Leave a reply

Part 0: Multi-Master Kerberos Server with OpenLDAP Backend – Installer

Some months ago, I started to play around with OpenLDAP and Kerberos. At the beginning of my LDAP adventure, I often messed up my installation, so I ended up reinstalling everything and had to start again from scratch.

To make my life a little bit easier, I wrote a simple bash script to do the package installing in order to make the necessary changes to the config files only to the last ‘save’ point. Over the time, I added a lot of stuff and features and so the script started to accumulate. In retrospect, if I started again from the beginning, I would now use something more appropriated than bash.

Anyway, the script installs a “Multi-Master Kerberos Server with a LDAP Backend”.

Please follow the steps to try out the script on a current ubuntu or debian system (ubuntu 17.10 or debian 8). I would recommend to use a fresh system in a virtual machine.

There are some more things I will explain in further posts, once I will have the time which I do not have currently. Soooo, if you have specific questions about the script or ideas for improvement, please leave me a comment.

Disclaimer: Feel free to use this script at your own charge, I cannot be held responsible for what YOU do on YOUR administered system.

  1. Download the two files:
  2. Use md5 to check the data integrity of the downloaded file:
    user@yourbox:~$ md5sum -c LDAPX-0.18.4.tar.gz.md5
  3. Extract the file with tar:
    user@yourbox:~$ tar -zxvf LDAPX-0.18.4.tar.gz
  4. Change in the directory LDAPX:
    user@yourbox:~$ cd LDAPX
  5. Add the fully qualified domain name of the server(s) to the variable ‘LIST_OF_ALL_LDAP_MASTERS’ in ‘conf/ldapx.main.conf‘. (Only necessary if you want more then one master server.)
    • Optional step: Change the password of the ldap admin (_LDAP_ADMIN_PW), the gpg password file (_GPG_FILE_PW) and the gpg user password file (_GPG_FILE_PW_USER)
      (Leave it blank to enter them during the installation)
  6. Optional step: In the file ‘conf/ldapx.tls.conf’ change the values of TLS_CA_LOCALITY/TLS_CA_STATE/TLS_CA_COUNTRYCODE/
  7. Become root with the command:
    user@yourbox:~$ sudo su
  8. Important: Add the fully qualified domain name of the server(s) to ‘/etc/hosts‘.
    127.0.0.1       localhost
    #127.0.1.1       yourbox.domain.name yourbox
    10.0.0.1        yourbox.domain.name yourbox
  9. Make the two scripts executable with:
    root@yourbox:/home/user/LDAPX# chmod +x installLDAPX.sh
    and
    root@yourbox:/home/user/LDAPX# chmod +x setupLDAPX.sh
  10. Run the script:
    root@yourbox:/home/user/LDAPX# ./setupLDAPX.sh
  11. Start the installation process with the menu item ‘Install first master server’
  12. You can find some more information in the file: ‘backup/ldapx.info
  13. Test the setup:
    • kinit
      1. Use kinit to request a kerberos ticket:
        root@yourbox:/home/user/LDAPX# kinit doejo
      2. The default password for user doejo is ‘winter2014#’
      3. Use klist to list your cached Kerberos ticket.
    • ssh
      1. ssh to yourbox with:
        ssh doejo@yourbox
      2. Use your new password or ‘winter2014#’ if you did not change it above.
      3. Use klist to list your cached Kerberos ticket.
      4. Try to become root with doejo@yourbox:~# sudo su –

Leave a reply

Xen LDAP Schema

For a small project I needed an ldap schema to map the structure of virtual machines in an LDAP directory tree. As far as I know, there is no xen-ldap-scheme out there, so I created one myself. Although it is at an early stage, someone may be interested in using and improving it.

xenX.schema (0.4.4)
###############################################################################
# XEN LDAP schema.                                                            #
#   This Schema provides objects and attributes to manage xen based vms       #
#   inside a ldap server                                                      #
#                                                                             #
# Copyright (C) 2018 Thorsten Seeger                                          #
#                                                                             #
# Version 0.4.4                                                               #
#                                                                             #
# *Works in progress*    Contents of this file are subject to                 #
#                        change (including deletion) without notice.          #
#                        Not recommended for production use!                  #
#                        Use with extreme caution!                            #
#                                                                             #
#    This program is free software: you can redistribute it and/or modify     #
#    it under the terms of the GNU General Public License as published by     #
#    the Free Software Foundation, either version 3 of the License, or        #
#    (at your option) any later version.                                      #
#                                                                             #
#    This program is distributed in the hope that it will be useful,          #
#    but WITHOUT ANY WARRANTY; without even the implied warranty of           #
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
#    GNU General Public License for more details.                             #
#                                                                             #
#    You should have received a copy of the GNU General Public License        #
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.    #
#                                                                             #
###############################################################################
#
#
# Main OID: 1.3.6.1.4.1.44080         TNTNET        (Creation date: 2014/06/17)
# Sub  OID: .111
#
# OID Tree:
#   .111
#     |__.5 attributes
#     |   |
#     |   |___.1
#     |   |
#     |   |___.2 Mandatory configuration items
#     |   |
#     |   |___.3 Cpu
#     |   |
#     |   |___.4 Memory
#     |   |
#     |   |___.5 Event actions
#     |   |
#     |   |___.6 Other Options
#     |   |
#     |   |___.7 Pci
#     |   |
#     |   |___.8 PV guest options
#     |   |
#     |   |___.9 HVM guest options
#     |   |
#     |   |__.10 PVH guest options
#     |   |
#     |   |__.11 Paravirtualisation of HVM Guests
#     |   |
#     |   |__.12 Emulated VGA Graphics Device
#     |   |
#     |   |__.13 VNC
#     |   |
#     |   |__.14 SDL
#     |   |
#     |   |__.15 Spice Graphics Support
#     |   |
#     |   |__.16 NUMA
#     |   |
#     |   |__.17 Miscellaneous Emulated Hardware
#     |   |
#     |   |__.18 Device-Model Options
#     |   |
#     |   |__.19 Vif - Network Configuration
#     |   |
#     |   |__.20 Vbd - Disk Configuration
#     |   |
#     |   |__.21 Vtpm
#     |   |
#     |   |__.22 p9
#     |   |
#     |   |__.23 Channel
#     |   |
#     |   |__.24 Vdispl - Virtual display devices
#     |   |
#     |   |__.25 Reserved Device Memory (RDM)
#     |   |
#     |   |__.26 USB controller (usbctrl)
#     |   |
#     |   |__.27 USB
#     |   |
#     |   |__.28 Architecture Specific options
#     |   |
#     |   |__.30 Cpupool Configuration
#     |
#     |__.1 STRUCTURAL objectclass
#     |
#     |__.2 STRUCTURAL objectclass Virtual Devices
#     |
#     |__.3 AUXILIARY
#
###############################################################################


