1. NDS and The Computing Infrastructure Division of Computing and Information Technology CLEMSON U N I V E R S I T Y January 22, 1998

2. Agenda n Background on Clemson IS n Mission & Support Structure n Userid Management n Network Design n Server & Network Access n Public Access Labs n Printing n Electronic Mail n Intranet n Authentication Server n Futures

3. Background on Clemson Information Systems

4. Background n Large Systems Background n Strong Development Shop n Mainframe and Open Systems Expertise n Departmental LANs ruled 90’s until NDS n NDS populated in Summer 1995 (36,000) n Departmental LANs gone. More centralized management of the network. n NDS is centerpiece of security and authentication.

5. Mission & Support Structure

6. Mission n Provide computing infrastructure. n Empower Users and Departments. n Provide guidance in selecting solutions based on industry standards. n Deploy solutions to meet the needs of institutional computing. n Provide user support and training.

7. Defining Groups n Network Services - supports the physical network…routers, hubs, backbone n LAN Systems - supports application, group, and personal data servers. n Client Support Group (CSG) - supports faculty and staff via TSPs. n Systems Integration Group (SIG) - supports students and departmental labs.

8. Defining (more) Groups n Computer Resources - assists with user account problems (DCIT sponsored). n College Consultants - DCIT sponsored person and college sponsored person(s) that help support the end users of the college. n Technology Support Provider (TSP) - supports faculty/staff end users n Help Desk - sponsored by DCIT to assist end users.

9. Support Structure n Support is based on a four tier model. Problems Resources Client Support Systems Integration LAN Systems Network Services TSPs HelpDesk Faculty Staff Students 1 2 3 4 College Consultant Computer Resources

10. Server Strategy & Management n Novell and NT servers maintained by Divison of Computing & Info Tech (DCIT). n DCIT provides hardware and Network Operating System (NOS). n DCIT administers backups. n DCIT performs user administration. n Group maintains data and security with help of a Tech Support Provider (TSP). n Virus Protection and Software Metering

11. Userid Management

12. Automatic Userid System (AUS) AUS Personnel Admissions MVS Unix NDS Other

13. Automating User Maintenance MVS Personnel Admissions Other AUS Present Daily UIMPORT Run Summer ‘97 USRMAINT.NLM FTP TCP/IP RealTime NDS Add Users Add Users Modify User Attributes Modify User Attributes Delete Users Delete Users

14. Network Design

15. Physical Network Design 100BT Switch FDDI Server 100BT T1

16. Tree Design

17. Every Person Has a Place

18. Every Group Has a Place

19. Partition Design

20. Use Dedicated “ROOT” Servers for NDS Replicas CU_ROOT_3 100BT Switch CU_ROOT_1 CU_ROOT_2 (ITC) Master for all R/W for all R/W for users “A” to “Z” Group Server R/W optional FDDI

21. Distribute Network Management

22. Login Script Design n Based on Profile scripts and User scripts. n No container scripts. n Use base profiles: (EMPLOYEE, STUDENT) n Base profile includes high level organizational scripts based on membership. n Organizational scripts controlled by TSPs. n Organization scripts may include departmental scripts managed by others.

23. Script Design & Management User Script.EMPLOYEE.employee.clemsonu.GROUPIFS.employee.clemsonu.ENG.ces.clemsonu.BioE.ces..AG.cafls.clemsonu.Forestry.cafls..Civil.ces. ISALAB

24. Server Time Sync Hierarchy Server C Ref Server A Prim Server B Prim Server D Secon Server E Secon External Source

25. Server and Network Resource Access

26. Personal Storage (User Data Servers) StudentD EmployeD Any Faculty or Staff Member Any Student Office, Lab, or DialUp Dorm, Lab, or DialUp

27. Personal Data Server Configuration

28. Collaborative Storage - “Group Servers” (Faculty & Staff) Group Server2 EmployeD Group Server1

29. Collaborative Storage - “App Servers” (Students) StudentD Applications Server(N)

30. Group/App/Root Server Average Configuration

31. Collaborative Storage (Faculty and Students) App Server EmployeD Group Server1 StudentD N

32. Faculty/Student Collaboration n Faculty member wants to put data on the network that his students can use. n Student submission of work to faculty. n Students collaborate on team projects with assistance from faculty member. n Students and Faculty collaborate on projects or assignments. n Publish web pages as a team or class.

