Mandriva Management Console documentation¶

Introduction¶

The MMC agent is a XML-RPC server that exports to the network the API provided by the MMC python plugins.

Its configuration file is /etc/mmc/agent/config.ini. This file must be readable only by root, as it contains the login and password required to connect to the MMC agent.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

/etc/mmc/agent/config.ini available sections:

All the other sections (loggers, handlers, ...) are related to Python language logging framework. See the Python documentation for more informations.

Section « main »¶

Available options for the “main” section:

If host=127.0.0.1, the MMC agent will only listen to local incoming connections. You can use host=0.0.0.0 to make it listen to all available network interfaces.

To connect to the MMC agent, the client (for example the MMC web interface) must do a HTTP Basic authentication, using the configured login and password.

You must change the login and password in the configuration file, because if you keep using the default configuration, anybody can connect to your MMC agent. MMC agent issue a warning if you use the default login and password.

Section « daemon »¶

This section defines some MMC agent daemon settings.

Available options for the “daemon” section

If the MMC agent is configured to run as non-root, it drops its root privileges to the defined user and group id using the “seteuid” system call. This is done as soon as the configuration file is read.

Sections related to the Python logging module¶

See http://docs.python.org/lib/logging-config-fileformat.html.

In the default MMC agent configuration, two handlers are configured:

[handler_hand01]
class=FileHandler
level=INFO
formatter=form01
args=("/var/log/mmc/mmc-agent.log",)

[handler_hand02]
class=StreamHandler
level=DEBUG
args=(sys.stderr,)

The handler hand01 records all logs emitted by the MMC agent (and its activated plugins) in the file /var/log/mmc/mmc-agent.log.

The handler hand02 is used by the MMC agent only when it starts to display startup messages, then it is closed.

How to enable full debug in MMC agent¶

Just set level=DEBUG in hand01 handler (see previous section), and restart the MMC agent.

All the remote function calls and responses are now recorded in MMC log file.

Introduction¶

The « base » plugin is the main plugin of the MMC Python API. It features base operations like LDAP management (users, groups, etc), user authentication and provisioning.

The plugin configuration file is /etc/mmc/plugins/base.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Obfuscated password support in configuration files¶

All the passwords contained in MMC-related configuration files can be obfuscated using a base64 encoding. This is not a security feature, but at least somebody won’t be able to read accidentally a password.

To obfuscate a password, for example the word “secret”, you can use the Python interpreter:

$ python -c 'print "secret".encode("base64")'
c2VjcmV0

The base64-encoded password is the word “c2VjcmV0”. Now to use it in a configuration file:

[section]
password = {base64}c2VjcmV0

The {base64} prefix warns the configuration parser that the following word is a base64-encoded word, and so needs to be decoded before being used.

Configuration file sections¶

Here are all the base.ini available sections:

Section « ldap »¶

This section defines how the main LDAP is accessed, where are located the users organization units, etc.

Available options for the “ldap” section

Section « backup-tools »¶

This section defines where are located the backup tools. The backup tools are used when backuping a home directory or a SAMBA share from the MMC.

Available options for the “backup-tools” section:

Section « audit »¶

This section defines the audit framework behaviour. By default the audit framework is disabled.

Available options for the “audit” section:

Section « hooks »¶

The hooks system allow you to run external script when doing some operations with the MMC.

The script will be run as root user, with as only argument the path to a temporary file containing the full LDIF export of the LDAP user.

For the « adduser » and « changeuserpassword » hooks, the LDIF file will contain the userPassword attribute in cleartext.

For the « usertoken » hook the userPassword attribute will contain the authentication token for the user. This token is valid for 15 minutes. Using this token a link can be send to the user (email, sms...) so that he can login in the MMC interface and change his password trough the “Reset password page”. The link is in the form: http://SERVER/mmc/token.php?token=<TOKEN>.

The executable bit must be set on the script to run. The temporary LDIF file is removed once the script has been executed.

Available options for the “hooks” section:

Here is a hook example written in BASH for « adduser »:

#!/bin/sh
# Get the uid of the new user
VALUE=`cat $1 | grep ^uid: | sed "s/uid: //"`
# Log new user event
echo "New user $VALUE created" >> /var/log/newuser.log
exit 0

The same hook, written in Python:

#!/usr/bin/env python
import sys
# ldif is a Python package of the python-ldap extension
import ldif
LOGFILE = "/var/log/newuser.log"

class MyParser(ldif.LDIFParser):

    def handle(self, dn, entry):
        uid = entry["uid"][0]
        f = file(LOGFILE, "a")
        f.write("New user %s created\\n" % uid)
        f.close()

parser = MyParser(file(sys.argv[1]))
parser.parse()

Section « userdefault »¶

This section allows to set default attributes to a user, or remove them, only at user creation.

