Changing the IP Address of a DCE Machine

The procedure for changing the IP address on a machine running DCE 3.1 (either on the Solaris or AIX platform) is documented in the "IBM Distributed Computing Environment Version 3.1 for AIX and Solaris: Problem Determination Guide, section: "Changing the IP Address of a DCE Server", page 48. As part of this procedure, it also discusses what changes need to be made on client machines for the clients to recognize the new server IP addresses, in section "Client Updates". Details are also provided here for "Changing the IP Address of a DCE Client", and "Changing the IP Address of a DFS Server". The DCE 3.1 documentation is available in PDF-format. For a link to all the DCE 3.1 documentation guides, including the Problem Determination Guide: IBM DCE 3.1 Publications. The Problem Determination Guide for DCE 3.1 on AIX and for DCE 3.1 on Solaris are the same, so it does not matter which 3.1 Problem Determination Guide you reference for this procedure.

NOTE: A code change introduced with DCE 3.1 PTF 4 causes dced to update the pe_site file at startup, even when "-t 0" is set for dced. This updating of the pe_site at startup can cause dced to core on 3.1 server and 3.1 client machines when the IP address of a security server is changed, because the old IP address is not resolvable in dns until the secd is back up and running. There is a new flag for dced, "-n", which is available as of DCE 3.1 PTF 5, which is used to indicate "no pe_site update", including no update at startup. Therefore, to avoid the possibility of a dced core when changing the IP address of your secd servers machines, it is strongly advised that, on any DCE 3.1 machine in the cell where you are changing the IP address of a security server in the cell, you should also apply PTF 5 _and_ alter your cfgarg.dat file (/opt/dcelocal/etc/cfgarg.dat) to start dced with the "-n" flag. An apar slated for DCE 3.1 PTF 6 will address the dced core.

The procedure for changing the IP address of a machine running DCE 2.2 on AIX is documented in the "IBM DCE for AIX Problem Determination Guide", section Changing the IP Address of a DCE Server. This section also documents what changes need to be made on client machines for the clients to recognize the new server IP addresses, in "IP Address Changes for Client Machines", along with instructions for "Changing the IP Address of a DFS Server".

Procedure for DCE 1.1 or DCE 2.0 on Solaris

Use the following procedure to change a DCE server machine's IP address on a Solaris machine running DCE 1.1 or DCE 2.0 (If you must change a DCE client's IP address, the easiest thing to do is probably to just unconfigure the client, change the IP address, then reconfigure it.)

• 1. Rename the DCE startup files in /etc/rc3.d to prevent DCE from trying to restart during step 2.
  
  
  • mv /etc/rc3.d/S15-10dce-clean /etc/rc3.d/s15-10dce-clean
    mv /etc/rc3.d/S15-20dce /etc/rc3.d/s15-20dce
    mv /etc/rc3.d/S15-70dfs /etc/rc3.d/s15-70dfs

    Note: the numbers may be different, e.g. 15-20.

  2. Change the machine's IP address if you haven't already done so. Reboot.
  3. Change the IP address in:
  
  
  • /opt/dcelocal/etc/security/pe_site
    /opt/dcelocal/var/adm/directory/cds/cds_cache.wan

    If the cds_cache.wan file is zero-length, then just leave it alone.

  4. Remove the following files. They will be re-created automatically with the correct IP address when DCE restarts:
  
  
  • /opt/dcelocal/var/dced/Ep.db
    /opt/dcelocal/var/security/creds/*
    /opt/dcelocal/var/adm/directory/cds/cds_cache.version
    /opt/dcelocal/var/adm/directory/cds/cds_cache.[some_number]
    /opt/dcelocal/var/adm/directory/cds/cdsclerk_*
    /opt/dcelocal/var/adm/directory/cds/clerk_mgmt_acl_v1.dat
  
  
  
   
  •  
  5. Start the DCE processes by hand. Only start those processes configured on the machine. If you are unsure, you can check the /opt/dcelocal/etc/setup_state file. Only those processes listed need to be restarted.
  
  
  • dced
    secd
    cdsadv
    cdsd
  
  
  
   
  •  
  6. Issue the following commands:
  
  
  • setenv BIND_PE_SITE 1
    dce_login cell_admin [cell_admin_password]

    NOTE: If the following command does not return for a long period of time, stop DCE using the /etc/init.d/dce stop command, and redo steps 5 and 6.

    
    rpccp show entry /.:/hosts/[machine]/self
    
    rpccp unexport -i [uuid_and_version_number_from_rpccp_show] \
    /.:/hosts/[machine]/self
    
    rpccp export -i [uuid_and_version_number_from_rpccp_show] \
    -b ncadg_ip_udp:[new_IP_address]\[135\] \
    /.:/hosts/[machine]/self
    dcecp -c object delete /.:/hosts/[machine]/config

    Now start DCE via /etc/init.d/dce start.

  7. Reverse the renaming of the startup files done in step 1 to insure that DCE also starts up at boot time.
  8. If the machine houses DFS filesets (is a DFS server machine), then you must also change the machine's entry in the FLDB to reflect the new IP address:
  
  
  • fts edserverentry [old_IP_address] -changeaddr [new_IP_address]

    Stop the DFS processes and then reboot to restart the File Exporter.

You must also update EVERY client machine to recognize the server machine at its new IP address. To do this, stop DCE on the client and modify the files listed in step 3 above to contain the server's new IP address; then (still on the client) remove the files listed in step 4 and restart DCE.

Finally, you will have to modify any CDS entry that contains an IP address for an application server that runs on a machine whose IP address changed. (Step 6 above does this for the hosts/machine/self CDS entry that DCE itself uses.) Probably the easiet thing to do is:

• • Use dcecp rpcentry show to dump the current contents of the CDS entry
  • Stop the application server
  • Use dcecp rpcentry delete to delete the existing entry
  • Restart the application server
  • Use dcecp rpcentry show to examine the CDS entry -- if the application has recreated it with the new IP address, fine; otherwise, use dcecp rpcentry export to modify the entry appropriately (so that it looks like it did originally but with the new IP address).