Service Desk Knowledgebase: User Accounts and Groups

From Computer Laboratory System Administration
Jump to navigationJump to search


This is the User Accounts and Groups content page of the CL Wiki Service Desk Knowledgebase. Its purpose is to provide information to the Service Desk team on how to handle problems and requests about this CL service. If you are involved with the provision of this CL service please feel free to add to the knowledge about that it.

If CL staff need to tell the Service Desk team about problems with this service please email
sys-admin-aside@cl.cam.ac.uk.

Return to the Service Desk Knowledgebase SERVICE PORTFOLIO

Key Service Description & URLs

CL Customer Documentation

CL SysInfo Documentation

People

There's also:

Underpinning Services

  • ??? - Any supporting or underpinning services

Customer-base for this Service

Costs

SLA

  • N/A

Service Desk Call Handling Procedure

  • RT tickets can be escalated by changing the Queue to backoffice with the Owner set to Nobody and the Status as new. Tell the requestor:
    I am passing this request over to the experts who, I'm sure, will be in contact shortly.

Accounts

CL Account creations are carried out via the SCG website, they normally are added automatically via the arrivals process.

Note that Reception can do UIS account requests.

Part 1: Email: "Account creation request for <CRSid> arriving <date>"

Sent into RT from <gt19@cl.cam.ac.uk> from https://dbwebserver.ad.cl.cam.ac.uk/Administration/Visitors/ArrivalDetails.aspx

If this is the first time you have carried out this procedure, then first set the printer to lime and click Save in the configuration settings.

Either:

or in the email:

and then:

  1. With the CRSid in Enter CRSID for new User, click [Validate] to pull in details
  2. Check Full Name entered
  3. Anyone in an Outstanding accounts to create for people arriving email will be an incoming person and should be on the office list at the point in time the discretionary status comes up for review so set Discretionary Use Status: to Account for new user who should be on office list by review date and click [Create Account] (with Print form? ticked)
  4. Update RT ticket with comment "Account creation started." and save with the status of "Open" - it is then clear that it is being worked on and awaiting a "Part 2"
  5. The process then updates the AD, email forwarding, LDAP entries and ends with another email coming in to RT in about 30 minutes (see Part 2)

Part 2: Email: "Create home directories for new users"

Sent into RT from <gt19@cl.cam.ac.uk>

[NOTE: See http://www.wiki.cl.cam.ac.uk/clwiki/SysInfo/HelpDesk/Users/Adduser and the actual contents of the individual email]

When a new RT ticket comes in with the subject Create home directories for new users it should be merged with the earlier associated Outstanding accounts to create for people arriving RT ticket for the user.

First access the privileged machine laira with PuTTY using:

1. Make sure Pageant.EXE is running and has your private key - by double clicking on CL.ppk or similar.

2. Use PuTTY and go to the CL's slogin-serv.cl.cam.ac.uk

3. Make the PuTTY window longer.

4. Type kinit & press [Enter]

5. Enter your CL Password for CRSid@AD.CL.CAM.AC.UK & press [Enter]

6. Type ssh -K laira & press [Enter] to go to the privileged machine laira

then...

7. At the laira:~$ prompt use the actual commands included in the Create home directories for new users email which look similar to: sudo ssh elmer wcc -s CRSid

8. If requested,give your CL [sudo] password for CRSid: & press [Enter]

9. Check that the string "cifsuser" is NOT shown for the user(s) listed in the email the ouput like this: 

 (NT - UNIX) account name(s):  (CL.CAM.AC.UK\vv274 - vv274)
       ***************
       UNIX uid = 3472
       user is a member of group vv274 (3472)
       user is a member of group vv274 (3472)
 
       NT membership
               CL.CAM.AC.UK\vv274
               CL.CAM.AC.UK\Domain Users
               BUILTIN\Users
       User is also a member of Everyone, Network Users,
       Authenticated Users
       ***************

If (CL.CAM.AC.UK\CRSid - cifsuser) is shown then wait...

10. Then use the two commands from the email that look like:
cd /usr/groups/admin/users
./makehomedir CRSid UID $PARTITION
to make their home directory.

