unixwiz

I have been having some problems getting IBM’s Tivoli Directory Server to replicate properly. So I decided to try and see what it would take to move the IBM AIX machines from using IBM’s LDAP Server to using Sun’s LDAP Server. This is what I hope to accomplish:

1. Setup Sun’s JES Directory Server on a Solaris 10 machine
2. Configure the DS to have the AIX schema and objectclasses needed for user and group info
3. Configure a AIX test machine to authenticate against the Sun LDAP Server
4. Eventually move all AIX machines from the IBM DS to Sun DS, thereby having one set of servers that control all users/passwords for all Sun/Linux/AIX machines

Step 1: AIX Schema
The first thing I had to overcome is how AIX has 4 different ways of using LDAP for authentication. AIX 4.3.3 and AIX 5.1 used a non RFC2307 compliant schema. AIX 5.2 and AIX 5.3 can use this old schema or RFC2307, or a new one called RFC2307AIX, which combines the old with the new (there is also another one that I will not cover). When I originally setup the IBM LDAP I used the RFC2307AIX because it allows me to store ulimits and other info about AIX accounts in LDAP and not on each individual machine. But this also makes it harder to port these things over to Sun’s LDAP. Which lead me to yesterday’s afternoon adventure, creating a schema file that would work. I will link to my final copy below.

Step 2: AIX ObjectClasses
Second up was to create the objectclasses required for AIX Authentication, which consisted of creating the eAccount, AIXAccount,AIXaccessGroup, ibm-SecurityIdentities, container, and account. Some of these may not be needed for a fresh install, but I am trying to move entries from IBM’s LDAP to Sun’s LDAP with the least amount of editing an extremely huge ldap ldif export file. I will link to my final copy of this file below as well.

Step 3: Install JES DS
The third step was to download and install the DS 5.2.P4 on my fresh install of Solaris 10 U3 running on a Sparc machine. I did the custom install as I wanted to change the location of where it was installed to. The other thing I did is not load any sample data. Once the install was done, I ran the /usr/lib/ldap/idsconfig script to setup the DS. This is sort of how it went (copied from another doc):

Unfortunately the “directoryserver” command does not exist in Solaris 10, so i did the following:

(I installed the ldap server to /ldapserver)

Now that the indexes are created we can go on to the next step of modifying the schema.

Step 4: Importing new schema
Now I can import the AIXAttributes.ldif and the AIXObjectClasses.ldif files to my fresh newly installed server:

All should go well on the above imports. There were a couple of quirks that I found when creating the files, like how IBM uses one OID for a value when Sun uses a different one.

Step 5: Creating an OU for AIX data
By this time I have fired up the Console for the LDAP server and was doing things through the gui. The first thing I did was create a new OU for my aix data, i.e. ou=aixdata,dc=example,dc=com. This OU is where all my AIX stuff will be, the ou=people,dc=example,dc=com will be where my Sun users will go. (Can’t combine them yet because of massive amounts of differing UIDS between the AIX users and Sun Users).

After creating this, create 2 more OU’s under the aixdata. The first one will be for all users, ou=aixuser,ou=aixdata,dc=example,dc=com. The second will be for group information, ou=aixgroup,ou=aixdata,dc=example,dc=com.

Step 6: Create and AIX LDAP Admin Account
Because of how the AIX servers need to connect and get/put info into ldap, you will need to create an account that has read/write access to the 2 new ou’s you created. (This account is sort of similar to the Sun proxyagent account created with the idsconfig). I created my user, uid=aixldap,ou=aixdata,dc=example,dc=com. Also set the password for it to never expire (if you make it expire, you will have to update every AIX server every time the password expires). Once this user is created give it full read/write access to the ou=aixuser and ou=aixgroup with ACI’s.

Step 7: Export info from IBM LDAP
Since I am planning on moving from IBM LDAP to Sun LDAP I need to export the data from my IBM LDAP to an ldif format:

Do the above on the IBM LDAP server, it will put a file called /tmp/ldapexport.ldif. But now I need to “clean” some stuff out of it. Some of the stuff I need to remove is anything that is not User and Group related. For example I had IBM LDAP Replication setup so there are a ton of entries for that. (so the only thing you should have in your ldif file are entries for the dn’s like username=*,ou=aixuser,ou=aixdata,dc=example,dc=com and groupname=*,ou=aixgroup,dc=example,dc=com
)

Step 8: Import users and groups
Next I imported the cleaned file:

Now all your users and groups should be in the new ldap server.

Step 9: Misc config in Sun LDAP
Some other stuff I did was add a couple indexes to the non-standard attributes that AIX uses:
groupname
username
hostsallowedlogin

The hostsallowedlogin allows us to put an entry in the persons LDAP entry to say which hosts they can log in to. If the attribute does not exist they can log in to any host that is served by this LDAP server. But if they have a value in this attribute, they can only log in to those host(s). (there is also a hostsdeniedlogin, which is the opposite of the hostsallowedlogin, if you want them to log in to every machine but one you can just populate that single host in to the hostsdeniedlogin).

Step 10: Configure AIX to talk to ldap server
One of the fall backs I don’t like about LDAP on AIX is that you have to have a local ldap user, and the ldap client software does not come with the base os. So you will have to install the ldap.client.adt and ldap.client.rte (probably don’t need the adt, but I install it anyways). During this install it usually creates the ldap user and group, which is never where we want it so either create an ldap group and ldap user before you install it, or after it is installed do the following, change the userid and groupid to what you want it to be in /etc/passwd and /etc/group and then run:

Now we can run the mksecldap command:

The above is all on one line. You must make sure the -t is set to 0, if it is not then you will get some weirdness that I will talk about later.