###############################################################################
# 1.3.6.1.4.1.44080.111.5.1.XX
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.1.1
    NAME 'xenBackend'
    DESC 'backend'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

#attributetype ( 1.3.6.1.4.1.44080.111.5.1.2
#    NAME 'xenDevid'
#    DESC 'devid'
#    EQUALITY integerMatch
#    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
#    SINGLE-VALUE
# )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.2.XX -- Mandatory configuration items
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.2.1
    NAME 'xenName'
    DESC 'name'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.2.2
    NAME 'xenUUID'
    DESC 'uuid'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

# The builder option is being deprecated in favor of the type option.
#attributetype ( 1.3.6.1.4.1.44080.111.5.2.3
#    NAME 'xenBuilder'
#    DESC 'builder'
#    EQUALITY caseIgnoreMatch
#    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
#    SINGLE-VALUE
# )

attributetype ( 1.3.6.1.4.1.44080.111.5.2.4
    NAME 'xenType'
    DESC 'type'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.3.XX - CPU
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.3.1
    NAME 'xenCpuPool'
    DESC 'pool'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.3.2
    NAME 'xenVcpus'
    DESC 'vcpus'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.3.3
    NAME 'xenMaxvcpus'
    DESC 'maxvcpus'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.3.4
    NAME 'xenCpus'
    DESC 'cpus'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.3.5
    NAME 'xenCpusSoft'
    DESC 'cpus_soft'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.3.6
    NAME 'xenCpuWeight'
    DESC 'cpu_weight'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.3.7
    NAME 'xenCap'
    DESC 'cap'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.3.8
    NAME 'xenSched'
    DESC 'cpu scheduler'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.4.XX - Memory
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.4.1
    NAME 'xenMemory'
    DESC 'memory'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.4.2
    NAME 'xenMaxmem'
    DESC 'maxmem'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.5.XX - Event Actions
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.5.1
    NAME 'xenOnPoweroff'
    DESC 'on_poweroff'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.5.2
    NAME 'xenOnReboot'
    DESC 'on_reboot'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.5.3
    NAME 'xenOnWatchdog'
    DESC 'on_watchdog'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.5.4
    NAME 'xenOnCrash'
    DESC 'on_crash'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.5.5
    NAME 'xenOnSoftReset'
    DESC 'on_soft_reset'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.6.XX - Other Options
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.6.1
    NAME 'xenSeclabel'
    DESC 'seclabel'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.6.2
    NAME 'xenInitSeclabel'
    DESC 'init_seclabel'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.6.3
    NAME 'xenMaxGrantFrames'
    DESC 'max_grant_frames'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )
 