Each option of this section is corresponding to the attribute you want to act on.

If you want to remove the « displayName » attribute of each newly added user:

[userdefault]
displayName = DELETE

Substitution is done on the value of an option if a string between ‘%’ is found. For example, if you want that all new user have a default email address containing their uid:

[userdefault]
mail = %uid%@mandriva.com

If you want to add a value to a multi-valuated LDAP attribute, do this:

[userdefault]
objectClass = +corporateUser

Since version 1.1.0, you can add modifiers that interact with the substitution. This modifiers are put between square bracket at the beginning os the string to substitute.

Available modifiers for substitution

For example, you want that all new created users have a default mail address made this way: « firstname.lastname@mandriva.com ». But your user firstname/lastname have accent marks, that are forbidden for email address. You do it like this:

[userdefault]
mail = [_/]%givenName%.%sn%@mandriva.com

User authentication¶

The default configuration authenticates users using the LDAP directory specified in the [ldap] section.

But it is also possible to set up authentication using an external LDAP server.

[authentication]
method = baseldap

[authentication_baseldap]
authonly = root

[authentication_externalldap]
exclude = root
ldapurl = ldap://192.168.0.1:389
suffix = cn=Users,dc=adroot,dc=com
bindname = cn=Administrator, cn=Users, dc=adroot, dc=com
bindpasswd = s3cr3t
filter = objectClass=*
attr = cn

User provisioning¶

This feature allows to automatically create a user account if it does not already exist in the LDAP directory configured in the [ldap] section of the base plugin.

User provisioning is needed for example if an external LDAP is used to authenticate users. The users won’t be able to log in to the MMC web interface even if their login and password are rights, because the local LDAP doesn’t store thir accounts.

[provisioning]
method = externalldap

[authentication]
method = baseldap externalldap

[authentication_externalldap]
exclude = root
ldapurl = ldap://192.168.0.1:389
suffix = cn=Users,dc=adroot,dc=com
bindname = cn=Administrator, cn=Users, dc=adroot, dc=com
bindpasswd = s3cr3t
filter = objectClass=*
attr = cn

[provisioning]
method = externalldap

[provisioning_externalldap]
exclude = root
ldap_uid = cn
ldap_givenName = sn
ldap_sn = sn

Subscription informations¶

This section contains all the information needed when the version is not a community one. It allow for example to send mail to the administrator directly from the GUI when something went wrong.

Available options for the “subscription” section:

Introduction¶

The « ppolicy » plugin allows to set the default password policy to apply to all users contained into the LDAP directory, and to set a specific password policy to a user.

This plugin is disabled by default. Please be sure to understand how works password policy for LDAP before enabling it. Here are some related documentations:

• Internet-Draft: Password Policy for LDAP Directories
• Managing Password Policies in the Directory

The plugin configuration file is /etc/mmc/plugins/ppolicy.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Here are all the ppolicy.ini available sections:

Section « main »¶

This sections defines the global options of the mail plugin

Section « ppolicy »¶

This section defines the LDAP location of the password policies.

Section « ppolicyattributes »¶

This section defines the attributes and the values of the default LDAP password policy. The default policy will be initialized when the MMC agent starts if the default policy doesn’t exist in the LDAP directory.

Of course the attribute name must match the LDAP password policy schema. Here is the default configuration we ship for this section:

# This options are used only once to create the default password
policy entry
# into the LDAP
[ppolicyattributes]
pwdAttribute = userPassword
pwdLockout = True
pwdMaxFailure = 5
pwdLockoutDuration = 900
# Password can be change if it not 7 days old
pwdMinAge = 25200
# Password expiration is 42 days
pwdMaxAge = 3628800
pwdMinLength = 8
pwdInHistory = 5
pwdMustChange = True
# To check password quality
pwdCheckModule = mmc-check-password.so
pwdCheckQuality = 2

Introduction¶

The MMC web interface communicates with MMC agents to manage LDAP directories, services and ressources.

Its configuration file is /etc/mmc/mmc.ini. This file must be readable only by the Apache web server, as it contains the login and password required to connect to MMC agents.

Like all MMC related configuration files, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

/etc/mmc/mmc.ini available sections:

Section « global »¶

Available options for the « global » section:

Section « debug »¶

For debugging purpose only. The XML-RPC calls and results will be displayed on the MMC web interface.

Section « logintitle »¶

This section allows to customize the title of the login box of the MMC web interface login page. By default, there is no title.

