Administration groups Introduction 11.. IInnttrroodduuccttiioonn An admin group is a set of machines which are sharing some config files or some parts of some config files. In linuxconf parlance, they are sharing some sub-systems. The concept of sub-system is the same used for the "system profile versionning" feature. 11..11.. DDeeffiinniittiioonn ooff aa ssuubb--ssyysstteemm A sub-system represents a set of logically tied configuration files. In some cases, a sub-system is made of only parts of a configuration file. Seen differently, every configuration files known to linuxconf belong to at least one sub-systems. In some case, a configuration is splitted logically into more than one sub-system. This is the case for _/_e_t_c_/_f_s_t_a_b which belong to the _h_a_r_d_w_a_r_e and the _n_e_t_c_l_i_e_n_t sub-systems. This ability to distribute logically one configuration file into various sub-systems is the key to sharing. For example, many machines on a net may share the NFS client part of _/_e_t_c_/_f_s_t_a_b but can't share the rest as it is hardware dependant (partition layout, swap partitions, etc). 22.. DDeeffiinniinngg aa ggrroouupp Here are the steps to create an administration group. 22..11.. GGiivvee iitt aa nnaammee Each group must have a uniq name. The name must not have any space. Each group correspond to a sub-directory in /etc/linuxconf/admgroups The name of the sub-directory is simply the group name. 22..22.. GGiivvee iitt aa ddeessccrriippttiioonn This is used to enhance various screens. It has no functionnal usage. 22..33.. LLiinnkk iitt wwiitthh aann aaddmmiinniissttrraattiioonn ttrreeee An administration tree is like a virtual workstation in your computer. It has all the configuration files (or could have) a fully configured linux station normally have. By linking to a specific administration tree you are telling that this administration group is picking its configuration files (or parts of) from the configuration files of this administration tree. The idea of separating the administration tree from the administration group is that, in many environnement, you will have one administration tree and the machines part of this environnement will split this way · Most machines: They share a large part of the administration tree · Some machines: They share the same information except for specific services only. · Some other machines: They are completly independant. As such they are not member of any administration group. Often, all machines of the same physical network will share some aspect of a single administration tree. A help list shows available administration trees. You can enter a name which is not in the list. Just don't forget to create it later. 22..33..11.. TThhee // aaddmmiinniissttrraattiioonn ttrreeee It is possible to share the configuration of the workstation itself. The administration tree is simply called /. It is shown in the help list. 22..44.. MMeemmbbeerrss ooff tthhee ggrroouupp You simply enumerate the various members (the machine name and domain) who must be synchronised. This is currently limited as you have to specify them one by one. This is expect to expand in various area: · Allow the definition of pseudo member which will themselves repeat the configuration file to other machines. A repeater may act this way for several administration group. · Allow for usage of wildcards: *.domain.com. · Allow for usage of network/netmask pairs. · Allow for on demand supply of configuration files. As such and administration group may very well have no official members! 22..55.. SSuubb--ssyysstteemm ttoo sshhaarree A list of all sub-systems available is presented. On the left, the sub-system ID is presented. On the right, the description of the sub- system is presented. For each sub-system, there is a check-box. You can select this way which sub-systems are shared. 33.. DDiiaalloogg''ss bbuuttttoonnss Here are the functions associated to the various dialog buttons 33..11.. AAdddd This will enlarge the dialog to allow more members (Not completed yet). 33..22.. DDeell This allows you to delete the administration group. This delete the information in linuxconf, but the files in /etc/linuxconf/admgroups/group-id are not deleted. 33..33.. PPuubblliisshh This takes a snapshot of the selected sub-systems in the administration tree. The snapshot is installed in /etc/linuxconf/admgroups/group-id Once published, an administration group is ready to be shared with members of the group, using either the _e_x_p_o_r_t functionnality or any other mean you can imagine. The directory tree of an administration group may be installed on any Linuxconf station with the netadm module and imported, making it operationnal. 33..44.. EExxppoorrtt Export use a custom protocol to reach another linuxconf host. It then sends the content of the administration group repository and then trigger and _i_m_p_o_r_t procedure and an _a_c_t_i_v_a_t_i_o_n procedure (netconf --update). Currently, this procedure is manual. For each member of the administration group, linuxconf is prompting you for its root password. Using this password, it can get access and completes the operation. This is only one way an administration group repository may be shared. One may choose to export it using NFS (depending of the level of privacy required) or any other well known network protocol. We believe that much will be needed to make this sharing appropriate for the various network environnements out there. Comments are welcome. 33..44..11.. SSppeecciiaall aaccccoouunnttss ffoorr rreemmoottee aaddmmiinniissttrraattiioonn aanndd cclluusstteerr mmaannaaggee­­ mmeenntt Linuxconf use special protocols to perform remote administration and cluster management. Those protocols may be encapsulated easily to enhance either conectivity and security. One nice encapsulating tool is ssh (secure shell). ssh is a great replacement for commands like rlogin, rsh, rcp and telnet. It does basically the same thing (and more), but add strong encryption and compression. ssh is also very useful just to interconnect two process remotly, by providing a secure (encrypted) link. This is the way linuxconf is using it. By setting special account on workstations and servers, you will be able to use that with linuxconf without even knowing. This is experimental and comments are welcome. 33..44..22.. HHooww ttoo sseettuupp aa hhoosstt ffoorr cclluusstteerr mmaannaaggeemmeenntt Linuxconf uses ssh to establish the link. It expect that a special user account "netadm" do exist on the remote host. This user account must have the shell /usr/lib/linuxconf/lib/netadmshell The account must NOT have a password. The idea is to trigger linuxconf immediatly, which will request the root password using its remote management protocol. You can use ssh access control to limit who may access you box this way. They need the root password nevertheless to access it.