1 / 29

Configuration and Maintenance

Configuration and Maintenance. Burgess, Ch.7. Introduction. Configuration – How to initially setup system as required Maintenance – How to keep it that way!! Systems tend towards disorder during use There are more ways for disorder to occur. Setting Policies. Definition

yvonnesmith
Télécharger la présentation

Configuration and Maintenance

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Configuration and Maintenance Burgess, Ch.7

  2. Introduction • Configuration – How to initially setup system as required • Maintenance – How to keep it that way!! • Systems tend towards disorder during use • There are more ways for disorder to occur

  3. Setting Policies • Definition • A clear expression of goals and responses • Prepares for possible errors or problems • Documents Intent and Procedure • Necessary in medium to large organisations or where many administrators co-operate • Helps to align system operation with organisational objectives

  4. System Policy includes: • Organisational rights and responsibilities • User rights and Account procedures • Network infrastructure and access rights • Application limits and responsibilities • FTP, eMail, Printing, Web pages, CGI • Security and Privacy Example: • http://www.its.monash.edu.au/policies/

  5. Network Policy • Network structure derived from • Design or Functional requirements • Geography or Building constraints • Network Engineering constraints • Policies should relate to operational goals • Small organisation – resource sharing • single network, repeaters/switches • Bigger organisation – sharing & reduced traffic • Subnets – switches/routers

  6. Network Policy (cont’d) • Segmentation • Subnet addressing • Logical to physical address mapping (VLANs?) • Port Blocking? Different on each subnet? • Blocking at Firewall or Router? • Address configuration • IP - Static /etc/hosts, RARP, BOOTP, DHCP • Name Resolution • IP – DNS, WINS • Directory – LDAP, MS PDC, Novell NDS

  7. Applications Policy • TFTP/FTP – Anonymous, Read-Only ? • SMTP • Name aliases (eg Chris.Freeman@monash.edu.au) • File size and type limitations (ie attachments) • SPAM filtering • Virus checking • HTTP • Content & Style guides, plagiarism, authorisation? • CGI / Modules allowed? (eg Apache mod_perl, mod_ssl) • Load Limiting

  8. Resource Sharing Policy • Printing • Personal printing? Page count quotas? • Colour vs Monochrome • File Systems • Common/Shared directories? Read-only? • Backups • Global or Local? • Image or File? • Archival or Incremental?

  9. Network Security Policies • Physical security of Servers & Workstations • File/Directory/Resource access control lists • UFS, NFS, Kerberos, NIS+, PDC, NDS • Superuser/Administrator Passwords • Enforced password aging and format rules • License servers • Logging and Auditing • Encryption tools supported?

  10. Some Common Configuration and Maintenance activities

  11. Synchronisation • Keeping the time-of-day clocks set correctly on all hosts within a network • Many security and maintenance tasks depend on time-of-day or elapsed time • Hardware clock accuracy varies greatly • Can use UNIX script (rsh command) • Better to use NTP(xntpd or shareware available for most OSes)

  12. Executing Scheduled Tasks • Most host management systems require regular execution of housekeeping tasks • This is a key feature in most configuration management systems • Unix cron service • crontab command • /etc/crontab file format • Windows Schedule service • at command

  13. Unix cron service • To edit a user crontab: crontab –e • To list user crontab entries:crontab –l –u <user> • crontab format:min(0-59) hr(0-23) day(1-31) mth(1-12) weekday(M-S) ShellCmd‘*’ in any position means ‘any’#Run script every weekday morning Mon-Fri at 3:15am15 3 * * Mon-Fri /usr/local/bin/script# The root crontab0 2 * * 0,4 /etc/cron.d/logchecker5 4 * * 6 /usr/lib/newsyslog0 0 * * * /usr/local/bin/cfwrap /usr/local/bin/cfdaily30 * * * * /usr/local/bin/cfwrap /usr/local/bin/cfhourly

  14. Automation • Configuring and maintaining any non-trivial network can be a heavy workload…. • Automation hides the effort required, increasing the “efficiency” of administrators • But may increase reliance on net services • Therefore wont work well if net unreliable!!