11. Then copy and paste the two commands:
cd /usr/groups/admin/netapp/conf-elmer
co -l quotas
and [Enter] and you should see 

 RCS/quotas,v  -->  quotas
 revision 1.2182 (locked)
 done

which is fine.

12. Edit the quotas file to add a default entry, checking that the number for the partition in user@/vol/vol1/homes-$PARTITION matches with the ./makehomedir CRSid UID $PARTITION partition number used above. To do that use vi quotas and [Enter] to edit the file and:

  • /Actual user quotas and [Enter] to search for the right area
  • Use Ctrl+F and the arrow keys move down to the CRSid user@/vol/vol1/homes-$PARTITION line for the CRSid alphabetically before the new user (ready to insert the new user)
  • Use Shift+A to enter --INSERT-- mode at the end of that line
  • Press [Enter] then insert the new line
  • Using spaces put in
 CRSid                   user@/vol/vol1/homes-$PARTITION    50G      1M
  • [Esc] out of --INSERT-- mode
  • :wq and [Enter] to write the file and quit vi

GENERAL NOTES on vi
Note: Best to press <escape> before using these to put you back in "command" mode rather than editing

  • /string and [Enter] (search for the string)
  • /^<char> and [Enter] (search for character char at the start of a line)
  • : for command prompt
  • :1 to go to line 1
  • :wq and [Enter] is write & quit
  • :q! and [Enter] is quit without writing (if you mess up!)
  • :help and [Enter] for help
  • Arrow-keys scroll around text
  • Ctrl+F to page-Forward through text
  • Ctrl+B to page-Back through text
  • Shift+A to go into -- INSERT -- mode at end of line
  • i to go into -- INSERT -- mode at the cursor
  • Shift+R to enter -- REPLACE -- or "Overtype" mode
  • [Esc] escape out of -- INSERT -- & -- REPLACE -- mode
  • u undo last change
  • dd deletion (if pressed twice the object is the current line)
  • U undelete (to undelete the last deletion)
  • P paste (to paste the last delete)
  • w move forward by a word (a word is any string - this includes white space)

13. rcsdiff quotas and [Enter] to check what changes have actually been made

14. ci -u quotas and [Enter] to check-in and add a comment of the RT ticket number e.g. RT#94171 then [Enter] and exit with .[Enter]

15. Then copy & paste the two commands:
cd /usr/groups/admin/netapp
make maintain

and press [Enter] - It takes couple of minutes and you will then see things like: 

 elmer: quota resize vol9 done
 elmer: quota resize vol10 done


16. Then copy & paste the two commands:
cd /global/src/etc/amd.conf
make inst
and press [Enter] then give your CL [sudo] password for CRSid: & press [Enter] if requested. You will see: 

 localhost: updating host localhost
 localhost: maps: updating
 localhost: updating of localhost finished
 -r--r--r--. 1 root root 206 Feb 17  2004 /anfs/master/dist/all/etc/amd.conf/maps

17. Use exit and [Enter] to close down PuTTY

18. Copy the output from PuTTY and paste it into an RT comment as a record of what was done.

19. In RT put in a second comment of Print out of password now at reception on "lime" and set the status to resolved and the owner as nobody.

Email: "Outstanding equipment requests for arriving visitors/staff"

Sent into RT from <gt19@cl.cam.ac.uk> as an automated periodic check to ensure things don't get missed e.g. 

Please fulfil request(s) which have already been logged in RT.
requestID Sponsor Person Starting 
----------- -------- -------------------- ------------
1008 as2330 Arcia-Moret 05/05/2015 
1029 avsm2 Laurent 01/06/2015 
1058 fms27 Brown 06/07/2015 
969 rnw24 Schwemmer 11/05/2015 
1063 rnw24 Pearce 24/06/2015 
 
(5 rows affected)

Copy each requestID in turn and plug into the URL

https://dbwebserver.ad.cl.cam.ac.uk/Administration/Visitors/VisitorDetails.aspx?ID=1063

Copy the RT# from the RT_Ticket field.

If the RT_Ticket field has not been updated) copy the person's surname and go to RT's Simple Search at https://rt.cl.cam.ac.uk/Search/Simple.html and search for it.

