View source for Infrastructure Management

This page serves to be a quick but complete reference of various infrastructure-related tasks.

[[Category:Internal How-Tos]]

== Emergency operations: I '''NEED''' to... ==

=== ...disconnect the Internet. ===

{{:Infrastructure Management/Warning|This disconnects the network from the Internet!|This will disconnect ''all'' services, including important, public-facing ones such as [[Mirror]], [[Docs]], and [[Talos]]' DNS. This should only be done as an absolute last resort, after confirming that the lab's network ''is'' responsible for some network/Internet aberration (e.g., compromised client) that cannot otherwise be resolved in a timely fashion. Obviously, this will be very disruptive to internal clients as well.}}

{{:Infrastructure Management/Privileges|level=serverroom}}


== Operations: How do I... ==

=== ...list users? ===

==== Method 1 (LDAP information users on enrolled machines) ====

{{:Infrastructure Management/Privileges|level=users}}

On any machine, run <code>getent passwd</code> and view the entries with a UID (third field) >= 1000000 (1 million).

==== Method 2 (LDAP information, raw query) ====

{{:Infrastructure Management/Privileges|level=anyone}}

On any machine with the OpenLDAP client binaries, run <code>ldapsearch -H ldap://talos.cslabs.clarkson.edu/ -D "" -b ou=users,dc=cslabs,dc=clarkson,dc=edu</code> and try to grok the resulting LDIF.

==== Method 3 (Kerberos <s>users</s> principals) ====

{{:Infrastructure Management/Privileges|level=admins}}

# {{:Infrastructure Management/Login to KAdmin}}
# Run <code>getprincs</code>.

=== ...create a new user? ===

{{:Infrastructure Management/Privileges|level=admins}}

# {{:Infrastructure Management/Login to PLA|leader=First, }}
# Expand ''dc=cslabs,dc=clarkson,dc=edu'', then expand ''ou=users''.
# Click ''Create new entry here'' immediately under ''ou=users''.
# In the right pane, select ''Generic: User Account''.
# Enter relevant account information, setting the following attributes. (This is going to be a little challenging, because some of the fields automatically populate from other fields. Check your work before saving it.)
#* '''User ID''' must be a valid Unix username. '''cn''' is traditionally set to the same value. (These fields like to populate from name, so change them after name.)
#* '''GID number''' should almost always be ''users'' (it's actually a drop-down).
#* '''Home directory''' should be <code>/mnt/home/''username''</code>. This will be set up momentarily.
#* '''Login shell''' can be left up to preference of users, but should be set to <code>/bin/sh</code> for maintainers and administrators to avoid being refused a session on a machine that doesn't have a certain shell.
#* The '''UID Number''' cannot be changed here. It will be done after saving.
#{{:Infrastructure Management/Critical Section|Click ''Create Object'', and accept the changes. From the next screen in the right pane, confirm adding the object; then, ''immediately'' go to the newly added object and change the ''UID Number'' field to a proper value (ours start at one million [1000000] and go up; use <code>getent passwd</code> on any enrolled machines to get the current ID mappings and choose one that isn't allocated). Click ''Update Object'', then again click through to confirm the changes.}}
# Double-check the fields while you're here; if you need to change anything, do so, click ''Update Object'', and click through the confirmation.
# Have the user type their password in the password field; make sure to set the hash method to ''ssha'' (or something stronger than MD5). ''Update Object'', click through to confirm.
# If the user is to be a member of other groups, enter the ''ou=groups'' unit in the left pane and select the relevant groups. From the right pane, you may select ''modify group members'' under the '''memberUID''' field. After you're done modifying the members, remember to click through the confirmation.
# {{:Infrastructure Management/Login to KAdmin|leader=Then, }}
# Run <code>addprinc ''username''</code>. Have the user enter their password, which should, for ease of use, be the same as the LDAP password.
# For administrators, also run <code>addprinc ''username''/admin</code> for an administrative principal (one to use with <code>kadmin</code> etc.). This should ''not'' be the same password.
# '''Finally, login to [[Metapod]]'''
# cd to <code>/storage/home/</code>, and <code>mkdir ''username''</code>. Then, <code>chown ''username'':users ''username''</code>

That should be it!

