Case Studies
This case study examines the csutil.exe, a very useful utility that comes with the CS ACS software. Csutil.exe is in the following location:
<ACS_install_directory>\utils\
For example, C:\Program Files\CiscoSecure ACS v3.2\utils\
The command syntax is as follows:
CSUtil.exe [-q] [-c] [-d] [-g] [-i filename] [[-p] -l filename] [-e - number] [-b filename] [-r filename] [-f] [-n] [-u] [-y] [-listUDV] [-addUDV slotfilename] [-delUDV slot]
To run this utility, some options require you to stop the services. To do this, use the net stop command. Example 13-12 shows the CSAuth service stopped with the net stop command.
Example 13-12 Stopping the CSAuth Service
C:\> net stop CSAuth The CSAuth service is stopping. The CSAuth service was stopped successfully. C:\>
Csutil.exe has many options/arguments for different purposes. Table 13-5 summarizes the options.
Table 13-5 Options Available for the csutil.exe Utility
|
Arguments |
Descriptions |
|
-b |
Back up system to a named file |
|
-d |
Export internal data to named file |
|
-g |
Export group information |
|
-I |
Import user or NAS information |
|
-l |
Load internal data from a named file |
|
-n |
Create/initialize the ACS database |
|
-q |
Run csutil.exe in quiet mode |
|
-r |
Restore system from a named file |
|
-u |
Export user information |
Back Up and Restore the CS ACS Database
Database backup and restore can be accomplished from the GUI and by browsing to the System Configuration option. However, due to csadmin failure, GUI access may be unavailable. Besides, if performing backup/restore requires an external script, using csutil.exe is very handy. When performing the backup function, services will automatically be stopped, which means no user authentication occurs during the backup. You are prompted for confirmation. You may use the quiet mode to bypass this confirmation. The backup will contain the following information:
- User and group information
- System configuration
If a component of the backup is empty, a Backup Failed notice will be displayed for that component only. To uninstall or upgrade, copy the backup file to a safe location; otherwise it will be removed. The command syntax for database backup is as follows:
C:\Program Files\CiscoSecure ACS v3.2\csutil –b filename
Example 13-13 shows the sample output of a database backup.
Example 13-13 Sample Run of Database Backup
C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -b backup.dat CSUtil v3.3(2.2), Copyright 1997-2004, Cisco Systems Inc All running services will be stopped and re-started automatically. Are you sure you want to proceed? (Y or N)(Y) Done C:\Program Files\CiscoSecure ACS v3.3\Utils>
If you restore the CS ACS database, services will automatically be stopped. You can restore user and group information or system configuration or both. Note that you can restore data only to the same version of CS ACS as the backup file, which means that this is not a system upgrade path. The following is the syntax used for database restore:
C:\> csutil –r [users|config | all] filename
Example 13-14 shows an example of database restore.
Example 13-14 Sample Run of Database Restore
C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -r all backup.dat CSUtil v3.3(2.2), Copyright 1997-2004, Cisco Systems Inc Reloading a system backup will overwrite ALL current configuration information All Running services will be stopped and re-started automatically. Are you sure you want to proceed? (Y or N)(Y) CSBackupRestore(IN) file C:\Program Files\CiscoSecure ACS v3.3\Utils\System Back up\CRL Reg.RDF not received, skipping.. Done C:\Program Files\CiscoSecure ACS v3.3\Utils>
Creating a Dump Text File
A dump text file contains only the user and group information. This is useful for troubleshooting user profile issues. Cisco support may be able to load a dump file from your dump file to view user configuration to troubleshoot any possible configuration issue. Before creating a dump file, you need to manually stop the CSAuth service with the following command:
C:\> net stop CSAuth
Note that no user authentication takes place while the service is stopped. You must start the service manually with net start CSAuth once you are finished creating the dump. Command syntax to create dump file is as follows:
csutil –d filename
Example 13-15 shows a sample run of the creation of a dump file.
Example 13-15 A Sample Run of Dump Text File Creation
C:\Program Files\CiscoSecure ACS v3.3\Utils>net stop CSAuth The CSAuth service is stopping. The CSAuth service was stopped successfully. C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -d dump.txt CSUtil v3.3(2.2), Copyright 1997-2004, Cisco Systems Inc Done C:\Program Files\CiscoSecure ACS v3.3\Utils>
To load the dump file into CS ACS, first stop the CSAuth service, which means that user authentication will be stopped during that time. Loading a dump file will replace existing data. You can use the -p option to reset password aging counters. The syntax to use for loading the dump file is as follows:
csutil –p –l filename
Example 13-16 shows a sample run of a creation of a dump.txt file.
Example 13-16 Sample Run of Dump.txt File Creation
C:\Program Files\CiscoSecure ACS v3.3\Utils>net stop CSAuth The CSAuth service is stopping. The CSAuth service was stopped successfully. C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -p -l dump.txt CSUtil v3.3(2.2), Copyright 1997-2004, Cisco Systems Inc Loading a database dump file will overwrite the existing database. Are you sure you want to proceed? (Y or N)Y Initializing database... Loading database from file... Password aging counters will be reset Done C:\Program Files\CiscoSecure ACS v3.3\Utils>