Changes between Version 2 and Version 3 of ALL__accounts_roles


Ignore:
Timestamp:
11/13/14 14:37:12 (12 years ago)
Author:
lttoth@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • ALL__accounts_roles

    v2 v3  
    9393 
    9494 
    95 == UNIX ACCOUNT/GROUPS == 
    96  
    97 === Directory Servers === 
    98         ==== account: ldapgw ====        
    99         UNIX account owning CGI scripts representing the EDIR/AUTHSERV web gateways. 
    100                 * member of group ldapgw (primary group) 
    101                 * member of group edirgw (used to expose password files to nobody during CGI script execution) 
     95== UNIX GROUPS AND MEMBER ACCOUNTS == 
     96       === Directory Server Groups === 
     97        ==== group: iplanet     ==== 
     98                default group of iplanet account 
     99 
     100        ==== group: ldapgw ====  
     101                default group of ldapgw account 
     102 
     103        ==== group: updategw ==== 
     104                group used by iplanet to expose files that must be visible to 'nobody'  
     105                (future) group used by sxldap to expose files that must be visible to 'nobody' 
     106                (owner of Apache processes) when executing update process CGI scripts 
     107 
     108 
     109        ==== group: edirgw ==== 
     110                group used by ldapgw to expose files that must be visible to 'nobody'  
     111                (owner of Apache processes) when executing gateway CGI scripts 
     112 
     113=== Directory Server Accounts  === 
     114        ==== account: //ldapgw// ====    
     115UNIX account owning CGI scripts representing the EDIR/AUTHSERV web gateways. 
     116 
     117                * Group Membership 
     118                  * ldapgw - primary group 
     119                  * edirgw 
     120                        * exposes password files to //nobody// during CGI script execution via group membership 
    102121                        * any files opened during execution of CGI scripts 
    103122                        * <GW>/logs directory where output is written 
    104                 * member of group other   
    105                 * member of group UA_Korn (on toklat only) 
     123                  * other   
     124                  * UA_Korn (on toklat only) 
    106125                * .shosts file must allow access by  
    107126                        * <<directory servers>> iplanet 
    108127                * ldapgw must be listed in ~ua?synch/.shosts file to facilitate transfer of UA? specific "style" elements utilized by EDIR/AUTHSERV 
    109128 
    110         ==== account: sxldap ==== 
    111         UNIX account owning CGI scripts representing the UPDATE back end gateway. 
     129        ==== account: //sxldap// ==== 
     130UNIX account owning CGI script representing the UPDATE back end gateway. 
    112131 
    113132                * Group Membership 
    114                 member of group updategw (primary group) 
    115                 member of group edirgw (used to expose password files to nobody during CGI script execution) 
    116                         any files opened during execution of CGI scripts 
    117                         <GW>/logs directory where output is written 
    118                 member of group other   
    119                 member of group UA_Korn (on toklat and summit only) 
    120          
    121                 .shosts file must allow access by  
    122                         <<directory servers>>   iplanet 
    123          
    124         account: iplanet         
     133                 * updategw  - primary group 
     134                 * edirgw 
     135                        * exposes password files to //nobody// during CGI script execution via group membership 
     136                        * affects any files opened during execution of CGI scripts 
     137                        * affects <GW>/logs directory where output is written 
     138                 * other   
     139                 * UA_Korn (on toklat and summit only) 
     140                 * .shosts file must allow access by  
     141                        * <<directory servers>> iplanet 
     142         
     143        ==== account: //iplanet// ====   
    125144        UNIX account owning iPlanet directory and web update processes.   
    126145                * Directory Locations 
    127146                        ~iplanet/EDIR[TEST|PREP|PROD]/ 
    128147                        ~iplanet/AUTH[TEST|PREP|PROD]/ 
    129                 *All directory maintenance related source code is stored under this account  
     148                * All directory maintenance related source code is stored under this account  
    130149                        ~iplanet/local/ldap/ 
    131                 *.shosts file must allow access by 
     150                * .shosts file must allow access by 
    132151                        <<registry servers>>    sxldap 
    133152                * Group membership 
    134                   * iplanet (primary group) 
     153                  * iplanet - primary group 
    135154                  * other   
    136                   * edirgw (associated with files visible to all parties supporting gateways) 
    137                   * updategw (associated with password files read by CGI scripts) any files opened during execution of CGI scripts <GW>/ldap/web/log directory where output is written 
    138          
    139         account: nobody  
    140         UNIX account under which Apache httpd processes are started and under which EDIR CGI scripts are executed via the web. 
