sqlaccess/mysql-1

Configuration files and scripts that enable the HP-UX AAA Server to use an ODBC client to interact with a MySQL database:

  • sqlaccess.config: Sample configuration file that defines database connections, SQL statements, and RADIUS - database mappings

  • sqlaccess.config.dynauth: Sample configuration file that defines SQL actions required for implementing the dynamic authorization functionality.

  • sqlaccess.config.dynauth_server_group: Sample configuration files that define SQL actions required for implementing the dynamic authorization functionality when multiple HP-UX AAA Servers are configured as a group.

  • dbsetup.sql: Script that creates the database tables for the sample configuration and inserts a test user in a database table

  • dbsetup.sql.dynauth_server_group: Script that creates the database tables and stored procedures for the dynamic authorization sample configuration.

NOTE: Refer to Chapter 22: “SQL Access” for details on using the SQL Access feature.

For information on dynamic authorization, see Chapter 20.

/opt/aaa/examples/sqlaccess/oracle-1

Configuration file and script that enable the HP-UX AAA Server to use an OCI client to interact with an Oracle database server:

  • sqlaccess.config: Sample configuration file that defines database connections, SQL statements, and RADIUS - database mappings

  • sqlaccess.config.dynauth: Sample configuration file that defines SQL actions required for implementing the dynamic authorization functionality.

  • sqlaccess.config.dynauth_server_group: Sample configuration files that define SQL actions required for implementing the dynamic authorization functionality when multiple HP-UX AAA Servers are configured as a group.

  • dbsetup.sql: Script that creates the database tables for the sample configuration and inserts a test user in a database table

  • dbsetup.sql.dynauth_server_group: Script that creates the database tables and stored procedures for the dynamic authorization sample configuration.

NOTE: Refer to Chapter 22: “SQL Access” for details on using the SQL Access feature.

For information on dynamic authorization, see Chapter 20.

/opt/aaa/include

Header files for SDK

  • sdk.h: Header file contains the definitions for all the SDK data structures, constants and APIs.

  • plugin.h: Header file containing interfaces plug-ins

/opt/aaa/lib/dbcon/alternate

Connector libraries that enable HP-UX AAA Server to communicate with supported database clients:

  • libdbcon_oci.so: OCI client connector library

  • libdbcon_odbc.so: MySQL Unix ODBC client connector library

NOTE: Refer to Chapter 22: “SQL Access” for details on using the client connector libraries.
/opt/aaa/examples/proldap

LDAP schema and sample LDIF files

/opt/aaa/lib

Shared libraries:

  • libradlib.sl: Contains functions that interface with the main server

  • librpilib.sl: Contains functions for programs and utilities

  • libjniAgent.sl: Contains functions for Server Manager.

NOTE: Shared library files have .so file extensions on HP-UX 11i v2 (B.11.23) and HP-UX 11i v3 (B.11.31).
/opt/aaa/newconfig

Default configuration files. Files residing here are copied to /etc/opt/aaa directory during installation.

/etc/opt/aaa/security/

Directory containing a unique set of self-signed digital certificates created during installation.

/opt/aaa/share/man/man5 and ~/man1m

Directories where manpages are installed

/opt/aaa/share/doc/

Directory containing Administrator’s Guide and product documentation.

/etc/opt/aaa

Configuration files:

  • aaa.config: runtime and tunneling configuration file

  • authfile: realm to authentication-type mapping file

  • clients: client to shared secret mapping file

  • dictionary: definition file required by the radiusd daemon

  • las.conf: authorization and accounting configuration file

  • log.config: session logging configuration file

  • radius.fsm: external FSM table for the server

  • users: holds user security profiles and reply items

  • vendors: holds Internet Assigned Numbers Authority (IANA) numbers and other vendor specific details

  • engine.config: stores most of the AAA server properties.

  • EAP.authfile: configures EAP authentication for user profiles

  • iaaaAgent.conf: specifies how often the AAA server’s SNMP subagent will check to see if a master agent is active

  • aaa.config.license: Do not alter this file

  • RADIUS-ACC-SERVER-MIB.txt: describes RADIUS Accounting MIB definitions.

  • RADIUS-AUTH-SERVER-MIB.txt: describes RADIUS Authentication MIB definitions.

  • RADIUS-DYNAUTH-CLIENT-MIB.txt: RADIUS Client Dyanmic Authorization MIB definition

  • Default policy files:

    • request-ingress.grp

    • reply-egress.grp

    • proxy-egress.grp

    • proxy-ingress.grp

    • client-request-init.grp

    • client-request-egress.grp

    • client-reply-ingress.grp

 

Table 3-2 lists the files generated during operation and located in /var/opt/aaa/ by default:

Table 3-2 Files Generated During Operation

Directory

File
/acct/session.yyyy-mm-dd.log

Default session accounting logs, Merit style

/data/session.lasCurrently active sessions log file
/ipc/*.sm

Shared memory files related to the interface used for some authentication types.

IMPORTANT: You must not alter or delete the shared memory (*.sm) files. The server does not operate correctly if the files are changed or removed from the ipc directory.
/logs/logfile

The server log file

/logs/logfile.yyyymmdd

Compressed daily or weekly log files

/radacct/*

For session accounting logs in Livingston call detail records directory style format (not generated by default configuration)

/run/radius.pid

Contains the process id (pid) for the server.

 

Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© Hewlett-Packard Development Company, L.P.