Synchronization of password in MC/SG

[yc_2]

Hi,

Is there a way to synchronnise the password in real time for users in MC/SG environment beside using NIS service?


Thanks in advance,
YC

[Vladislav Demidov]

You can copy /etc/passwd file from one cluster node to the other using cron.

[Anthony Goonetilleke]

I once wrote a small C program to replace the passwd file on MCSG machines. It basically got the user password as ARGV and rcp'd to both machines and set it.
This way it was sync'd instantly. You can do this with a shell script as well but its a bit more insecure.

[John Palmer]

You could move /usr/bin/passwd elsewhere and replace it with a script/program that calls it on all servers in the cluster (or calls it locally and then distributes the updated /etc/passwd file).

This would probably have to be a root suid program (/usr/bin/passwd is already) because it could be called by any user.

You have to be careful when applying patches however, because a new passwd binary could be installed - overwriting your replacement.

Regards,
John

[Alan Riggs]

I agree that the best solution (if you wish to avoid NIS) is to write a program/script that distributes the passwd to both servers. I recommend, however, that you train your users to use a different password changing procedure rather than replacing the passwd binary. Tell them "use sync_passwd to keep your password synchronized across the cluster", then name your program appropriately.

This both protects you from having your program overwritten by patches/upgrades and preserves the capability to change passwd on only one system if you ever have a need to do so.

[Stephen Clark_1]

This may be highly unorthodox but please do not "flame" me as it works well for our environment.

We have a 2 node cluster where one box is serving as a database server (no one logs in here) and the 2nd, an application server. (everyone logs in here) On each server I have created a base /etc/passwd file with users that would need to log into each machine, i.e DBA, etc. This file is also copied to an "etc" directory on a volume that moves between both systems on the application package. The /etc/passwd file is replaced by a symbolic link to the location of this file i.e. /etc/passwd -> /u/etc/passwd. With the application package down I create that directory so that when the package is not running it still links to the same file.

When new accounts are created they are only created from the application package.

There are obvious drawbacks to this, as in what if someone in the base password file changes their password. Because our environment is small I can easily maintain those updates. You also need to remember to update the underlying password file in the event that the application package is still running when the password file is updated. This also does not work well for large clusters.

I'm in the process of changing this as I want to move to NIS as we are needing to maintain the passwords among several machines rather than 2.

Hope this helps.
-Steve