A title can be defined for each supported locales, like this:

localename = Title_for_this_locale

The title string must be encoded in UTF-8.

For example:

[logintitle]
; Default page title for English and non-translated languages
C = Welcome
; French title
fr_FR = Bienvenue
; Spanish title
es_ES = Bienvenido

Section « server_x »¶

You can set multiple sections called « server_01 », « server_02 » ... to specify a list of MMC agents to connect to.

On the MMC login web page, all the specified MMC agents will be displayed, and you will be able to select the one you want to be connected to.

Available options for the « server_x » sections:

For example, to define a local MMC agent:

[server_01]
description = Local MMC agent
url = http://127.0.0.1:7080

To use SSL between the web interface and the MMC agent (SSL must be enabled on the MMC agent):

[server_01]
description = Local MMC agent
url = https://127.0.0.1:7080

To use TLS with certificate check:

[server_01]
description = MMC agent
url = https://10.0.0.1:7080
verifypeer = 1
cacert = /etc/mmc/certs/demoCA/cacert.pem
localcert = /etc/mmc/certs/client.pem

Introduction¶

The « mail » plugin allows the MMC to add/remove mail delivery management attributes to users and groups, and mail virtual domains, etc. It uses the « base » plugin for all its related LDAP operations.

The plugin configuration file is /etc/mmc/plugins/mail.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Here are all the mail.ini available sections:

Section « main »¶

This sections defines the global options of the mail plugin

Available options for the « main » section:

Section « userdefault »¶

When adding the mail attributes to a user, you may want to change the value of the attributes that are added. Please look at the MMC base plugin configuration file for a look at how this section works.

The mailbox field of this section is very important to set because it determines the paths where the mails are delivered to users.

If the mails are delivered by Postfix, use this:

[userdefault]
mailbox = %homeDirectory%/Maildir/

If you use Dovecot as the delivery agent:

[userdefault]
mailbox = maildir:%homeDirectory%/Maildir/

Zarafa support¶

The zarafa.schema file must be included into the LDAP directory.

If Zarafa support is enabled, the “zarafa-user” object class will be automatically added to users if the administrator gives them mail access thanks to the MMC web interface.

The following fields are also available:

• Administrator of Zarafa (zarafaAdmin LDAP field)
• Shared store (zarafaSharedStoreOnly LDAP field)
• Zarafa account (zarafaAccount)
• Zarafa send as user list (zarafaSendAsPrivilege)

When you edit a group, you will also be able to set the “zarafa-group” object class to it.

Section « mapping »¶

When using an existing LDAP your mail attributes may not have the same name than the attributes of our mail.schema. The MDS mail plugin support attribute mapping so that you can use your LDAP without modification.

The following attributes can be mapped to other values: mailalias, maildrop, mailenable, mailbox, mailuserquota, mailhost

If your are using the zarafaAliases to store users aliases write:

[mapping]
mailalias = zarafaAliases

Introduction¶

The « network » plugin allows the MMC Python API to manage DNS zones and hosts, DHCP subnet and hosts, into a LDAP. Patched version of ISC BIND (with LDAP sdb backend) and ISC DHCP (with LDAP configuration file backend) are needed. PowerDNS support is also available.

The plugin configuration file is /etc/mmc/plugins/network.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Here are all the network.ini available sections:

Section « main »¶

This sections defines the global options of the network plugin.

Available options for the “main” section:

Section « dns »¶

This section defines where DNS needed files, directories and LDAP entities are located.

When the plugin starts for the first time, it creates:

• the directory bindroot/named.ldap. This directory will contains all zones definitions
• the file bindroot/named.conf.ldap. This file will include all the zone definitions stored into bindroot/named.ldap/

Available options for the “dns” section:

Here is an example for BIND on a Mandriva Corporate Server 4:

[dns]
type = bind
dn = ou=DNS,dc=mandriva,dc=com
pidfile = /var/lib/named/var/run/named.pid
init = /etc/rc.d/init.d/named
logfile = /var/log/messages
bindroot = /var/lib/named/etc/
bindchrootconfpath = /etc
bindgroup = named
dnsreader = uid=DNS Reader,ou=System Accounts,dc=mandriva,dc=com
dnsreaderpassword = s3cr3t

Section « dhcp »¶

This section defines where DHCP related files and LDAP entities are located.

Available options for the “backup-tools” section:

Introduction¶

The « samba » plugin allows the MMC to add/remove SAMBA attributes to users and groups, to manage SAMBA share, etc. It uses the « base » plugin for all its related LDAP operations.