Once this is done, then you need to tell AIX that it is to look in LDAP for it’s info, you will need to edit another file /etc/security/user:

in the “default:” stanza, you will need to change the SYSTEM variable to LDAP, and add a registry variable with the value of LDAP.

I.E.:

Now you should be able to do an id username, and see some results:

Next up try logging in remotely (you may have to create your home directory first). It should work.

Some Notes

1. If you do not set the cachetimeout to be 0, if you change a users password as root, the user will get thrown in to a loop of changing their passwords. I.E. They will never be able to login as everytime they login it will say their password has expired and make them change it again and then it will kick them off (ie close their ssh session). Lather/rinse/repeat.
2. After importing the users from an existing IBM server, you can delete the IBM-ENTRYUUID and the control attributes, they are for IBM DS only and have no use in Sun’s LDAP.
3. Any problems on the import/etc, make sure to look at the ldap server error logs (/ldapserver/slapd-ldap2/logs/error_log) it should tell you exactly what is wrong.
4. If you replicate this LDAP server, you should probably do a Master/Master relationship because of how AIX always stores info about last logins/etc in LDAP. I have not tested yet if it can follow referrals yet.

Here are the two files I was talking about:

AIXAttributes.ldif
AIXObjectClasses.ldif

Some other links:
IBM’s Redbook : Integrating AIX into Heterogeneous LDAP Environments, which I found was missing some stuff

Sun’s Cookbook for Solaris 8 client with Directory Server 5.1/Solaris 9 which I follow some times if I need to connect Solaris 8 machines in.

Hope this helps some one, if it does leave me a message.

Technorati Tags: IBM, Sun, LDAP

We got our copy of Windows Vista at work the other day. So I decided to see just how well my Sun Ultra 20 M2 would run it. Needless to say, the Ultra 20 M2 only scored a 5.2 out of 10 on the Microsoft User Experience scale (it’s built in thingy).. That is pretty bad considering it has a Quadro FX 1500 Graphics Accelerator, 1 Dual-Core AMD Opteron - Model 1218, 2 GB of ram, and 2 x 250 GB SATA harddrives. It does run the Aero interface, but every time you open a window or any of those special effects happen it pegs the CPU at between 30 and 40%. Chris tried it on his Ultra 20 (original version), and it would only scored a 2.X and would not run the Aero interface. But now I am stuck with Vista on the machine (which also has Solaris 10 and XP on it) since Vista some how hosed my XP installation. So I will now list my complaints about it:

1. Install took 3 reboots to install. You would think that since it is delivered on DVD, that it would only need 1 boot, and then you are done.
2. Too many popup’s. Every time you download a program to install, or try to run something it constantly asks are you sure you want to run this?
3. You can not set Firefox as the default browser. I tell Firefox every time it starts to make it the default browser, and as soon as you close it IE becomes the default again. I even changed it in the Default Program’s settings in Windows and it never sticks.
4. During the Install it asks you to create an account, this account is automatically given Administrator rights still, and even with Admin rights it still keeps asking you all the questions.
5. Before I changed the start menu to the classic mode, I clicked what I thought was the “shutdown” icon. The machine immediately went to sleep. It took me unplugging the power from the machine to get it to boot right again. I think this is how they are trying to say that Vista boots so fast, when it never really is booting just resuming from hibernate mode.
6. The desktop icons are either freakishly huge or small and crappy, no real in between.
7. The pop-ups, did I mention that already, I will get screen shots later, but they are so annoying
8. The constant popping/fading of windows. Every time an application opens a new window it will pop and fade in/out. How annoying..
9. Activation failed every time with some “DNS” error.. Ended up going in and clicking on the “Change Product Key” and typing the same product key in and it all of the sudden said it was activated.
10. Control Panel is almost completely different, new names for old stuff
11. Logging, take a look in the system log stuff and see all the stuff that it logs, install Office 2007 and see any more of what is logged.

Overall I am not impressed at all. If you put it besides Mac OS X, it is trying to mimic everything, but is so badly done that it requires a huge machine to run it on.

And if you did not see The Daily Show last night on Comedy Central, John Stewart was interviewing Bill Gates about Vista, it was a very funny interview and John kept trying to get Bill’s password out of him. Sorry Bill but this is one OS i will not be installing on my home PC.

(N.B. The version of Windows Vista I was using was the Enterprise Edition.)

I rewrote the spam statistics stuff the other night and now it is reporting a more “accurate” statistics.. Just for yesterday alone:

Was looking at one of our incoming servers tonight for yesterday’s mail stats, here is what I found:

Now if you add up the Aborted/Discarded/Quarantined/Rejected you get 462,908 messages, which gives you about 92% of the mail coming in was listed as spam. And this is just for 1 of 7 incoming servers we have. If I were to expand this by 7 (assuming all were equal, which they are not), then there would be 3.5 million messages coming in and 3.2 million spam messages.

And based on this article on CNN looks like we are right on the money. If only we could block all gif images in email I think we could get the number a little higher on the catch rate.

Earlier I had started a job to clean up the PostgreSQL database on our main spam machine, here are some stats:

To reindex 6.4 million messages, 7+ hours
To reimport the header information of those messages back in to PostgreSQL: 38 hours 28 minutes, 29 seconds.

What is the outcome of this? The Spam DB went from 80+ gig down to 7.5Gig and the searchs are MUCH faster now. Hopefully this will fix some of the problems we have been having over the last week with people trying to release their spam messages.