| Deletions are marked like this. | Additions are marked like this. |
| Line 4: | Line 4: |
|
On all KDCs: 1. Open {{{ /etc/heimdal-kdc/kadmind.acl }}} 1. Add "{{{$NEWUSER/admin@CLUB.CC.CMU.EDU all *@CLUB.CC.CMU.EDU}}}" and "{{{$NEWUSER/admin@CLUB.CC.CMU.EDU all */*@CLUB.CC.CMU.EDU}}}" to the file above the line for {{{contribkey@CLUB.CC.CMU.EDU}}} On all KDCs and fileservers (make sure you modify the AFS `server/UserList` on '''all''' of them!): {{{ /etc/openafs/server/UserList }}} On '''any one''' machine with an afs client, as admin, run: {{{ pts cu $NEWUSER.admin pts adduser $NEWUSER.admin system:administrators }}} |
[[Common Maintenance Tasks/Adding an admin principal]] |
Adding a new admin
Common Maintenance Tasks/Adding an admin principal
Machines
KDCs: barium, sodium, potassium
AFS: vos listaddrs and go down the list to see which ones are current, and "gafs" as well (though this one isn't so critical, as it won't cause the new account script to barf if you forget 
Binary Log Explosion
(09:17:22 PM) Keith Bare: POTASSIUM did that annoying that it does every once in awhile (09:17:32 PM) Keith Bare: potassium:/var/lib# ls -hl heimdal-kdc/log -rw------- 1 root root 486M 2012-08-20 21:16 heimdal-kdc/log (09:17:41 PM) Keith Bare: potassium:/var/lib# df -h Filesystem Size Used Avail Use% Mounted on /dev/xvda1 1020M 1020M 0 100% / tmpfs 63M 0 63M 0% /lib/init/rw udev 10M 24K 10M 1% /dev tmpfs 63M 0 63M 0% /dev/shm (09:17:42 PM) mkasick: hurrah (09:18:05 PM) Keith Bare: I don't recall how you "fixed" it though (09:18:09 PM) mkasick: oh (09:18:15 PM) mkasick: the log file is ipropd, iprop blewup (09:18:51 PM) mkasick: fix is to stop the kdc and ipropd-slave on potassium, rm /var/heimdal/log, mv /var/heimdal/heimdal.db /tmp; restart iprop; wait for sync; then restart the kdc and optionally remove the old databse (09:19:11 PM) mkasick: you shouldn't have to restart ipropd-master on sodium, but if it goes crazy again, perhaps that's also advisable (09:19:21 PM) Keith Bare: ok (09:20:37 PM) Keith Bare: yeah, BARIUM too (09:20:42 PM) mkasick: oh (09:20:48 PM) mkasick: yeah in that case kill ipropd-master on sodium (09:21:19 PM) mkasick: kill ipropd-slaves; blow away potassium/barium log files, rename old dbs, start ipropd-master, ipropd-slaves, let resync, then restart kdcs (09:21:24 PM) mkasick: sodium kdc can stay up though (09:21:41 PM) mkasick: there's a sodium:/var/heimdal/slave-stats files that will register when the new slaves have the latest version (09:30:05 PM) Keith Bare: ok, looks like it's fixed now (09:30:16 PM) mkasick: cool