From: kraemerf@franvm3.VNET.IBM.COM (Frank Kraemer)
Date: Thu, 8 Oct 92 17:16:38 CET
Newsgroups: comp.unix.aix
Subject: DCE/6000 first experiences
Reply-To: kraemerf@franvm3.VNET.IBM.COM
Organization: IBM Germany, BO-89 ACIS South
Disclaimer: This posting represents the poster's views, not those of IBM
News-Software: Usenet 3.0

File: DCE.HOWTO
From: Frank Kraemer
Sub.: DCE/6000 - first experiences
Date: 92/10/08

 =---------------------------------------------------------------------=

Part 0:   I had the chance to work 7 weeks in the International
=======   Technical Support Center in Austin and make some first
          experiences with OSF DCE/6000. I try to summarize and
          share my experience.

 =---------------------------------------------------------------------=

Part 1:   DCE/6000 installation is a two step process. The first part is the
=======   installation via SMIT (installp) of the required products.
          This is the same straightforward process like any other LPP
          (e.g. X11 or TCP/IP) and just takes some minutes.

          The second part of the installation needs more time and
          brain and is the integration or set up of the DCE cell environment.
          SMIT offers an interface to the 'mkdce' shell script, which does
          the real work behind the screens. Before you start your cell
          layout and configuration should be ready on paper - spend a
          lot of time there to save more later. :-) :-)

 =---------------------------------------------------------------------=

Part 2:   Files and directories used by DCE/6000
=======

  /etc/dce_cf.db         -  DCE configuration database.
                            Contains:   cellname  $cellname
                                        hostname  hosts/$hostname

  /etc/services          -  Contains an entry for the Kerberos well known
  /etc/objrepos/InetServ    UDP/IP port: "kerberos5    88/udp  kdc"

  /etc/inittab           -  Contains an entry to call '/etc/rc.dce' at each
                            system reboot (optional). A good idea is to
                            redirect STDOUT to '/tmp/DCE.log' instead of
                            messing up the login prompt. Example:

                             "rcdce:2:wait:/etc/rc.dce > /tmp/DCE.LOG 2>&1"

  /etc/rc.dce            -  The mkdce shell script starts up all DCE server
                            and client processes according to the configured
                            parts and role of the system in the cell.

  /etc/rc.dts            -  Start up shell script for the DTS system.

  /etc/mkdce.data        -  Contains DCE configuration information.

  /etc/dce.clean         -  Shell script to stop all or part of the configured
                            DCE processes and daemons. A good idea is to
                            include a line in the '/etc/shutdown' script
                            to call '/etc/dce.clean all' before power off.

                            Example: (insert in /etc/shutdown)
                            --------

                               # ==>> before calling /etc/nfs.clean
                               # if /etc/dce.clean exists then execute it
                               if [ -f /etc/dce.clean ]
                               then
                                       sh /etc/dce.clean all
                               fi

  /krb5/krb.conf         -  Kerberos configuration file.
                            Contains: $short_cell_name
                                      $short_cell_name $initial_sec_server

  /krb5/v5srvtab         -  The keytab file contains principal password
                            data. (Example: server and machine passwords)

  /opt/dcelocal/var/security/creds    -  This directory contains files which
                                         represent valid kerberos tickets
                                         used by the security system.

  /opt/dcelocal/etc/security/pe_site  -  This file contains UUID's and
                                         protocol information from the
                                         security server.

                       Example:  (xxx.xxx.xxx.xxx := dotted IP)
                       --------
                       "/.../<cellname> <UUID>@ncadg_ip_udp:xxx.xxx.xxx.xxx[]"

  /opt/dcelocal/etc/cds.conf          -  Cell Directory Service (CDS)
                                         configuration file.
    Example:
    --------
    cds.cdsd.security.server_princ_name:  $cellname/hosts/$hostname/cds-server
    cds.*.security.host_princ_name:       hosts/$hostname/self
    cds.*.security.server_group_name:     subsys/dce/cds-server
    cds.*.security.admin_group_name:      subsys/dce/cds-admin
    cds.gdag.security.server_princ_name:  $cellname/host/$hostname/gda

  /var/dce/directory/cds              - This directory contains the files
                                        which represent the DCE clearinghouse.

                               $cellname#$hostname_ch.checkpointnnnnnnnnnn
                               $cellname#$hostname_ch.tlognnnnnnnnnn
                               $cellname#$hostname_ch.version

  /opt/dcelocal/var/security/rgy_data - The registry database.

