topic Re: Syncing Passwords on 2 servers in Operating System - HP-UX

Syncing Passwords on 2 servers

Marty Metras — Thu, 15 Jan 2004 10:53:06 GMT

I am lucky to have a standby server with a standby database the is kept in sync with in an hour. If I hav a falure on the Main server I can change over in 15-30 minutes.
The only thing I am not in sync is the the unix users.
Both are HPUX 11.0 servers and are non trusted systems.
I control the new users and the users change there own passwords.
Is there a way to keep the users and passwords in sync while only maintening one server?

Marty, Doer of Things

Re: Syncing Passwords on 2 servers

Pete Randall — Thu, 15 Jan 2004 10:57:15 GMT

Marty,

There's NIS and NIS+. They'll do the job but can be complicated in and of themselves and also complicate other things. Another simple technique would be to regulary copy the password file from the main server to the standby. You could use cron, even, to do it once an hour, once a day, whatever!

Pete

Re: Syncing Passwords on 2 servers

Marty Metras — Thu, 15 Jan 2004 11:01:39 GMT

Pete,
I am already using rsync/ssh to keep most thing up to date.
If it us rsync to keep the passwd file synced is there any thing I should do to make sure the PID numbers are the same for the system stuff?
Marty

Re: Syncing Passwords on 2 servers

Steven E. Protter — Thu, 15 Jan 2004 11:04:14 GMT

NIS will work, as will copying the passwd file.

Many organizations shy away from NIS due to the complexity.

Another alternative would be to make the main server an LDAP server and have the offline server be an LDAP client.

Then the only authentications that will be out of synch would be root, which should be different anyway.

I think many organizations are moving toward LDAP because they can also handle Microsoft authentication in such a setup.

Another alternative, not as easy as Pete's but possibly a good route nonetheless.

SEP

Re: Syncing Passwords on 2 servers

Hoefnix — Thu, 15 Jan 2004 11:04:50 GMT

I have used the /etc/password replication(as posted above) in the past in the same situation. Be aware that you also need to replicatte the homedirectories of the user (can also be done using cron and for exmpl NFS shares)
Copy also /etc/group if you add groups on the main server. If you use /etc/ftpusers copy this file aswell.

REgards,

Peter Geluk

Re: Syncing Passwords on 2 servers

Hoefnix — Thu, 15 Jan 2004 11:06:30 GMT

sorry typo: I mean /etc/passwd

Re: Syncing Passwords on 2 servers

Pete Randall — Thu, 15 Jan 2004 11:08:53 GMT

Marty,

What do you mean by the "PID numbers"?

Pete

Re: Syncing Passwords on 2 servers

Marty Metras — Thu, 15 Jan 2004 11:12:15 GMT

In the passwd file like
metm:aRCxNJfnIXEmA:103:102:Marty....
the 103,102 UsedID#, and GroupID#

Marty

Re: Syncing Passwords on 2 servers

Pete Randall — Thu, 15 Jan 2004 11:16:58 GMT

Marty,

Ah, the User ID Number (UID)! If you're copying the passwd file (and the group file) from one machine to the other, they'll be identical, as will the UID numbers. Or am I missing something (I'm not really familiar with rsync/ssh).

Pete

Re: Syncing Passwords on 2 servers

Jeff Schussele — Thu, 15 Jan 2004 11:21:45 GMT

Hi Marty,

If all you're dealing with here is 2 systems then a simple cronned rcp/scp will do.
But beyond the /etc/passwd file I'd also copy the /etc/group file, the /home dir as well as the /tcb dir structure if trusted.
That way *everything* would be in sync.

My 2 cents,
Jeff

Re: Syncing Passwords on 2 servers

Marty Metras — Thu, 15 Jan 2004 11:25:19 GMT

I thought the UID and Group ID numbers was what the system used for the files so it knew who owned the files.
Say a file was owned be user METM and Group VISIB. In the passwd file these are 102,103.
Does the system uses the numbers or the names to keep things straight.
Meaning if I copy the passwd file to the Standby server and the UID Nos do not match will this be a problem now. Right now some of then do not match on the 2 servers.
Marty

Re: Syncing Passwords on 2 servers

Marty Metras — Thu, 15 Jan 2004 11:28:03 GMT

I under stannd the passwd, group, userso home must be coppied I'm just confused about the Passwd file and the UID numbers. It might not be an issue. It is just because right now they do not match.
Marty

Re: Syncing Passwords on 2 servers

Hoefnix — Thu, 15 Jan 2004 11:29:46 GMT

If the numbers do not match on both servers, the ownership of files can change after copy etc/passwd. It uses the UID's to keep track of the ownerships.

Regards,

Peter

Re: Syncing Passwords on 2 servers

Jeff Schussele — Thu, 15 Jan 2004 11:30:42 GMT

Everything in the system is done by the UID - which then looks up the name out of the passwd file. If no match then only the # is displayed.
You *must* match UID <=> name between systems. BUT this would be accomplished on the first copy anyway. But it's also possible that then you'll have files owned by now non-existent UIDS & you'd have to find & change them all. So map out the name to UID before changing so you know what to change & to whom.

Rgds,
Jeff

Re: Syncing Passwords on 2 servers

Pete Randall — Thu, 15 Jan 2004 11:34:55 GMT

The issue with UIDs then, would be that existing files are owned by UID 1234 (Marty) for example. After copying, the files would be still be owned by UID 1234 and this would not translate to Marty. You'll need to set up a one time chown script either going by home directory or using find -user to straighten the ownership out.

Pete

Re: Syncing Passwords on 2 servers

Marty Metras — Thu, 15 Jan 2004 13:12:17 GMT

OK, I understand now.
I have to make the Standby servers UID match the Primary served first. Most match now.
If I understand your messages, I can change the UID's that do not match on the standby box and change the ownership on the few files that they own.
Once done, I should beable to copy the passwd, group and User's directories and I should be set to keeping then in sync.

Marty

Re: Syncing Passwords on 2 servers

Jeff Schussele — Thu, 15 Jan 2004 13:14:54 GMT

Absolutely - you have it down now.

Rgds,
Jeff

Re: Syncing Passwords on 2 servers

Pete Randall — Thu, 15 Jan 2004 13:19:35 GMT

Yep, you've got it, O Mighty Doer of Things!!

Pete

Re: Syncing Passwords on 2 servers

Marty Metras — Thu, 15 Jan 2004 13:51:21 GMT

Thanks guys.
Again you have cleared up my thoughts.
You have saved me more work. That is right after I do some more things.
Marty

Re: Syncing Passwords on 2 servers

Pete Randall — Thu, 15 Jan 2004 13:59:35 GMT

Marty,

I had one last thought: I don't think my suggestion about the find command will work so you'll need to do it either by home directory or by pre-building a list of files for each user (the find command could be used for this, though).

Good luck,

Pete