User passwords & cron jobs?

[brian nelson_1]

Hi, I'm building a new 2 node cluster from 2 existing HPUX servers. We have users that login using "xterm" sessions to both of these servers. My question is how do i sync up the 2 servers in regards to the users' passwords? We allow the users to maintain their own passwords but since i'm creating new unix accounts for many users on both nodes, i don't know how i can set the same password for both nodes for these users without asking them for their passwords (which i'd hate to do). Any suggestions would be appreciated. Also, how would i go about changing the cron jobs related to my cluster pkgs in the case of a node failover? Thanks again for your advise.

[Sanjay_6]

Hi Brian,

Do remeber that the userid of all the users should be same on both the nodes. You can use NIS to maintian the user id and password information. That way you won't have to worry about changing the passowrd on both the nodes individually.

My suggestion would be to have the cron job to be same on both the nodes and before running the cron job pertaining to a particular package the script should check the existance of package on that node. If it exist, the rest of the job is executed or it exits without doing anything.

At the same time the same script is running on the other node and if the package exists over there, it is executed over there, or else it fails.

Hope this helps.

thanks

[Steve Bonds]

User Passwords:

The easy way is to cut and paste the relevant sections out of the /etc/passwd file on one node and put them on the second. NIS is another way to keep things synced, but this is hideously insecure. NIS+ is so secure that it's unusable.

Welcome to the wonderful world of system administration! I know of no good solution to the "how do I sync users/software" quandry. (But I'd be glad to listen to ideas from other folks here.)

Cron Jobs:

I'm thinking about abandoning cron altogether. It's just too node-specific. Instead I'm considering having a little scheduler daemon run as part of each package normally using cron.

A short perl script using Proc::Daemon (http://www.perl.com/CPAN-local/modules/by-module/Proc/) should be able to handle running routine tasks. If I get real lazy I may just rip off someone else's (http://www.megadodo.demon.co.uk/perl/)

The advantage is that these little cron-lets can be application/package-specific rather than node-specific. They will fail over with the package, and if you wanted to get real fancy could even report their health via EMS so you don't have to wonder why that job hasn't run yet...

Note that this is still just an idea, so there may yet be major practical problems with its implementation. If you find them, please let me know.

[Stephen Doud]

This is a common question at the Response Center and a document was written dealing with the topic: UXSGKBAN00000227

You can view this document by going into the Knowledge Database and search on the document ID.

We recommend using NIS as the primary solution but users may also use a 'wrapper' command in place of the 'passwd' command to simultaneously update both servers' password files.

[Mark van Hassel]

Another option could be to use "rdist" to keep files equal on multiple nodes. However, I don't think this works for the passwd file on trusted systems !