Service Desk Knowledgebase: User Accounts and Groups: Difference between revisions

From Computer Laboratory System Administration
Jump to navigationJump to search
Line 68: Line 68:
# Update RT ticket with comment "'''Account creation started.'''" and leave the RT ticket on the '''sysadmin''' queue with the status of "'''Open'''" - it is then clear that it is being worked on and awaiting a "Part 2"
# Update RT ticket with comment "'''Account creation started.'''" and leave the RT ticket on the '''sysadmin''' queue with the status of "'''Open'''" - it is then clear that it is being worked on and awaiting a "Part 2"
# The process then updates the AD, email forwarding, LDAP entries and ends with another email coming in to RT in about 30 minutes (see '''[https://wiki.cam.ac.uk/cl-sys-admin/Service_Desk_Knowledgebase:_User_Accounts_and_Groups#Part_2:_Create_home_directories_for_new_users Part 2]''')
# The process then updates the AD, email forwarding, LDAP entries and ends with another email coming in to RT in about 30 minutes (see '''[https://wiki.cam.ac.uk/cl-sys-admin/Service_Desk_Knowledgebase:_User_Accounts_and_Groups#Part_2:_Create_home_directories_for_new_users Part 2]''')
===Part 2: Email: "Create home directories for new users"===
Sent into RT from <[mailto:gt19@cl.cam.ac.uk gt19@cl.cam.ac.uk]>
[NOTE: See http://www.wiki.cl.cam.ac.uk/clwiki/SysInfo/HelpDesk/Users/Adduser and the actual contents of the individual email]
When a new RT ticket comes in with the subject "'''Create home directories for new users'''..." it should be '''merged''' with the earlier associated "'''Account creation request for <CRSid> arriving <date>'''" or "'''Outstanding accounts to create for people arriving RT ticket'''..." for the user.
{{PuttyConnect}}
7. At the '''laira:~$''' prompt use the actual commands included in the "'''Create home directories for new users'''" email which look similar to:<br />
'''sudo ssh elmer wcc -s <font color="red">'''CRSid'''</font>'''
8. If requested,give your CL '''[sudo] password for CRSid:''' & press '''[Enter]'''
9. Check that the string "'''cifsuser'''" is '''''NOT shown''''' for the user(s) listed in the email the ouput like this:
  (NT - UNIX) account name(s):  (CL.CAM.AC.UK\vv274 - '''vv274''')
        ***************
        UNIX uid = 3472
        user is a member of group vv274 (3472)
        user is a member of group vv274 (3472)
 