  /opt/dcelocal/var/rpc/rpcdep.dat    - The local RPC database maintained
  /opt/dcelocal/var/rpc/rpcllb.dat      from the rpcd daemon process.
                                        ('rpcllb.dat' is for backward
                                        compatibility with NCS V.1.5.1)

  /opt/dcelocal/bin/rpcd              -   RPC daemon
                    secd              -   Security server daemon
                    cdsd              -   CDS server daemon
                    gdad              -   GDA daemon
                    dtsd              -   DTS daemon
                    sec_clientd       -   Security client daemon
                    cdsadv            -   CDS advertiser
                    cdsclerk          -   CDS clerk/client

 =---------------------------------------------------------------------=

Part 3:   What's going on during DCE configuration. A shell script
=======   named 'mkdce' does the the real work. This script is about
          50 pages long (!) - I try to explain what's going on step
          by step in english words. (see /usr/lpp/dce/bin/mkdce)

               =---main()----------------------------------=

  * Verify that this process of 'mkdce' it the only occurence of 'mkdce'
    that is running at a time on the local system.
  * Verify that this process is only running while 'rmdce' is not.
  * Verify that 'mkdce' has being started by the root user.
  * Process command line options.
  * Parse items of DCE/6000 to be configured on the local system and
    test if the software is available on the filesystem.
  * Create a configuration list to process things in the right order:

     a) RPC System             -  $rpc        = "rpc"
     b) Security Server System -  $sec_server = "sec_srv"
     c) CDS Server System      -  $cds_server = "cds_srv" or "cds_second"
     d) GDA System             -  $gda        = "gda"
     e) DTS Server System      -  $dts_server = "dts_global" or "dts_local"
     f) Security Client System -  $sec_client = "sec_cl"
     g) CDS Client System      -  $cds_client = "cds_cl"
     h) DTS Client System      -  $dts_client = "dts_cl"

  * Verify the cell name.
  * Request the password for the "cell_admin" account.
  * Verify the Cell security server.
  * Verify the CDS server.
  * Run the configuration functions for the configuration list.
    These functions are part of the 'mkdce' shell script and
    their names are "config_<DCE-component-name>()".
  * Dislpay the current configuration status of DCE/6000 on the local system.
  * Exit 'mkdce'

               =---config_rpc()----------------------------=

  * Check if the RPC system is already configured on the local host.
    If 'yes' then check if the rpcd daemon process is active on the
    system or try to restart the daemon process.
    If the rpcd daemon process was running fine or could be restarted
    successfully and the RPC system was configured before return
    from the function to it's caller.
  * Update the /etc/mkdce.data file with log information.
  * Check if any other DCE daemon process is running on the system.
    If not, then try to remove the local RPC database files maintained
    from the 'rpcd' daemon if they exist.
  * Start the 'rpcd' daemon process on the local system. This process is
    called the "endpointmapper" and is runnning on all DCE hosts in a
    network.
  * Update the /etc/rc.dce file to start the rpcd daemon in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_sec_srv()------------------------=

  * Configure the RPC system via calling config_rpc().
  * Check if the system is already configured as a security server.
    If 'yes' then check if the secd daemon process is active on the system
    or try to restart the daemon process.
    If the secd daemon process was running fine or could be restarted
    successfully and the security server system was configured before return
    from the function to it's caller.
  * If the system was not configured as a security server but the secd
    daemon process is running - stop it.
  * Update the /etc/mkdce.data file with log information.
  * Create the DCE configuration file /etc/dce_cf.db or verify the
    contents of the file it it already exists.
  * Clean up the security database files on the system.
  * Update the /etc/services file with the well known port number for
    the Kerberos system. Sync the /etc/services file with the ODM
    database InetServ via the inetimp command.
  * Initialize the security database via executing the sec_create_db
    program with the required arguments.
  * Start up the secd daemon process the first time with the "-bootstrap"
    option.
  * Update the /etc/rc.dce file to start the secd daemon in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_cds_srv()------------------------=

