# Presentation: 035526

## Unix/Linux Standardization Efforts at LLNL

- Jenny Aquilino
- Lawrence Livermore National Lab
- June 11, 2007

- UCRL-PRES-231336

## Agenda

- Background/Motivation
- Challenges
- Response
- Standardization Efforts
- Future plans
- Summary

- UCRL-PRES-231336

## Background/Motivation

- UCRL-PRES-231336

## Benefits of Standardization

- Potential to decrease support costs if done properly
- Reduced number of special apps/configs
- Simplified support/training requirements
- Thorough evaluation of current environment resulting in better understanding of Unix environment
- Increased opportunities for collaboration amongst system administrators

- UCRL-PRES-231336

## Caveats - “Whoa there Nelly...”

- Not all processes/procedures can be standardized
- Special purpose equipment may have different requirements (ie: storage nodes, compute clusters, control equipment, etc.)
- Highly customized/effective processes may already be in place possessing functionality that cannot be achieved by a particular standard
- Potential to erode morale if there is no flexibility in the standards and/or if there are no opportunities to contribute to standards definitions

- UCRL-PRES-231336

## Not too long ago.....

- Unix support was considered too program specific to attempt any kind of standardization
*Authentication*: NIS/NIS+ and standalone files
*Certification and Accreditation*: Manual reporting/homegrown scripts for each directorate
*Build process*:  Build from CD or directorate kickstart server
*Logging*: Central loghost parsing logs by hand with grep or with logwatch
- Minimal organization of Unix administrators making it difficult to understand problem scope
- Desire existed to improve Unix processes but a number of challenges stood in the way before that could happen

- UCRL-PRES-231336

## Challenges

- UCRL-PRES-231336

## Challenges

- Getting a handle on the existing Unix environments across 14 directorates
- Identifying potential areas for standardization
- Getting Unix administrators to consider adopting standards
- Recognizing contributions to the group as well as individual accomplishments (ranking)

- UCRL-PRES-231336

## Response

- UCRL-PRES-231336

## Response to challenges

- Creation of Institutional Unix Working Group monthly meetings
- Forum for Unix administrators to share information with each other
- Energized and empowered administrators to be active participants in finding solutions for common problems
- Over time, areas for standardization naturally emerged from discussions
- Since its inception, attendance increased as did participation in spin-off working groups
- Recognition from management during ranking for contributions made to institutional efforts (ie. Spin-off working groups)

- UCRL-PRES-231336

## Standardization Efforts

- UCRL-PRES-231336

## Centralized Authentication

- Active Directory w/ VAS
- Ubiquitous deployment
- Large knowledge base and support for Active Directory
- Benefits:
- Group policy support for Unix systems
- Ability to centrally mange host access control
- Common login name and password for all platforms
- Limited single-sign on support
- Soon to be tied into institutional identity management feed

- UCRL-PRES-231336

## Slide 13

- UCRL-PRES-231336

## Certification and Accreditation

- LANDesk
- Already purchased and being deployed for Windows and OSX
- Significant effort being put into determining ideal configuration and support model
*Note*:  Minimal functionality for Linux but does support several nice features making it worthwhile to use
- Benefits:
- Hardware inventory of Linux systems (used for determining hardware refresh)
- Software inventory for Linux systems
- Custom C&A check script written for Linux LANDesk agent automates process of reporting C&A numbers

- UCRL-PRES-231336

## Slide 15

- UCRL-PRES-231336

## Standard Linux OS/Build 

- Standard Linux OS (RedHat Enterprise Linux)
- Standard Linux Build (uLoad)
- Benefits:
- CIO purchased RedHat Network patch server and licenses to automate process of patching systems
- Standard Linux build:
- Installs security configuration/audit script
- Installs LANDesk agent
- Binds to RHN patch server
- Binds to Active Directory

- UCRL-PRES-231336

## Slide 17

- UCRL-PRES-231336

## Future Plans

- UCRL-PRES-231336

## Event Log Monitoring/Analysis

- Splunk
- IT Search engine
- Eats everything including Windows logs
- Correlates events by event type, host name and time
- Customizable searches, notifications and alerts
- Ad-hoc search query ability in real-time
- Benefits:
- Ability to quickly troubleshoot issues on the network
- More proactive response to problems

- UCRL-PRES-231336

## Slide 20

- UCRL-PRES-231336

## And there’s more!....

- Backup solution
- Legato
- Backup to disk
- Other software....
- E-mail/calendar client (for Exchange)
- Evolution
- Thunderbird w/ Lightning plug-in
- Encryption for laptops
- FIPS140-2 compliant
- Key escrow

- UCRL-PRES-231336

## Wrap-up

- Organize Unix administrators
- Give them the opportunity to be involved in finding solutions
- Identify an advocate for Unix interests who understands and shares institutional values
- Start with low-hanging fruit
- Focus efforts on most commonly used OS’s
- Leverage existing infrastructure if possible
- Respect need to deviate from standards when programmatic requirements call for it
- Adopt a “right tool for the job” over a “one size fits all” approach to standardization

- UCRL-PRES-231336

## Questions??

- UCRL-PRES-231336