Trusted systems and central user management (eg NIS+)

[support_5]

Hi,

I run a site of 15 HP-UX servers, mainly running oracle applications. Management want to go "trusted systems" for our HP-UX machines and I want to implement some way of centrally managing users and groups. I was considering NIS but management want to go trusted systems and NIS is not available with trusted systems.

My dilema is: How can I centrally manage users and groups within a trusted systems architecture?

I know about NIS+ but is it worth going to NIS+? I ask this because everywhere I ask I am told that NIS+ is very very difficult to setup and maintain. Is it worth it for 15 Servers?? I question the value we would get for going to NIS+, since the application is all in house anyway (It's not an e-commerce site or anything like that), and behind our filewall systems.

Are there other mechanism to centrally manage users and groups? ie what are the other options?

I have heard of sites using rdist to distribute password files etc, but I don't think that is very secure way of transferring files, especially since it is un-encrypted (they were not running "trusted systems"). But what about if we used ssh with rdist? What are your comments on this?

What else is there about NIS+ and trusted systems that you think I should know about.

Thanks in advance.

Cheers,

- Andy Gray

[support_5]

Hi,

Surely someone has comments to make about this.

All I want to know is: is there a mechanism other than NIS+ which will enable me to centrally manage users and groups, and be able to propogate the new passwords information (either a passwd file or something else) out to other machines without sending them in clear text (ie, un-encrypted).

Any advice would be much appreciated.

- Andy Gray

[Sanjay_6]

Hi Andy,

Try these links,

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90701/B2355-90701_top.html&con=/hpux/onlinedocs/B2355-90701/00/00/72-con.html&toc=/hpux/onlinedocs/B2355-90701/00/00/72-toc.html&searchterms=trusted%7cnis&queryid=20020311-210756

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B3782-90728/B3782-90728_top.html&con=/hpux/onlinedocs/B3782-90728/00/00/39-con.html&toc=/hpux/onlinedocs/B3782-90728/00/00/39-toc.html&searchterms=trusted%7cnis&queryid=20020311-210756

Hope this helps.

Regds

[Chris Wong]

Here's an on-line addition to my book regarding NIS+:

http://newfdog.hpwebhost.com/bookupdates/article.nhtml?uid=10002

You might also find this interesting:

http://newfdog.hpwebhost.com/bookupdates/article.nhtml?uid=10003

- Chris

[Eric Ladner]

I use NIS+ to manage 5 servers.

The setup is the hard part, mainly for the learning curve. Once you get the hang of it, it's not that bad.

Make sure you have all the latets NIS+ and trusted mode patches installed before you start, it will save your hair/sanity

[support_5]

Hi,

Thanks for the replies!

I am still toying with other ideas. Has anyone considered using rdist over ssh within a trusted systems environment? I ask because this could be a good alternative way to distribute password changes and add users to a site. But are there security flaws in this design? What about problems with rdist and ssh? I suppose password changes could be difficult because a change on one box would get overridden next time the passwd file was updated and distributed.

What about ldap? It seems more likely to have a future than NIS+ does? What do others think?

Anything else?

Your comments would be much appreciated!

Cheers,

- Andy Gray

[Aksoy · Accepted solution]

Andy,

As you mentionned, you may consider using LDAP.

You need to have the ldapux package (/opt/ldapux) installed (reboot), or download it from HP site:

https://software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=J4269AA&date=

1- First step would be to have a working ldap directory, download is free from iplanet.com or hp site.

2- Setup each hp-ux system to talk to ldap, you just need to run the ~/config/setup utility. This will create an entry (ldapux profile) on ldap which will be the configuration reference for this host. You could use the same profile for all your hosts.

3- Then you may want to migrate your unix users, from /etc/passwd to ldap (some template scripts exist under ~/migrate/.

Or you could create them manually on ldap by adding the ObjectClass posixaccount to each user.

4- activate ldap:
nsswitch.conf: passwd files ldap
overwrite pam.conf with pam.ldap


Then it's all dynamic, you can create filters to validate accounts on each specific host. Only valid users are seen on the system (use nsquery passwd username or listusers).
The advantage is that you could use the same ldap server to authenticate web users, using the same account/passwd.

Preferably do it on a test system first.

Cheers
S.Aksoy

[Steve Bonds]

I've used rdist over ssh for file synchronization. The problem with rdist is locking yourself in by using "distfiles". Rsync is simpler (more like rcp) and contains a number of provisions to ensure that the /etc/passwd file is only overwritten if the entire transfer is successful.

I've also used cfengine, but this has a pretty steep learning curve on it. It is very difficult to get people to use it, and nearly impossible to get non-admins familiar with it.

In my experience rsync/ssh has been less painful than dealing with NIS+. But then, what could be more painful?

[support_5]

Hello all.

An update:

I ended up using a custom made system which consists of checking the trusted-system database and the passowrd file and when changes are made, those changes are pushed out to other hosts on the network using rcp/rdist. Actually, is a fairly complicated setup but has worked quite well for the past year now. I should release the code, maybe.

However, the desire is to still move to LDAP (on a novell server (NDS)...yes, the site uses novell for pc access).

So we are back to square one.... LDAP and a secure system.

I have since found that under HP-UX 11i, you can have shadow passwords with LDAP, but we are running 11.00, so no go there.

Any other ideas folks?

Thanks

- Andrew Gray