33. Faculty and TSP/Client Support Management Group Server1 Read Only Create Only Read Write Teams R/W with Tgroups

34. Collaborative Storage and Network Bandwidth Group Server1

35. Public Access Labs

36. The Virtual PC

37. Outline Environment for the Virtual PC (VPC) How the Current VPC Environment Evolved Mechanics of the VPC Setting up the Computer Boot time Login and Login Script Profiles Software Involved Future Directions

38. Standard Lab Standard Set of Applications Standard Operating System(s) Contextless Login Standard Drive Mappings Identical Hard Drive Contents

39. The Environment as Seen by the Machine Data Servers Application Servers Hard Drive Image Handling Locations and Hardware

40. Personal Storage (User Data Servers) StudentD EmployeD Any Faculty or Staff Member Any Student Office, Lab, or DialUp Dorm, Lab, or DialUp

41. Collaborative Storage - “App Servers” (Students) StudentD Applications Server(N)

42. Goals of the Virtual PC Paradigm Easy Maintenance Provide Global Access to Password Protected Network Disk Space Allow User to Customize his Desktop Same Environment (“look and feel”) Regardless of Location, Hardware, or Facility Ownership

43. Evolution n Pre-Netware n Windows 3.11 Under Netware n Windows 95 Under Netware

44. How it Happens to the User

45. Constructing the Machine The Rebuild Disk REBUILD {options} Importance of VLM Client

46. Boot Time Events Location, PCType, “ISALAB”, and Other Environment Variables Some Registry Updates to Ensure Default Desktop Appearance and Server Failover Keys

47. Contextless Login Can’t Teach End Users What a Context is Using Commercial Product Because Netware SDK Lacks Information

48. The Login Script Perform Some Basic Actions Perform Group-specific Actions Perform Lab Actions Load Profile

49. Isitcool - Fail-over Applications Server Attachment Applications Server(2) ISITCOOL NLM Applications Server(n) ISITCOOL NLM Applications Server(1) Work- station Lab 1 ISITCOOL NLM Workstation Disk Image Applications 1. Using IP, get info from primary app server ISITCOOL. 2. If attach failure or ISITCOOL reports no, try next server. 3. Attach to server using Netware client. Isitcool? NO! YES!

50. Loading the Profile PCRDist is Called by the Login Script PCRDist Imports User Registry Keys from Directory Mapped to Drive U: First Time Lab Users Get Setup Printers

51. Special Mappings and Events n Mapping Shared Disk (most done by Login Scripts) n NAL (will eventually be doing most special mappings)

52. Collaborative Storage - “Group Servers” (Faculty & Staff) Group Server2 EmployeD Group Server1

53. Collaborative Storage (Faculty and Students) App Server EmployeD Group Server1 StudentD

54. Logout Logout Only Export User Registry Logout and Shutdown Export User Registry Perform Maintenance

55. Problems n Present Implementation not Scalable n DCIT Lab Support Must do All Software Installs n DCIT Lab Support Must Handle All Initial Lab Setup Operations n If Present Trends Continue, Labs of Computers will be Replaced by Labs of Network Jacks n Image must live in the login directory (not protected) n Metering

56. Summary of Novell Components n Netware n Client32 (IntraNetware Client) n NAL n VLM Client

57. Summary of Novell Products We Can Almost Use n NAL – Requires execution of some app – Will not permit re-mapping n SnapShot – We can’t distribute apps with NAL, so.AOT files are useless. This makes SnapShot useless n Client32 (IntraNetware Client) Login – Need contextless login n NRS: will not allow replication of directories on SYS (specifically, login)

58. Summary of 3rd Party Products n SoftTrack n PC Rdist and TRAPSD – Need a Netware client with integrated profile handling and event hooks n SFLogin – Need a contextless login with event hooks n NWCopy – NRS needs to allow us to replicate specific SYS volume directories n Pcounter – Need better auditing tools

