1. CIT 470: Advanced Network and System Administration
Accounts and Namespaces
CIT 470: Advanced Network and System Administration

2. CIT 470: Advanced Network and System Administration
Topics
Namespaces
Policies: selection, lifetime, scope, security
User Accounts
Directories
LDAP
CIT 470: Advanced Network and System Administration

3. CIT 470: Advanced Network and System Administration
Namespaces
A namespace consists of
A set of unique keys
A set of attributes associated with each key
Example
Key = Username
Attributes
GECOS
Homedir
Shell
Password
CIT 470: Advanced Network and System Administration

4. CIT 470: Advanced Network and System Administration
Namespaces
Systems include many namespaces
User account names.
addresses.
Filesystem pathnames.
Hostnames.
IP addresses.
Printer names.
Service names.
CIT 470: Advanced Network and System Administration

5. CIT 470: Advanced Network and System Administration
Types of Namespaces
Flat
No duplicates may exist.
Ex: usernames in /etc/passwd.
Hierarchical
Tree-structured namespace like DNS.
Duplicates can exist.
Ex: and
CIT 470: Advanced Network and System Administration

6. CIT 470: Advanced Network and System Administration
Namespace Problems
How to select names?
How to avoid name collisions?
How to ensure consistency?
How to distribute names?
CIT 470: Advanced Network and System Administration

7. CIT 470: Advanced Network and System Administration
Name Selection
Functional Names
mail hostname, /cit/470, student account
Descriptive names
geographic, print type, customer type
Formula-based Names
cvg0141 hostname, student0148 account
Themed Names
constellations (orion, ursa, etc.)
No Standard
CIT 470: Advanced Network and System Administration

8. CIT 470: Advanced Network and System Administration
Name Lifetime
When are names removed?
Immediately after PC, user leaves org.
Set time after resource is no longer in use.
When are names re-used?
Immediately: functional names.
Never.
After a set time: usernames, addresses.
CIT 470: Advanced Network and System Administration

9. CIT 470: Advanced Network and System Administration
Namespace Scope
Geographical scopes
Local machine. (e.g., /etc/passwd.)
Local network.
Organization.
Global (e.g., DNS.)
Service scopes
Single username for UNIX, NT, RADIUS, , VPN?
Transferring scopes
Difficult without advance planning.
Some names may have to change.
CIT 470: Advanced Network and System Administration

10. CIT 470: Advanced Network and System Administration
Namespace Security
What are you trying to protect names from and why?
Do the names need to be protected or just the attributes?
Who can add, change, or delete records?
Can the owner of a record change fields within the record?
CIT 470: Advanced Network and System Administration

11. Example Namespace: Usernames
Selection policies
Descriptive: waldenj, jwalden
Decriptive + formulaic: waldenj1, jwalden0002
Scope
Use for every campus (avoids collisions.)
Use for every service (avoids collisions.)
Lifetime
Do not reuse until 1 year has passed since addresses derive from usernames.
CIT 470: Advanced Network and System Administration

12. CIT 470: Advanced Network and System Administration
One Big Database
Centralize namespace in one big database.
Use SQL or LDAP to store entire namespace.
Derive other namespaces from database.
Program to generate UNIX accounts.
Program to generate NT accounts.
etc.
Advantages
Consistency
Ease of making changes, additions, deletions.
CIT 470: Advanced Network and System Administration

13. CIT 470: Advanced Network and System Administration
User Account Types
OS files
UNIX /etc/{passwd,shadow}
Windows SAM
Network service
NIS
LDAP
Kerberos
Active Directory
RADIUS
CIT 470: Advanced Network and System Administration

14. CIT 470: Advanced Network and System Administration
UNIX Accounts
Account Components
Username
UID
Password
Home directory
Account Files
/etc/passwd
/etc/shadow
/etc/group
Account Management
Adding users
Removing and disabling users
Account/password policies
CIT 470: Advanced Network and System Administration

15. CIT 470: Advanced Network and System Administration
/etc/{passwd,shadow}
Central file(s) describing UNIX user accounts.
/etc/passwd
Username
UID
Default GID
GCOS
Home directory
Login shell
/etc/shadow
Username
Encrypted password
Date of last pw change.
Days ‘til change allowed.
Days `til change required.
Expiration warning time.
Expiration date.
student:x:1000:1000:Example User,, ,:/home/student:/bin/bash
student:$1$w/UuKtLF$otSSvXtSN/xJzUOGFElNz0:13226:0:99999:7:::
CIT 470: Advanced Network and System Administration

16. CIT 470: Advanced Network and System Administration
Username
Syntax
Each username must be unique.
Length limits (8 chars on old systems)
Any character except : or \n.
Issues
Naming standards.
How to ensure that usernames are unique?
System uses UIDs internally.
CIT 470: Advanced Network and System Administration

17. CIT 470: Advanced Network and System Administration
UIDs
UIDs are 32-bit non-negative integers.
Standards
Root is UID 0.
System accounts have low UIDs (<= 500)
Uniqueness
Multiple usernames can have same UID!
Re-using UIDs may give away files to new user.
Distributed systems may require unique UIDs across organizational boundaries.
CIT 470: Advanced Network and System Administration

