Sun Secure Global Desktop 4.5 Administration Guide Sun Microsystems, Inc. www.sun.com Part No. 820-6689-10 April 2009, Revision 01 Submit comments about this document at: http://docs.sun.com/app/docs/form/comments Copyright 2008-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A. All rights reserved. Sun Microsystems, Inc. has intellectual property rights relating to technology that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.sun.com/patents and one or more additional patents or pending patent applications in the U.S. and in other countries. U.S. Government Rights - Commercial software. Government users are subject to the Sun Microsystems, Inc. standard license agreement and applicable provisions of the FAR and its supplements. This distribution may include materials developed by third parties. Parts of the product may be derived from Berkeley BSD systems, licensed from the University of California. UNIX is a registered trademark in the U.S. and in other countries, exclusively licensed through X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, Solaris, OpenSolaris, Java, JavaScript, JDK, JavaServer Pages, JSP,JavaHelp, JavaBeans, JVM, JRE, Sun Ray, and StarOffice are trademarks or registered trademarks of Sun Microsystems, Inc. or its subsidiaries in the United States and other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and in other countries. Products bearing SPARC trademarks are based upon an architecture developed by Sun Microsystems, Inc. Adobe is the registered trademark of Adobe Systems, Incorporated. ICA is a registered trademark of Citrix Systems, Inc. Intel is a trademark or registered trademark of Intel Corporation or its subsidiaries in the United States and other countries. Netscape is a trademark or registered trademark of Netscape Communications Corporation in the United States and other countries. Products covered by and information contained in this service manual are controlled by U.S. Export Control laws and may be subject to the export or import laws in other countries. Nuclear, missile, chemical biological weapons or nuclear maritime end uses or end users, whether direct or indirect, are strictly prohibited. Export or reexport to countries subject to U.S. embargo or to entities identified on U.S. export exclusion lists, including, but not limited to, the denied persons and specially designated nationals lists is strictly prohibited. DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. Copyright 2008-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, Californie 95054, États-Unis. Tous droits réservés. Sun Microsystems, Inc. détient les droits de propriété intellectuels relatifs à la technologie incorporée dans le produit qui est décrit dans ce document. En particulier, et ce sans limitation, ces droits de propriété intellectuelle peuvent inclure un ou plus des brevets américains listés à l’adresse http://www.sun.com/patents et un ou les brevets supplémentaires ou les applications de brevet en attente aux Etats - Unis et dans les autres pays. Cette distribution peut comprendre des composants développés par des tierces parties. Des parties de ce produit pourront être dérivées des systèmes Berkeley BSD licenciés par l’Université de Californie. UNIX est une marque déposée aux Etats-Unis et dans d’autres pays et licenciée exclusivement par X/Open Company, Ltd. Sun, Sun Microsystems, le logo Sun, Solaris, OpenSolaris, Java, JavaScript, JDK, JavaServer Pages, JSP,JavaHelp, JavaBeans, JVM, JRE, Sun Ray, et StarOffice sont des marques déposées ou enregistrées de Sun Microsystems, Inc. ou ses filiales aux Etats-Unis et dans d’autres pays. Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des marques déposées de SPARC International, Inc. aux Etats-Unis et dans d’autres pays. Les produits portant les marques SPARC sont basés sur une architecture développée par Sun Microsystems, Inc. Adobe est une marque enregistrée de Adobe Systems, Incorporated. ICA est une marque enregistrée de Citrix Systems, Inc. Intel est une marque déposée ou enregistrée de Intel Corporation ou ses filiales aux Etats-Unis et dans d’autres pays. Netscape est une marque de Netscape Communications Corporation aux Etats-Unis et dans d’autres pays. Les produits qui font l’objet de ce manuel d’entretien et les informations qu’il contient sont regis par la legislation americaine en matiere de controle des exportations et peuvent etre soumis au droit d’autres pays dans le domaine des exportations et importations. Les utilisations finales, ou utilisateurs