59. CU Products cumap isitcool datacool editreg/patch95 editini difrator (in development) labstats (in re-development)

60. Future Directions for Us n Departmental Software (Hardware?) Installations n Remote Control of Workstation n Queuing Users Waiting for a Computer n Move from Lab to Laptop

61. Future Directions for Novell’s Products? n Client integrate profload stuff n Logout exits n Client should allow us to customize machine as well as user. We can think of a dozen uses for the Computer object in NDS! n Basically, Novell should handle the profiles (store the sludge in NDS?) n Metering n Improve Auditing Tools

62. Printing

63. Printing Strategy n All shared printers are network attach supporting only IPX protocol (HP-Jetdirect) n All printer access is controlled through NDS print queues. n Unix Print Services makes any print queue available to Unix/MVS/??? hosts using standard LPR/LPD protocols. n Unix Print Services also makes high speed institutional printers on MVS available to both Netware and Unix users/applications.

64. Printing Strategy OS/390 Unix ??? Print Gateway PC Mac Q Q Q Q Q

65. NDS Design for Printing

66. Electronic Mail

67. Electronic Mail Server: n Based on Sun Solaris. n No user accounts required on Solaris. n Server software developed at Clemson. n Multiple recipients / one copy of message. n Server based on POP/MIME Internet standard protocols. IMAP4 coming? n Eudora site license purchased by DCIT. n Listserver gaining wide spread acceptance and use. Class/section list automated.

68. Mail Server DOS POPc mainframe POPc Windows POPc Mac POPc UNIX POPc OS/2 POPc ? ? popD ListD Mail Server Mail Server

69. Mail Server: Statistics 199519961997*Category 14k 46k85kDaily Average POP Connections 13k36k62kDaily Average Msgs Retrieved from Server 27k48k92kAverage Msgs Sent using Server per day *based on partial year statistics through May 26, 1997.

70. Automated Distribution Lists MVS OS/390 ListMGR popD ListD Mail Server Mail Server TCP/IP Class Roles Departments

71. Automated NDS Group Membership MVS OS/390 ListMGR popD ListD Mail Server Mail Server TCP/IP Class Roles Departments NDS GroupMGR NLM TCP/IP

72. Student Interface to Collaborative Storage n Use DMO’s along with a graphical tool to have users select and map network resources to make them available.

73. Managing Distribution Lists with NDS popD ListD Mail Server Mail Server GroupMGR.NLM Monitor group membership modifications RegisterForEvent() TCP/IP NDS 1. Membership 2. See Also

74. NDS Interface to the List Server n Enabler for collaborative work between Faculty and Students. n Uses data from employee system on MVS to keep department NDS groups correct. n Lets users use NWAdmin to administer e- mail lists n Eliminates need to make changes to NDS and the list server. n Ensures that data is correct everywhere.

75. Intranet

76. WEB Serving n Institutional Servers n Department or Group Servers n Organizational Page Servers n Personal Page Servers n Administrative and Student Application Page Servers

77. NDS web Security via NT/Unix/?

78. Authentication Server

79. Authentication Server n Too many userid/password combinations for each user to remember. n Need central set of secure servers that all systems use for authentication. n Clemson University Personal ID (CUPID). n Based on Automatic Userid System (AUS). n Idea born in interdepartmental task force. n Production on July 1, 1996.

80. Authentication Server MAIL authC WEB authC mainframe authC Unix authC Netware authC Sun authC NT authC Oracle authC

81. NDSNDS IntranetWare Server BIntranetWare Server A AUTHSERV.NLM IntranetWare Server C Mainframe(MVS) VTAM RACF AuthClient Onlines MAIL(solaris) AuthClient POPd NTServer(4.0) AuthClient Website Application User Workstation (‘95/Mac/NT Workstation) Eudora TN3270NetscapeLogin.exe Linux AuthClient Apache Application AUTHSERV.NLM

82. Authentication Server n NLM is multithreaded. n Clients use common code base. n Clients have builtin failover capability. n Communication based on TCP/IP sockets. n >90% successful password checks complete in less than 0.1 seconds. n >2 million requests serviced by primary server over a 6 week period. 50,000/day