18. CIT 470: Advanced Network and System Administration
Password
Syntax
Length: unlimited (MD5,SHA1), 8 chars (crypt)
Chars: anything except \n, though certain control chars may be interpreted by system.
Stored in “encrypted” format.
Hashed: crypt, MD5, SHA1
Salted: 12-bit salt means 4096 different hashes for each password
CIT 470: Advanced Network and System Administration

19. CIT 470: Advanced Network and System Administration
GID
GIDs are 32-bit non-negative integers.
Each user has a default GID.
File group ownership set to default GID.
Temporarily change default GID: newgrp.
Groups are described in /etc/group
Users may belong to multiple groups.
Format: group name, pw, GID, user list.
wheel:x:10:root,waldenj,bergs
CIT 470: Advanced Network and System Administration

20. CIT 470: Advanced Network and System Administration
GECOS
Original use
Data for General Electric Comprehensive OS
Current use
User information.
Full name, location, phone number, .
CIT 470: Advanced Network and System Administration

21. CIT 470: Advanced Network and System Administration
Home Directory
User’s CWD at login time.
Typically where user stores all files.
CIT 470: Advanced Network and System Administration

22. CIT 470: Advanced Network and System Administration
Login Shell
Process started when user logs in.
Typically a shell like bash, tcsh, ksh, or zsh.
System users may be different.
Disabled accounts have a noshell program.
CIT 470: Advanced Network and System Administration

23. CIT 470: Advanced Network and System Administration
Adding a User
Create account with adduser.
Lock account until user arrives.
User signs account agreement.
Set passwd with passwd.
CIT 470: Advanced Network and System Administration

24. CIT 470: Advanced Network and System Administration
Adding a User
Edit /etc/{passwd,shadow} with vipw.
Set passwd with passwd command.
Edit /etc/group to add groups.
Create user home directory.
mkdir /home/studenta
chown studenta.student /home/studenta
chmod 755 /home/studenta
Copy default files from /etc/skel
.bashrc, .Xdefaults, .xsession, etc.
Set aliases, disk quotas, etc.
Verify that the account works.
CIT 470: Advanced Network and System Administration

25. CIT 470: Advanced Network and System Administration
Disabling an Account
Edit account configuration:
Place * in front of encrypted password.
Replace shell with nologin program.
Kill active logins and processes.
CIT 470: Advanced Network and System Administration

26. CIT 470: Advanced Network and System Administration
Removing a User
Disable account.
Change shared passwords (root, etc.)
Kill active logins and processes.
Remove from local databases/files.
Remove from aliases.
Remove mail spool (backup first.)
Remove crontabs and pending jobs.
Remove temporary files.
Remove home directory (backup first.)
Remove from passwd, shadow, and group.
CIT 470: Advanced Network and System Administration

27. CIT 470: Advanced Network and System Administration
What is a Directory?
Directory: A collection of information that is primarily searched and read, rarely modified.
Directory Service: Provides access to directory information.
Directory Server: Application that provides a directory service.
CIT 470: Advanced Network and System Administration

28. Directories vs. Databases
Directories are optimized for reading.
Databases balanced for read and write.
Directories are tree-structured.
Databases typically have relational structure.
Directories are usually replicated.
Databases can be replicated too.
Both are extensible data storage systems.
Both have advanced search capabilities.
CIT 470: Advanced Network and System Administration

29. System Administration Directories
Types of directory data
Accounts
Mail aliases and lists (address book)
Cryptographic keys
IP addresses
Hostnames
Printers
Common directory services
DNS, LDAP, NIS
CIT 470: Advanced Network and System Administration

30. Advantages of Directories
Make administration easier.
Change data only once: people, accounts, hosts.
Unify access to network resources.
Single sign on.
Single place for users to search (address book)
Improve data management
Improve consistency (one location vs many)
Secure data through only one server.
CIT 470: Advanced Network and System Administration

31. NIS: Network Information Service
Originally called Sun Yellow Pages
Clients run ypbind
Servers run ypserv
Data stored under /var/yp on server.
Server shares NIS maps with clients
Each UNIX file may provide multiple maps
passwd: passwd.byname, passwd.byuid
Slave servers replicate master server content.
Easy to use, but insecure, difficult to extend.
CIT 470: Advanced Network and System Administration

32. CIT 470: Advanced Network and System Administration
LDAP
Lightweight Directory Access Protocol
Lightweight compared to X.500 directories.
Directory, not a database, service.
Access Protocol, not a directory itself.
CIT 470: Advanced Network and System Administration

33. LDAP Clients and Servers
Standalone directory browsers.
Embedded clients (mail clients, logins, etc.)
Cfg /etc/nsswitch.conf on UNIX to use LDAP.
Common LDAP servers
OpenLDAP
Fedora Directory Server (formerly Sun, Netscape)
Mac Open Directory
Microsoft ActiveDirectory
Novell eDirectory (NDS)
CIT 470: Advanced Network and System Administration

