Minimal object containing this commit
Commit Diff
commit 467519f746c95d4b2b2aceb5a1789bd63f30b45f6f356e4cb9244b76aa5da70b
Author: yihanwu1024 <yihanwu1024>
Date: Sat Jun 4 00:00:00 2022 +0000
create memo-guide on systems administration
diff --git a/020049f5f3217ba196cb04f055ad6fa68e9cc3edc6e4101704b76679a57f3e75 b/020049f5f3217ba196cb04f055ad6fa68e9cc3edc6e4101704b76679a57f3e75
new file mode 100644
index 0000000..09e4ba4
--- /dev/null
+++ b/020049f5f3217ba196cb04f055ad6fa68e9cc3edc6e4101704b76679a57f3e75
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="020049f5f3217ba196cb04f055ad6fa68e9cc3edc6e4101704b76679a57f3e75">
+<title>Authorization</title>
+<para>Authorization is only about making a decision based on authenticated information.
+At this point, it is already certain that the logged-in user is the actual user.</para>
+<para>If you think about it, authorization is handled by the owner of a resource or on behalf of it.
+The owner usually means the app server.</para>
+</section>
diff --git a/1e3cd2626a26729ff8a5a93a9e297b03443032213b9621baca28f51ee53d09dd b/1e3cd2626a26729ff8a5a93a9e297b03443032213b9621baca28f51ee53d09dd
new file mode 100644
index 0000000..e47c1d2
--- /dev/null
+++ b/1e3cd2626a26729ff8a5a93a9e297b03443032213b9621baca28f51ee53d09dd
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="1e3cd2626a26729ff8a5a93a9e297b03443032213b9621baca28f51ee53d09dd">
+<title>Other Protocols</title>
+<para>The authentication mode varies from program to program.
+Bearer authentication has become the industry standard.</para>
+<blockquote>
+<para>How we did it: Our SMTP and IMAP ports use bearer authentication (both OAUTHBEARER and XOAUTH2) thanks to Postfix and Dovecot.</para>
+</blockquote>
+</section>
diff --git a/25b9d5204e7c6666651d156c6f339e84e6d57f3179b824f555f29c74c6455b6f b/25b9d5204e7c6666651d156c6f339e84e6d57f3179b824f555f29c74c6455b6f
new file mode 100644
index 0000000..e5b781c
--- /dev/null
+++ b/25b9d5204e7c6666651d156c6f339e84e6d57f3179b824f555f29c74c6455b6f
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="25b9d5204e7c6666651d156c6f339e84e6d57f3179b824f555f29c74c6455b6f">
+<title>Checking for Authorization</title>
+<para>The Authorization: Bearer token is sent to the app server.
+The app server queries a central identity server to find out (introspect) if it is valid and whose it is, then make authorization decisions.</para>
+</section>
diff --git a/3313d7832c23d49044d53cf27d0d5a22437b90dd4555404e313903b0f47b9644 b/3313d7832c23d49044d53cf27d0d5a22437b90dd4555404e313903b0f47b9644
new file mode 100644
index 0000000..40d4e0b
--- /dev/null
+++ b/3313d7832c23d49044d53cf27d0d5a22437b90dd4555404e313903b0f47b9644
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="3313d7832c23d49044d53cf27d0d5a22437b90dd4555404e313903b0f47b9644">
+<title>Authentication</title>
+<para>There are a large number of IdPs available, many of which do not need adapter code written.</para>
+<blockquote>
+<para>How we did it: Tebibyte uses OpenID Connect, Keycloak implementation.</para>
+<para>Recent candidates are: Ory, Kanidm, Authentik, Authelia.</para>
+</blockquote>
+<para>Ideally, all authentication should be managed by a central service.
+In that case, when the user logs out from the IdP, all web apps subsequently recognize the user as logged out.
+The IdP is also able to keep log of all authentication events.