  * Make sure the RPC system and the security client system are configured
    and running via calling config_sec_cl().
  * Check if the system is already configured as a CDS server. If 'yes'
    then check if the cdsd daemon process is active on the system or
    try to restart the daemon process.
    If the cdsd daemon process was running fine or could be restarted
    successfully and the CDS server system was configured before return
    from the function to it's caller.
  * Check that the CDS secondary server system or the CDS client system
    have not been configured on the local system before.
  * If the system was not configured as a CDS server or a CDS secondary
    server but the cdsd daemon process is running - stop it.
  * Request a valid ticket from the security system to become authenticated.
  * Update the /etc/mkdce.data file with log information.
  * Clean up old 'cds-server' account information from the registry database.
  * Add security accounts and passwords for this server in the registry
    database using the rgy_edit command.
  * Create the CDS configuration file '/etc/cds.conf'.
  * Start up the CDS advertiser process 'cdsadv' on the local system.
  * Start up the CDS server proces 'cdsd' on the local system.
  * Verify the authentication and re-authenticate if necessary.
  * Initialize the CDS namespace using the acl_edit, rpccp and
    cdscp commands.
  * Update the /etc/rc.dce file to start the cdsd and cdsadv daemon in
    the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_cds_second()---------------------=

  * Make sure the CDS client  system is configured via calling the
    config_cds_cl() function.
  * Check if the system is already configured as a secondary CDS server.
    If 'yes' then check if the cdsd daemon process is active on the
    system or try to restart the daemon process.
    If the cdsd daemon process was running fine or could be restarted
    successfully and the CDS secondary server system was configured
    before return from the function to it's caller.
  * Check that the local system was not set up as an initial CDS server.
  * If the system was not configured as an initial CDS server but
    the cdsd daemon process is running - stop it.
  * Request a valid ticket from the security system to become authenticated.
  * Update the /etc/mkdce.data file with log information.
  * Clean up old 'cds-server' account information from the registry database.
  * Add security accounts and passwords for this server in the registry
    database using the rgy_edit command.
  * Create the CDS configuration file '/etc/cds.conf'.
  * Start up the CDS advertiser process 'cdsadv' on the local system.
  * Start up the CDS server proces 'cdsd' on the local system.
  * Create a CDS clearinghouse on the local system using the 'cdscp' command.
  * Update the namespace information to reflect the new secondary CDS
    server using the 'rpccp' and 'acl_edit' commands.
  * Update the /etc/rc.dce file to start the cdsd daemon in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_gda()----------------------------=

  * Make sure the RPC, the security and the CDS client system are configured
    and running via calling the config_cds_cl() function.
  * Check if the system is already configured as a GDA server. If 'yes'
    then check if the gdad daemon process is active on the system or
    try to restart the daemon process.
    If the gdad daemon process was running fine or could be restarted
    successfully and the GDA server system was configured before return
    from the function to it's caller.
  * If the system was not configured as a GDA system but the gdad daemon
    process is running - stop it.
  * Request a valid ticket from the security system to become authenticated.
  * Update the /etc/mkdce.data file with log information.
  * Clean up old 'gda' account information from the registry database.
  * Add GDA account information to the registry database using the
    rgy_edit command.
  * Update the CDS configuration file /etc/cds.conf with GDA information.
  * Start up the GDA daemon gdad on the local system.
  * Update the /etc/rc.dce file to start the gdad daemon in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_dts_global()---------------------=

  * Make sure the RPC, the security and the CDS client system are configured
    and running via calling the config_cds_cl() function.
  * Check if the system is already configured as a DTS Global server. If
    'yes' then check if the dtsd daemon process is active on the system or
    try to restart the daemon process.
    If the dtsd daemon process was running fine or could be restarted
    successfully and the DTS server system was configured before return
    from the function to it's caller.
  * Check that the local system was not set up as DTS client or DTS Local
    server before.
  * If the system was not configured as a DTS system but the dtsd daemon
    process is running - stop it.
  * Update the /etc/mkdce.data file with log information.
  * Load the DTS kernel extensions.
  * Start up the DTS server process dtsd.
  * Configure the DTS server process via the dtscp program as a Global DTS
    server.
  * Create the /etc/rc.dts start up and configuration file.
  * Update the /etc/rc.dce file to start the dtsd in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_dts_local()----------------------=

  * Make sure the RPC, the security and the CDS client system are configured
    and running via calling the config_cds_cl() function.
  * Check if the system is already configured as a DTS Local server. If
    'yes' then check if the dtsd daemon process is active on the system or
    try to restart the daemon process.
    If the dtsd daemon process was running fine or could be restarted
    successfully and the DTS server system was configured before return
    from the function to it's caller.
  * Check that the local system was not set up as DTS client or DTS Global
    server before.
  * If the system was not configured as a DTS system but the dtsd daemon
    process is running - stop it.
  * Update the /etc/mkdce.data file with log information.
  * Load the DTS kernel extensions.
  * Start up the DTS server process dtsd.
  * Configure the DTS server process via the dtscp program as a Local DTS
    server.
  * Create the /etc/rc.dts start up and configuration file.
  * Update the /etc/rc.dce file to start the dtsd in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_sec_cl()-------------------------=