34. CIT 470: Advanced Network and System Administration
LDAP Structure
An LDAP directory is made of entries.
Entries may be employee records, hosts, etc.
Each entries consists of attributes.
Attributes can be names, phone numbers, etc.
objectClass attribute identifies entry type.
Each attribute is a type / value pair.
Type is a label for the information stored (name)
Value is value for the attribute in this entry.
Attributes can be multi-valued.
CIT 470: Advanced Network and System Administration

35. Tree-structure of LDAP Directories
CIT 470: Advanced Network and System Administration

36. CIT 470: Advanced Network and System Administration
LDAP Schemas
Schemas specify allowed objectClasses and attributes.
CIT 470: Advanced Network and System Administration

37. CIT 470: Advanced Network and System Administration
LDIF
LDAP Interchange Format.
Standard text format for storing LDAP configuration data and directory contents.
LDIF Files
Collection of entries separated by blank lines.
Mapping of attribute names to values.
Uses
Import new data into directory.
Export directory to LDIF files for backups.
CIT 470: Advanced Network and System Administration

38. CIT 470: Advanced Network and System Administration
LDIF Output Example
CIT 470: Advanced Network and System Administration

39. CIT 470: Advanced Network and System Administration
Distinguished Names
Distinguished Names (DNs)
Uniquely identify an LDAP entry.
Provides path from LDAP root to the named entry.
Similar to an absolute pathname.
dn:cn=Jeff Foo,ou=Sales,dc=plainjoe,dc=org
Relative DNs (RDNs)
Any unique attribute pair in directory’s container.
ex: cn=Jeff Foo OR username=fooj
Similar to a relative pathname.
Except may have multiple components.
cn=Jane Smith+ou=Sales
cn=Jane Smith+ou=Engineering
CIT 470: Advanced Network and System Administration

40. LDAP Client/Server Interaction
Client requests to bind to server.
Server accepts/denies bind request.
Client sends search request.
Server returns zero or more dir entries.
Server sends result code with any errors.
Client sends an unbind request.
Server sends result code and closes socket.
CIT 470: Advanced Network and System Administration

41. CIT 470: Advanced Network and System Administration
LDAP Operations
Client Session Operations
Bind, unbind, and abandon
Query and Retrieval Operations
Search and compare
Modification Operations
Add, modify, modifyRDN, and delete
CIT 470: Advanced Network and System Administration

42. CIT 470: Advanced Network and System Administration
Authentication
Anonymous Authentication
Binds with empty DN and password.
Simple Authentication
Binds with DN and password. Cleartext.
Simple Authentication over SSL/TLS
Use SSL to encrypt simple authentication.
Simple Authentication and Security Layer
SASL is an extensible security scheme.
SASL mechanisms: Kerberos, GSSAPI, SKEY
CIT 470: Advanced Network and System Administration

43. Distributed Directories
Use multiple LDAP servers.
Why distribute?
Throughput
More servers can reduce load on any single server.
Latency
Have local server serve local data to LAN.
Only use WAN for non-local data on other servers.
Administrative Boundaries
Let each side administrate their own directory.
CIT 470: Advanced Network and System Administration

44. CIT 470: Advanced Network and System Administration
OpenLDAP
Open source LDAPv3 server.
LDAP server: slapd
Client commands: ldapadd, ldapsearch
Backend storage: BerkeleyDB
Backend commands: slapadd, slapcat
Schemas: /etc/openldap/schema
Data: /var/lib/ldap
Configuration files
Client: /etc/openldap/ldap.conf
Server: /etc/openldap/slapd.conf
CIT 470: Advanced Network and System Administration

45. Building an OpenLDAP Server
Install OpenLDAP.
Configure LDAP for your domain.
Change suffix, rootdn, rootpw options.
vim /etc/openldap/slapd.conf
Start server
Immediate: /sbin/service ldap start
Permanent: /sbin/chkconfig --level 35 ldap on
Add data with ldapadd
Verify functionality with ldapsearch
CIT 470: Advanced Network and System Administration

46. CIT 470: Advanced Network and System Administration
LDAP Authentication
Configure server with schema + user data.
Point clients to hostname and rootDN of svr.
/etc/ldap.conf and
/etc/openldap/ldap.conf
Verify server access with ldapsearch
Configure clients to use LDAP auth
/etc/nsswitch.conf
passwd: files ldap
shadow: files ldap
group: files ldap
CIT 470: Advanced Network and System Administration

47. CIT 470: Advanced Network and System Administration
References
Brian Arkills, LDAP Directories Explained: An Introduction and Analysis, Addison-Wesley, 2003.
Gerald Carter, LDAP System Administration, O’Reilly, 2003.
J. Heiss, “Replacing NIS with Kerberos and LDAP,”
LDAP Howtos, Links, and Whitepapers,
Luiz Malere, “Linux LDAP HOWTO,”
OpenLDAP, OpenLDAP Administrator’s Guide,
RedHat, Red Hat Enterprise Linux 4 Reference Guide, Chapter 13,
CIT 470: Advanced Network and System Administration