Real HA cluster implementation

[alexskynet]

(05-01-2010 02:44 PM)pgentoo Wrote:  Can't openldap be configured via pam so standard "useradd" and similar commands add to ldap instead of /etc/{passwd,shadow,group}

I'm wondering if the same thing could be accomplished without actually changing ispcp... ?

I'm also setting up an HA environment for another project i'm wokring on, but once it's done i'll piggyback my hosting setup on it, so i'm very interested.

I suppose the answer is yes, and the same thing may be done using nsslib-mysql.

But this is not my desired behaviour.

I want to avoid that a useradd changes the configuration of the system.

REAL users, like root, support users and daemons, will work as usual, while ispcp users will not.

The only need for "real users" (nss, ldap or local) is required if you plan to give ssh as a service, but if you only plan to only use ftp, mail and httpd this ca be very easily done with virtual only users.

I have some setups worink in the real world where no "real users" exists:
dovecot, postfix, httpd and pure-ftpd are able to use mysql users with absolutely no connection with real users

Last but not least I think ISPCP should use one single backend, since this makes easier for users to fix any situation.

ISPCP uses MySQL so users will very likely know a little bit of it, I don't see the need for users learning to use/configure LDAP to use both LDAP and MySQL (one for users and one for ISPCP).

I'm not saying that LDAP is not good, but only that I, as user, would prefer a SINGLE backend where in emergency I can access and do any changes

NSS is part of any modern distribution and configure it is a matter of very few minutes.

Anyway I'd like to see the same thing done using LDAP.

I'm preparing a small step by step howto about using NSS, patching ISPCP and some using it.

I've also in mind a very simple hack to enable ISPCP to work with natted IPs.

Is something very simple as adding one column to the IPs table, adding a ISNATTED configuration variable and changing a single query to enable BIND/Apache to be configurd automagically in a transparent way