    141                 * member of group nobody (primary group) 
    142                 * member of group edirgw (facilitate reading of password files read by CGI scripts) 
    143                 * member of group updategw (facilitate reading of password files read by CGI scripts) 
    144          
    145         account: ua?synch 
    146                 UNIX accounts under which UAA specific "style" elements are maintained  
    147                 for test and preproduction EDIR/AUTHSERV. 
    148                         ~ua?synch/[TEST|PREP]/ 
     155                  * edirgw  
     156                   * associated with files visible to all parties supporting gateways 
     157                  * updategw  
     158                   * associated with password files read by CGI scripts  
     159                   * any files opened during execution of CGI scripts  
     160                   * <GW>/ldap/web/log directory where output is written 
     161         
     162        ==== account: //nobody// ====    
     163UNIX account under which Apache httpd processes are started and under which EDIR CGI scripts are executed via the web. 
     164                * Group membership 
     165                * nobody - primary group 
     166                * edirgw  
     167                 * facilitate reading of password files read by CGI scripts 
     168                * updategw  
     169                 * facilitate reading of password files read by CGI scripts 
     170         
     171        ==== account: //ua?synch// ==== 
     172UNIX accounts under which UAA specific "style" elements are maintained for test and preproduction EDIR or AUTHSERV. 
     173 
     174                * for test and preproduction EDIR/AUTHSERV. 
     175                        * ~ua?synch/[TEST|PREP]/ 
    149176 
    150177                Note: Production "style" elements are copied from preproduction to the gateway  
    … …  
    156183                        <<ua? entities>> 
    157184         
    158                 member of group other (primary group) 
    159                 member of group edirsynch (facilitate transfer of LDIF to uaasynch account) 
    160  
    161         group: iplanet   
    162                 default group of iplanet account 
    163  
    164         group: ldapgw    
    165                 default group of ldapgw account 
    166  
    167         group: updategw 
    168                 group used by iplanet to expose files that must be visible to 'nobody'  
    169                 (future) group used by sxldap to expose files that must be visible to 'nobody' 
    170                 (owner of Apache processes) when executing update process CGI scripts 
    171  
    172  
    173         group: edirgw 
    174                 group used by ldapgw to expose files that must be visible to 'nobody'  
    175                 (owner of Apache processes) when executing gateway CGI scripts 
    176  
    177  
    178 Registry Servers: 
    179  
    180         account: oracle 
    181                 UNIX account owning oracle processes on registry servers where DBMS_FILE  
    182                 is used in LDIF generation.  oracle owns resulting files and must change the  
    183                 file permissions before files can be copied by the registry account. 
    184          
    185                 member of group SWLDAP (facilitate change owner on EDIR LDIF) 
    186                 <<and member of many other groups not applicable to EDIR processing>> 
    187          
    188         account: sxldap 
    189                 UNIX account under which EDIR Banner Extract processing occurs and from  
    190                 which registry generated LDIF originates.  All EDIR registry related source  
    191                 code is stored under this account 
    192                         summit:~sxldap/local/ldap/ 
     185                * Group Membership 
     186                 * other - primary group 
     187                 * edirsynch  
     188                   * facilitate transfer of LDIF to uaasynch account 
     189 
     190 
     191 
     192=== Registry Servers - Groups and Accounts === 
     193 
     194        ==== group: SWLDAP ==== 
     195                group used to share output of registry database batch processes where output is  
     196                owned by oracle and written to /tmp 
     197 
     198        ==== account: //oracle// ==== 
     199UNIX account owning oracle processes on registry servers where DBMS_FILE is used in LDIF generation.  oracle owns resulting files and must change the file permissions before files can be copied by the registry account. 
     200         
     201               * Group Membership  
     202                  * group SWLDAP  
     203                    * facilitate change owner on EDIR LDIF 
     204                  * many other groups not applicable to EDIR processing 
     205         
     206        ==== account: //sxldap// ==== 
     207UNIX account under which EDIR Banner Extract processing occurs and from which registry generated LDIF originates.  All EDIR registry related source code is stored under this account.  
     208         
     209                Master - eklutna:~sxldap/local/ldap/ 
    193210         
    194211                sxldap must be listed in ~iplanet/.shosts file to facilitate transfer  
    … …  
    198215                member of group UA_Korn 
    199216 
    200         group: SWLDAP 
    201                 group used to share output of registry database batch processes where output is  
    202                 owned by oracle and written to /tmp 
    203217         
    204218