+Note that in such an architecture, if the IdP is slow to respond, the web service also slows down.</para>
+<para>If you provide binary client apps, they need to support OpenID Connect separately from the web apps.</para>
+</section>
diff --git a/47d9b23839ef7953c3e5c267fc8e8efbd7f4dcbc96b04a66b797c905b80c29ee b/47d9b23839ef7953c3e5c267fc8e8efbd7f4dcbc96b04a66b797c905b80c29ee
new file mode 100644
index 0000000..9a67bb5
--- /dev/null
+++ b/47d9b23839ef7953c3e5c267fc8e8efbd7f4dcbc96b04a66b797c905b80c29ee
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="47d9b23839ef7953c3e5c267fc8e8efbd7f4dcbc96b04a66b797c905b80c29ee">
+<title>System Organization</title>
+<para>Learn the File Hierarchy Standard (FHS) or whatever standard for your system.
+Take note of any locations that may be incompliant or difficult to remember.</para>
+<para>Use you package manager.
+Use other package managers (such as Python’s PIP) carefully and not for the whole system.</para>
+<para>Create the service users and set permissions for their directories.
+Use your init manager (systemd or otherwise) to manage startup dependencies.</para>
+</section>
diff --git a/5d3a81c4bf1cc831acbf12112c7216142ce1d522f7ca4fc56e9bb74f0c8174d6 b/5d3a81c4bf1cc831acbf12112c7216142ce1d522f7ca4fc56e9bb74f0c8174d6
new file mode 100644
index 0000000..97c56fa
--- /dev/null
+++ b/5d3a81c4bf1cc831acbf12112c7216142ce1d522f7ca4fc56e9bb74f0c8174d6
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="5d3a81c4bf1cc831acbf12112c7216142ce1d522f7ca4fc56e9bb74f0c8174d6">
+<title>Identity</title>
+<para>There is only one directory standard to choose from: LDAP.</para>
+</section>
diff --git a/855b95819d3fdcd3ea2e7ed9cc2ec8dfe2508062a53f32bf764b3d4fc800c8d0 b/855b95819d3fdcd3ea2e7ed9cc2ec8dfe2508062a53f32bf764b3d4fc800c8d0
new file mode 100644
index 0000000..fd018cd
--- /dev/null
+++ b/855b95819d3fdcd3ea2e7ed9cc2ec8dfe2508062a53f32bf764b3d4fc800c8d0
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="855b95819d3fdcd3ea2e7ed9cc2ec8dfe2508062a53f32bf764b3d4fc800c8d0">
+<title>HTTP Proxy</title>
+<para>Pay attention to proxy-specific headers.
+Also keep track of port numbers.
+Disable external access of naked ports.</para>
+</section>
diff --git a/a83a37e279e85863495a846aef685db9d50712021c156b4cb2d62d1bdf31c45e b/a83a37e279e85863495a846aef685db9d50712021c156b4cb2d62d1bdf31c45e
new file mode 100644
index 0000000..5800d59
--- /dev/null
+++ b/a83a37e279e85863495a846aef685db9d50712021c156b4cb2d62d1bdf31c45e
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="a83a37e279e85863495a846aef685db9d50712021c156b4cb2d62d1bdf31c45e">
+<title>Web Services</title>
+<para>There are a two major designs:</para>
+<itemizedlist>
+<listitem>
+<para>A directory with resource files and PHP or other scripts that are called by the webserver when a path is visited.</para>
+<itemizedlist>
+<listitem>
+<para>If the scripts are left out, the site just becomes purely static.</para>
+</listitem>
+<listitem>
+<para>These PHP scripts are stateless.</para>
+</listitem>
+<listitem>
+<para>Any scheduled jobs can only be triggered explicitly.</para>
+</listitem>
+</itemizedlist>
+</listitem>
+<listitem>
+<para>A long-running program that binds to a port ready to directly accept requests.</para>
+<itemizedlist>
+<listitem>
+<para>This port is usually proxied.</para>
+</listitem>
+<listitem>
+<para>Any scheduled jobs are run automatically.</para>
+</listitem>
+</itemizedlist>
+</listitem>
+</itemizedlist>
+<para>Web services typically need you to configure a database and file storage location.