The plugin configuration file is /etc/mmc/plugins/samba.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Here are all the samba.ini available sections:

Section « main »¶

This section defines the global options of the SAMBA plugin.

Available options for the “main” section:

Section « hooks »¶

The hooks system allow you to run external script when doing some operations with the MMC.

The script will be run as root user, with as only argument the full LDIF of the LDAP user. For the « addsmbattr » and « changeuserpasswd » hook, the LDIF file will contains the userPassword attributes in cleartext.

Available options for the “hooks” section:

Section « userdefault »¶

When adding the SAMBA attributes to a user, you may want to change the value of the attribute that are added. Please look at the MMC base plugin configuration file for a look at how this section works.

For example, if you want to delete the sambaPwdMustChange attribute of a user entry:

sambaPwdMustChange = DELETE

Introduction¶

The plugin allows control of internet content filters, manipulating squid files directly and use the LDAP base to authentication of users.

The plugin configuration file is /etc/mmc/plugins/squid.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Here are all the squid.ini available sections:

Section « main »¶

This sections defines the global options of the squid plugin

Available options for the « main » section:

Section « squid »¶

Available options for the « main » section:

Introduction¶

The « sshlpk » plugin allows the MMC to manage lists of SSH public keys on users. It uses the « base » plugin for all its related LDAP operations.

The plugin configuration file is /etc/mmc/plugins/sshlpk.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Here are all the sshlpk.ini available sections:

Section « main »¶

This sections defines the global options of the sshlpk plugin

Available options for the “main” section:

Section « hooks »¶

The hooks system allow you to run external script when doing some operations with the MMC.

The script will be run as root user, with as only argument the full LDIF of the LDAP user.

Available options for the “hooks” section:

Introduction¶

The « userquota » plugin allows the MMC to set filesystem quotas to users. The plugin provides LDAP attributes for storing quota information. The plugin allows also to store network quotas in the LDAP directory for external tools. It uses the « base » plugin for all its related LDAP operations.

The plugin configuration file is /etc/mmc/plugins/userquota.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Here are all the userquota.ini available sections:

Section « main »¶

This sections defines the global options of the mail plugin

Available options for the « main » section:

Section « diskquota »¶

Available options for the « diskquota » section:

The soft limits of the quotas are calculated using the softquotablocks and softquotainodes coefs. The inode limit is calculated using the inodesperblock coef.

The inode limits protects the filesystem if some user create to much hardlinks as a hardlink use one inode but no block on the filesystem.

The setquotascript and delquotascript options define the commands templates used to apply or remove quotas on the filesystem. The runquotascript is the name of a shell script which contain the quota commands to be run on the system. If it is set to /bin/sh, then quotas will be applied on the local system. Check the applyquotas.sh example script to see how you can apply quotas on a different server. This is useful if your mmc-agent does not run on your file server.

Section « networkquota »¶

Available options for the « networkquota » section:

This section define the networks on which you want to use quotas. This allows you to store differents quotas values for differents network/protocol pair. This plugin will update the ldap records for network quotas for each user, but does not attempt to apply these quotas to a firewall, as this will be different for most people.

The networkmap option must be formatted with the following format :

displayName:network:protocol,...
----------------------
Internet:0.0.0.0/0:any,Local:192.168.0.0/24:any

Installation form source code¶

# apt-get install git-core build-essential autogen autoconf libtool gettext
python-sqlalchemy python-mysqldb python-ldap python-openssl
python-twisted-web nsis xsltproc docbook-xsl

# yum install git-core

# urpmi git-core

$ git clone git://github.com/mandriva-management-console/mmc.git

$ $ cd pulse2/
$ ./autogen.sh
$ ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
$ make
# make install

$ git pull origin master

$ ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --disable-conf

OpenLDAP¶

Debian:

# apt-get install slapd ldap-utils

Debconf will ask only ldap root password by default to more granular configuration use:

# dpkg-reconfigure slapd

Using dpkg-reconfigure debconf will ask you for:

• Omit OpenLDAP server configuration?: Choose <No>.
• DNS domain name: Enter you domain name.
• Organization name: Enter organization name.
• Admin password: Enter a password and confirm in next screen.
• Database backend to use: choose HDB.
• Do you want the database to be removed when slapd is purged: Choose <No>.
• Allow LDAPv2 protocol: Choose <NO>.