attributetype ( 1.3.6.1.4.1.44080.111.5.6.4
    NAME 'xenMaxMaptrackFrames'
    DESC 'max_maptrack_frames'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.6.5
    NAME 'xenNoMigrate'
    DESC 'nomigrate'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.6.6
    NAME 'xenDriverDomain'
    DESC 'driver_domain'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.6.7
    NAME 'xenDeviceTree'
    DESC 'device_tree'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.6.8
    NAME 'xenFirmware'
    DESC 'firmware'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.7.XX - PCI
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.7.1
    NAME 'xenPciIdentifier'
    DESC 'Identifies the PCI device from the host perspective in the domain.'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.2
    NAME 'xenPciVSLOT'
    DESC 'Specifies the virtual slot where the guest will see this device'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.3
    NAME 'xenPciPermissive'
    DESC 'permissive & pci_permissive'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.4
    NAME 'xenPciMsitranslate'
    DESC 'msitranslate & pci_msitranslate'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.5
    NAME 'xenPciSeize'
    DESC 'size & pci_seize'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.6
    NAME 'xenPciPowerMgmt'
    DESC 'power_mgmt & pci_power_mgmt'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.7
    NAME 'xenGfxPassthru'
    DESC 'gfx_passthru'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.8
    NAME 'xenIoports'
    DESC 'ioports'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.9
    NAME 'xenIomem'
    DESC 'iomem'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.10
    NAME 'xenIrgs'
    DESC 'irgs'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.11
    NAME 'xenMaxEventChannels'
    DESC 'max_event_channels'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.12
    NAME 'xenE820Host'
    DESC 'e820_host'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.13
    NAME 'xenDtdev'
    DESC 'dtdev'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.7.14
    NAME 'xenDMrestrict'
    DESC 'dm_restrict'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.8.XX - PV guest options
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.8.1
    NAME 'xenKernel'
    DESC 'kernel'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.8.2
    NAME 'xenRamdisk'
    DESC 'ramdisk'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.8.3
    NAME 'xenCmdline'
    DESC 'cmdline'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.8.4
    NAME 'xenRoot'
    DESC 'root'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.8.5
    NAME 'xenExtra'
    DESC 'extra'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.8.6
    NAME 'xenBootloader'
    DESC 'bootloader'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.8.7
    NAME 'xenBootloaderArgs'
    DESC 'bootloader_args'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.9.XX - HVM guest options
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.9.1
    NAME 'xenBoot'
    DESC 'boot'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.2
    NAME 'xenHap'
    DESC 'hap'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.3
    NAME 'xenOos'
    DESC 'oos'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.4
    NAME 'xenShadowMemory'
    DESC 'shadow_memory'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.5
    NAME 'xenBios'
    DESC 'bios'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.6
    NAME 'xenBiosPathOverride'
    DESC 'bios_path_override'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.7
    NAME 'xenPae'
    DESC 'pae'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.8
    NAME 'xenAcpi'
    DESC 'acpi'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.9
    NAME 'xenAcpiS3'
    DESC 'acpi_s3'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.10
    NAME 'xenAcpiS4'
    DESC 'acpi_s4'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.11
    NAME 'xenAcpiLaptopSlate'
    DESC 'acpi_laptop_slate'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.12
    NAME 'xenApic'
    DESC 'apic'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.13
    NAME 'xenNx'
    DESC 'nx'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.14
    NAME 'xenHpet'
    DESC 'hpet'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.15
    NAME 'xenNestedhvm'
    DESC 'nestedhvm'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.16
    NAME 'xenCpuid'
    DESC 'cpuid'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.17
    NAME 'xenAcpiFirmware'
    DESC 'acpi_firmware'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.18
    NAME 'xenSmbiosFirmware'
    DESC 'smbios_firmware'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.19
    NAME 'xenTscMode'
    DESC 'tsc_mode'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.20
    NAME 'xenlocaltime'
    DESC 'localtime'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.21
    NAME 'xenRtcTimeoffset'
    DESC 'rtc_timeoffset'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.22
    NAME 'xenVptAlign'
    DESC 'vpt_align'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.23
    NAME 'xenTimerMode'
    DESC 'timer_mode'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.24
    NAME 'xenHdtype'
    DESC 'hdtype'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.25
    NAME 'xenAltp2m'
    DESC 'altp2m'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.26
    NAME 'xenMsVmGenid'
    DESC 'ms_vm_genid'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.9.27
    NAME 'xenMmioHole'
    DESC 'mmio_hole'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.10.XX - PVH guest options
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.10.1
    NAME 'xenPvshim'
    DESC 'pvshim'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.10.2
    NAME 'xenPvshimPath'
    DESC 'pvshim_path'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.10.3
    NAME 'xenPvshimCmdline'
    DESC 'pvshim_cmdline'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.10.4
    NAME 'xenPvshimExtra'
    DESC 'pvshim_extra'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.11.XX - Paravirtualisation of HVM Guests
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.11.1
    NAME 'xenPlatformPci'
    DESC 'xen_platform_pci'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.11.2
    NAME 'xenViridian'
    DESC 'viridian'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.11.3
    NAME 'xenViridianEnable'
    DESC 'viridian_enable'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.11.4
    NAME 'xenViridianDisable'
    DESC 'viridian_disable'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.11.5
    NAME 'xenVideoram'
    DESC 'videoram'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

# This option is deprecated, use vga="stdvga" instead.
attributetype ( 1.3.6.1.4.1.44080.111.5.11.6
    NAME 'xenStdvga'
    DESC 'stdvga - This option is deprecated, use vga="stdvga" instead.'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.11.7
    NAME 'xenVga'
    DESC 'vga'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.11.8
    NAME 'xenKeymap'
    DESC 'keymap'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.11.9
    NAME 'xenNographic'
    DESC 'nographic'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.13.XX
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.13.1
    NAME 'xenVnc'
    DESC 'vnc'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.13.3
    NAME 'xenVnclisten'
    DESC 'vnclisten'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.13.4
    NAME 'xenVncdisplay'
    DESC 'vncdisplay'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.13.5
    NAME 'xenVncunused'
    DESC 'vncunused'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.13.6
    NAME 'xenVncpasswd'
    DESC 'vncpasswd'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.13.7
    NAME 'xenVfbDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.14.XX - SDL
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.14.1
    NAME 'xenSdl'
    DESC 'sdl'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