finaux, pour des armes nucleaires, des missiles, des armes biologiques et chimiques ou du nucleaire maritime, directement ou indirectement, sont strictement interdites. Les exportations ou reexportations vers des pays sous embargo des Etats-Unis, ou vers des entites figurant sur les listes d’exclusion d’exportation americaines, y compris, mais de maniere non exclusive, la liste de personnes qui font objet d’un ordre de ne pas participer, d’une facon directe ou indirecte, aux exportations des produits ou des services qui sont regi par la legislation americaine en matiere de controle des exportations et la liste de ressortissants specifiquement designes, sont rigoureusement interdites. LA DOCUMENTATION EST FOURNIE "EN L’ÉTAT" ET TOUTES AUTRES CONDITIONS, DÉCLARATIONS ET GARANTIES EXPRESSES OU TACITES SONT FORMELLEMENT EXCLUES DANS LA LIMITE DE LA LOI APPLICABLE, Y COMPRIS NOTAMMENT TOUTE GARANTIE IMPLICITE RELATIVE À LA QUALITÉ MARCHANDE, À L’APTITUDE À UNE UTILISATION PARTICULIÈRE OU À L’ABSENCE DE CONTREFAÇON. Please Recycle Contents Preface xxxv 1. Networking and Security 1 Overview of Networks and Security 1 Connections Between Client Devices and SGD Servers 2 Connections Between SGD Servers and Application Servers 3 Connections Between SGD Servers in an Array 4 The SGD Gateway 4 DNS Names 5 Configuring External DNS Names 6 Changing the Peer DNS Name of an SGD Server 7 Proxy Servers 9 Supported Proxy Servers 10 Configuring Client Proxy Settings 10 Proxy Server Timeouts 12 Configuring Server-Side Proxy Servers 13 Firewalls 14 Firewalls Between Client Devices and SGD Servers 15 Firewalls Between SGD Servers 16 Firewalls Between SGD Servers and Application Servers 17 v Other Firewalls 19 Securing Connections Between Client Devices and SGD Servers 20 Setting Up Secure Client Connections 21 Using Server SSL Certificates 23 Enabling SGD Security Services With Automatic Configuration 32 Using HTTPS Connections to the SGD Web Server 34 Using Firewall Traversal 35 Securing SOAP Connections to an SGD Server 37 Enabling SGD Security Services 40 Using Connection Definitions 41 Client Connections and Security Warnings 43 The SSL Daemon 48 Selecting a Cipher Suite for Secure Client Connections 50 Using External SSL Accelerators 52 Securing Connections Between SGD Servers 53 Using Secure Intra-Array Communication 53 Managing CA and Peer SSL Certificates 55 ▼ How to Enable Secure Intra-Array Communication 55 Selecting a Cipher Suite for Secure Intra-Array Communication 57 Securing Connections to Application Servers with SSH 59 SSH Support 59 Configuring the SSH Client 60 Enabling X11 Forwarding 61 Using SSH and the X Security Extension 62 Using SSH and X Authorization 62 Using Advanced SSH Functions 63 2. User Authentication 65 Secure Global Desktop Authentication 65 vi Sun Secure Global Desktop 4.5 Administration Guide • April 2009 User Identity 66 User Profile 67 System Authentication Mechanisms 67 Password Expiry 68 Security and Passwords 69 Application Authentication 70 Login Scripts 71 Configuring Application Authentication 71 The Application Server Password Cache 72 Using RSA SecurID for Application Authentication 74 Supporting Users in Different Locales 75 Active Directory Authentication 76 How Active Directory Authentication Works 76 Setting Up Active Directory Authentication 77 Configuring SGD for Kerberos Authentication 78 ▼ How to Enable Active Directory Authentication 82 ▼ How to Configure SSL Connections to Active Directory 83 Anonymous User Authentication 85 How Anonymous User Authentication Works 85 ▼ How to Enable Anonymous User Authentication 86 LDAP Authentication 87 How LDAP Authentication Works 87 Supported LDAP Directory Servers 88 ▼ How to Enable LDAP Authentication 89 Restricting the LDAP Users That Can Log In to SGD 91 SecurID Authentication 92 Supported Versions of SecurID 92 How SecurID Authentication Works 92 Contents vii Setting Up SecurID Authentication 93 Configuring SGD servers as Agent Hosts 94 ▼ How to Enable SecurID Authentication 95 Third-Party and Web Server Authentication 95 How Third-Party Authentication Works 96 ▼ How to Enable Third-Party Authentication 98 Web Server Authentication 100 Enabling Web Server Authentication 101 Using Authentication Plug-ins With Web Server Authentication 104 Using Client Certificates With Web Server Authentication 105 SGD Administrators and Third-Party Authentication 107 Trusted Users and Third-Party Authentication 107 UNIX System Authentication 109 How UNIX System Authentication Works 110 UNIX System