IP aliases, SA kerberos set-up & possible WGM confusion

[gshenaut]

I’m trying to set up a Tiger server that has three IP aliases to the main IP address. These all seem to work correctly, each one has its own web page that can be accessed externally, all the DNS stuff seems correct, and so on.

When I promote the server to OD Master and then proceed to the Kerberos set-up, the suggested realm is consistently one of the alias names (the one with the highest numbered IP address and last alphabetically, FWIW), not the name corresponding to the main address. Also, when I fire up WGM, and connect to the main name, a window with the that name in the title opens, but then after a few seconds, it is replaced with a window displaying the same alias that the Kerberos set-up always chooses.

To be more explicit, the main address has an address ending in .34, and the aliases are .33, .35, and ,36. The name of the .34 address is "bogslab.xxx.yyy", and the aliases are "bogs", "ouijasida", and "pirouette", respectively. The Kerberos realm wants to default to "PIROUETTE.XXX.YYY", and the title displayed in the WGM screen is "pirouette.xxx.yyy".

I hesitate to proceed beyond this point until I understand what’s going on. What I think I want is for the realm to be BOGSLAB.XXX.YYY (or even better: XXX.YYY), and there’s no way the WGM should be displaying pirouette, which is used in a rather limited way for web & email only.

Any ideas about this? Could the numeric order of the IP addresses be relevant? The alphabetic order of the names?

Greg Shenaut

[gshenaut]

Progress report: I finally tried commenting out the three aliases in /etc/IPAliases, rebooted, and then in an unaliased state promoted the server to OD Master. This time everything seemed smooth: the suggested realm matched the server, and the Workgroup Manager window also reflected the same host.

I put back the aliases and rebooted again. Now, the kerberos realm stuff still seemed OK, but the WGM windowflipped to the same alias as before when I connected to the server.

Before I did this, I searched high and low in the system for some configuration file somewhere that identified the alias incorrectly as the primary address, and I couldn’t find anything (for either the name or the IP).

I’m beginning to think that some of the Server Admin programs use some secret algorithm to figure out the name of a server they are administering on the fly. It may be that I will be able to ignore the WGM weirdness.

Greg Shenaut

[gshenaut]

I continue to plod along with this. I noticed that /etc/krb5.keytab contained the string "pirouette", the alias that keeps showing up in WGM, so I extended the previous idea: I demoted OD, removed krb5.keytab, commented out the aliases, rebooted, promoted OD, added a user & group using WGM, put back the aliases, and rebooted. After I did this, krb5.keytab contained only the correct, main hostname.

But when I then fired up WGM to add another user, the faux name showed up again as before in the window title, and the false name was suggested as the mail server for the new user (I typed in the correct name). I also noticed that in the "Account Summary" of both users, the "Location" field contained the alias, not the correct main name:

pirouette.ucdavis.edu/LDAPv3/127.0.0.1

I ran strings(1) on a file called /var/servermgrd/servermgr_info.lock, because when I xargs|grep’ed the entire filesystem, it was one of the files that contained "pirouette". But it contains all of the aliases and their addresses in ascii, so it isn’t the source of the problem.

Greg Shenaut

[gshenaut]

Yes, that’s about what I had concluded. But at some point, I do need to add those aliases.

When you say “highest priority interface that is active”, is there a specific meaning you had in mind ?

I think this is the key here. It’s not just when promoting, because if I do the promotion without aliases, I get the main (non-aliased) interface, but if I do other WGM things (e.g., add a user) after the promotion, but with the aliases put back, WGM still “wants” to use one of the aliases. Could “highest priority” means something like “highest IP address”, because this happens to be the case.

One other question, if you don’t mind. I’ve been adding IP aliases by putting them in /etc/IPAliases, which seems to work OK. You mentioned doing it via the GUI or with networksetup. What are the trade-offs on these three different methods of adding IP aliases? Also, I looked pretty hard, but I haven’t found a good step-by-step of adding IP aliases with the GUI (and I never heard of networksetup.

Thanks,
Greg Shenaut

[Author]

Posts