kanaka for Macintosh 3.0.1 を Microfocus OES Linux ファイルサーバーへ導入

前の記事

OES 2018 Linux でフォルダ容量制限付き AFP Mac 用ファイルサーバー

https://islandcnt.exblog.jp/238458407/

OES 2018 Linux eDirectory＋NSS での CIFS ファイルサーバー

https://islandcnt.exblog.jp/238412872/

前回は、Microforcus/Novell Open Enterprise Server (OES Linux) を使った CIFS/AFP による、Windows/Mac 用、「ファイルのゴミ箱化」させないファイルサーバーの構築手順を説明しました。

ここでは、 OES 2018 に付属の kanaka for mac 3.0.1 を使った、Macintosh ファイルサーバーのバックエンドの導入方法を説明します。

- kanaka for Mac 3.0.1 -

kanaka for Mac は

- バックエンド、サーバー側で動作し、 Mac クライアントに最適なサービスを提供するkanaka engine]

- Mac フロントエンドで動作し、macOS のログインからedirectory へログオンさせるkanaka plugin.

=Mac フロントエンドで動作し、macOS デスクトップから eDirectory ユーザのパスワード管理, OES ボリュームをチェックする kanaka Desktop

の３つのコンポーネントから構成されます。ここでは kanaka engine の構成方法を説明します。

マニュアル、概要、入手先はこちらです。。

Micro Focus Kanaka for Mac

https://www.microfocus.com/ja-jp/products/open-enterprise-server/features/kanaka-mac-networking/

Manual

https://www.novell.com/documentation/kanaka/

Download

https://download.novell.com/Download?buildid=Yxf0re2NfvU~

なお、ドキュメントにあるように、kanaka for Macintosh は OES 2018 のコンポーネントの一部として OES のサブスクリプションを購入することで Novell のテクニカルサポートを受ける事ができるようです。

ダウンロードしたファイルは ISO 形式です。中身から kanaka-engine の rpm を取り出します。

MicroFocus-Kanaka_3_0_1.iso microfocus-kanaka-engine-3.0.1-3.x86_64.rpm

- Engine のインストール -

oes2018a:~/ISO/kanaka # rpm -i microfocus-kanaka-engine-3.0.1-3.x86_64.rpm

Adding microfocus-kanakaengined to the list of services at startup...done.

Micro Focus Kanaka for Mac Engine successfully installed.

To configure the Micro Focus Kanaka for Mac Engine, run the microfocus-kanakaengine-config utility.

Refreshing microfocus-kanakaengined for systemd...done.

- エンジンの設定 -

oes2018a:~/ISO/kanaka # microfocus-kanakaengine-config

Resolving current hostname...

Micro Focus Kanaka for Mac Engine Configuration

Please fill in the following required fields:

Current Data Path: /var/opt/microfocus/kanaka/engine/data

New Path-> [Enter]

Current Address: [Enter]

Select new Engine address:

[0] 192.168.1.211

Selection->

Invalid selection.

Selection->0 <-- そのままでいいので"0"

Engine HTTP Port [0] : 0

Engine HTTPS Port [3089] : [Enter]

[S] Set Server Address

[C] Clear Server Address

Hit [Enter] to accept current address

[oes2018a]:

The service cannot be started before a certificate is copied to /etc/opt/microfocus/kanaka/engine/config/server.pem

------------------------------------------------------------------------

Micro Focus Kanaka for Mac Engine Service Config

------------------------------------------------------------------------------

Data Path: /var/opt/microfocus/kanaka/engine/data

Engine Address: 192.168.1.211

HTTP Port: 0

HTTPS Port: 3089

Default NCP Server Address: oes2018a

Debug Level: 5

------------------------------------------------------------------------------

[D] Data Path [E] Engine Service

[N] Default NCP Server Address [O] Debug Options

[S] Service Management [Q] Quit

-----------------------------------------------------------------------------

Micro Focus Kanaka for Mac Engine Service Config

------------------------------------------------------------------------------

Data Path: /var/opt/microfocus/kanaka/engine/data

Engine Address: 192.168.1.211

HTTP Port: 0

HTTPS Port: 3089

Default NCP Server Address: oes2018a

Debug Level: 5

------------------------------------------------------------------------------

[D] Data Path [E] Engine Service

[N] Default NCP Server Address [O] Debug Options

[S] Service Management [Q] Quit

サービス管理をしようと[S]を押してみました。

Selection->S

NOTICE: The certificate file does not exist, and the microfocus-kanakaengined cannot be managed.