Centos:

# yum install

Mandriva:

# urpmi

OpenLDAP Schema¶

# cp /usr/share/doc/python-mmc-base/contrib/ldap/mmc.schema /etc/ldap/schema/

include /etc/ldap/schema/mmc.schema

$ cp /usr/share/doc/python-mmc-base/contrib/ldap/mmc.schema .

include    mmc.schema

$ mkdir schemas

$ slaptest -f mmc.conf -F schemas/

dn: cn=mmc,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: mmc

structuralObjectClass: olcSchemaConfig
entryUUID: 0ec2fe60-1381-1031-8f21-f92982aeda45
creatorsName: cn=config
createTimestamp: 20120405153755Z
entryCSN: 20120405153755.316520Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20120405153755Z

# ldapadd -Y EXTERNAL -H ldapi:/// -f schemas/cn\=config/cn\=schema/cn\=\{0\}mmc.ldif

MySQL¶

Debian:

# apt-get install mysql-server

Debconf will ask mysql root password.

Centos:

# yum install

Mandriva:

# urpmi

Apache HTTP server¶

Debian:

# apt-get install apache2 php5 php5-gd php5-xmlrpc

Centos:

# yum install

Mandriva:

# urpmi

# ln -s /etc/mmc/apache/mmc.conf /etc/apache2/sites-enabled/mmc.conf

# /etc/init.d/apache2 restart

Pulse setup¶

pulse2-setup will ask:

INFO     - Load defaults values from existing config
INPUT    - Enable audit module (Y/n): y
INPUT    - Enable inventory server (Y/n): y
INPUT    - Enable imaging server (Y/n): y
INPUT    - Enable package server (proxy) (Y/n): y
INPUT    - Server external IP address (default: 10.0.2.15): 172.16.0.4
INFO     - Run setup
INPUT    - Database host (default: localhost):
INPUT    - Database admin user (default: root):
INPUT    - Database admin password:
...
INPUT    - LDAP uri (default: ldap://127.0.0.1:389):
INPUT    - LDAP base DN (default: dc=mandriva, dc=com):
INPUT    - LDAP admin DN (default: cn=admin, dc=mandriva, dc=com):
INPUT    - LDAP admin password:
...
INPUT    - Wake-on-lan tool path (default: /usr/sbin/pulse2-wol):

DHCP Install¶

Debian:

# apt-get install isc-dhcp-server

DHCP Setup¶

The imaging module of Pulse 2 needs PXE functionalities, NFS and TFTP services. For PXE configure the DHCP server on the network to serve the Pulse2 PXE bootmenu.

For example with dhcp3-server in /etc/dhcp3/dhcpd.conf:

 subnet 192.168.0.0 netmask 255.255.255.0 {
     option broadcast-address 192.168.0.255; # broadcast address
     option domain-name "pulse2.test"; # domain name
     option domain-name-servers 192.168.0.2; # dns servers
     option routers 192.168.0.2; # default gateway
     pool {
         range 192.168.0.170 192.168.0.180;
         filename "/bootloader/pxe_boot";
        next-server 192.168.0.237;
     }
}

• filename and next-server are the relevant options to set.

You can find an example file for dhcp3 server in or repository.

Imaging client installation¶

Imaging client can run only on i386 compliant machines. It is not run directly on the server, but served through the network to i386 machines. For your convenience, prebuilt binaries are available, so that you can install it on a server which is not i386.

Once you have downloaded prebuilt binaries as pulse2-imaging-client-<version>_i386.tar.gz, simply run the following, as root: $ tar xfC pulse2-imaging-client-<version>_i386.tar.gz /

All files are extracted in /var/lib/pulse2/imaging/ dir.

As to serve the imaging client to the machines, you must then configure the following network services.

NFS setup¶

In /etc/exports file, add the following lines:

/var/lib/pulse2/imaging/computers *(async,rw,no_root_squash,subtree_check)
/var/lib/pulse2/imaging/masters *(async,rw,no_root_squash,subtree_check)
/var/lib/pulse2/imaging/postinst *(async,ro,no_root_squash,subtree_check)

Then reload the new NFS configuration, as root.

Check the export list:

# showmount -e
Export list for imaging:
/var/lib/pulse2/imaging/masters *
/var/lib/pulse2/imaging/postinst *
/var/lib/pulse2/imaging/computers *

TFTP Setup¶

Bootloader and kernel are served to the client with TFTP protocol. We recommend using the atftpd server as it supports multicast..

You must configure the TFTP server to use as base directory:

/var/lib/pulse2/imaging

Then check the configuration:

# atftp localhost
tftp> get /bootloader/pxe_boot
tftp> quit
# rm pxe_boot

configure options¶

The configure recognizes the following options to control how it operate:

• –help, -h: Print a summary of all of the options to configure, and exit.

• –help=short –help=recursive: Print a summary of the options unique to this

  package’s configure, and exit. The short variant lists options used only in the top level, while the recursive variant lists options also present in any nested packages.