 attributetype ( 1.3.6.1.4.1.44080.111.5.14.2
    NAME 'xenSdldisplay'
    DESC 'display'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.14.3
    NAME 'xenSdlxauthority'
    DESC 'xauthority'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.14.4
    NAME 'xenSdlopengl'
    DESC 'opengl'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.15.XX - Spice Graphics Support
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.15.1
    NAME 'xenSpice'
    DESC 'spice'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.2
    NAME 'xenSpicehost'
    DESC 'spicehost'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.3
    NAME 'xenSpicePort'
    DESC 'spiceport'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.4
    NAME 'xenSpicetlsPort'
    DESC 'spicetls_port'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.5
    NAME 'xenSpicedisableTicketing'
    DESC 'spicedisable_ticketing'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.6
    NAME 'xenSpicepasswd'
    DESC 'spicepasswd'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.7
    NAME 'xenSpiceagentMouse'
    DESC 'spiceagent_mouse'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.8
    NAME 'xenSpicevdagent'
    DESC 'spicevdagent'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.9
    NAME 'xenSpiceClipboardSharing'
    DESC 'spice_clipboard_sharing'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.10
    NAME 'xenSpiceusbredirection'
    DESC 'spiceusbredirection'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.11
    NAME 'xenSpiceImageCompression'
    DESC 'spice_image_compression'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.15.12
    NAME 'xenSpiceStreamingVideo'
    DESC 'spice_streaming_video'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.16.XX - Numa
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.16.1
    NAME 'xenVnumaDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.16.2
    NAME 'xenNumaPlacement'
    DESC 'numa_placement'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.16.3
    NAME 'xenVnumaPnode'
    DESC 'pnode'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.16.4
    NAME 'xenVnumaSize'
    DESC 'size'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.16.5
    NAME 'xenVnumaVcpus'
    DESC 'vcpus'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.16.6
    NAME 'xenVnumaVdistances'
    DESC 'vdistances'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.17.XX - Miscellaneous Emulated Hardware
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.17.1
    NAME 'xenSerial'
    DESC 'serial'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.17.2
    NAME 'xenSoundhw'
    DESC 'soundhw'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.17.3
    NAME 'xenVendorDevice'
    DESC 'vendor_device'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.18.XX - Device-Model Options
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.18.1
    NAME 'xenDeviceModelVersion'
    DESC 'device_model_version'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.18.2
    NAME 'xenDeviceModelOverride'
    DESC 'device_model_override'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.18.3
    NAME 'xenDeviceModelStubdomainOverride'
    DESC 'device_model_stubdomain_override'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.18.4
    NAME 'xenDeviceModelStubdomainSeclabel'
    DESC 'device_model_stubdomain_seclabel'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.18.5
    NAME 'xenDeviceModelArgs'
    DESC 'device_model_args'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.18.6
    NAME 'xenDeviceModelArgsPv'
    DESC 'device_model_args_pv'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.18.7
    NAME 'xenDeviceModelArgsHvm'
    DESC 'device_model_args_hvm'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.19.XX - Vif
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.19.1
    NAME 'xenVifDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.2
    NAME 'xenVifMac'
    DESC 'mac'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.3
    NAME 'xenVifBridge'
    DESC 'bridge'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.4
    NAME 'xenVifGatewaydev'
    DESC 'gatewaydev'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.5
    NAME 'xenVifType'
    DESC 'type'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.6
    NAME 'xenVifModel'
    DESC 'model'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.7
    NAME 'xenVifname'
    DESC 'vifname'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.8
    NAME 'xenVifScript'
    DESC 'script'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.9
    NAME 'xenVifIp'
    DESC 'ip'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.10
    NAME 'xenVifRate'
    DESC 'rate'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.11
    NAME 'xenVifRateBytesPerInterval'
    DESC 'rate_bytes_per_interval'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.19.12
    NAME 'xenVifRateIntervalUsecs'
    DESC 'rate_interval_usecs'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.20.XX - Vbd
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.20.1
    NAME 'xenDiskTarget'
    DESC 'target'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.2
    NAME 'xenDiskFormat'
    DESC 'format'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.3
    NAME 'xenDiskVdev'
    DESC 'vdev'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.4
    NAME 'xenDiskAccess'
    DESC 'access'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.5
    NAME 'xenDiskDevtype'
    DESC 'devtype'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.6
    NAME 'xenBackendtype'
    DESC 'backendtype'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.7
    NAME 'xenDiskScript'
    DESC 'script'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.8
    NAME 'xenDiskDirectIoSafe'
    DESC 'direct-io-safe'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.20.9
    NAME 'xenDiskDiscard'
    DESC 'discard'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.21.XX - Vtpm
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.21.1
    NAME 'xenVtpmDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.21.2
    NAME 'xenVtpmUUID'
    DESC 'uuid'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.22.XX - p9
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.22.1
    NAME 'xenP9Devid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.22.2
    NAME 'xenP9Tag'
    DESC 'tag'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.22.3
    NAME 'xenP9SecurityModel'
    DESC 'security_model'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.22.4
    NAME 'xenP9Path'
    DESC 'path'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.23.XX - Channel
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.23.1
    NAME 'xenChannelDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.23.2
    NAME 'xenChannelName'
    DESC 'name'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.23.3
    NAME 'xenChannelConnection'
    DESC 'connection'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.24.XX - Virtual display devices (vdispl)
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.24.1
    NAME 'xenVdisplDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.24.2
    NAME 'xenVdisplBeAlloc'
    DESC 'be-alloc'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.24.3
    NAME 'xenVdisplConnectors'
    DESC 'connectors'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.25.XX - Reserved Device Memory (RDM)
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.25.1
    NAME 'xenRdmStrategy'
    DESC 'strategy'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.25.2
    NAME 'xenRdmPolicy'
    DESC 'rdm_policy'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.25.3
    NAME 'xenRdmMemBoundary'
    DESC 'rdm_mem_boundary'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.26.XX - USB controller (usbctrl)
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.26.1
    NAME 'xenUsbctrlDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.26.2
    NAME 'xenUsbctrlType'
    DESC 'type'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.26.3
    NAME 'xenUsbctrlVersion'
    DESC 'version'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.26.4
    NAME 'xenUsbctrlPorts'
    DESC 'ports'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    SINGLE-VALUE
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.27.XX - USB
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.27.1
    NAME 'xenUsb'
    DESC 'usb'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.27.2
    NAME 'xenUsbVersion'
    DESC 'usbversion'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.27.3
    NAME 'xenUsbDevice'
    DESC 'usbdevice'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

 attributetype ( 1.3.6.1.4.1.44080.111.5.27.4
    NAME 'xenUsbdevDevid'
    DESC 'devid'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
    SINGLE-VALUE
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.27.5
    NAME 'xenUsbdevType'
    DESC 'devtype'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.27.6
    NAME 'xenUsbdevHostbus'
    DESC 'hostbus'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.27.7
    NAME 'xenUsbdevHostaddr'
    DESC 'hostaddr'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.27.8
    NAME 'xenUsbdevController'
    DESC 'controller'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.27.9
    NAME 'xenUsbdevPort'
    DESC 'port'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.28.XX - Architecture Specific options
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.28.1
    NAME 'xenGicVersion'
    DESC 'gic_version'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.28.2
    NAME 'xenVuart'
    DESC 'vuart'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.28.3
    NAME 'xenMcaCaps'
    DESC 'mca_caps'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )


###############################################################################
# 1.3.6.1.4.1.44080.111.5.30.XX - Cpupool Configuration
###############################################################################

attributetype ( 1.3.6.1.4.1.44080.111.5.30.1
    NAME 'xenCpuPoolName'
    DESC 'name'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

 attributetype ( 1.3.6.1.4.1.44080.111.5.30.2
    NAME 'xenCpuPoolSched'
    DESC 'sched'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.30.3
    NAME 'xenCpuPoolNodes'
    DESC 'nodes'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )

attributetype ( 1.3.6.1.4.1.44080.111.5.30.4
    NAME 'xenCpuPoolCpus'
    DESC 'cpus'
    EQUALITY caseIgnoreMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
 )


###############################################################################
# Objectclasses
###############################################################################

###############################################################################
# 1.3.6.1.4.1.44080.111.1.XX
###############################################################################

objectclass ( 1.3.6.1.4.1.44080.111.1.1
    NAME 'xenDomU'
    DESC 'Define the domU'
    SUP top
    STRUCTURAL
    MUST ( xenName )
    MAY ( xenMemory $
          xenMaxmem $
          xenUUID $
          xenRdmMemBoundary $
          xenKernel $
          xenFirmware $
          xenBootloader $
          xenBootloaderArgs $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.1.2
    NAME 'xenDomuPv'
    DESC 'Define the pv guest'
    SUP xenDomU
    STRUCTURAL
    MUST ( xenType )
    MAY ( xenRamdisk $
          xenCmdline $
          xenRoot $
          xenExtra $
          xenE820Host )
 )

objectclass ( 1.3.6.1.4.1.44080.111.1.3
    NAME 'xenDomuHvm'
    DESC 'Define the hvm guest'
    SUP xenDomU
    STRUCTURAL
    MUST ( xenType )
    MAY ( xenBoot $
          xenHdtype $
          xenMmioHole )
 )

# TODO
# Currently there's no firmware available for PVH guests
objectclass ( 1.3.6.1.4.1.44080.111.1.4
    NAME 'xenDomuPvh'
    DESC 'Define the pvh guest'
    SUP xenDomuPv
    STRUCTURAL
    MUST ( xenType )
    MAY ( xenPvshim $
          xenPvshimPath $
          xenPvshimCmdline $
          xenPvshimExtra )
 )

objectclass ( 1.3.6.1.4.1.44080.111.1.6
    NAME 'xenDomuStub'
    DESC 'Define stub domain'
    SUP xenDomU
    STRUCTURAL
    MAY ( xenIomem $ xenExtra )
 )

objectclass ( 1.3.6.1.4.1.44080.111.1.7
    NAME 'xenDomuvTPM'
    DESC 'Define TPM Stub domain'
    SUP xenDomU
    STRUCTURAL
    MAY ( xenIomem )
 )

###############################################################################
# 1.3.6.1.4.1.44080.111.2.XX
###############################################################################

objectclass ( 1.3.6.1.4.1.44080.111.2.1
    NAME 'xenDeviceVif'
    DESC 'Virtual Network Interface'
    SUP top
    STRUCTURAL
    MUST xenVifDevid
    MAY ( xenBackend $
          xenVifBridge $
          xenVifGatewaydev $
          xenVifIp $
          xenVifMac $
          xenVifModel $
          xenVifname $
          xenVifScript $
          xenVifType $
          xenVifRate $
          xenVifRateBytesPerInterval $
          xenVifRateIntervalUsecs $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.2
    NAME 'xenDeviceDisk'
    DESC 'Virtual Disk'
    SUP top
    STRUCTURAL
    MUST xenDiskVdev
    MAY ( cn $
          xenDiskTarget $
          xenDiskAccess $
          xenDiskScript $
          xenDiskDevtype $
          xenBackend $
          xenBackendtype $
          xenDiskDirectIoSafe $
          xenDiskDiscard $
          xenDiskFormat $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.3
    NAME 'xenDevicePci'
    DESC 'PCI Passthrough Device'
    SUP top
    STRUCTURAL
    MUST xenPciIdentifier
    MAY ( cn $
          xenPciMsitranslate $
          xenPciPermissive $
          xenPciPowerMgmt $
          xenPciSeize $
          xenPciVSLOT $
          xenRdmPolicy $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.4
    NAME 'xenDeviceVtpm'
    DESC 'VTPM Device'
    SUP top
    STRUCTURAL
    MUST ( xenVtpmDevid $
           xenBackend )
    MAY ( cn $
          xenVtpmUUID $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.5
    NAME 'xenDeviceVfb'
    DESC 'The paravirtual framebuffer devices'
    SUP top
    STRUCTURAL
    MUST xenVfbDevid
    MAY ( cn $
          xenVnc $
          xenVncdisplay $
          xenVnclisten $
          xenVncpasswd $
          xenVncunused $
          xenSdl $
          xenSdldisplay $
          xenSdlxauthority $
          xenSdlopengl $
          xenKeymap $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.6
    NAME 'xenDeviceVnuma'
    DESC 'Virtual NUMA Configuration'
    SUP top
    STRUCTURAL
    MUST ( xenVnumaDevid $
           xenVnumaPnode $
           xenVnumaSize $
           xenVnumaVcpus $
           xenVnumaVdistances )
    MAY ( cn $ description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.7
    NAME 'xenDeviceP9'
    DESC 'Creates a Xen 9pfs connection to share a filesystem from the backend to the frontend.'
    SUP top
    STRUCTURAL
    MUST ( xenP9Devid $
           xenP9Tag $
           xenP9Path )
    MAY ( cn $ 
          xenBackend $
           xenP9SecurityModel $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.8
    NAME 'xenDeviceChannel'
    DESC 'Specifies the virtual channels to be provided to the guest.'
    SUP top
    STRUCTURAL
    MUST ( xenChannelDevid $
           xenChannelName )
    MAY ( cn $
          xenChannelConnection $
          xenBackend $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.9
    NAME 'xenDeviceVdispl'
    DESC 'Specifies the virtual display devices to be provided to the guest.'
    SUP top
    STRUCTURAL
    MUST ( xenVdisplDevid $
           xenVdisplConnectors )
    MAY ( cn $ 
          xenVdisplBeAlloc $
          xenBackend $
          description )
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.10
    NAME 'xenDeviceUsbdev'
    DESC 'Specifies the USB devices to be attached to the guest at boot.'
    SUP top
    STRUCTURAL
    MUST ( xenUsbdevDevid $
          xenUsbdevType $
          xenUsbdevHostbus $
          xenUsbdevHostaddr )
    MAY ( xenUsbdevController $
          xenUsbdevPort $
          description $
          cn)
 )