83. (Back to) Intranet

84. NDS Authentication through NT/Unix/other To the WEB? Application: Employee Info System (EIS) Type: WEB Server OS: Windows NT 4.0 Server Enabling App: Website/Visual Basic

85. Using NDS Security Across the Intranet Authenticated Client Server Auth Client Authentication Server NDS Netscape IIS 32bit DLL AUTHSERV NLM NDS Page request CheckEquiv Check Security Equivalence Locate user object and run equivalence list. NT 4.0

86. AUTHSERV Client Functions n Password Check n Password Change n Resolve to Fully Distinguished Name n Check Security Equivalence n Return Group Membership n Misc Administrative Functions

87. Authentication Server as an NDS Data Gateway Application: Call Tracking System Type: WEB Server OS: Windows NT 4.0 Server Enabling App: Website/Visual Basic Not Assigned BILL BROYLES CCR DAVE DAVIDC DON JAMBO YATES DAVIDC

88. Caldera OpenLinux and Apache Caldera OpenLinux File Server File Server File Server AuthC Browser AuthServer File Server File Server n WEB gateway to Netware File System.

89. Caldera OpenLinux and Apache n First attempt to provide web services via Novell made use of Novell’s IntranetWare Web Server 1.0 which simply was not reliable. n Caldera OpenLinux provided robust unix connectivity to NDS and supported the industry standard Apache web server. n Out of the box Caldera/Apache did not provide home directory redirection and/or authentication. It did however provide the source code needed to make these modifications.

90. Caldera OpenLinux and Apache Modifications n Added a module that would link Apache’s UserDir directive to the user’s Novell home directory. n Making http://www.clemson.edu/~erich point to EMPLOYED/USR02:\USERS\U20\ERICH\PUBLIC.WWW n Since Caldera is NDS aware, this also allows us to serve group web sites via their own group servers.

91. Web Interface to Home Directories via Authserv NDS Gateway Application: Personal Pages Type: WEB Server OS: Linux Server Enabling App: Apache/Caldera http://www.clemson.edu/~acollin

92. Web Interface to Department Pages Application: Departmental Pages Type: WEB Server OS: Linux Server Enabling App: Apache/Caldera http://dcitnds.clemson.edu/CSO/depts/maint

93. Caldera OpenLinux and Apache Modifications n Added another module using the previously mentioned Authentication Server routines to provide both user and group authentication. n Makes use of standard HTACCESS format with additional Novell Directives.

94. Using NDS to Secure Web Pages NovellAuth on AuthName Novell Tree AuthType Basic require user gmcochr require user kellen require group.resadmin.groups.employee.clemsonu

95. WebAuth: Web Single Signon Workstation 3rd Party WebServer WebAuth Client AuthServ NLM NDS WebAuth NLM Auth Client Web Browser 1 Web Browser 2 DCIT Authentication WebServer WebAuth Trusted Client CHECK STORE Only trusted web servers prompt for userid password and set cookie in browser. Other web servers must use the cookie to determine the user. Redirect

96. Auditing NDS Connections n Have not had much luck with standard auditing in 4.x n Hook login/logout in AUDITLGN.NLM n Writes easy to manipulate log files n Data logged includes fully distinguished object name, login time, logout time, and MAC address n Monitor file server and print server as well as user connections.

97. Dialin n Mostly Rely on contract between users and ISPs for dialin access. Campus-MCI. n Some PPP connectivity through Livingston server with Radius modified to use NDS via the Authentication Server. n Attempting to get Netware/IP deployed this summer for file server connectivity via PPP. n Starting to deploy DHCP for dialin and dorm usage only.

98. Server Growth n Split User Data Servers (ie: StudentD1 and StudentD2) n Common access server for both Students and Faculty/Staff (scratch disk) n Develop tools for user disk cleanup. n Develop more tools to help end users get more out of NDS and the network in general.

99. What We Need n Web interface to unresolved as well as resolved issues at Novell. n More out of SMP. n NDS on NT (no replicas required). n Help from Novell on resolving “NT Server” marketing-through-documentation issues. n Code Exits in Novell Products such as client32, Radius, FTP server, Web server. n Good performance monitoring (SMP) tools.

100. That’s It! (that’s enough..)