        NT membership
                CL.CAM.AC.UK\vv274
                CL.CAM.AC.UK\Domain Users
                BUILTIN\Users
        User is also a member of Everyone, Network Users,
        Authenticated Users
        ***************
If '''(CL.CAM.AC.UK\<font color="red">CRSid</font> - cifsuser)''' is shown then ''wait...''
10. Then use the two commands from the email that look like:<br />
'''cd /usr/groups/admin/users'''<br />
'''./makehomedir <font color="red">CRSid UID $PARTITION</font>'''<br />
to make their home directory.
11. Then copy and paste the two commands:<br />
'''cd /usr/groups/admin/netapp/conf-elmer'''<br />
'''co -l quotas'''<br />
and '''[Enter]''' and you should see
  RCS/quotas,v  -->  quotas
  revision 1.2182 (locked)
  done
which is fine.
12. Edit the quotas file to add a default entry, checking that the number for the partition in '''user@/vol/vol1/homes-<font color="red">$PARTITION</font>''' matches with the '''./makehomedir <font color="red">CRSid UID $PARTITION</font>''' partition number used above.  To do that use '''vi quotas''' and '''[Enter]''' to edit the file and:
* '''/Actual user quotas''' and '''[Enter]''' to search for the right area
* Use '''Ctrl+F''' and the arrow keys move down to the '''<font color="red">CRSid</font> user@/vol/vol1/homes-<font color="red">$PARTITION</font>''' line for the CRSid ''alphabetically before the new user'' (ready to insert the new user)
* Use '''Shift+A''' to enter '''--INSERT--''' mode at the end of that line
* Press '''[Enter]''' then insert the new line
* Using '''spaces''' put in
  '''<font color="red">CRSid</font>                  user@/vol/vol1/homes-<font color="red">$PARTITION</font>'''    50G      1M
* '''[Esc]''' out of '''--INSERT--''' mode
* ''':wq''' and '''[Enter]''' to write the file and quit vi
----
{{NotesOnVi}}
----
13. '''rcsdiff quotas''' and '''[Enter]''' to check what changes have actually been made
14. '''ci -u quotas''' and '''[Enter]''' to check-in and add a comment of the RT ticket number e.g. '''RT#<font color="red">94171</font>''' then '''[Enter]''' and exit with  '''.[Enter]'''
15. Then copy & paste the two commands:<br />
'''cd /usr/groups/admin/netapp'''<br />
'''make maintain'''<br />
and press '''[Enter]''' - It takes couple of minutes and you will then see things like:
  elmer: quota resize vol9 done
  elmer: quota resize vol10 done
16. Then copy & paste the two commands:<br />
'''cd /global/src/etc/amd.conf'''<br />
'''make inst'''<br />
and press '''[Enter]''' then give your CL '''[sudo] password for CRSid:''' & press '''[Enter]''' if requested.  You will see:
  localhost: updating host localhost
  localhost: maps: updating
  localhost: updating of localhost finished
  -r--r--r--. 1 root root 206 Feb 17  2004 /anfs/master/dist/all/etc/amd.conf/maps
17. Use '''exit''' and '''[Enter]''' to close down PuTTY
18. Copy the output from PuTTY and paste it into an RT comment as a record of what was done.
19. In RT put in a second comment of '''Print out of password now at reception on "pear"''' and set the '''status''' to '''resolved''' and the '''owner''' as '''nobody'''.


===Email: "Outstanding equipment requests for arriving visitors/staff"===
===Email: "Outstanding equipment requests for arriving visitors/staff"===

Revision as of 10:47, 22 December 2015


This is the User Accounts and Groups content page of the CL Wiki Service Desk Knowledgebase. Its purpose is to provide information to the Service Desk team on how to handle problems and requests about this CL service. If you are involved with the provision of this CL service please feel free to add to the knowledge about that it.

If CL staff need to tell the Service Desk team about problems with this service please email
sys-admin-aside@cl.cam.ac.uk.

Return to the Service Desk Knowledgebase SERVICE PORTFOLIO

Key Service Description & URLs

CL Customer Documentation

CL SysInfo Documentation

People

There's also:

Underpinning Services

  • ??? - Any supporting or underpinning services

Customer-base for this Service

Costs

SLA

  • N/A

Service Desk Call Handling Procedure

  • RT tickets can be escalated by changing the Queue to backoffice with the Owner set to Nobody and the Status as new. Tell the requestor:
    I am passing this request over to the experts who, I'm sure, will be in contact shortly.

Accounts

CL Account creations are carried out via the SCG website, they normally are added automatically via the arrivals process.

Note that Reception can do UIS account requests.

Part 1: Email: "Account creation request for <CRSid> arriving <date>" or "Outstanding accounts to create for people arriving"

Sent into RT from <gt19@cl.cam.ac.uk> from https://dbwebserver.ad.cl.cam.ac.uk/Administration/Visitors/ArrivalDetails.aspx

If this is the first time you have carried out this procedure, then first set the printer to pear and click Save in the configuration settings.

Either:

or in the email:

and then:

  1. With the CRSid in Enter CRSID for new User, click [Validate] to pull in details. If the details are not present or you do not have a valid crsid then move the ticket to the Back Office queue.
  2. Check Full Name entered
  3. Anyone in an Outstanding accounts to create for people arriving email will be an incoming person and should be on the office list at the point in time the discretionary status comes up for review so set Discretionary Use Status: to Account for new user who should be on office list by review date and click [Create Account] (with Print form? ticked)
  4. Update RT ticket with comment "Account creation started." and leave the RT ticket on the sysadmin queue with the status of "Open" - it is then clear that it is being worked on and awaiting a "Part 2"
  5. The process then updates the AD, email forwarding, LDAP entries and ends with another email coming in to RT in about 30 minutes (see Part 2)

Email: "Outstanding equipment requests for arriving visitors/staff"

Sent into RT from <gt19@cl.cam.ac.uk> as an automated periodic check to ensure things don't get missed e.g. 