  15. Automation Tools • Most Admin tools provide one or both of • Administrator control interface (manual) • Cloning of existing reference system (mirror) • These may have friendly GUI but often don’t provide autonomous activity • Allow a human manager to tweak things • Most are management frameworks for executing scripts (in shell or perl)

  16. Automation Tools(see Burgess, Page 156…) • Examples include: • Tivoli • HP OpenView • Microsoft SMS • Sun Solstice • Host Factory • GNU/Linux tools • Problems may include • Limited functions, e.g., lack of autonomous behavior • Potential for compromised security over the network • Complexity • Open problems in rigidness and flexibility

  17. Scripting Languagesused by Automation Tools • Shell and CLI: native to Host OS • Most common… • Perl • Python • PHP

  18. Monitoring Tools • Unobtrusively gather data about network or host behaviour (ie Audit) • Usually leave analysis of data until later • When specified parameters exceed pre-defined limits, an alarm can be raised (eg send email or SMS or pager message) • Alarm may trigger maintenance activity • In future, Neural network or Semantic analysis may be used to interpret these logs and perform complex autonomous maintenance

  19. SNMP Tools • Simple Network Management Protocol • Useful for accessing management information from networked devices (managed devices) • Requires user knowledge of MIB (managed information base) structure • Focus in message exchange syntax rather than information content…. • snmpwalk, snmpget • Other APIs encapsulate SNMP tools

  20. Preventative Maintenance • Determine system policies • Define what is expected and how to respond to failure • SysAdmin team agreement • Enforce policies – inspect and repair • Educate users in good and bad practice • Care for special users. • Catering to mission critical or power users can save time and effort later

  21. Preventative Maintenance in general • Don’t rely exclusively on outside support • Educate users by posting information in a clear and friendly way • Make rules and structures as simple as possible • Keep valuable information about configurations securely and readily available • Document all changes so that other who may rebuild can incorporate them • Work defensively • If it ain’t broke, don’t fix it • Redundancy provides fallback in case of a crisis

  22. Other Preventative measures • Garbage Collection • Disk tidying – deleting old or temporary files, flushing caches and out-of-date documents • Process management – removing orphan and run-away or hung processes • Productivity or Throughput • Priorities and Quotas – can prevent rogue processes flooding disk or overloading CPU, but can also interfere with legitimate short term overloads (eg compiles or compute bound process)

  23. Cfengine An environment for turning system policy into automated maintenance actions

  24. Cfenginesee Burgess (1st Edn Pg 158, 385) • Use cron to start cfengine at regular intervals • cfengine is a language used to define policies and a run-time environment (or robot) to interpret and implement these policies • cfengine is about: • Defining how all hosts in network are to be configured • Writing this is a ‘program’ to be read by all hosts • Running this program on each host to check and fix its own configuration

  25. cfengine capabilities • Check and configure network interface • Edit text files for system or users • Make/maintain symbolic links • Check and set file permissions • Delete ‘junk’ files • Automatic ‘static’ mounting of NFS files • Checks for presence of important system files • Controlled execution of user scripts • Process management

  26. cfengine programs • cfengine.conf contains several action-type sectionsaction-type: classes:: list of actions • Sections may be in any order, but are executed in order set by the actionsequence parameter of the control action-type • Classes is a single or compound expression identifying: • Operating systems • Hosts • Times and days • A user defined string • Actions are only performed if the classes:: expression is true for the current machine

  27. Data Configuration & Management • Databases required as web back-end • Usually SQL based • Database used as parameter storage • LDAP • Other proprietary storage (eg NDS, Active Directory)

  28. The following slides are overflow slides only. They are not to be the basis for examinable/assessable content. (end)

  29. System vs Application configuration • Modern trend toward implementing applications as collections of components • Increasingly, system configuration includes configuration of applications too! • Policies and Standards reduce variety and choice for users, but when implemented carefully, lead to economies of scale

More Related