• –version, -V: Print the version of Autoconf used to generate the configure

  script, and exit.

• –cache-file=FILE: Enable the cache: use and save the results of the tests

  in FILE, traditionally config.cache. FILE defaults to /dev/null to disable caching.

• –config-cache, -C: Alias for –cache-file=config.cache.

• –quiet, –silent, -q: Do not print messages saying which checks are

  being made. To suppress all normal output, redirect it to /dev/null (any error messages will still be shown).

• –srcdir=DIR: Look for the package’s source code in directory DIR. Usually

  configure can determine that directory automatically.

• –prefix=DIR: Use DIR as the installation prefix. note Installation

  Names for more details, including other options available for fine-tuning the installation locations.

• –no-create, -n: Run the configure checks, but stop before creating any

  output files.

• –disable-conf: Do not install conf files. On a first install, you may not

  use this option as configuration files are required.

• –disable-conf-backup: Do not backup configuration files if they are

  already installed. Default is to create backup files like *.~N~.

• –disable-wol: Do not build and install wake-on-lan tool.

OpenLDAP Schema¶

# cp /usr/share/doc/python-mmc-base/contrib/ldap/mmc.schema /etc/ldap/schema/

include /etc/ldap/schema/mmc.schema

$ cp /usr/share/doc/python-mmc-base/contrib/ldap/mmc.schema .

include    mmc.schema

$ mkdir schemas

$ slaptest -f mmc.conf -F schemas/

dn: cn=mmc,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: mmc

structuralObjectClass: olcSchemaConfig
entryUUID: 0ec2fe60-1381-1031-8f21-f92982aeda45
creatorsName: cn=config
createTimestamp: 20120405153755Z
entryCSN: 20120405153755.316520Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20120405153755Z

# ldapadd -Y EXTERNAL -H ldapi:/// -f schemas/cn\=config/cn\=schema/cn\=\{0\}mmc.ldif

Pulse setup¶

pulse2-setup will ask:

INFO     - Load defaults values from existing config
INPUT    - Enable audit module (Y/n): y
INPUT    - Enable inventory server (Y/n): y
INPUT    - Enable imaging server (Y/n): y
INPUT    - Enable package server (proxy) (Y/n): y
INPUT    - Server external IP address (default: 10.0.2.15): 172.16.0.4
INFO     - Run setup
INPUT    - Database host (default: localhost):
INPUT    - Database admin user (default: root):
INPUT    - Database admin password:
...
INPUT    - LDAP uri (default: ldap://127.0.0.1:389):
INPUT    - LDAP base DN (default: dc=mandriva, dc=com):
INPUT    - LDAP admin DN (default: cn=admin, dc=mandriva, dc=com):
INPUT    - LDAP admin password:
...
INPUT    - Wake-on-lan tool path (default: /usr/sbin/pulse2-wol):

Imaging client installation¶

Imaging client can run only on i386 compliant machines. It is not run directly on the server, but served through the network to i386 machines. For your convenience, prebuilt binaries are available, so that you can install it on a server which is not i386.

Once you have downloaded prebuilt binaries as pulse2-imaging-client-<version>_i386.tar.gz, simply run the following, as root: $ tar xfC pulse2-imaging-client-<version>_i386.tar.gz /

All files are extracted in /var/lib/pulse2/imaging/ dir.

As to serve the imaging client to the machines, you must then configure the following network services.

DHCP Setup¶

The imaging module of Pulse 2 needs PXE functionalities, NFS and TFTP services. For PXE configure the DHCP server on the network to serve the Pulse2 PXE bootmenu.

For example with dhcp3-server in /etc/dhcp3/dhcpd.conf:

 subnet 192.168.0.0 netmask 255.255.255.0 {
     option broadcast-address 192.168.0.255; # broadcast address
     option domain-name "pulse2.test"; # domain name
     option domain-name-servers 192.168.0.2; # dns servers
     option routers 192.168.0.2; # default gateway
     pool {
         range 192.168.0.170 192.168.0.180;
         filename "/bootloader/pxe_boot";
        next-server 192.168.0.237;
     }
}

• filename and next-server are the relevant options to set.

You can find an example file for dhcp3 server in or repository.

NFS setup¶

In /etc/exports file, add the following lines:

/var/lib/pulse2/imaging/computers *(async,rw,no_root_squash,subtree_check)
/var/lib/pulse2/imaging/masters *(async,rw,no_root_squash,subtree_check)
/var/lib/pulse2/imaging/postinst *(async,ro,no_root_squash,subtree_check)

Then reload the new NFS configuration, as root.

