1. UNITED STATES

2. Understanding NDS for Directory-Enabled Solutions David Condrey, LAN Systems Manager davidc@clemson.edu Clemson University Jeremy Campbell, Information Resource Consultant jerm@clemson.edu Clemson University

3. UNITED STATES Novell Directory Services (NDS) and the Computing Infrastructure A real world example: Division of Computing and Information Technology CLEMSON U N I V E R S I T Y

4. UNITED STATES Agenda )Background on Clemson information systems )Mission and support structure )Userid management )Network design )Server and network access )Public access labs )Printing )Electronic mail )Intranet )Authentication server )Futures

5. UNITED STATES Background on Clemson Information Systems

6. UNITED STATES Background )Large systems background. )Strong development shop. )Departmental LANs ruled 90’s until Novell Directory Services (NDS). )NDS populated in Summer 1995 (36,000). )Departmental LANs gone—more centralized management of the network. )NDS is centerpiece of security and authentication. )~150,000 Authentications/day using NDS.

7. UNITED STATES Mission and Support Structure

8. UNITED STATES Mission )Provide computing infrastructure )Empower users and departments )Provide guidance in selecting solutions based on industry standards )Deploy solutions to meet the needs of institutional computing )Provide user support and training

9. UNITED STATES Defining Groups )Network services # Supports the physical network (routers, hubs, backbone) )LAN systems # Supports application, group, and personal data servers )Client Support Group (CSG) # Supports faculty and staff via Technology Support Providers (TSPs)

10. UNITED STATES Defining Groups (cont.) )Systems Integration Group (SIG) # Supports students and departmental labs )Computer resources # Assists with user account problems & Division of Computing and Information Technology (DCIT) sponsored )College consultants # DCIT sponsored person and college sponsored person(s) that help support the end users of the college

11. UNITED STATES Defining Groups (cont.) )Technology Support Provider (TSP) # Supports faculty/staff end users )Help desk # Sponsored by DCIT to assist end users

12. UNITED STATES Support Structure )Support is based on a four-tier model Problems Resources LAN systems Network services 1 Faculty Staff Students 4 TSPs Help desk 3 College consultant Client support Systems integration 2 Computer resources

13. UNITED STATES Server Strategy and Management )Novell and Windows NT servers maintained by DCIT )DCIT provides hardware and Network Operating System (NOS) )DCIT administers backups )DCIT performs user administration )Group maintains data and security with help of a TSP )Virus protection and software metering

14. UNITED STATES Userid Management

15. UNITED STATES Automatic Userid System (AUS) AUS MVS UNIX NDS PersonnelAdmissionsOther

16. UNITED STATES Automating User Maintenance MVS Old method Daily UIMPORT run Summer ’97 USRMAINT.NLM FTP TCP/IP Real-time NDS •Add users •Modify user attributes •Delete users PersonnelAdmissionsOther AUS

17. UNITED STATES Network Design

18. Physical Network Design 100BT Switch FDDI Server 100BT T1

19. UNITED STATES Tree Design

20. Every Person Has a Place toZAZA ZA StudentsMisc.Employee Organizations ClemsonU to

21. Every Group Has a Place Users AthleticsDCIT ForestryResearchDean's office CAFLSCES ClemsonU

22. Partition Design A StudentsEmployeeAthletics CSOCSG APS DCIT ABZZB ClemsonU

23. Use Dedicated “ROOT” Servers for NDS Replicas CU-ROOT-3 100BT Switch CU-ROOT-1 CU-ROOT-2 (ITC) Master for all R/W for all R/W for users “A” to “Z” Group Server R/W optional FDDI

24. Distribute Network Management

25. UNITED STATES Login Script Design )Based on profile scripts and user scripts )No container scripts )Use base profiles # EMPLOYEE # STUDENT )Base profile includes high level organizational scripts based on membership )Organizational scripts controlled by TSPs )Organization scripts may include departmental scripts managed by others

26. UNITED STATES Script Design & Management.EMPLOYEE.employee.clemsonu.ENG.ces.clemsonu.BioE.ces. ISALAB.Civil.ces..AG.cafls.clemsonu.Forestry.cafls..GROUPIFS.employee.clemsonu User Script

27. UNITED STATES Server Timesync Hierarchy Server C Ref Server A Primary Server B Primary Server D Secondary Server E Secondary External source

28. UNITED STATES Server and Network Resource Access

29. UNITED STATES Personal Storage (User Data Servers) EmployeDn Any faculty or staff member Any student Office, lab, or dial-in Dorm, lab, or dial-in StudentDn