objectclass ( 1.3.6.1.4.1.44080.111.2.11
    NAME 'xenDeviceUsbctrl'
    DESC 'Specifies the USB controllers created for this guest.'
    SUP top
    STRUCTURAL
    MUST ( xenUsbctrlDevid )
    MAY ( xenUsbctrlType $
          xenUsbctrlVersion $
          xenUsbctrlPorts $
          xenBackend $
          description $
          cn )
 )


###############################################################################

objectclass ( 1.3.6.1.4.1.44080.111.2.20
    NAME 'xenCpuPool'
    DESC 'XL Cpupool Configuration objectclass'
    SUP top
    STRUCTURAL
    MUST ( xenCpuPoolName )
    MAY ( cn $
          xenCpuPoolSched $
          xenCpuPoolNodes $
          xenCpuPoolCpus )
 )

###############################################################################
# 1.3.6.1.4.1.44080.111.3.XX
###############################################################################

objectclass ( 1.3.6.1.4.1.44080.111.3.1
    NAME 'xenAuxSpice'
    DESC 'Spice Graphics Support'
    SUP top
    AUXILIARY
    MUST ( xenSpice )
    MAY ( xenSpiceagentMouse $
          xenSpiceClipboardSharing $
          xenSpicedisableTicketing $
          xenSpicehost $
          xenSpicepasswd $
          xenSpicetlsPort $
          xenSpicePort $
          xenSpiceusbredirection $
          xenSpicevdagent $
          xenSpiceImageCompression $
          xenSpiceStreamingVideo )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.2
    NAME 'xenAuxUsb'
    DESC 'Emulated USB bus'
    AUXILIARY
    MUST ( xenUsb )
    MAY ( xenUsbVersion $
          xenUsbDevice )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.4
    NAME 'xenAuxPci'
    DESC 'Global PCI device options'
    AUXILIARY
    MAY ( xenPciPermissive $
          xenPciMsitranslate $
          xenPciPowerMgmt $
          xenPciSeize $
          xenGfxPassthru $
          xenIomem $
          xenIoports $
          xenIrgs $
          xenMaxEventChannels $
          xenDtdev $
          xenDMrestrict $
          xenRdmMemBoundary )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.5
    NAME 'xenAuxCpu'
    DESC 'CPU Allocation & CPU Scheduling'
    AUXILIARY
    MAY ( xenCpuid $
          xenCpuWeight $
          xenCpusSoft $
          xenCap $
          xenSched $
          xenVcpus $
          xenMaxvcpus $
          xenCpus $
          xenCpuPool $
          xenNumaPlacement )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.6
    NAME 'xenAuxProcessorAndPlatform'
    DESC 'Processor and Platform Features'
    AUXILIARY
    MAY ( xenBios $
          xenBiosPathOverride $
          xenPae $
          xenAcpi $
          xenAcpiS3 $
          xenAcpiS4 $
          xenAcpiLaptopSlate $
          xenApic $
          xenNx $
          xenHpet $
          xenNestedhvm $
          xenAcpiFirmware $
          xenSmbiosFirmware )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.7
    NAME 'xenAuxDeviceModel'
    DESC 'Device-Model Options'
    AUXILIARY
    MAY ( xenDeviceModelArgs $
          xenDeviceModelArgsHvm $
          xenDeviceModelArgsPv $
          xenDeviceModelOverride $
          xenDeviceModelStubdomainOverride $
          xenDeviceModelStubdomainSeclabel $
          xenDeviceModelVersion )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.8
    NAME 'xenAuxHvmTime'
    DESC 'Guest Virtual Time Controls'
    AUXILIARY
    MAY ( xenTscMode $
          xenRtcTimeoffset $
          xenVptAlign $
          xenTimerMode $
          xenlocaltime )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.9
    NAME 'xenAuxHvmMisc'
    DESC 'Miscellaneous Emulated Hardware'
    AUXILIARY
    MAY ( xenSerial $
          xenSoundhw $
          xenVendorDevice )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.10
    NAME 'xenAuxHvmPaging'
    DESC 'Paging'
    AUXILIARY
    MAY ( xenHap $
          xenOos $
          xenShadowMemory )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.11
    NAME 'xenAuxEventActions'
    DESC 'Event Actions'
    AUXILIARY
    MAY ( xenOnCrash $
          xenOnPoweroff $
          xenOnWatchdog $
          xenOnReboot $
          xenOnSoftReset )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.12
    NAME 'xenAuxGraphics'
    DESC 'Emulated VGA Graphics Device'
    AUXILIARY
    MAY ( xenVga $
          xenVideoram $
          xenKeymap $
          xenNographic $
          xenStdvga $
          xenSdl $
          xenSdldisplay $
          xenSdlxauthority $
          xenSdlopengl $
          xenVnc $
          xenVncdisplay $
          xenVnclisten $
          xenVncpasswd $
          xenVncunused )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.13
    NAME 'xenAuxAdditional'
    DESC 'Other Options'
    AUXILIARY
    MAY ( xenNoMigrate $
          xenDriverDomain $
          xenSeclabel $
          xenInitSeclabel $
          xenMaxMaptrackFrames $
          xenMaxGrantFrames $
          xenDeviceTree $
          xenAltp2m )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.14
    NAME 'xenAuxArchSpecificOptions'
    DESC 'Architecture Specific options'
    AUXILIARY
    MAY ( xenVuart $
         xenGicVersion $
         xenMcaCaps )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.15
    NAME 'xenAuxMsSpecificOptions'
    DESC 'Adds Microsoft special options to the guest'
    AUXILIARY
    MAY ( xenMsVmGenid )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.16
    NAME 'xenAuxDirectBoot'
    DESC 'Direct Kernel Boot Options'
    AUXILIARY
    MAY ( xenRamdisk $
          xenCmdline $
          xenRoot $
          xenExtra )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.17
    NAME 'xenDeviceRdm'
    DESC 'Specifies information about Reserved Device Memory.'
    AUXILIARY
    MAY ( xenRdmStrategy $
          xenRdmPolicy )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.20
    NAME 'xenAuxPvOnHvm'
    DESC 'Support for Paravirtualisation of HVM Guests'
    AUXILIARY
    MAY ( xenViridian $
          xenViridianEnable $
          xenViridianDisable $
          xenPlatformPci )
 )