Check the export list:

# showmount -e
Export list for imaging:
/var/lib/pulse2/imaging/masters *
/var/lib/pulse2/imaging/postinst *
/var/lib/pulse2/imaging/computers *

TFTP Setup¶

Bootloader and kernel are served to the client with TFTP protocol. We recommend using the atftpd server as it supports multicast..

You must configure the TFTP server to use as base directory:

/var/lib/pulse2/imaging

Then check the configuration:

# atftp localhost
tftp> get /bootloader/pxe_boot
tftp> quit
# rm pxe_boot

Old versions¶

The mmc schema is needed to set ACLs on users in the MMC web interface:

# cp /usr/share/doc/python-mmc-base/contrib/ldap/mmc.schema /etc/ldap/schema/

Then in /etc/ldap/slapd.conf include the schema:

include /etc/ldap/schema/mmc.schema

New versions¶

#TODO: Talk more about openldap changes in config and schema new storage.

Copy mmc schema to your current directory:

$ cp /usr/share/doc/python-mmc-base/contrib/ldap/mmc.schema .

Create a file mmc.conf with:

include    mmc.schema

Create a folder schemas:

$ mkdir schemas

Convert mcc.schema to ldif:

$ slaptest -f mmc.conf -F schemas/

Edit mmc schema, remove {0} from dn:, cn: and add cn=schema,cn=config to dn

dn: cn=mmc,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: mmc

Remove the following lines at the bottom of that file:

structuralObjectClass: olcSchemaConfig
entryUUID: 0ec2fe60-1381-1031-8f21-f92982aeda45
creatorsName: cn=config
createTimestamp: 20120405153755Z
entryCSN: 20120405153755.316520Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20120405153755Z

Add schema to ldap:

# ldapadd -Y EXTERNAL -H ldapi:/// -f schemas/cn\=config/cn\=schema/cn\=\{0\}mmc.ldif

Restart the slapd daemon.

Introduction¶

The « dyngroup » plugin is the MMC plugin in charge of creating, modifying and deleting groups of machines.

The plugin configuration file is /etc/mmc/plugins/dyngroup.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now 3 sections are available in this configuration file:

Introduction¶

The « glpi » plugin is the MMC plugin in charge of the glpi machine backend, it should only be used when invnetory is not used.

The plugin configuration file is /etc/mmc/plugins/glpi.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now four sections are available in this configuration file:

Introduction¶

The « imaging » plugin is the MMC agent plugin that allows to manage all imaging related data.

The plugin configuration file is /etc/mmc/plugins/imaging.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now three sections are available in this configuration file:

Introduction¶

The « imaging server » service is the Pulse 2 daemon in charge of managing backup folder on the server, based on the clients needs.

The service configuration file is /etc/mmc/pulse2/imaging-server/imaging-server.ini.

Like all Pulse 2 related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now four sections are available in this configuration file. The section describing the option can be duplicated if you need to pass more than one kind of option to the OCS inventory agent.

Introduction¶

The « inventory » plugin is the MMC plugin in charge displaying the content of the inventory database, and providing facilities for dynamic group creation.

The plugin configuration file is /etc/mmc/plugins/inventory.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Available sections in this configuration file:

[computers]
content = Registry::Value::regdn::Path==DisplayName||Registry::Value::srvcomment::Path==srvcomment
display = cn::Computer Name||displayName::Description||srvcomment::Name||regdn::Display Name

[provisioning]
method = inventory
# Multiple provisining method can be used, for example:
# method = externalldap inventory

[provisioning_inventory]
exclude = root
profile_attr = pulse2profile
profile_entity_admin = .
profile_entity_agent = entityA entityB
profile_entity_tech = %pulse2entity%
profile_entity_manager = plugin:network_to_entity
profile_entity_none =
profile_entity_default = entityA

entityA              ip      match   ^192\\.168\\.1\\..*$
entityB,entityC      ip      match   ^192\\.168\\.0\\.19$
.                    ip      match   ^.*$

Introduction¶

The « inventory server » service is the Pulse 2 daemon in charge importing inventory sent from ocs inventory agents.

The service configuration file is /etc/mmc/pulse2/inventory-server/inventory-server.ini.

Like all Pulse 2 related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now four sections are available in this configuration file. The section describing the option can be duplicated if you need to pass more than one kind of option to the OCS inventory agent.

All the other sections (loggers, handlers, ...) are related to Python language logging framework. See http://docs.python.org/lib/logging-config-fileformat.html.