30. UNITED STATES Personal Data Server Configuration EmployeD(2)StudentD(5) ProcessorDual Pro–200Pentium II–300 Memory1024MB512MB Disk90GB (RAID5)50GB (RAID5) ReplicasNone Home directories ~10,000~26,000 Base quota100MB25MB

31. UNITED STATES Collaborative Storage—“Group Servers” (Faculty and Staff) Group Server2 EmployeD Group Server1

32. UNITED STATES Collaborative Storage— “Applications Servers” (Students) StudentD Applications Server (N)

33. UNITED STATES Group/App/Root Server Average Configuration Group App Root Pro-200P-200P2-300 128MB64MB384MB 18GB9GB4GB Possible R/WNoneAll replicas 25–250 users 250–800 users

34. UNITED STATES Collaborative Storage (Faculty and Students) EmployeD Group server1 StudentD App server

35. UNITED STATES Collaborative Learning Environment (CLE) )Faculty member wants to put data on the network that students can use )Student submission of work to faculty )Students collaborate on team projects with assistance from faculty member )Students and faculty collaborate on projects or assignments )Publish web pages as a team or class )~5000 class sections per semester

36. UNITED STATES NAL as CLE User Interface

37. UNITED STATES CLE Disk Space Management Group Server1 Read Only Teams R/W with Tgroups Create Only Read Write

38. UNITED STATES Collaborative Storage and Network Bandwidth Group Server1 CLE Server1

39. UNITED STATES Public Access Labs: Home of the Virtual Personal Computer

40. UNITED STATES Outline )Environment of the Virtual PC (VPC) )How the current VPC environment evolved )Mechanics of the VPC # Setting up the computer # Boot time # Login and login script # User profiles )Software involved )Future directions

41. UNITED STATES Standard Lab )Standard set of applications )Standard operating system )Standard context-less login )Standard drive mappings )Standard hard drive contents

42. UNITED STATES Local Lab Machine The Environment As Seen By the Machine StudentDn App Server Local Hard Drive Local Lab Printer

43. UNITED STATES Goals of the Virtual PC Paradigm )Easy maintenance )Provide global access to password protected network disk space )Allow user to customize his desktop )Same environment (“look and feel”) regardless of location, hardware, or facility ownership

44. UNITED STATES Evolution )Pre-NetWare )Windows 3.11 under NetWare )Windows 95 under NetWare

45. UNITED STATES Local Lab Machine StudentDn How It Happens to the User VPC = A series of software manipulations triggered by user login and logout. User Profile Logout User Profile Login

46. UNITED STATES Constructing the Machine )The rebuild disk )REBUILD {options} )Virtual Loadable Module (VLM) client allows it all on one floppy rebuild

47. UNITED STATES Boot Time Events )Location, PC type, “ISALAB”, and other environment variables )Some registry updates to ensure default desktop appearance and server failover keys

48. UNITED STATES Contextless Login )Can’t teach end users what a context is )Using commercial product because we needed an immediate solution

49. UNITED STATES The Login Script )Perform some basic actions )Perform group- specific actions )Perform lab actions )Load profile

50. UNITED STATES Isitcool—Failover Applications Server Attachment

51. UNITED STATES Isitcool—Failover Applications Server Attachment (cont.) Applications Server(2) ISITCOOL NLM Applications Server(n) ISITCOOL NLM Applications Server(1) Work- station Lab 1 ISITCOOL NLM Workstation Disk Image Applications 1. Using IP, get info from primary app server Isitcool 2. If attach failure or Isitcool reports no, try next server 3. Attach to server using NetWare client Isitcool? NO! YES!

52. UNITED STATES Loading the Profile

53. UNITED STATES Loading the Profile )PC-Rdist is called by the login script )PC-Rdist imports user registry keys from directory mapped to drive U: )First-time lab users get setup )Printers

54. UNITED STATES Special Mappings and Events )Mapping shared disk # Most done by login scripts )Novell Application Launcher (NAL) # Will eventually be doing most special mappings

55. UNITED STATES Logout )Logout only # Export user registry # End session )Logout and shutdown # Export user registry # Perform maintenance # Reboot

56. UNITED STATES Lab Support Problems )Present implementation not easily scaled )DCIT lab support must do all software installs )DCIT lab support must handle all initial lab setup operations )If present trends continue, labs of computers will be replaced by labs of network jacks )Image must live in the login directory (not protected) )Metering

57. UNITED STATES Summary of Novell Components Used in Lab Support )NetWare )Client 32 (intraNetWare client) )NAL )VLM client )Novell Replication Services (testing)