objectclass ( 1.3.6.1.4.1.44080.111.3.21
    NAME 'xenAuxPvGuest'
    DESC 'Paravirtualised (PV) Guest Specific Options'
    AUXILIARY
    MAY ( xenE820Host )
 )

 


Leave a reply

SSH key exchange between two linux systems

If you work with several different *nix hosts, you will often have to jump from one to another and you have to enter your passwords all over again. Well, there is an easy way to avoid this and at the same time to add some more security to the setup. To be honest, there is more than just one way, but right now we are going to look at the public key authentication method to make a ssh login without password possible. We will create a pair of rsa keys as a normal user and transfer the public key to one of our boxes. At the end we will look at the difference between a normal and root user and what we need to establish a ssh login without password for root.
Suggestion before we start: It is possible to secure the private key with a password. This adds more security but the trade-off is that you need to enter the key password before log-on.


Example: To demonstrate how to use the above mentioned, we create a pair of keys for the user myuser on the host0815 to establish a ssh login without a password to host host5180. The user myuser exists on both host systems. The standard ssh port 22 is used by default, if you want to use another port you can change it with the ‘-p‘ switch (e.g. if the ssh daemon listens on port 2222 use: ssh –p 2222 myuser@host5180). Remember, if you operate on a remote computer which is not easy to reach, I would recommend to always run a second ssh connection in another terminal session.

  1. In order to create the ssh keys, login to host0815 and create the ‘~/.ssh’ directory with the command mkdir -p ~/.ssh and with the command chmod 700 ~/.ssh, we restrict the access to the directory to only your user myuser. After this, execute the ssh-keygen command ssh-keygen -t rsa -b 2048. With the ‘–b’ switch it is possible to specify the number of bits in the key (e.g. –b 4096). You can enter a password to secure your key or just press enter twice to leave the key “unprotected”. ssh can either use “RSA” (Rivest-Shamir-Adleman) or “DSA” (“Digital Signature Algorithm”) keys. RSA is often considered the recommended choice for new keys and it is selected by default (OpenSSH 7.0 and greater disable the DSA public key algorithm).
    myuser@host0815:/# mkdir -p ~/.ssh
    myuser@host0815:/# chmod 700 ~/.ssh
    myuser@host0815:/# ssh-keygen -t rsa -b 2048
    Generating public/private rsa key pair.
    Enter file in which to save the key (/home/myuser/.ssh/id_rsa):
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /home/myuser/.ssh/id_rsa.
    Your public key has been saved in /home/myuser/.ssh/id_rsa.pub.
    The key fingerprint is:
    SHA256:1VTYUA+D+7s58s4lGj4nss2sSgxTkSIH5oGOiJ1QcGU myuser@host0815
    The key's randomart image is:
    +---[RSA 2048]----+
    |.oooE.  ..  oB=  |
    |...+..o .. oo .+ |
    |o= ..o .. . ..  .|
    |+ +    . .  .    |
    |      o S    .   |
    |       +      .  |
    |        o   . ...|
    |       .  .=++++ |
    |        ..o+*B*o |
    +----[SHA256]-----+
    
  2. Copy the newly created ssh public key to host5180:
    myuser@host0815:/# ssh-copy-id myuser@host5180
    After entering  the password of myuser@host5180, the key is written to
    ~/.ssh/authorized_keys

    /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/myuser/.ssh/id_rsa.pub"
    /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
    /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
    
    Number of key(s) added: 1

    The operation has worked if the following message is displayed: “Number of key(s) added: 1”.

