Syncing Passwords on 2 servers

[Marty Metras]

I am lucky to have a standby server with a standby database the is kept in sync with in an hour. If I hav a falure on the Main server I can change over in 15-30 minutes.
The only thing I am not in sync is the the unix users.
Both are HPUX 11.0 servers and are non trusted systems.
I control the new users and the users change there own passwords.
Is there a way to keep the users and passwords in sync while only maintening one server?

Marty, Doer of Things

[Pete Randall]

Marty,

There's NIS and NIS+. They'll do the job but can be complicated in and of themselves and also complicate other things. Another simple technique would be to regulary copy the password file from the main server to the standby. You could use cron, even, to do it once an hour, once a day, whatever!


Pete

[Marty Metras]

Pete,
I am already using rsync/ssh to keep most thing up to date.
If it us rsync to keep the passwd file synced is there any thing I should do to make sure the PID numbers are the same for the system stuff?
Marty

[Steven E. Protter]

NIS will work, as will copying the passwd file.

Many organizations shy away from NIS due to the complexity.

Another alternative would be to make the main server an LDAP server and have the offline server be an LDAP client.

Then the only authentications that will be out of synch would be root, which should be different anyway.

I think many organizations are moving toward LDAP because they can also handle Microsoft authentication in such a setup.

Another alternative, not as easy as Pete's but possibly a good route nonetheless.

SEP

[Hoefnix]

I have used the /etc/password replication(as posted above) in the past in the same situation. Be aware that you also need to replicatte the homedirectories of the user (can also be done using cron and for exmpl NFS shares)
Copy also /etc/group if you add groups on the main server. If you use /etc/ftpusers copy this file aswell.

REgards,

Peter Geluk

[Hoefnix]

sorry typo: I mean /etc/passwd

[Pete Randall]

Marty,

What do you mean by the "PID numbers"?


Pete

[Marty Metras]

In the passwd file like
metm:aRCxNJfnIXEmA:103:102:Marty....
the 103,102 UsedID#, and GroupID#

Marty

[Pete Randall]

Marty,

Ah, the User ID Number (UID)! If you're copying the passwd file (and the group file) from one machine to the other, they'll be identical, as will the UID numbers. Or am I missing something (I'm not really familiar with rsync/ssh).


Pete

[Jeff Schussele]

Hi Marty,

If all you're dealing with here is 2 systems then a simple cronned rcp/scp will do.
But beyond the /etc/passwd file I'd also copy the /etc/group file, the /home dir as well as the /tcb dir structure if trusted.
That way *everything* would be in sync.

My 2 cents,
Jeff