58. UNITED STATES Summary of Third-Party Products Used for Lab Support )SofTrack )PC-Rdist and TrapSD # Need a NetWare client with integrated profile handling and event hooks )SFLOGIN )NWCopy )PCOUNTER # Need better auditing tools

59. UNITED STATES Clemson University Products Used for Lab Support )isitcool )cumap )datacool )editreg/patch95 )editini )difrator/TED (in development) )labstats

60. UNITED STATES Future Directions for Lab Support )Departmental software (hardware?) installations )Remote control of workstation )Move from lab to laptop

61. UNITED STATES Printing

62. UNITED STATES Printing Strategy )All shared printers are network-attached supporting only IPX protocol (HP JetDirect) )All printer access is controlled through NDS )UNIX print services makes any print queue available to any TCP/IP host using standard LPR/LPD protocols )UNIX print services also makes high speed institutional printers on mainframe available to both NetWare and UNIX users/applications

63. UNITED STATES Printing Strategy OS/390 UNIX ??? Print Gateway PC Mac Q Q Q Q Q

64. UNITED STATES NDS Design for Printing B Library ITC... Printers Employees B Printers CivilMechanical CES A StudentsPrtDevCAFLS clemsonu A Poole

65. UNITED STATES Electronic Mail

66. UNITED STATES Electronic Mail Server )Based on Sun Solaris )No user accounts required on Solaris )Server software developed at Clemson )Multiple recipients/one copy of message )Server based on Post Office Protocol/ Multipurpose Internet Mail Extensions (POP/MIME) Internet standard protocols # Internet Messaging Access Protocol 4 (IMAP 4) coming?

67. UNITED STATES Electronic Mail Server )Eudora site license purchased by DCIT )List server gaining wide-spread acceptance and use # Class/section list automated

68. Mail Server DOS POPc mainframe POPc Windows POPc Mac POPc UNIX POPc OS/2 POPc ? ? popD ListD Mail Server

69. UNITED STATES Mail Server: Statistics 199519961997Category *based on partial year statistics through Feb 10, 1998 1998* POP connections per day (average) Messages sent per day (average) 11K37K83K135K 10K29K59K89K 21K58K84K97K Messages retrieved per day (average)

70. UNITED STATES Automated Distribution Lists MVS OS/390 ListMGR popD ListD Mail Server Mail Server TCP/IP Class Roles Departments

71. UNITED STATES Automated NDS Group Membership MVS OS/390 ListMGR popD ListD Mail Server Mail Server TCP/IP Class Roles Departments NDS GroupMGR NLM TCP/IP

72. UNITED STATES Collaborative Learning Environment Automatically maintained group membership for class rolls

73. UNITED STATES Collaborative Learning Environment Course abbreviation Application object for NAL Semester number Course number Section number Instructor Instructor managed teams

74. UNITED STATES Managing Distribution Lists with NDS popD ListD Mail Server Mail Server GroupMGR.NLM Monitor group membership modifications RegisterForEvent() TCP/IP NDS 1. Membership 2. See also

75. UNITED STATES NDS Interface to the List Server )Enabler for collaborative work between faculty and students )Uses data from employee system on MVS to keep department NDS groups correct )Lets users use NWAdmin to administer E-mail lists )Eliminates need to make changes to NDS and the list server )Ensures that data is correct everywhere

76. UNITED STATES Intranet

77. UNITED STATES Web Serving )Institutional servers )Department or group servers )Organizational page servers )Personal page servers )Administrative and student application servers

78. NDS Web Security via Windows NT/UNIX/???

79. UNITED STATES Authentication Server

80. UNITED STATES Authentication Server )Too many userid/password combinations for each user to remember )Need central set of secure servers that all systems use for authentication )Clemson University Personal ID (CUPID) )Based on Automatic Userid System (AUS) )Idea born in interdepartmental task force )Production on July 1, 1996

81. UNITED STATES Authentication Server Mail authC Web authC mainframe authC UNIX authC NetWare authC Sun authC Windows NT authC Oracle authC

82. NDSNDS intraNetWare Server BintraNetWare Server A AUTHSERV.NLM intraNetWare Server C Mainframe (MVS) RACF AuthClient Onlines MAIL (Solaris) AuthClient POPd NT Server AuthClient Website WebApp User Workstation (Windows 95/NT and MAC Workstation) Eudora TN3270NetscapeLogin.exe OpenLinux AuthClient Apache WebApp AUTHSERV.NLM VTAM

83. UNITED STATES Authentication Server )NetWare Loadable Module (NLM) is multithreaded )Clients use common code base )Clients have built-in failover capability )Communication based on TCP/IP sockets )> 90% successful password checks complete in less than 0.1 seconds )> 2 million requests serviced by primary server over a 6 week period (50,000/day)

