Administration Guide -- Core Components

First Edition (February 1998)

This edition applies to Version 2.2 of IBM Distributed Computing Environment for AIX and to all subsequent releases and modifications until otherwise indicated in new editions or technical newsletters.

Order publications through your IBM representative or the IBM branch office serving your locality. Publications are not stocked at the address below.

IBM welcomes your comments. Send your comments to the following address:

International Business Machines Corporation

Department VLXA

11400 Burnet Road

Austin, Texas

78758

When you send information to IBM, you grant IBM a nonexclusive right to use or distribute the information in any way it believes appropriate without incurring any obligation to you.

This documentation and the software to which it relates are derived in part from materials supplied by the following:

Copyright © 1995, 1996 Open Software Foundation, Inc.

Copyright © 1990, 1991, 1992, 1993, 1994, 1995, 1996 Digital Equipment Corporation

Copyright © 1990, 1991, 1992, 1993, 1994, 1995, 1996 Hewlett-Packard Company

Copyright © 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996 Transarc Corporation

Copyright © 1990, 1991 Siemens Nixdorf Informationssysteme AG

Copyright © 1988, 1989, 1995 Massachusetts Institute of Technology

Copyright © 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California

Copyright © 1995, 1996 Hitachi, Ltd.

Licensee agrees that it will comply with and will require its Distributors to comply with all then applicable laws, rules and regulations (i) relating to the export or re-export of technical data when exporting or re-exporting a Licensed Program or Documentation, and (ii) required to limit a governmental agency's rights in the Licensed Program, Documentation or associated technical data by affixing a Restricted Rights notice to the Licensed Program, Documentation and/or technical data equivalent to or substantially as follows: "Use, duplication or disclosure by the U.S. Government is subject to restrictions as set forth in DFARS 52.227-7013(c)(1)(i)-(ii); FAR 52.227-19; and FAR 52.227-14, Alternate III, as applicable or in the equivalent clause of any other applicable Federal government regulations."

© Copyright International Business Machines Corporation 1997. All rights reserved.
Note to U.S. government Users -- Documentation related to restricted rights -- Use, duplication or disclosure is subject to restrictions set forth in GSA ADP Schedule contract with IBM Corp.

