Administration groups 11.. IInnttrroodduuccttiioonn An admin group is a set of machines which are sharing some config files or parts of some config files. In Linuxconf parlance, they are sharing some subsystems. The concept of a subsystem is the same as that used for the "system profile versioning" feature. 11..11.. DDeeffiinniittiioonn ooff aa ssuubbssyysstteemm A subsystem represents a set of logically tied configuration files. In some cases, a subsystem is made of only parts of a configuration file. Seen differently, all configuration files known to Linuxconf belongs to at least one subsystem. In some cases, a configuration is split logically into more than one subsystem. This is the case for _/_e_t_c_/_f_s_t_a_b which belongs to the _h_a_r_d_w_a_r_e and the _n_e_t_c_l_i_e_n_t subsystems. This ability to logically distribute one configuration file into various subsystems is the key to sharing. For example, many machines on a net may share the NFS client part of _/_e_t_c_/_f_s_t_a_b but can't share the rest as it is hardware dependent (partition layout, swap partitions, etc). 22.. DDeeffiinniinngg aa ggrroouupp Here are the steps to create an administration group: 22..11.. GGiivvee iitt aa nnaammee Each group must have a unique name. The name must not have any space. Each group corresponds to a subdirectory in /etc/linuxconf/admgroups The name of the subdirectory is simply the group name. 22..22.. GGiivvee iitt aa ddeessccrriippttiioonn This is used to enhance various screens. It has no functional usage. 22..33.. LLiinnkk iitt wwiitthh aann aaddmmiinniissttrraattiioonn ttrreeee An administration tree is like a virtual workstation in your computer. It either has (or could have) all the configuration files a fully configured Linux station would normally have. By linking to a specific administration tree, you are saying that this administration group is picking all or parts of its configuration files from the configuration files of this administration tree. The idea of separating the administration tree from the administration group is in many environments. You will have one administration tree and the machine's part of this environment will split it this way: +o Most machines: share a large part of the administration tree. +o Some machines: share the same information except for specific services only. +o Some other machines: are completely independent. As such, they are not members of any administration group. Often, all machines on the same physical network will share some aspect of a single administration tree. A help list shows available administration trees. You can enter a name which is not in the list; just don't forget to create it later. 22..33..11.. TThhee // aaddmmiinniissttrraattiioonn ttrreeee It is possible to share the configuration of the workstation itself. The administration tree is simply called / and is shown in the help list. 22..44.. MMeemmbbeerrss ooff tthhee ggrroouupp Simply enumerate the various members (the machine names and domains) who must be synchronized. This is currently limited as you have to specify them one by one, but is expected to expand in various areas: +o Allowing the definition of pseudo members which will themselves repeat the configuration file to other machines. A repeater may act this way for several administration groups. +o Allowing for usage of wild cards: *.domain.com. +o Allowing for usage of network/netmask pairs. +o Allowing for on demand supply of configuration files, since such administration groups may very well have no official members! 22..55.. SSuubbssyysstteemm ttoo sshhaarree A list of all subsystems available is presented. On the left, the subsystem ID is presented. On the right, the description of the subsystem is presented. For each subsystem, there is a checkbox. You can select which subsystems are shared. 33.. DDiiaalloogg''ss bbuuttttoonnss Here are the functions associated with the various dialog buttons 33..11.. AAdddd This will enlarge the dialog to allow more members (not completed yet). 33..22.. DDeell This allows you to delete the administration group. This deletes the information in Linuxconf, but the files in /etc/linuxconf/admgroups/group-id are not deleted. 33..33.. PPuubblliisshh This takes a snapshot of the selected subsystems in the administration tree. The snapshot is installed in /etc/linuxconf/admgroups/group-id Once published, an administration group is ready to be shared with members of the group, using either the _e_x_p_o_r_t functionality or any other means you can imagine. The directory tree of an administration group may be installed on any Linuxconf station with the netadm module and imported, making it operational. 33..44.. EExxppoorrtt Export uses a custom protocol to reach another Linuxconf host. It sends the contents of the administration group repository and then triggers an _i_m_p_o_r_t procedure and an _a_c_t_i_v_a_t_i_o_n procedure (netconf --update). Currently, this procedure is manual. For each member of the administration group, Linuxconf prompts you for its root password. Using this password, it gets access and completes the operation. This is only one way an administration group repository may be shared. One may choose to export it using NFS (depending of the level of privacy required) or any other well known network protocol. We believe that much will be needed to make this sharing appropriate for the various network environments out there. Comments are welcome. 33..44..11.. SSppeecciiaall aaccccoouunnttss ffoorr rreemmoottee aaddmmiinniissttrraattiioonn aanndd cclluusstteerr mmaannaaggee-- mmeenntt Linuxconf uses special protocols to perform remote administration and cluster management. Those protocols may be encapsulated easily to enhance either connectivity and security. One nice encapsulating tool is ssh (secure shell). ssh is a great replacement for commands like rlogin, rsh, rcp and telnet. It does basically the same thing (and more), but with added encryption and compression. ssh is also very useful to interconnect two processes remotely, by providing a secure (encrypted) link. This is the way Linuxconf is using it. By setting a special account on workstations and servers, you will be able to use it with Linuxconf without even knowing it. This is experimental and comments are welcome. 33..44..22.. HHooww ttoo sseett uupp aa hhoosstt ffoorr cclluusstteerr mmaannaaggeemmeenntt Linuxconf uses ssh to establish the link. It expects that a special user account "netadm" exists on the remote host. This user account must have the shell /usr/lib/linuxconf/lib/netadmshell The account must NOT have a password. The idea is to trigger Linuxconf immediately, which will request the root password using its remote management protocol. You can use ssh access control to limit who may access your box this way. They need the root password, no matter what, to access it.