From: norton@gdwest.gd.com (Kent Norton)
Newsgroups: comp.sys.apollo
Subject: Migration to HP-UX: changing UID/GID's on DOMAIN
Date: 16 Oct 92 14:57:34 GMT
Organization: Computer Sciences Corp.

We just went through a fun-filled weekend of standardizing the UID's
and GID's for all the accounts on our Apollo's, HP's, SGI's and SUN's.
I thought that maybe some folks would be interested in some of the problems
we stumbled on and how they were fixed.

First of all, changing the UID's of the non-DOMAIN machines is straight-
forward:  modify the values in /etc/passwd and /etc/group and use a
simple script that runs find to identify all the files that have changed
and then use chown and chgrp to change them to the new values.

On DOMAIN, the problem is not so straight forward since the registry
is responsible for the creation and updates to the /etc/passwd and 
/etc/group files.  These are not ASCII files that can be edited, but
are rather written to by some special type managers.  Therefore, any changes
to the UID's should be initiated through edrgy.  Doesn't sound too bad,
but there _can_ be some pitfalls, especially in large dds-internetted
networks.

After going through several iterations, here's the steps we came up
with that allowed us to successfully change the UID's and GID's across
*all* DOMAIN machines in our network:

   - Create master list of old and new UID's for all systems
   - Make sure global location brokers are all running, have
     the same information, and are on nodes that have their
     clocks in 'sync'.
   - Make sure that rgyd sites are all up and running and that
     /etc/rgy_admin reports that all sites have been updated
     with the latest master registry information. 
   - Plan a time to make the changes when few to NO users are on the 
     network.
   - Using the master rgyd site, use edrgy to change the UID's for all 
     affected 'person' and 'group' entries.
   - Make sure all rgyd sites have the same data by shutting them ALL
     down and then restarting them. (there is an HPSL entry that talks
     about this one...)
   - Delete /sys/node_data/systmp/.passwd and /sys/node_data/systmp/.group
     on every node.  This is NOT mandatory, but we found that we got
     multiple entries in /etc/passwd for accounts that changed on some
     nodes.  The only way we successfully fixed this was to delete these
     files.  They get rebuilt the next time someone tries to read /etc/passwd
     and /etc/group.
   - Reboot *every* node in the network.  I'll explain why later...
   - Run "/etc/syncids -l /" on every node in the network.  You can use a
     simple script to kick off syncids in parallel on all your nodes.
     If you do this, be sure to redirect the std and error output of syncids
     to a file so that you can determine if there were any errors.
   - Examine the output from syncids and make sure there were no errors.  
     If there were, fix the problem, and rerun syncids.
   - using "/bin/ls -lg" or similar UNIX command, look at directories and files
     that you KNOW should have changed and be sure that the owner and group are
     properly displayed.  If you see numbers, you probably have a problem.

The "reboot all nodes" step above was key in our network.  We found that if we
didn't reboot a node, say //test, we found that if we sat AT //test, the ownerships
looked fine.  BUT, if we looked at the permissions on //test from another node
in the network (via dds), we had some directories that showed numbers rather than
the correct owner.  A simple, but time-consuming reboot and subsequent sysncids
solved the problem.  Apparently the old registry information was cached by the OS. 

Hope this helps.  I would be very interested in feedback from other sites that
have done this.  The Domain/HP-UX Interoperability Documentation offers no real
help for this very important step.

Kent Norton
Lead Engineering System Administrator
Computer Science Corporation/Technology Management Div.
norton@gdwest.gd.com            (203)433-6455
Newsgroups: comp.sys.apollo