Please refer to the documentation for instructions.

Press any key to continue.

怒られたので仕方なくquit

Selection->q

NOTICE: The certificate file does not exist, and the microfocus-kanakaengined cannot be started.

Please refer to the documentation for instructions.

oes2018a:~/ISO/kanaka #

マニュアルによると

When are asked if you want to restart the service, do not do so until completing Step 13.

Copy the PEM file that you created in Step 9 to the following location:

/etc/opt/microfocus/kanaka/engine/config

Restart the service by selecting Y.

次の手順で cert.pfx を取り出して、 server.pem に変換する必要があるようです。

Generating Certificates

https://www.novell.com/documentation/kanaka/kanaka_install_admin/data/b14f74m5.html

Exporting an eDirectory Server Certificate#

Depending on usage, choose to export the DNS or IP certificate for the Open Enterprise Server that hosts the Kanaka Engine. If Kanaka clients are configured with the DNS hostname of the OES server, you should export the DNS AG <server DNS hostname> certificate. If Kanaka clients are configured with the IP address of the OES server, you should export the IP AG <server IP address> certificate.

Log in to iManager.

From Roles and Tasks, click NetIQ Certificate Access.

Click Server Certificates.

Select the certificate for the OES server hosting the Kanaka Engine.

iManager >Role & Tasks > NetIQ Certificate Access > Server Certificates > IP_AG_IP-Address をチェック。絵では、違うものをクリックしていますが... ご愛敬

Click Export.

From the Certificates drop-down menu, select the certificate that you checked in Step 4.

Leave Export private key selected.

Leave Include all certificates in the certification path if available selected.

Certificate の右横のトグルボタンを押して

Certificate private Key > IP AG xx.xx.xx.xx にトグル

Enter a password to protect the private key.(後で使います。任意です。覚えておくこと)

This is required when Export private key is selected.

Click Next.

Click Save the exported certificate.

The file is saved to your Downloads folder with the name cert.pfx.

3.5.3 Convert a PKCS#12 Certificate to a PEM Certificate#

iManager exports server certificates in the PKCS#12 or PFX format. This format needs to be converted to PEM format for the Kanaka Engine. You can use one of the following two methods to do so:

microfocus-kanakaengine-convertcert#

Copy the cert.pfx file to the OES server hosting the Kanaka Engine.

- サーバー証明書を kanaka Engine に登録 -

- List -

oes2018a:~ # cd kanaka

oes2018a:~/kanaka # ls

cert.pfx

oes2018a:~/kanaka #

--

In a terminal session on the OES server hosting the Kanaka Engine type:

microfocus-kanakaengine-convertcert

When prompted, enter the name of the certificate cert.pfx.

When prompted, enter the pass phrase that was used when the certificate was exported.

In this case, the pass phrase from Step 9 from Section 3.5.2, Exporting an eDirectory Server Certificate.

You are then prompted twice to enter a new pass phrase for the temporary key.

When prompted, re-enter the pass phrase you used for the temporary key in Step 4.

- List -

oes2018a:~/kanaka # microfocus-kanakaengine-convertcert

Enter path of certificate file in PKCS12 format and press [ENTER]: ./cert.pfx

Enter pass phrase for ./cert.pfx and press [ENTER]: password　<- エクスポートした時のパスワード

Converting ./cert.pfx to PEM format...

Creating temporary certificate...

Creating temporary private key (/tmp/private.key)

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

Removing passphrase from temporary private key...

Enter pass phrase for /tmp/private.key:

Converted ./cert.pfx to server.pem

oes2018a:~/kanaka # ls -l

合計 16

-rw-r--r-- 1 root root 4915 4月 12 13:47 cert.pfx

-rw-r--r-- 1 root root 4308 4月 12 13:54 server.pem　<--- 変換できました。

oes2018a:~/kanaka #

--

Stop the Kanaka Engine:

rcmicrofocus-kanakaengine stop

Copy the server.pem file:

cp server.pem /etc/opt/microfocus/kanaka/engine/config

Start the Kanaka Engine:

rcmicrofocus-kanakaengine start

- List server.pem のコピー -

oes2018a:~/kanaka # rcmicrofocus-kanakaengined stop

redirecting to systemctl stop microfocus-kanakaengined.service

oes2018a:~/kanaka # cp server.pem /etc/opt/microfocus/kanaka/engine/config/

oes2018a:~/kanaka # ls /etc/opt/microfocus/kanaka/engine/config/*.pem

/etc/opt/microfocus/kanaka/engine/config/server.pem

oes2018a:~/kanaka # rcmicrofocus-kanakaengined start

redirecting to systemctl start microfocus-kanakaengined.service

oes2018a:~/kanaka #

--

- List kanaka engine の再起動 -

oes2018a:~ # microfocus-kanakaengine-config

Resolving current hostname...