If you get Found 0 tickets click Edit Search and under Current search click on the first ( of 

 ( 
   Status = 'new' 
   OR Status = 'open' 
   OR Status = 'stalled' ) 
 AND (  
   Subject LIKE 'Pearce' )

and click the [Delete] button to just search for 

 ( 
   Subject LIKE 'Pearce' )

and then click Show Results to find the RT ticket.

When the original RT ticket is found use Link & Refers to link through to the original ticket in RT and work in the original ticket putting only a summarizing comment in the "Outstanding equipment requests for arriving visitors/staff" ticket. Go through the associated RT tickets and see if any equipment requests are stuck. It may be that the database has just not been updated and the equipment has been provided and the VLAN configured. So update the database as appropriate.

Quota Increases

For individuals

Approval: "Bigdisk" quotas can be increased on request up to 250Gb. Home quotas up to 100Gb. Anything else needs to be escalated as above for approval.

1. Make sure Pageant.EXE is running and has your private key - by double clicking on CL.ppk or similar.

2. Use PuTTY and go to the CL's slogin-serv.cl.cam.ac.uk

3. Make the PuTTY window longer.

4. Type kinit & press [Enter]

5. Enter your CL Password for CRSid@AD.CL.CAM.AC.UK & press [Enter] - Note: upper case AD.CL.CAM.AC.UK

6. Type ssh -K laira & press [Enter] to go to the privileged machine laira

7. If requested give your CL [sudo] password for CRSid: & press [Enter]

8. At the laira:~$ prompt copy and paste the two commands:
cd /usr/groups/admin/netapp/conf-elmer
co -l quotas
and [Enter] and you should see 

 RCS/quotas,v  -->  quotas
 revision 1.2182 (locked)
 done

which is fine.

9. Edit the quotas file to update the existing entry using vi quotas and [Enter] and:

  • /CRSid and [Enter] (to search for a CRSid) with user@/vol/vol5/scr-1 area for Bigdisk quotas or user@/vol/vol1/homes-$PARTITION area for Home quotas (the number for $PARTITION will vary)
  • Arrow-key to be directly over the top of the quota numbers you want to change.
  • Use Shift+R to enter -- REPLACE -- or "Overtype" mode
  • Edit the quota figures on the end of the line like
 vrw10 user@/vol/vol5/scr-1 100G  100K

or 

 vrw10 user@/vol/vol1/homes-$PARTITION 50G  500K

[NOTE: Text is separated by spaces not tabs]

  • [Esc] out of -- REPLACE -- mode
  • :wq and [Enter] to write the file and quit vi

Click here for GENERAL NOTES on vi


10. rcsdiff quotas and [Enter] to check what changes have actually been made

11. ci -u quotas and [Enter] to check-in and add a comment of the RT ticket number e.g. RT #94171 then [Enter] and exit with .[Enter]

12. Then copy & paste the two commands:
cd /usr/groups/admin/netapp
make maintain

and press [Enter] - It takes couple of minutes and you will then see things like: 

 elmer: quota resize vol9 done
 elmer: quota resize vol10 done

For groups

Based on the guidelines on Computer Lab RT#95305 from Graham Titmus (16/04/15)

Click here for GENERAL NOTES on vi

The quotas are in the same file as the User quotas, but earlier on in the file.
Providing the requester is an SRA, it is reasonable to accept a request for a larger group quota.