Please fulfil request(s) which have already been logged in RT.
requestID Sponsor Person Starting 
----------- -------- -------------------- ------------
1008 as2330 Arcia-Moret 05/05/2015 
1029 avsm2 Laurent 01/06/2015 
1058 fms27 Brown 06/07/2015 
969 rnw24 Schwemmer 11/05/2015 
1063 rnw24 Pearce 24/06/2015 
 
(5 rows affected)

Copy each requestID in turn and plug into the URL

https://dbwebserver.ad.cl.cam.ac.uk/Administration/Visitors/VisitorDetails.aspx?ID=1063

Copy the RT# from the RT_Ticket field.

If the RT_Ticket field has not been updated) copy the person's surname and go to RT's Simple Search at https://rt.cl.cam.ac.uk/Search/Simple.html and search for it.

If you get Found 0 tickets click Edit Search and under Current search click on the first ( of 

 ( 
   Status = 'new' 
   OR Status = 'open' 
   OR Status = 'stalled' ) 
 AND (  
   Subject LIKE 'Pearce' )

and click the [Delete] button to just search for 

 ( 
   Subject LIKE 'Pearce' )

and then click Show Results to find the RT ticket.

When the original RT ticket is found use Link & Refers to link through to the original ticket in RT and work in the original ticket putting only a summarizing comment in the "Outstanding equipment requests for arriving visitors/staff" ticket. Go through the associated RT tickets and see if any equipment requests are stuck. It may be that the database has just not been updated and the equipment has been provided and the VLAN configured. So update the database as appropriate. The Equipment_state field requires OK Inventory #???? MachineName? to complete it and stop it being picked up as a "Outstanding equipment requests for arriving visitors/staff".

Quota Increases

For individuals

Approval: "Bigdisc" quotas can be increased on request up to 250Gb. Home quotas up to 100Gb. Anything else needs to be escalated as above for approval. A user's quota and usage can be checked using cl-rquota -u CRSid if they are not 'nearly full' on the file system for which they are asking for more, ascertain why they think they need it (e.g. they are about to start some work that needs lots of space) before just giving it.

To increase a quota:

1. Make sure Pageant.EXE is running and has your private key - by double clicking on CL.ppk or similar.

2. Use PuTTY and go to the CL's slogin-serv.cl.cam.ac.uk

3. Make the PuTTY window longer.

4. Type kinit & press [Enter]

5. Enter your CL Password for CRSid@AD.CL.CAM.AC.UK & press [Enter] - Note: upper case AD.CL.CAM.AC.UK

6. Type ssh -K laira & press [Enter] to go to the privileged machine laira

7. If requested give your CL [sudo] password for CRSid: & press [Enter]

8. At the laira:~$ prompt copy and paste the two commands:
cd /usr/groups/admin/netapp/conf-elmer
co -l quotas
and [Enter] and you should see 

 RCS/quotas,v  -->  quotas
 revision 1.2182 (locked)
 done

which is fine.

9. Edit the quotas file to update the existing entry using vi quotas and [Enter] and:

  • /CRSid and [Enter] (to search for a CRSid) with user@/vol/vol5/scr-1 area for Bigdisc quotas or user@/vol/vol1/homes-$PARTITION area for Home quotas (the number for $PARTITION will vary)
  • Arrow-key to be directly over the top of the quota numbers you want to change.
  • Use Shift+R to enter -- REPLACE -- or "Overtype" mode
  • Edit the quota figures on the end of the line like
 vrw10 user@/vol/vol5/scr-1 100G  100K

or 

 vrw10 user@/vol/vol1/homes-$PARTITION 50G  500K

[NOTE: Text is separated by spaces not tabs]