+All data consistency is enforced by the database and filesystem.</para>
+</section>
diff --git a/abe97275ddccc780bc2fd6df37fd644116dcb218e3573e1b3101c4527749f93a b/abe97275ddccc780bc2fd6df37fd644116dcb218e3573e1b3101c4527749f93a
new file mode 100644
index 0000000..3b8c7c9
--- /dev/null
+++ b/abe97275ddccc780bc2fd6df37fd644116dcb218e3573e1b3101c4527749f93a
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="abe97275ddccc780bc2fd6df37fd644116dcb218e3573e1b3101c4527749f93a">
+<title>Mail</title>
+<para>The modern email security framework consists of DKIM, SPF, and DMARC.
+Other online spam detection services can be an addition.</para>
+</section>
diff --git a/ac5aafa2e86068902ecd3704c3e06c48eb5bc013d0bdad703bc1689928f29ead b/ac5aafa2e86068902ecd3704c3e06c48eb5bc013d0bdad703bc1689928f29ead
new file mode 100644
index 0000000..2de87ca
--- /dev/null
+++ b/ac5aafa2e86068902ecd3704c3e06c48eb5bc013d0bdad703bc1689928f29ead
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="ac5aafa2e86068902ecd3704c3e06c48eb5bc013d0bdad703bc1689928f29ead">
+<title>General Good Practice</title>
+<para>Keep in mind that implementation-specific configurations are only the final boring step of server administration.
+Understand each step you do.
+Make decisions in an engineering sense.</para>
+</section>
diff --git a/ba2754b2a6c0ad064b20fa859175d07134c0e395e1618ba0e63876ac445e4ca4 b/ba2754b2a6c0ad064b20fa859175d07134c0e395e1618ba0e63876ac445e4ca4
new file mode 100644
index 0000000..257e93d
--- /dev/null
+++ b/ba2754b2a6c0ad064b20fa859175d07134c0e395e1618ba0e63876ac445e4ca4
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="ba2754b2a6c0ad064b20fa859175d07134c0e395e1618ba0e63876ac445e4ca4">
+<title>Firewall</title>
+<para>Use them whenever you need.</para>
+</section>
diff --git a/c2b8a5e3535fb824ee5ddb2918fc58a09e90b9fae45330153b944331af2c6bc9 b/c2b8a5e3535fb824ee5ddb2918fc58a09e90b9fae45330153b944331af2c6bc9
new file mode 100644
index 0000000..964a940
--- /dev/null
+++ b/c2b8a5e3535fb824ee5ddb2918fc58a09e90b9fae45330153b944331af2c6bc9
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="c2b8a5e3535fb824ee5ddb2918fc58a09e90b9fae45330153b944331af2c6bc9">
+<title>Database</title>
+<para>If you are using a UNIX-like server and the database is on the same machine as the web app, consider using a UNIX socket.
+This not only handles connection authentication on some systems but also achieves zero copy.</para>
+<para>Make sure to put your database on an SSD, and do not forget to back it up.</para>
+</section>
diff --git a/c2ef036bd5ac3be28a490de7c9324e2ddfd05061276ae16e4f11ef56610cc2db b/c2ef036bd5ac3be28a490de7c9324e2ddfd05061276ae16e4f11ef56610cc2db
new file mode 100644
index 0000000..d476e68
--- /dev/null
+++ b/c2ef036bd5ac3be28a490de7c9324e2ddfd05061276ae16e4f11ef56610cc2db
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="c2ef036bd5ac3be28a490de7c9324e2ddfd05061276ae16e4f11ef56610cc2db">
+<title>Network</title>
+<para>If you are using a single machine for everything, try to imagine that each service is actually on a separate machine.