  3. Finally, test if everything works like expected:
    • Try to login with your key to host5180.
      myuser@host0815:/# ssh myuser@host5180
    • If you are prompted for a password (and you didn’t protect the key with a password) then the key exchange didn’t work out and you need to check the previous steps (1-3). If you find yourself on the command prompt of host5180 you managed to established a public key based connection.

Additional hint: If you want to be able to login from host5180 to host0815 in the same way, you have to repeat the steps 1-3 with the two hosts exchanged of course.

Now that everything is set up, we can consider disabling the “normal” password-based authentication. This has some advantages and disadvantages.

Options:

  1. Leave the normal login just like it is.
    • Advantage:
      • You can log in with both the private key and your normal password. This is especially helpful if you work on a computer without your private key e.g. from your friends PC.
    • Disadvantage:
      • From a security point of view, this adds one more possibility for the bad guys to break into your computer, if they gets hold of your private key.
  2. Disable the password enabled login!
    • Advantage:
      • This closes the door for brute force attacks against your users passwords.
    • Disadvantage:
      • You can only login from remote if you have your private key with you.
      • This obviously doesn’t remove the possibility that your key gets stolen and the thief can break into your computer.

At the end there is a trade-off between comfort and safety. For maximum safety, we turn off the password based login and secure our private key with a strong password. Keys without a password are for the utmost comfort since they offer the possibility to jump from one computer to another without entering a password.
But the decision on safety or comfort has the administrator to take for the system he is responsible of.


SSH key exchange between two linux boxes for the root user.

For the root user, you will need a few more steps especially on a stock Ubuntu system, because the root user is disabled and root is not allowed to log in via ssh. Again we use the two hosts host0815 and host5180 for the example.

Important: Open a second ssh connection and keep it open until you know everything works!

  1. Login with your normal user to host0815 and become root with the following command:
    myuser@host0815:/# sudo su –
  2. Create the ssh key pair:
    root@host0815:/# mkdir ~/.ssh
    root@host0815:/# chmod 700 ~/.ssh
    root@host0815:/# ssh-keygen -t rsa -b 4096
  3. Now we copy the newly generated ssh key to host5180. As already mentioned, there is a specialty for the root user: the password based ssh login on many linux systems is disabled by default for root.
    So we will look at how to activate it temporarily to be able to copy our public key to host5180.

    1. Login with your normal user to host5180 and use sudo to become root with the following command:
      myuser@host5180:/# sudo su –
    2. Activate the root user by setting a password with the command passwd:
      root@host5180:~# passwd
      New password:
      Retype new password:
      passwd: password updated successfully
    3. Open the config file “/etc/ssh/sshd_config” with your editor of choice and search for “PermitRootLogin without-password”, comment the line out by adding ‘#’ in front of it and add “PermitRootLogin yes” in the line below:
      # PermitRootLogin prohibit-password
      PermitRootLogin yes

      This will enable the root ssh login with the password we have just set up.

    4. Save the file and restart the ssh daemon. Check that your second ssh connection is still open!
      root@host5180:/# systemctl restart sshd.service
      or
      root@host5180:/# service sshd restart
    5. Now go back to host0815 and test if root can login to host5180:
      root@host0815:/# ssh root@host5180 date
      After entering the root password date and time should be displayed as a result. If this didn’t work out check the the previous steps (3.1-3.5).

    After this little excursion we can now copy the public key to host5180:
    root@host0815:/# ssh-copy-id root@host5180
    In my opinion, this is the easiest/best way to copy the public key to a host but of course there are other ways to do this, for example use a USB stick, scp, etc.

  4. Test if everything works:

    1. Try to login with your shiny new key to host5180:
      root@host0815:/# ssh root@host5180
    2. If you are prompted for a password the key exchange didn’t work out and you have to re-check the previous steps (1-4).
  5. Finally change the “PermitRootLogin yes” back to “PermitRootLogin without-password” in the config file ‘/etc/ssh/sshd_config’ and restart the ssh daemon (see 3.4).
  6. Disable the root user again if you like:
    myuser@host5180:/# sudo passwd -l root

Step 5 and 6 are not necessary but recommended.


Additional hint:

It is possible to change single settings only for individual users, e.g.:

DenyUsers user0815
Match User myuser
    PasswordAuthentication no
  • Prohibits ssh access for the user user0815
  • Disables password authentication for user myuser
  • For all other users, the password authentication is maintained.

 


Leave a reply

Cannot contact any KDC for requested…

kinit: Cannot contact any KDC for requested realm while getting initial credentials

If you get this error message while you try to change your Kerberos password and your running server system is virtualized, you may have an entropy shortage issue which will lead to a timeout.
Linux operating systems serve random numbers using special files, /dev/random and /dev/urandom. The pool of random bits of these files will exhaust very fast in virtualized systems without hardware entropy from keyboard, mouse or actuality hardware entropy generators.
One possible solution is to install the haveged entropy deamon. This daemon will provide you with unpredictable random numbers.

For ubuntu or debian: use the following command to install the daemon.

apt-get install haveged

After the daemon is running you can issue the kinit command again. To get some more debug information write it to stdout with KRB5_TRACE=/dev/stdout in front of kinit.

KRB5_TRACE=/dev/stdout kinit username