------------------------------------------------------------------------------

Micro Focus Kanaka for Mac Engine Service Config

------------------------------------------------------------------------------

Data Path: /var/opt/microfocus/kanaka/engine/data

Engine Address: 192.168.1.211

HTTP Port: 0

HTTPS Port: 3089

Default NCP Server Address: oes2018a

Debug Level: 5

------------------------------------------------------------------------------

[D] Data Path [E] Engine Service

[N] Default NCP Server Address [O] Debug Options

[S] Service Management [Q] Quit

Selection->q

If changes have been made to the configuration a restart maybe required.

(Re)start the service at this time? [Y/N]: Y

Unknown Status

Unknown Status

Checking for service Micro Focus Kanaka for Mac Engine ..running

● microfocus-kanakaengined.service - LSB: Micro Focus Kanaka for Mac Engine

Loaded: loaded (/etc/init.d/microfocus-kanakaengined; bad; vendor preset: disabled)

Active: active (running) since 木 2018-04-12 14:02:12 JST; 61ms ago

Docs: man:systemd-sysv-generator(8)

Process: 102300 ExecStop=/etc/init.d/microfocus-kanakaengined stop (code=exited, status=0/SUCCESS)

Process: 102318 ExecStart=/etc/init.d/microfocus-kanakaengined start (code=exited, status=0/SUCCESS)

Tasks: 15 (limit: 512)

CGroup: /system.slice/microfocus-kanakaengined.service

└─102328 /opt/microfocus/kanaka/engine/bin/microfocus-kanakaengined --daemon

Press [Enter] to continue

oes2018a:~ #

oes2018a:~ # ps ax | grep kanaka

102328 ? Sl 0:00 /opt/microfocus/kanaka/engine/bin/microfocus-kanakaengined --daemon

102416 pts/0 S+ 0:00 grep --color=auto kanaka

oes2018a:~ #

Configuring the Engine

https://kanaka_engine_IP:3089/ をブラウザで開きます

スキーマを拡張します。

Click Next to extend the eDirectory schema.

kanaka Proxy オブジェクト、Kanaka Administrator オブジェクトを作ります。

ユーザインデックスを作るユーザコンテナを指定します。O=ORG を選び、"Serch All Subcontainers ...." を選ぶと、サブツリー全体のユーザインデックスを構築します。

この下にインデックスリビルドを実行する時間のチェックリストが出てきます。デフォルトで午前1時がチェックされています。ネットワークの負荷が少ない時間帯を選べという事なので、未明の時間が良いでしょう。

In the Rebuild Times region, specify the hours when you want Micro Focus Kanaka for Mac to rebuild the index.

You should choose an hour when there is minimal network activity

kanaka engine をリスタートします。

oes2018a:~ # rcmicrofocus-kanakaengined stop

redirecting to systemctl stop microfocus-kanakaengined.service

oes2018a:~ # rcmicrofocus-kanakaengined start

redirecting to systemctl start microfocus-kanakaengined.service

oes2018a:~ # rcmicrofocus-kanakaengined status

Checking for service Micro Focus Kanaka for Mac Engine running

● microfocus-kanakaengined.service - LSB: Micro Focus Kanaka for Mac Engine

Loaded: loaded (/etc/init.d/microfocus-kanakaengined; bad; vendor preset: disabled)

Active: active (running) since 木 2018-04-12 15:01:37 JST; 8s ago

Docs: man:systemd-sysv-generator(8)

Process: 103809 ExecStop=/etc/init.d/microfocus-kanakaengined stop (code=exited, status=1/FAILURE)

Process: 103833 ExecStart=/etc/init.d/microfocus-kanakaengined start (code=exited, status=0/SUCCESS)

Tasks: 28 (limit: 512)

CGroup: /system.slice/microfocus-kanakaengined.service

└─102328 /opt/microfocus/kanaka/engine/bin/microfocus-kanakaengined --daemon

oes2018a:~ #

一旦ブラウザを閉じて、開きなおすと kanaka Console が起動しました。

"User Index" より "rebuild Time" の指定ができます。デフォルトでは午前０時に自動実行されます。

kanaka によってDesktop.Afp (隠しファイル)がrebuild されます。

isLandcenter.jp