Download simp-4.2.- PDF - Read the Docs

SIMP Documentation, Release 0-0
/var/www/yum and the user will point specific systems at those repositories using the yumrepo Puppet type. Any
common packages can be symlinked or hard linked between repositories for maximum space utilization.
3.6.2 Sudosh
By default, a SIMP system uses Sudosh to enable logging of sudo sessions to Rsyslog. To open a sudo session as
root (or any other user), type su - as simp, or sudo sudosh as anyone else, instead of sudo su.
The logs are stored in /var/log/sudosh.log. Sessions can be replayed by typing sudosh-syslog-replay.
3.6.3 User Accounts
By default, users can add local users to a system or use LDAP to administer users.
It is recommended that LDAP is used for adding all regular users so that there is no conflict with multiple system
updates and synchronization. For more information on managing LDAP users, refer to the User Management chapter.
It is also possible that there will be users that are local to the system. To have these users follow the normal password
expiration conventions set on the system, use the native Puppet user and group types.
To have a user that does not expire, look at the /etc/puppet/localusers file to enable these users across the
systems. The comments in the file provide instructions on generating entries for the desired systems. It is hoped that
future versions of Puppet will support the modification of password expiration values via the native types and that the
localusers file will be retired.
3.6.4 Certificate Management
This section describes the two different types of certificates used in a SIMP system and how to manage them. For
information on initial certificate setup, refer to the Apply Certificates section of the Client Management chapter.
3.6.5 Server Certificates
Server certificates are the standard PKI certificates assigned either by an official CA or generated using the FakeCA
utility offered by SIMP. They can be found in the /etc/pki/ directory of both the client and server systems. These
certificates are set to expire annually. To change this, edit the following files with the number of days for the desired
lifespan of the certificates:
Note: This assumes that the user has generated Certificates with the FakeCA provided by SIMP. If official certificates
are being used, these settings must be changed within the official CA, not on the SIMP system.
• /etc/puppet/Config/FakeCA/CA
• /etc/puppet/Config/FakeCA/ca.cnf
• /etc/puppet/Config/FakeCA/default\_altnames.cnf
• /etc/puppet/Config/FakeCA/default.cnf
• /etc/puppet/Config/FakeCA/user.cnf
In addition, any certificates that have already been created and signed will have a config file containing all of its details
in /etc/puppet/Config/FakeCA/output/conf/.
Important: Editing any entries in the above mentioned config files will not affect the existing certificates. To make
changes to an existing certificate it must be re-created and signed.
58
Chapter 3. SIMP User Guide