  • [Esc] out of -- REPLACE -- mode
  • :wq and [Enter] to write the file and quit vi

Click here for GENERAL NOTES on vi


10. rcsdiff quotas and [Enter] to check what changes have actually been made

11. ci -u quotas and [Enter] to check-in and add a comment of the RT ticket number e.g. RT #94171 then [Enter] and exit with .[Enter]

12. Then copy & paste the two commands:
cd /usr/groups/admin/netapp
make maintain

and press [Enter] - It takes couple of minutes and you will then see things like: 

 elmer: quota resize vol9 done
 elmer: quota resize vol10 done

13. Copy & paste the output in the TRT ticket "for the record".

For groups

Based on the guidelines on Computer Lab RT#95305 from Graham Titmus (16/04/15)

Click here for GENERAL NOTES on vi

The quotas are in the same file as the User quotas, but earlier on in the file.
Providing the requester is an SRA, it is reasonable to accept a request for a larger group quota.

  1. Attach to Laira as outlined in the instructions for an individual's quotas ("For individuals" following steps 1-8).
  2. Go to the Filer configuration directory (cd /usr/groups/admin/netapp/conf-elmer)
    and unlock the quotas file (co -l quotas).
  3. To find which group to increase, run the command df (to see the disk mount-path). Alternatively use the command "grep group exports".
    e.g. looking for group 'fluphone' reveals the shared folder as 'grp-sr11'
    grep fluphone exports
    /vol/vol3/grp-sr11 -sec=sys,rw=@cl_hosts:www-fluphone:www-cambridgeplus:www-duckplus,root=HOSTLIST(priv_elmer_nosquash),sec=krb5:krb5i:krb5p,rw=128.232.0.0/17
  4. Once you have identified the volume to increase (in this example it is grp-sr11), edit the quotas file
    vi quotas
  5. Locate the folder configuration line
    e.g. (Note that each "/" in the example search-string - /vol/vol3/grp-sr11 - is prefixed with the "\")
    /\/vol\/vol3\/grp-sr11
  6. Once on the line move to the size value (you can use "w" to move a 'word' at a time)
  7. When sitting on the current size press "x" to delete the character under the cursor to remove the current number then
    press "i" then enter the new value
  8. Once edited to the new value, exit and save the file using ":wq"
  9. Check the changes made with "rcsdiff quotas" and [Enter]
  10. Check-in the file with "ci -u quotas" and [Enter], then when prompted for a comment with ">>" type the RT ticket number (e.g. RT#94171) then [Enter] and exit with .[Enter]
  11. Then copy & paste the two commands:
    cd /usr/groups/admin/netapp
    make maintain
    and press [Enter]
    - this can take a couple of minutes


Copy the resultant screen contents from step 2 to the end, and paste it into the RT ticket as a comment and [Save Changes].

After an increase of this size it is best to escalate to check that the filer has enough spare capacity to provide the space.
Add another comment saying "Please can someone check the space availability for this increase"
Set the Status to "New" and the Owner to "Nobody" then click on [Save Changes]

Add user to a group

Note that: "A request to add a user to a group should be supported by a member of staff in the group."
Follow the procedure at http://www.wiki.cl.cam.ac.uk/clwiki/SysInfo/HelpDesk/Users/AddGroup or select the group in the list at https://dbwebserver.ad.cl.cam.ac.uk/SCG/UnixGroups/UnixGroups.aspx and Enter new member: and [Add User]. Tell the requester:
This has been done but it will take a while before it becomes visible.

Reactivating cancelled Computer Lab accounts

The user should be told:
If you have a good reason why you should need continued access then you need to contact your former supervisor here and get them to agree to sponsor your account. Such sponsorship is normally only granted for continued active collaboration that requires access to resources here.