+In your configuration files, before cramming everything onto a single apex domain (or even worse, localhost (or even worse, 127.0.0.1)), assign them wisely and write the correct subdomains for each component in your very first configuration file.
+(You get to decide what is considered a component.)
+Use CNAME in DNS.
+This way, when you only migrate certain services, nothing will break.</para>
+<include xmlns="http://www.w3.org/2001/XInclude" href="d0075f12560943bd419c9577ae8beb41d5b7c9580ee8e9015fcd0fe77e5f26d1"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="855b95819d3fdcd3ea2e7ed9cc2ec8dfe2508062a53f32bf764b3d4fc800c8d0"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="ba2754b2a6c0ad064b20fa859175d07134c0e395e1618ba0e63876ac445e4ca4"/>
+</section>
diff --git a/d0075f12560943bd419c9577ae8beb41d5b7c9580ee8e9015fcd0fe77e5f26d1 b/d0075f12560943bd419c9577ae8beb41d5b7c9580ee8e9015fcd0fe77e5f26d1
new file mode 100644
index 0000000..6a482b4
--- /dev/null
+++ b/d0075f12560943bd419c9577ae8beb41d5b7c9580ee8e9015fcd0fe77e5f26d1
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="d0075f12560943bd419c9577ae8beb41d5b7c9580ee8e9015fcd0fe77e5f26d1">
+<title>TLS</title>
+<para>Use TLS for all possible protocols and preferably disable insecure versions.
+Your Let’s Encrypt certificate is applicable to not only the HTTPS port but all TLS ports.
+Make this a natural practice.
+Security works better when everyone is used to it.</para>
+<para>Some ports use “StartTLS”, a command the client sends to establish TLS connection on an existing plaintext connection.</para>
+<para>When you update the TLS certificates, reload all services that use the certificates, like the web and mail servers.</para>
+<para>Use TLS outgoing requests even for same-machine connections across components, such as OpenID Connect login requests from the web service to the IdP.
+This way, when you only migrate certain services, nothing will break.</para>
+</section>
diff --git a/d1302383a2449dc902453de2bb0d8f7a193b6fecfe690932bc3a04bd5f8ffa49 b/d1302383a2449dc902453de2bb0d8f7a193b6fecfe690932bc3a04bd5f8ffa49
new file mode 100644
index 0000000..3746171
--- /dev/null
+++ b/d1302383a2449dc902453de2bb0d8f7a193b6fecfe690932bc3a04bd5f8ffa49
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="d1302383a2449dc902453de2bb0d8f7a193b6fecfe690932bc3a04bd5f8ffa49">
+<title>Identity, Authentication, and Authorization</title>
+<para>Identity, authentication, and authorization are distinct yet closely interworking systems.
+In the past, some protocols transgress into the other two of these three problems.
+Today, it is clear that every system should treat identity, authentication, and authorization as different problems, each addresses by a dedicated subsystem.</para>
+<para>Identity (Directory): Who are there?
+Does this identifier exist?
+Should only be accessible internally.</para>
+<para>Authentication (OpenID Connect): Given an identifier, make sure only the correct agent can act as it Open to the Internet.</para>
+<para>Authorization (OAuth): Given an authenticated user, and any resource, make allow/reject/etc.
+decisions, using information from the directory and database.
+Handled by the resource owner, open to the Internet.</para>
+<para>Before talking about this I need to make the distinction between internal services (usually operated by your own organization) and external services (usually not operated by your own organization).</para>
+<para>As a general rule, in internal services, all users have a presence by default.
+In external services, the presence of a user is opt-in.
+Therefore, it is important to note that they require different ways of managing the full list of users (directory; IdM).
+Internal services have <emphasis>prescribed</emphasis> access to the directory of your domain.
+It is usually wrong to configure internal services without direct access to the full directory.
