How to Create user accounts in three servers without affecting the security?

[Richard Woolley]

All,

We have three hpux servers and one of them is 11i and other two are 11.

Is there a secure and simple method to create users in single step in all servers?

We currently use a script to copy /etc/passwd and group on all servers.

thanks
Thomas

[Geoff Wild]

Well, you could install Servicecontrol manager 3.0

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B8339BA3.0

or HP Systems Insight Manager - HP-UX

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T2414BA

Looks like the direction is to go to HP Systems Insight Manager - HP-UX - but both appear to provide central management...


Rgds...Geoff

[Donald Kok]

There is a secure and a simple way:
- simple, but not secure: nis
- secure, but not simple: nis+

[baiju_3]

You may consider adding the user in one server and duplicate the same in other user .

Copying passwd and group file is not recommented .

Better create a shell script which will do the follwing .

add user in the remote system using useradd.

copy the tcb file and profiles to remote nodes.

Update the secondary group information on remote nodes.

Regards,
BL.

[Martin Brachtl]

There is one more possibility, LDAP. This could be even more secure than NIS+, and also more complicated. I'm not sure, if the pam modules are available on HP-UX11.

[Geoff Wild]

You couldn't pay me enough to use NIS...

Stick with the HP products - or if you have the cash, check out KEON - Unix Control:

http://www.tfstech.com/solutions/servercontrol/index.htm

Looks like it is now called "Server Control" - I guess I need to do an upgrade.

Rgds...Geoff

[Tim Nelson]

The below is how we address this with our 25 servers.

One server has the master list(basically a copy or recreation of the /etc/passwd file) of userids etc. I have created a script that is run by a non root user to add users. This script looks first in the master file. If found it takes all the information from the master password file parses out each piece of needed info and creates a script ( the script is basially just the useradd command with the correct uid, gid, comment, etc) This script is rcp'd as a normal user to each server or a specified one.
Then login to each other server as root. execute the script and user is added.

This method negates the need for root to have remsh or rcp accross servers and negates the need for all the problems associated with NIS.

Tweak this method to suit your needs.

The intent of the master file is to keep UIDs and GIDs consistant when creating new accounts.

Best of luck.(don't forget to assign points)

[Richard Woolley]

Thanks everyone,

I will get thomas to asign some points.

cheers

Richard

[Florian Heigl (new acc)]

hmmm, when I look at the requirements You ask:

using useradd through ssh would comply with that and be quite easily integrated.
:)

flo