Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

[Justo Exposito]

Hi everybody,

Can someone tell me how to delegate the commands cmrunpkg, cmhaltpkg, cmmodpkg to other user not root?.

Thanks in advance.
Justo.

[Jeff Machols]

The best way is sudo, if you don't have to get it for free. That allows you to setup users that can run commands as root. Another way, but this is risky, you can get sid bit on those commands so they will execute as root

[Uday_S_Ankolekar]

Hi,

No these commands to be run by superuser only..
Try configuring sudo or su , if you want to keep track of all super user activity

-USA..

[Sridhar Bhaskarla]

Justo,

Sudo will do this for you as suggested by others.

And the best way would be to setup restricted SAM that will allow package handling by users.

#sam -r

It's easy to setup.

-Sri

[Justo Exposito]

Hi,

Thanks, but how can I configure su or sudo?

Regards,
Justo.

[Sridhar Bhaskarla · Accepted solution]

Justo,

It's easy. Download sudo from here.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.2b1/

It's all in the /etc/sudoers file. Read the page

http://www.courtesan.com/sudo/man/sudoers.html

For the syntax.

I would suggest you try it with restricted SAM for the users.

-Sri

[Uday_S_Ankolekar]

Hi,

Download sudo from here..
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.2b1/

-USA..

[Jeff Machols]

when you get sudo installed, you can run visudo, this is an example of what you want the file to look like

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification
User_Alias CMUSERS = user1,user2

# Cmnd alias specification
Cmnd_Alias CMCOMMANDS=/usr/sbin/cmrunpkg, /usr/sbin/cmruncl
l
# User privilege specification
CMUSERS ALL = CMCOMMANDS

[Jeromy Gregg]

SUDO is a good tool and would definately solve your problem.

Also, if memory serves me correctly, even though the commands you asked about are world executable, and any user can run the MC/Svc Guard commands, the commands have logic built into them so that only the superuser (root) can affect the package/cluster.

I don't have a test server to confirm this right now, but I remember when we were setting up our clusters, I had the same concern, so I executed the commands as a non-priveldged user and got an error message back...the verbiage of the error stated that I could not run the command because I was not root.

If you have a test environment, try this out, but I am almost sure this is the case.