+(Can you imagine having to open Google Drive once before someone can share with your new Google Drive account?) External services add users to their directories as users log in for the first time, and it is the responsibility of the said service to maintain a subdirectory.</para>
+<include xmlns="http://www.w3.org/2001/XInclude" href="5d3a81c4bf1cc831acbf12112c7216142ce1d522f7ca4fc56e9bb74f0c8174d6"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="3313d7832c23d49044d53cf27d0d5a22437b90dd4555404e313903b0f47b9644"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="020049f5f3217ba196cb04f055ad6fa68e9cc3edc6e4101704b76679a57f3e75"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="25b9d5204e7c6666651d156c6f339e84e6d57f3179b824f555f29c74c6455b6f"/>
+</section>
diff --git a/e1f534a7d8fd7fa638be6932c5582978c63bceb6bc753d8bd2f20741e41dc29a b/e1f534a7d8fd7fa638be6932c5582978c63bceb6bc753d8bd2f20741e41dc29a
new file mode 100644
index 0000000..45abdb4
--- /dev/null
+++ b/e1f534a7d8fd7fa638be6932c5582978c63bceb6bc753d8bd2f20741e41dc29a
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="e1f534a7d8fd7fa638be6932c5582978c63bceb6bc753d8bd2f20741e41dc29a">
+<title>Storage</title>
+<para>User data storage can either be a mounted system volume on the same server as the service software, or a separate server typically through some object storage interface (which forms three-sided connections: web service, storage, user).
+If scaling is expected, it can be very suitable to first deploy a dedicated storage server on the same machine to make any future migrations easier.
+If so, assign whole disks to a storage server, not directories.</para>
+<para>If redundancy is a concern, use a disk array.
+But <link xlink:href="https://mirrors.tuna.tsinghua.edu.cn/tuna/tunight/2021-11-13-lto-intro/slides.html">a disk array is not a backup</link>.
+You should ideally keep a backup somewhere easily accessible, and another backup at a different location.</para>
+</section>
diff --git a/ea2992ee9234912a0242cac8cadc17ff0c0e8aab51b3beae4331aa471f377925 b/ea2992ee9234912a0242cac8cadc17ff0c0e8aab51b3beae4331aa471f377925
new file mode 100644
index 0000000..bd8a5f2
--- /dev/null
+++ b/ea2992ee9234912a0242cac8cadc17ff0c0e8aab51b3beae4331aa471f377925
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="ea2992ee9234912a0242cac8cadc17ff0c0e8aab51b3beae4331aa471f377925">
+<title>Web Server</title>
+<para>With a correct web server configuration, the served directory structure can be very different from the structure stored on the server.
+An example is this website, where there are actually no <literal>/~user/</literal> directories stored on the server.</para>
+<para>In addition to the main configuration files, there are per-directory <literal>.ht\*</literal> files for fine control.
+Use this to avoid a thousand location cases in your main configuration files just for access control.</para>
+</section>
diff --git a/eba1f3d39c4f924adc3b29a5e33bcb1afb686f407f29bc4b567f7cb7d0bfedfc b/eba1f3d39c4f924adc3b29a5e33bcb1afb686f407f29bc4b567f7cb7d0bfedfc
new file mode 100644
index 0000000..7423e83
--- /dev/null
+++ b/eba1f3d39c4f924adc3b29a5e33bcb1afb686f407f29bc4b567f7cb7d0bfedfc
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="eba1f3d39c4f924adc3b29a5e33bcb1afb686f407f29bc4b567f7cb7d0bfedfc">
+<title>The Architecture of Things</title>
+<include xmlns="http://www.w3.org/2001/XInclude" href="a83a37e279e85863495a846aef685db9d50712021c156b4cb2d62d1bdf31c45e"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="d1302383a2449dc902453de2bb0d8f7a193b6fecfe690932bc3a04bd5f8ffa49"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="1e3cd2626a26729ff8a5a93a9e297b03443032213b9621baca28f51ee53d09dd"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="f92ecee7671d0755d02b8524f5b08e50459f6946aba702c1846f752d2ffd458c"/>
+</section>
diff --git a/f4daa068778f768907c390ea7d8f47d2a5f092fdcdea8e7e89f27bf862dd2a1d b/f4daa068778f768907c390ea7d8f47d2a5f092fdcdea8e7e89f27bf862dd2a1d
new file mode 100644
index 0000000..f54f0de
--- /dev/null
+++ b/f4daa068778f768907c390ea7d8f47d2a5f092fdcdea8e7e89f27bf862dd2a1d
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<article xmlns="http://docbook.org/ns/docbook" xml:id="f4daa068778f768907c390ea7d8f47d2a5f092fdcdea8e7e89f27bf862dd2a1d">
+<title>Server Administration Memo</title>
+<para>This domain name is tebibyte.io.