  1. Attach to Laira as outlined in the instructions for an individual's quotas ("For individuals" following steps 1-8).
  2. Go to the Filer configuration directory (cd /usr/groups/admin/netapp/conf-elmer)
    and unlock the quotas file (co -l quotas).
  3. To find which group to increase, run the command df (to see the disk mount-path). Alternatively use the command "grep group exports".
    e.g. looking for group 'fluphone' reveals the shared folder as 'grp-sr11'
    grep fluphone exports
    /vol/vol3/grp-sr11 -sec=sys,rw=@cl_hosts:www-fluphone:www-cambridgeplus:www-duckplus,root=HOSTLIST(priv_elmer_nosquash),sec=krb5:krb5i:krb5p,rw=128.232.0.0/17
  4. Once you have identified the volume to increase (in this example it is grp-sr11), edit the quotas file
    vi quotas
  5. Locate the folder configuration line
    e.g. (Note that each "/" in the example search-string - /vol/vol3/grp-sr11 - is prefixed with the "\")
    /\/vol\/vol3\/grp-sr11
  6. Once on the line move to the size value (you can use "w" to move a 'word' at a time)
  7. When sitting on the current size press "x" to delete the character under the cursor to remove the current number then
    press "i" then enter the new value
  8. Once edited to the new value, exit and save the file using ":wq"
  9. Check the changes made with "rcsdiff quotas" and [Enter]
  10. Check-in the file with "ci -u quotas" and [Enter], then when prompted for a comment with ">>" type the RT ticket number (e.g. RT#94171) then [Enter] and exit with .[Enter]
  11. Then copy & paste the two commands:
    cd /usr/groups/admin/netapp
    make maintain
    and press [Enter]
    - this can take a couple of minutes


Copy the resultant screen contents from step 2 to the end, and paste it into the RT ticket as a comment and [Save Changes].

After an increase of this size it is best to escalate to check that the filer has enough spare capacity to provide the space.
Add another comment saying "Please can someone check the space availability for this increase"
Set the Status to "New" and the Owner to "Nobody" then click on [Save Changes]

Add user to a group

Note that: "A request to add a user to a group should be supported by a member of staff in the group."
Follow the procedure at http://www.wiki.cl.cam.ac.uk/clwiki/SysInfo/HelpDesk/Users/AddGroup or select the group in the list at https://dbwebserver.ad.cl.cam.ac.uk/SCG/UnixGroups/UnixGroups.aspx and Enter new member: and [Add User]. Tell the requester:
This has been done but it will take a while before it becomes visible.

Reactivating cancelled Computer Lab accounts

The user should be told:
If you have a good reason why you should need continued access then you need to contact your former supervisor here and get them to agree to sponsor your account. Such sponsorship is normally only granted for continued active collaboration that requires access to resources here.

If the sponsor gets back and authorises the reactivation, the two things to do to permit his account to stay alive are to edit both the user record at the top and the discretionary entry below it in the User Administration database. If they have a discretionary users record where the Status is purgewait then:

  1. Find and merge the (probable) two RT tickets
  2. Go to the User Administration database at https://dbwebserver.ad.cl.cam.ac.uk/SCG/UserAdmin/UserAdministration.aspx enter the CRSid into Find User and click [Lookup]
  3. Check that the discretionary users record is of type purgewait - if they have already been removed then pass the RT ticket on to the backoffice queue
  4. Click [Edit] at the top left of the Details for user CRSid user record.
  5. Tick the box next to active
  6. Click the [Update] button
  7. Next click the [Edit] button under Discretionary User Details
  8. Change the status to ok
  9. Set the reviewdate set to one year form the current date
  10. Put the sponsor's CRSid into sponsor
  11. Put the RT ticket number into comment as RT#96207
  12. Click the [Update] button
  13. Get back to the user & the sponsor using RT telling them:
    This has been done and a login should be possible again in the near future once the public ssh keys are again added to the recognised set.
  14. Resolve the ticket.


If they have already been removed then pass this on to the backoffice queue.

Contacts

Primary

Other

Availability

  • Monday:
  • Tuesday:
  • Wednesday:
  • Thursday:
  • Friday:
  • Saturday: Closed
  • Sunday: Closed

Additional CL Staff Resources

Hints, Tips & Know Issues

Notes on the Staff List

Vince Woodley (28/01/15)

Some Staff List Positions

  • blank = no longer have Computer Laboratory status
  • ACS = Advanced Computer Science (MPhil)
  • Intern = Working in lab as a summer student.
  • RA = Research Assistant
  • RARS = Research Assistant registered for a degree
  • SRA = Senior Research Associate

Categorising Keywords

  • User Accounts Groups creation recreation locked out quota conference snapshots
Retrieved from "https://wiki.cam.ac.uk/wiki/cl-sys-admin/index.php?title=Service_Desk_Knowledgebase:_User_Accounts_and_Groups&oldid=2659"