  * Configure the RPC system via calling config_rpc().
  * Check if the system is already configured as a security client. If
    'yes' then check if the sec_clientd daemon process is active on the
    system or try to restart the daemon process.
    If the sec_clientd daemon process was running fine or could be restarted
    successfully and the security client system was configured before return
    from the function to it's caller.
  * If the system was not configured as a security client system but the
    sec_clientd daemon process is running - stop it.
  * Update the /etc/mkdce.data file with log information.
  * Create or verify the /etc/dce_cf.db file.
  * Create or verify the /opt/dcelocal/etc/security/pe_site file.
  * Create or verify the /krb5/krb.conf file for the Kerberos system.
  * Check and if necessary create the well known UPD port for the Kerberos
    system on the local host.
  * Request a valid ticket from the security system to become authenticated.
  * Clean up old CDS security account information from the registry database.
  * Create the security account for this machine using the rgy_edit
    command.
  * Add the local host as a principal to the dts-servers group using the
    rgy_edit command.
  * Start up the security client process sec_clientd.
  * Update the /etc/rc.dce file to start the sec_clientd in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_cds_cl()-------------------------=

  * Make sure the RPC system and the security client system are configured
    and running via calling config_sec_cl().
  * Check if the system is already configured as a CDS client. If 'yes'
    then check if the cdsadv daemon process is active on the system or
    try to restart the daemon process.
    If the cdsadv daemon process was running fine or could be restarted
    successfully and the CDS client system was configured before return
    from the function to it's caller.
  * If the system was not configured as a CDS client but the
    cdsadv daemon process is running - stop it.
  * Request a valid ticket from the security system to become authenticated.
  * Create the CDS configuration file '/etc/cds.conf'.
  * Start up the CDS advertiser process 'cdsadv' on the local system.
  * Store CDS server info in the cache of the cdsadv process.
  * Verify the authentication and re-authenticate if necessary.
  * Initialize the CDS namespace using the acl_edit, rpccp and
    cdscp commands.
  * Update the /etc/rc.dce file to start the cdsadv daemon in the
    config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

               =---config_dts_cl()-------------------------=

  * Make sure the RPC, the security and the CDS client system are configured
    and running via calling the config_cds_cl() function.
  * Check if the system is already configured as a DTS client. If
    'yes' then check if the dtsd daemon process is active on the system or
    try to restart the daemon process.
    If the dtsd daemon process was running fine or could be restarted
    successfully and the DTS client system was configured before return
    from the function to it's caller.
  * Check that the local system was not set up as DTS Local or Global
    server before.
  * If the system was not configured as a DTS system but the dtsd daemon
    process is running - stop it.
  * Update the /etc/mkdce.data file with log information.
  * Load the DTS kernel extensions.
  * Start up the DTS daemon process dtsd.
  * Configure the DTS daemon process via the dtscp program as DTS client.
  * Create the /etc/rc.dts start up and configuration file.
  * Update the /etc/rc.dce file to start the dtsd daemon in the config script.
  * Log configuration information in the /etc/mkdce.data file.
  * Return from the function to it's caller.

 =---------------------------------------------------------------------=

Part 4:   We were working with pre-GA DCE/6000 code - things may change
=======   in the final version (please verify). Thanks for your interest.
          Send email reply to: kraemerf@franvm3.vnet.ibm.com

 =---------------------------------------------------------------------=

frank ;-)








.----------------------------------------------------------------------.
| E-Mail: FRANVM3(KRAEMERF)                 - IBM VNET  "Yes, I'm one  |
| ======  IBMMAIL(DEIBM27S)                 - IBM-Mail   of those      |
|         DE.IBMX400.IBMMAIL.KRAEMER.KRAEME - X.400      stupid IBM    |
|         kraemerf@franvm3.vnet.ibm.com     - Internet   field SE's."  |
| Voice : +49-(0)611/776-364                                           |
| Mail  : Abraham-Lincoln Street 26, 6200 Wiesbaden, Germany           |
'----------------------------------------------------------------------'
Newsgroups: comp.unix.aix