If the sponsor gets back and authorises the reactivation, the two things to do to permit his account to stay alive are to edit both the user record at the top and the discretionary entry below it in the User Administration database. If they have a discretionary users record where the Status is purgewait (if not it has to go to backoffice) then:

  1. Find and merge the (probable) two RT tickets
  2. Go to the User Administration database at https://dbwebserver.ad.cl.cam.ac.uk/SCG/UserAdmin/UserAdministration.aspx enter the CRSid into Find User and click [Lookup]
  3. Check under Discretionary User Details that the status is of type purgewait - if they have already been removed then just pass the RT ticket on to the backoffice queue
  4. Click [Edit] at the top left of the Details for user CRSid user record.
  5. Tick the box next to active
  6. Click the [Update] button
  7. Next click the [Edit] button under Discretionary User Details
  8. Change the status to ok
  9. Set the reviewdate set to one year form the current date
  10. Put the sponsor's CRSid into sponsor
  11. Put the RT ticket number into comment as RT#96207
  12. Click the [Update] button
  13. Get back to the user & the sponsor using RT telling them:
    This has been done and a login should be possible again in the near future once the public ssh keys are again added to the recognised set.
  14. Resolve the ticket.


If they have already been removed then pass this on to the backoffice queue.

Keeping open CL accounts for a student who is going on to a CL PhD or similar

If a sponsor requests that a student retains their CL accounts because they are going on to do a PhD the following can be used to ensure that the student's CL accounts are not closed over the summer:

  1. Check the sponsor is of a suitable status using https://dbwebserver.ad.cl.cam.ac.uk/Administration/HR/AllStaffStudents.aspx and [Lookup]
  2. Find the student's details using https://dbwebserver.ad.cl.cam.ac.uk/Administration/HR/AllStaffStudents.aspx and [Lookup]
  3. Click the [Create Discretionary Entry] button
  4. [Edit] the Discretionary User Details to include the following:
    • Status: new - User will be on the staff database by the reviewdate. If the person is leaving but the sponsor asks you to keep their account alive set the Status: OK
    • reviewdate: 30/10/2015 (i.e. a date just after they are due to arrive) or in case of a sponsored account a year unless told otherwise
    • sponsor: CRSid of their sponsor
    • comments: RT#96271
  5. Click [Update]
  6. Get back to the user & the sponsor using RT telling them:
    This has been done.
  7. Resolve the ticket.


If they have already been removed then pass this on to the backoffice queue.

Reissue Password

Piete Brooks (07/09/15)

It has been confirmed that the 'Reissue Password Form' button does not re-print the last Password Form, but resets the password, and prints a new form.

For someone who has never has a Lab account, it will make little difference. However, if the user already has a Lab account, and knows the password, trying to be helpful and using 'Reissue Password Form' will mean that they can no longer login (until they realise what has happened, and picked up the new form)!

So if the person doesn't know or has never had a Lab password:

  1. First go to https://dbwebserver.ad.cl.cam.ac.uk/SCG/Configuration.aspx and check your printer is set to "pear" and [Save Settings] if not.
    Only then...
  2. Go to https://dbwebserver.ad.cl.cam.ac.uk/scg/UserAdmin/UserAdministration.aspx
  3. Find user: CRSid and click [Lookup]
  4. Then click the [Reissue Password Form] button (bottom right)
  5. The new password form can then be picked up from CL Reception

Contacts

Primary

Other

Availability

  • Monday:
  • Tuesday:
  • Wednesday:
  • Thursday:
  • Friday:
  • Saturday: Closed
  • Sunday: Closed

Additional CL Staff Resources

Hints, Tips & Know Issues

Notes on the Staff List

Vince Woodley (28/01/15)

Some Staff List Positions

  • blank = no longer have Computer Laboratory status
  • ACS = Advanced Computer Science (MPhil)
  • Intern = Working in lab as a summer student.
  • RA = Research Assistant
  • RARS = Research Assistant registered for a degree
  • SRA = Senior Research Associate

Categorising Keywords

  • User Accounts Groups creation recreation locked out quota conference snapshots
Retrieved from "https://wiki.cam.ac.uk/wiki/cl-sys-admin/index.php?title=Service_Desk_Knowledgebase:_User_Accounts_and_Groups&oldid=3354"