Table of Contents

The DCE Control Program

DCE Administration Tasks

DCE Host and Application Administration

Cell Directory Service

DCE Distributed Time Service

DCE Security Service

Appendixes

Figures

1. Server Binding Information
2. Possible Information in a Server Entry
3. Possible Mappings of a Group
4. Possible Mappings of a Profile
5. Cell and Global Naming Environments
6. Interaction of CDSs, GDAs, and Global Directory Services
7. Sample CDS Namespace Hierarchy
8. RDNs and Distinguished Names
9. Comparison of CDS and X.500 Names
10. Sample Portion of the BIND Namespace
11. CDS Clerks and Servers on a LAN
12. A Sample CDS Lookup
13. Components of a CDS Server Node
14. Logical and Physical Views of a Namespace
15. Clearinghouse Object Entries and Clearinghouses
16. A Soft Link and Its Resolution
17. Child Pointers and Directories
18. How the Clerk Finds a Name
19. Example Namespace Hierarchy
20. Example Namespace Before and After the Merge Operation
21. Example Namespace Before and After the Append Operation
22. Example Replica Set
23. Example Replica Set After Master Redesignation
24. Example Replica Set After Replica Exclusion
25. How the CDS Clerk Finds a GDA
26. How the GDA Helps CDS Find a Name
27. Time and Inaccuracy
28. Computed Time
29. Adjustment of the Clock
30. ISO-Compliant Time Format
31. ISO-Compliant Time Format Variation
32. Relative Time Format
33. DTS Configuration--LAN
34. DTS Configuration--LAN with WAN Links
35. DTS Configuration--WAN Networks
36. DTS Timestamp Format
37. Local Fault
38. Local Time Source
39. Getting the Time from a Remote NTP Time Source (Scenario 1)
40. Getting the Time from a Remote NTP Time Source (Scenario 2)
41. Giving the Time to NTP
42. Configuration Before Stratum 2 Node Fails
43. Configuration After Stratum 2 Node Fails
44. Machines, Servers, and the Database
45. Disk Memory and Virtual Memory Copies of the Registry Database
46. The Master Replica Update Process
47. Slave Replica Update Process
48. ACL Managers in Servers
49. Sample ACL Entries
50. Order of Checking ACLs and Applying Masks
51. Initial ACLs for Objects Created in Containers
52. Initial ACLs for Containers Created in Containers
53. Direct and Transitive Trust Relationships
54. Cell Traversal in Transitive Trust Relationships
55. Limited Direct Trust Peer Traversal in Transitive Trust
56. Transitive Trust Without Direct Trust Peer Traversal
57. Limited Trust Traversal to Cell Ancestors
58. Alternate Trust Traversal to Cell Ancestors
59. The Registry Database Structure
60. Permission Required to Create Principals, Groups, or Organizations
61. Permissions Required to Delete Principals, Groups, or Organizations
62. Permissions Required to Add an Account and the Account Principal to the Group and Organization
63. Adding an Account For Which the Principal Is Already a Member of the Group and Organization
64. Permissions to Add an Account and the Principal to the Group Only
65. Permissions to Add an Account and the Principal to the Organization Only
66. Permissions Required to Delete Accounts
67. Permissions Required to Add Members to Groups
68. Permissions Required to Add Members to Organizations
69. Permissions to Delete Members From Groups or Organizations
70. Permissions Required to Change a Principal's, Group's, or Organization's Full Name
71. Permissions Required to Change Management Information For Principals, Groups, or Organizations
72. Permissions Required to Change Management, Authentication, and User Information (Except Passwords) For Accounts
73. Permissions Required to Change Passwords For Accounts
74. Permissions Required to Change Authentication and Management Information For Registry Policies and Properties
75. Permissions Required to Execute Commands That Act on Replicas
76. Permissions Required to Create Extended Registry Attribute Types
77. Permissions Required to Delete Extended Registry Attribute Types
78. Permissions Required to View Extended Registry Attributes
79. Permissions Required to Modify Extended Registry Attribute Types
80. Permission Required to Change ACLs on Registry Objects
81. Event Class Number Formats
82. Override Relations Between Filter Types
83. Valid Characters in CDS and DNS Names
84. World Time Zone Map

Tables

1. EMSD Server Permission Bits
2. Event Type Database Permission Bits
3. Event Type Permission Bits
4. Filter Database Permission Bits
5. Event Filter Permission Bits
6. Consumer Database Permission Bits
7. Serviceability Message Severity Levels
8. DCE Control Program Operations for CDS
9. dcecp Commands that Control CDS
10. ACL Entry Types Used for CDS Principals
11. DCE Control Program Commands and Required Permissions
12. Permissions Required To Create Target Objects
13. dcecp Operations for DTS
14. Settable DTS Object Attributes
15. Unsettable DTS Object Attributes
16. DCE Control Program Operations for the DCE Security Service
17. rgy_edit Commands for Maintaining the Local Registry
18. Attribute Options to Create Principals
19. DCE Version 1.1/Pre-DCE Version 1.1 Authentication Interoperation
20. Attribute Options to Create Groups and Organizations
21. Attribute Options to Create Accounts
22. The keytab create and keytab add Options
23. Default Attribute Values of Cross-Cell Authorization Principals and Accounts
24. Stricter Standard Policies
25. Initial Persons, Groups, and Organizations
26. Group Memberships Created by sec_create_db
27. Locksmith Account Changes Made by the Security Server
28. Registry Policy Changes Made by the Security Server
29. Permissions for Registry Objects
30. ACL managers and Valid Permissions and ACL Entry Types
31. Credential Cache Files
32. Keytab Files
33. Metacharacters and Their Meanings
34. Maximum Sizes of Directory Service Names
35. Time-Provider Selection Criteria