84. UNITED STATES Back to Intranet

85. UNITED STATES NDS Authentication through Windows NT/UNIX/??? to the Web Application: Employee Information System (EIS) Type: Web Server OS: Windows NT 4.0 Server enabling app: Website/Visual Basic

86. UNITED STATES Using NDS Security Across the Intranet Authenticated Client Server Auth Client Authentication Server NDS Netscape IIS 32-bit DLL AUTHSERV.NLM NDS Page request CheckEquiv Check Security Equivalence Locate user object and run equivalence list NT 4.0

87. UNITED STATES AUTHSERV Client Functions )Password check )Password change )Resolve to fully distinguished name )Check security equivalence )Return group membership )Miscellaneous administrative functions

88. UNITED STATES Authentication Server as an NDS Data Gateway Application: Call tracking system Type: Web Server OS: Windows NT 4.0 Server enabling app: Website/Visual Basic Not Assigned BILL BROYLES CCR DAVE DAVIDC DHF DHFRS DON JAMBO JHALL MIKE YATES DAVIDC

89. UNITED STATES Caldera OpenLinux and Apache )Web gateway to NetWare file system Caldera OpenLinux File Server File Server File Server AuthC Browser AuthServer File Server File Server

90. UNITED STATES Caldera OpenLinux and Apache )First attempt to provide web services via Novell made use of Novell’s intraNetWare Web Server 1.0 which simply was not reliable )Caldera OpenLinux provided robust UNIX connectivity to NDS and supported the industry standard Apache web server )Out of the box Caldera/Apache did not provide home directory redirection and/or authentication # It did however provide the source code needed to make these modifications

91. UNITED STATES Caldera OpenLinux and Apache Modifications )Added a module that would link Apache’s user directory directive to the user’s Novell home directory # Making http://www.clemson.edu/~erich point to EMPLOYED/USR02:\USERS\U20\ERICH\PUBLIC.WWW )Since Caldera is NDS aware, this also allows us to serve group web sites via their own group servers

92. UNITED STATES Web Interface to Home Directories via AUTHSERV NDS Gateway Application: Personal pages Type: Web Server OS: Linux Server enabling app: Apache/Caldera http://www.clemson.edu/~acollin

93. UNITED STATES Web Interface to Department Pages Application: Departmental pages Type: Web Server OS: Linux Server enabling app: Apache/Caldera http://dcitnds.clemson.edu/CSO/depts/maint

94. UNITED STATES Caldera OpenLinux and Apache Modifications )Added another module using the previously mentioned authentication server routines to provide both user and group authentication # Makes use of standard HTACCESS format with additional Novell directives

95. UNITED STATES Using NDS to Secure Web Pages NovellAuth on AuthName Novell Tree AuthType Basic require user gmcochr require user kellen require group.resadmin.groups.employee.clemsonu

96. WebAuth: Web Single Sign-On Workstation 3rd Party WebServer WebAuth Client AuthServ NLM NDS WebAuth NLM Auth Client Web Browser 1 Web Browser 2 DCIT Authentication WebServer WebAuth Trusted Client CHECK STORE Only trusted web servers prompt for userid password and set cookie in browser. Other web servers must use the cookie to determine the user. Redirect

97. UNITED STATES Auditing NDS Connections )Have not had much luck with standard auditing in 4.x )Hook login/logout in AUDITLGN.NLM )Writes easy to manipulate log files )Data logged includes fully distinguished object name, login time, logout time, and Medium Access Control (MAC) address )Monitor file server and print server as well as user connections

98. UNITED STATES Dial-In )Mostly rely on contract between users and Internet Service Providers (ISPs) for dial-in access # Campus-MCI )Some PPP connectivity through Livingston server with Remote Authentication Dial-In User Service (RADIUS) modified to use NDS via the Authentication Server )Deployed NetWare/IP for file server connectivity via PPP

99. UNITED STATES Futures )Develop tools for user disk clean up )Develop more tools to help end users get more out of NDS and the network in general )More fully integrate NT and NDS )Make use of virtual file server )Leverage collaborative learning environment )Automate data restores

100. UNITED STATES What We Need )Web interface to unresolved as well as resolved issues at Novell )Help from Novell on resolving “Windows NT Server” marketing-through-documentation issues )Code exits in Novell products such as Client 32, RADIUS, FTP server, Novell Web Server )Good performance monitoring Simple Management Protocol (SMP) tools

101. UNITED STATES Questions and Answers

102. UNITED STATES