[option_01]
NAME = REGISTRY
PARAM_01 = NAME::srvcomment||REGKEY::SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters||REGTREE::2##srvcomment
PARAM_02 = NAME::DisplayName||REGKEY::SYSTEM\\CurrentControlSet\\Services\\lanmanserver||REGTREE::2##DisplayName

.               Network/IP      match   ^192\\.168\\.0\\..*$
"entity A"      Network/IP      match   ^172\\.16\\..*$
entityB         Network/IP      match   ^10\\..*$          and        Hardware/OperatingSystem     match       ^Linux$

Introduction¶

The « Launcher » service is the Pulse 2 daemon in charge of doing jobs on clients on scheduler orders.

The service configuration file is /etc/mmc/pulse2/launchers.ini (please note the ending “s”).

Like all Pulse 2 related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

Some sections describing the different available launchers may appear, their name must begin with launcher_. The idea behind this is that the main section controls the common behavior of launchers, the others control the specific behaviors.

All the other sections (loggers, handlers, ...) are related to Python language logging framework. See http://docs.python.org/lib/logging-config-fileformat.html.

Introduction¶

The « MSC » plugin is the MMC plugin in charge of recording commands in the MSC database, and gathering results from the database.

The plugin configuration file is /etc/mmc/plugins/msc.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now five sections are available in this configuration file:

[scheduler_01]
host=127.0.0.1
port=8000
username = username
password = password
enablessl = 1

Introduction¶

The « package server » service is the Pulse 2 daemon that implement all the package apis, it permit the creation, edition, suppression, share, mirroring... of packages.

The service configuration file is /etc/mmc/pulse2/package-server/package-server.ini.

Like all Pulse 2 related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

The section describing the mirror, package_api_get or package_api_put can be duplicated if you need to have more than one api of this kind.

All the other sections (loggers, handlers, ...) are related to Python language logging framework. See http://docs.python.org/lib/logging-config-fileformat.html.

IdentityFile=/root/.ssh/id_rsa StrictHostKeyChecking=no Batchmode=yes PasswordAuthentication=no ServerAliveInterval=10 CheckHostIP=no ConnectTimeout=10

Pulse 2 package server performance on win32 platforms¶

Using the default configuration, the service won’t accept more than 64 concurrent TCP connections. The default event loop used by the Python Twisted library use the select() system call, which is limited to waiting on 64 sockets at a time on Windows.

Fortunately Twisted allows to choose another reactor instead of the default select() one. If sets to 1 in the package server configuration file, the use_iocp_reactor option lets Twisted runs with the IOCP reactor. IOCP (IO completions Ports) is a fast and scalable event loop system available on win32 platform. More informations are available in the Twisted documentation.

But there are some limitations:

• SSL is not supported (for the moment) by the IOCP reactor, so the package server can’t be run with IOCP and SSL enabled at the same time,
• The IOCP reactor implementation from Twisted only works on win32 platform where the ConnectEx() API is available. So it won’t works on Windows NT and Windows 2000 platforms.

Using the IOCP reactor, the package server can handle at least 300 parallel TCP connections, but more benchmarks need to be done to guess its limits.

Introduction¶

The « pkgs » plugin is the MMC plugin in charge of the edition, removal and creation of packages in the Pulse2 package system.

The plugin configuration file is /etc/mmc/plugins/pkgs.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now two sections are available in this configuration file:

Introduction¶

The « pulse2 » plugin is the MMC plugin in charge of the very generic part of pulse2 plugins.

The plugin configuration file is /etc/mmc/plugins/pulse2.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

For now two sections are available in this configuration file:

Introduction¶

The « Scheduler » service is the Pulse 2 daemon in charge of reading the MSC database, dispatching commands over available launchers and writing results in the MSC database.

The main service configuration file is /etc/mmc/pulse2/scheduler/scheduler.ini.

Optionnaly, the database configuration may also be defined into /etc/mmc/plugins/msc.ini

Like all Pulse 2 related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this: « option = value ».

For example:

[section1]
option1 = 1
option2 = 2

[section2]
option1 = foo
option2 = plop

Configuration file sections¶

The configuration file is splitted into several sections: Some sections describing the different available launchers may appear, their name must begin with launcher_.

• scheduler, daemon, database and logging,
• launchers declaration (describing the different available launchers may appear, their name must begin with launcher_).

scheduler.ini available sections:

All the other sections (loggers, handlers, ...) are related to Python language logging framework. See http://docs.python.org/lib/logging-config-fileformat.html.

[daemon]
pid_path = /var/run/pulse2
user = mmc
group = mmc
umask = 0007
setrlimit = RLIMIT_NOFILE 2048 2048 RLIMIT_CORE 0 0