Configuring DCE on HP/UX 10.20

[Justin Willoughby]

We have a vendor who has a product that can use DCE. However it's not working, or so says the vendor. Is there any HP documentation on DCE. For example, how it works and how to set it up? I think I did some searches before on the ITRC but did not find much. Maybe I was looking in the wrong place.

Thanks!

- Justin

[Alex Glennie]

see http://docs.hp.com/hpux/dev/index.html#DCE

installs under /opt/dce

basically to configure use /opt/dce/bin/dce_config and follow the appropriate prompts ....

[S.K. Chan]

Have you try ..
http://docs.hp.com/hpux/onlinedocs/B3190-90071/B3190-90071.html
ie for 10.20, it would be DCE version 1.6.

[Alex Glennie]

no offense mean't but I do not beleive there is a DCE version 1.6 available for 10.20 : you'll need 1.5

fyi I'm the UK Response Centre engineer who supports DCE :(

[S.K. Chan]

None taken .. :)
Thanks for correcting my mistake. You're right 1.6 is for 10.30 onwards.

[John Bolene]

You have to set up a DCE server or two.

Load the DCE kernel server extensions, go into SAM and DCE configuration on the server, set up the server stuff.

On each client, load the DCE client software, and configure it to access the server.

You may have to set the security options and relax them to what is needed by the application software.

This is the very high level simplified version. I can get deeper if you want.

[Justin Willoughby]

Thanks to all who replied.

I am looking over the documentation.

Does any native HP/UX process use DCE. That is if I make a change will it cause problems on my box?

The two boxes I am trying to setup are in an MC/Service Guard env.

The vendor has been trying to get DCE setup and working but has not had much luck. I have not been too involved with this up until now. The apps people have been working with the vendor on this.

Can someone give me a real general overview of DCE?

Thanks,

- Justin

[Alex Glennie]

Brief DCE Overview
DCE (Distributive Computing Environment) is middle-ware software for client/server applications. The client can run on a separate system from the server. There can be many clients talking to a server, or a given client can have more than 1 server to talk to. Any combination of 1 or clients talking to 1 or more servers is possible. Also, a server canbe a client to another server.

DCE product consists of DCE client bits and DCE server bits. DCE basic services and corresponding daemons are:

rpcd/dced - database lookup of bindings to services
cdsd - Cell directory service.
secd - Security service.
dtsd - Date/Time service.
A good reference for DCE overview is the O'Reilly & Assoc. "Understanding DCE", author Ward Rosenberry, David Kenney, and Gerry Fisher.

As to native HP processes -> yes swagentd ... swinstall and the like rely heavily on rpc communication, if a HP system is configured as a DCE cell rpcd runs as dced so if things aren't as they should be you can expect problems .... dce is very verbose .... it will log to both your syslog.log and also /var/opt/dce/svc/*.logs

what's your email address I have some info which may help wrt DCE and SG intergrations ....

What's the application involved here ..... a database ? .... encina or similar transaction s/w ?

What problems has the vendor encountered ?

DCE is IMHO quite complicated to get to grips with .....

[Justin Willoughby]

My e-mail address is jwilloug at mhc.net

The vendor is Sybase but it's not a database but their Impact product they bought from another company. The produce is an "interface engine" where as it receives, processes, sends such things has HL7 messages between systems. They have a add-on called Global Console that can be used for monitoring the system that uses DCE.

I am not sure of the exact problem the vendor is having. I was brought into the conversation about half way though and was in the middle of something else so I don't remember all of the details.

Thanks!

- Justin

[John Bolene]

Run kicking and screaming away from DCE if you can.

Setting it up and administering it can be real headaches.

If your clients are on Serviceguard, you may want to put both the server and client stuff on the same server. If you ever plan to setup more than a few clients, then set up dedicated DCE servers NOW, not later.

DCE services replace rpcd services as they are a superset of rpcd. Nothing will break by installing DCE, but at least one reboot will be needed.

Having done several configurations, I am comfortable with it now, but it was a struggle as the documentation is hard to understand. Classes are very much recommended.

DCE consists of master server processes and replica server processes on other machines if you want, and it is recommended to have at least one replica. DCE is best handled by having trusted servers, all of the client machines trusting the DCE master machine. Cell configuration can easily be done by using SAM or dcm if the machines are trusted, otherwise you have to visit each machine to configure them.

I have 3 cells setup, one test with only a master and 6 test machines, one quality with a master and 4 machines, and production with one master, one replica, and 250 client machines.

One real nice service if you want to go that way if using DCE DFS instead of NFS. DFS allows you to have shared data drives somewhere in the cell and move them at will, unlike NFS that has to be manually moved.


DCE is not for a casual application and will require knowledge, patience, and quite a lot of time to get to where you will be comfortable using it.

[Wodisch_1 · Accepted solution]

Hi Justin,

don't believe John! At least not about the running, kicking and screaming :-)

I am doing DCE administration and programming since 1989 (that's when it commercially started), and even though it *IS* a lot of work, and does need a lot of experience do make it right (in both areas: IMHO it needs admin experience to program usefully, and it needs programming experience to do the administration jobs properly), it actually does work.
And knowing it has always helped me in trouble shooting (and understanding), ads DCE and parts of it are used in HP-UX(e.g. "swinstall"), Windows (e.g. "rpcss"), OpenView Operations (e.g. Agent-Manager communication).
As for DCE itself:
- start with a redundant setup from the very beginning (2 security servers, 2 cell directory servers, multiple time-servers (if you use them at all),
- plan a meaningful name space and stick to it
- test and document the procedures to change roles: master/slave security servers, master- and additional cell directory servers,
- always test client/server communication over the network (i.e. do NOT run both on the same station when testing),
- automate all the monitoring and maintainance tasks,
- learn to script in TCL (part of "dcecp"),
- use "dce_config" instead of "SAM" (i.e. "dcm"), as you cannot use SAM with DCE on other operating systems,
- use the "US resident/domestic" version (includes encryption, though only 64bit DES), not the "international" version - NO encryption at all),
- learn to make and restore backups (online),

Not so sure wether to use DCE-DFS, as HP has stopped delivering it (available with 10.20, but not with 11.x), though I've heard rumours it might come back!

Get all the docu from docs.hp.com, and form http://www.TheOpenGroup.org (formerly know as www.osf.org).

If possible, read the book by Alexander Schill (worked on DCE at IBM, while it was created) - it is much better than the OSF one and the O'Reilly book.

Read the O'Reilly book about "DCE Security Programming" by Wei Hu (or was it Hu Wei?).
Subscribe to the mailing lists (but they are pretty silent, these days).
If needed, you can get DCE for Linux(i386), so you can run it even on your laptop...

Just like John writes: DCE is usually used in HUGE envrionments. I know one consisting of a couple of thousands of nodes (yes, it's the biggest on the planet, AFAIK), and others of hundreds of nodes.

FWIW,
Wodisch