=== ...change my password? ===

==== Method 1: <code>passwd</code> ====

{{:Infrastructure Management/Privileges|level=users}}

# If you are not on an enrolled machine, log in to one; for example, you may ssh into [[Phoenix]] or another reachable host.
# Run <code>passwd</code> in the terminal of any enrolled machine.
# Enter current and new passwords for passwords you want to change. It is recommended that you keep the Kerberos and LDAP passwords the same. With rare exceptions, you should ignore the UNIX password.

==== Method 2: Application-specific interfaces ====

{{:Infrastructure Management/Privileges|level=users}}

# {{:Infrastructure Management/Login to PLA|leader=First,}}
# Expand ''ou=users,dc=cslabs,dc=clarkson,dc=edu'' in the left pane, and find your DN (cn=''<your username>'').
# Enter your new password in the password pane; ensure that the dropdown next to the field is still ''ssha'' or similarly secure (''not'' "clear").
# Click ''Update Object'', then confirm the changes on the next screen.
# Then, get to a terminal on an enrolled machine (you may log in to a lab machine or ssh into [[Phoenix]], for example).
# Run <code>kpasswd</code> and follow the prompts.

=== ...change a password? ===

{{:Infrastructure Management/Privileges|level=admins}}

This is very similar to the above--you'll need to do this in two places, again, sorry.

# (For setting only the password of an administrative principal, skip to the KAdmin section, below.)
# {{:Infrastructure Management/Login to PLA|leader=First,}}
# Expand ''ou=users,dc=cslabs,dc=clarkson,dc=edu'' in the left pane, and find the user.
# Instruct the user to enter their password in the two password fields (''warning:'' the tab order is wrong; from the keyboard, you need to enter ''password''<Tab><Tab>''password'').
# Ensure the hash (the dropdown to the right) is still ''ssha'' or similarly secure (''not'' "clear").
# Click ''Update Object'', then confirm the changes.
# {{:Infrastructure Management/Login to KAdmin|leader=Then,}}
# Issue <code>cpw ''username''</code>, and instruct the user to enter their password at the prompt. This should generally be the same as the LDAP password.
# For administrative principals, also issue <code>cpw ''username''/admin</code> and do the same. This should ''not'' be the same as the LDAP password.

That's it!

=== ...change group memberships? ===

{{:Infrastructure Management/Privileges|level=admins}}

# {{:Infrastructure Management/Login to PLA}}
# Enter the groups OU, ''ou=groups,dc=cslabs,dc=clarkson,dc=edu'', in the left pane.
# Select any one of the groups of which you'd like to modify memberships.
# Under the '''memberUid''' field, click ''modify group memberships''.
# Add or remove users as you see fit.
# Click ''Update Object'', and click through the confirmation page.

Changes take effect immediately upon the next logins of the modified users, though the caches may occasionally disagree for a few minutes. If any of the hosts aren't showing updates, wait a few minutes or run <code>nscd -i group</code> (<code>nscd -I group</code> on [[Metapod]]).

=== ...delete a user? ===

{{:Infrastructure Management/Privileges|level=admins}}

First off, this usually doesn't need to be done. Nonetheless, these instructions are included for completeness.

# {{:Infrastructure Management/Login to PLA|leader=First,}}
# In the left pane, navigate to ''ou=users,dc=cslabs,dc=clarkson,dc=edu''.
# Select the user you'd like to delete under this OU.
# In the right pane, click ''Delete this entry''. If you are satisfied, confirm this action. ''This cannot be undone.''
# {{:Infrastructure Management/Login to KAdmin|leader=Then,}}
# Issue <code>delprinc ''username''</code>.
# For administrative users, also issue <code>delprinc ''username''/admin</code>.

You should stop here. However, if data loss is of little concern to you (which is wrong and I have strong words to the contrary if you fite me irl), you can also login to [[Metapod]] and <code>rm -rf /storage/home/''username''</code> as root.

=== ...enroll a Debian machine in central authentication? ===

{{:Infrastructure Management/Todo|content=For now, refer to the bottom of the great [[Talos]] book. The headings there practically enumerate the list that will go here, anyway.}}