Centrify DirectControl Best Practices - Cerberis

More documents

Recommendations

Info

CENTRIFY WHITE PAPERCENTRALIZED MANAGEMENT FOR UNIX, LINUX, MAC AND JAVA WITH ACTIVE DIRECTORY AND DIRECTCONTROL4 Solution: Phase Two Solution ArchitectureThe initial deployment of DirectControl at Illumi Clinics resulted in eighty Zones. Thereis no known limit to the number of Zones that can be stored in Active Directory;however, there is a subjective limit on how many Zones a small UNIX operations teamcan efficiently manage. Phase two projects with DirectControl typically focus onreducing the number of Zones to be administered, and consolidating the UID and GIDspace in use by the user community.4.1 Zone ConsolidationThe best practice for zone consolidation is to begin by defining a consolidated UNIXprofile space, and then consolidating Zones. Migrating to a consolidated UID/GID spacehas many benefits, including consistency of file permissions across mount points andbackup media. Historical approaches to this problem have required an all-or-nothingapproach that required unacceptable risk.The best possible approach is to migrate slowly to a consolidated UID/GID space as timeand resources permit. Begin by creating a new Zone that contains UNIX profiles for allusers and group in the organization. In most organizations, this is named the “Universal”zone. This Zone will ultimately serve as the basis for all users UNIX profiles.Next, copy the UID, GID, home directory and shell attributes for users from theUniversal Zone to the Zone being consolidated. These steps can be performed manuallyusing the Centrify DirectControl console. Alternatively, Centrify’s Professional Serviceshave developed a script, “userUnixCopier.vbs” which automates this process. From theusage statement:NAMEuserUnixCopier.vbs - the UNIX profile copierSYNOPSIScscript userUnixCopier.vbs /input:Universal /output:Finance /uidDESCRIPTIONThe UNIX profile copier allows for copying of individual attributevaluesfrom a UNIX user profile defined in one Zone to another Zone. This ismeant to beused with the Universal Zone design, where a single consolidated UID/GIDspace hasbeen defined for all users. The UNIX profile copier is used during azoneconsolidation project to copy all of the UID values (for example) in theUniversalzone into another Zone.OPTIONS/helpPrints the usage statement./?© CENTRIFY CORPORATION 2004-2007. ALL RIGHTS RESERVED. PAGE 34
CENTRIFY WHITE PAPERCENTRALIZED MANAGEMENT FOR UNIX, LINUX, MAC AND JAVA WITH ACTIVE DIRECTORY AND DIRECTCONTROLPrints the usage statement./verboseVerbose mode: prints successful operations as well as failures. Bydefaultonly failures are printed./vVerbose mode: prints successful operations as well as failures. Bydefaultonly failures are printed./input:{zone name}Specifies the Zone from which values will be copied. This willnormally be theUniversal Zone. Values from this Zone will be used to overwite valuesin the Outputzone./output:{zone name}Specifies the Zone where attribute values will be overwritten. OnlyUNIX profilesthat are defined in both the Input and Output zones will be modified./uidOverwrite the UID attribute value for existing UNIX user profiles inthe OutputZone with the UID attribute values from existing UNIX user profilesin the Input Zone./gidOverwrite the GID attribute value for existing UNIX user profiles inthe OutputZone with the GID attribute values from existing UNIX user profilesin the Input Zone./homeOverwrite the home directory attribute value for existing UNIX userprofiles in the OutputZone with the home directory attribute values from existing UNIX userprofiles in the Input Zone./shellOverwrite the shell attribute value for existing UNIX user profilesin the OutputZone with the shell attribute values from existing UNIX user profilesin the Input Zone.EXAMPLEScscript userUnixCopier.vbs /input:Universal /output:Engineering /uidThis command would update the existing UNIX user profiles in theEngineeringZone with the UID attribute values from the Universal Zone.cscript userUnixCopier.vbs /input:Universal /output:Marketing /shell/homeThis command would update the existing UNIX user profiles in theMarketing Zonewith the shell and home directory values from the Universal Zone.AUTHOR© CENTRIFY CORPORATION 2004-2007. ALL RIGHTS RESERVED. PAGE 35
Page 1 and 2: WHITE PAPERCENTRIFY CORP.Centrify D
Page 3 and 4: CENTRIFY WHITE PAPERCENTRALIZED MAN

Centrify DirectControl Best Practices - Cerberis

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?