[1876] in Moira
Re: computers on ACLs?
daemon@ATHENA.MIT.EDU (Garry Zacheiss)
Fri Oct 12 06:55:31 2001
Message-Id: <200110121055.GAA10659@brad-majors.mit.edu>
To: "Paul B. Hill" <pbh@MIT.EDU>
cc: "Pismere-Team@Mit. Edu" <pismere-team@MIT.EDU>, moiradev@MIT.EDU
In-Reply-To: Your message of "Thu, 11 Oct 2001 22:01:50 EDT."
<JDEEIOCIIGMKDNGJMBLJAENICIAA.pbh@mit.edu>
Date: Fri, 12 Oct 2001 06:55:23 -0400
From: Garry Zacheiss <zacheiss@MIT.EDU>
>> But when any group membership is changed in Moira, we re-propagate
>> the entire group membership to AD. So as soon as someone modifies the
>> group membership in Moira, the new computer account will be added to
>> the group in AD (and the old computer will be removed). At that point
>> we may be granting inappropriate access.
It seems like the correct way to handle this is to treat it in
much the same way we treat users currently. User accounts are currently
first marked as deleted, then a year later removed from the AFS prdb,
then purged from Moira, and finally have their Kerberos principals
deleted (in theory). We also run a process known as the "janitor"
across the entire athena cell yearly to remove ACL entries for users
that have been removed, so that their UIDs may be safely removed.
A similar process for machines would seem to be:
- Machine is set to status 3 ("Deleted").
- 7-9 months later, AD is regenerated (with the winad DCM?), removing
the machines that were previously marked as "Deleted" and any access
they might have had.
- Once this done, machines are purged from Moira.
- Hostname can now be safely removed?
>> If we can resolve this problem we could at least start the discussion
>> about if it would be appropriate to add a new type to Moira. Until we
>> can figure how to addres this problem there is no reason to consider
>> the implications of adding a COMPUTER type to Moira.
As a stylistic nit, I would want the name of the ACE type to be
MACHINE, not COMPUTER.
Garry