+You have to admit it’s pretty cool.</para>
+<para>Tebibyte was originally only a storage server intended for my family and close friends.
+I was the one with more IT knowledge and free time, so I set up the server with a 2010 Pentium and 8 TB of storage.
+Those times were simply quite pleasant.
+In the following months I kept adding more features to it, such as single sign-on, email and other services.
+As we used it more, I started to appreciate the efficiency of such practice, in terms of cost, human labor, and privacy.
+When we upgraded our server hardware, we did not buy a prebuilt server largely because of the cost.
+Instead, we used another existing computer, pooled from our users.
+The additional cost was low.</para>
+<para>And I only used very little time managing the server that benefits a number of users.
+The key to reducing cost and labor is good IT management.
+Even for such a scale as 20 users, I can imagine a huge difference between good management and a bad one.
+But this is also behind a great knowledge barrier.
+For example, when I did not know how to write systemd unit files, I could only use screen to keep a service running.
+However, the knowledge itself is less than key, but rather how it is systematically obtained and organized.
+This affects both high-level concepts and very specific software projects.</para>
+<para>Thus, to greatly organize research, I have compiled this document as a learning catalog.
+Use this memo as a compass if you are quite new to server administration or if you are not systematic with it.</para>
+<include xmlns="http://www.w3.org/2001/XInclude" href="ac5aafa2e86068902ecd3704c3e06c48eb5bc013d0bdad703bc1689928f29ead"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="eba1f3d39c4f924adc3b29a5e33bcb1afb686f407f29bc4b567f7cb7d0bfedfc"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="47d9b23839ef7953c3e5c267fc8e8efbd7f4dcbc96b04a66b797c905b80c29ee"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="e1f534a7d8fd7fa638be6932c5582978c63bceb6bc753d8bd2f20741e41dc29a"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="c2b8a5e3535fb824ee5ddb2918fc58a09e90b9fae45330153b944331af2c6bc9"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="c2ef036bd5ac3be28a490de7c9324e2ddfd05061276ae16e4f11ef56610cc2db"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="abe97275ddccc780bc2fd6df37fd644116dcb218e3573e1b3101c4527749f93a"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="ea2992ee9234912a0242cac8cadc17ff0c0e8aab51b3beae4331aa471f377925"/>
+</article>
diff --git a/f92ecee7671d0755d02b8524f5b08e50459f6946aba702c1846f752d2ffd458c b/f92ecee7671d0755d02b8524f5b08e50459f6946aba702c1846f752d2ffd458c
new file mode 100644
index 0000000..c99124c
--- /dev/null
+++ b/f92ecee7671d0755d02b8524f5b08e50459f6946aba702c1846f752d2ffd458c
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="f92ecee7671d0755d02b8524f5b08e50459f6946aba702c1846f752d2ffd458c">
+<title>System Accounts</title>
+<para>UNIX system accounts can use an IdP backend with a PAM module.</para>
+<blockquote>
+<para>How we did it: We are only using this after migrating all system users to another machine.
+It can be problematic to let a service manage the system that supports itself.</para>
+</blockquote>
+</section>