topic Re: ignite-root in Operating System - HP-UX

ignite-root

Emilio Brusa — Wed, 12 May 2004 17:23:36 GMT

Hi,
I have this problem...
I need to run manually the make_recovery -Avi or make_tape_recovey -x...but I need him to run him an operator that should not have privileges of ROOT
How can create a user that can run make_tape_recovey without priviliges of ROOT, only creating the tape of Ignite.
Also them...if they can lean on with the bestÂ´s practices for the creation of Ignites
Thanks everybody.

Re: ignite-root

Sundar_7 — Wed, 12 May 2004 17:41:03 GMT

It looks like make_recovery inturn checks the real UID of the user. So SUID will not work in this case.

You can install sudo and allow the user to run only make_recovery

Re: ignite-root

Sundar_7 — Wed, 12 May 2004 17:50:57 GMT

Best practice is to include everything in vg00. use the -ACvi option with make_recovery and -x inc_entire=vg00 when make_tape_recovery is used.

Re: ignite-root

Patrick Wallek — Wed, 12 May 2004 17:55:02 GMT

Create a script something like this:

# cat create_ignite_tape
#!/usr/bin/sh

# Replace the 0mn with your no-rewind tape drive
TAPE=/dev/rmt/0mn

# Rewind tape
mt -f ${TAPE} rew

# Run make_tape_recovery
/opt/ignite/bin/make_tape_recovery -a ${TAPE} -I -v -x inc_entire=vg00

# Eject the tape when done
mt -f ${TAPE} offl

# END OF SCRIP

Now you have a couple of options:

1) Install sudo as said above and set up the user so that he/she can run the create_ignite_tape script. --- I would prefer this method

2) Set the create_ignite_tape script so that it is owned by root and is a SUID script.

# chmod 4555 create_ignite_tape
# ll create_ignite_tape
-r-sr-xr-x root sys .... create_ignite_tape

I wouldn't necessarily recommend this as it could be a security hole (I don't like unnecessary SUID scripts lying around). I am not even 100% sure it will work, but it might.

Re: ignite-root

Sundar_7 — Wed, 12 May 2004 18:08:11 GMT

Patrick, I tried the script before posting my FIRST reply. Apparently make_recovery has a real UID check builtin.

Re: ignite-root

Sundar_7 — Wed, 12 May 2004 18:12:54 GMT

$ ls -lrt /root/m.sh
-r-sr-xr-x 1 root sys 68 May 12 16:09 /root/m.sh
$

$ more /root/m.sh
#! /usr/bin/sh
/opt/ignite/bin/make_recovery -ACvi -d /dev/rmt/0mn
$

$ /root/m.sh
make_recovery(201): Must have root capability to use make_recovery
$

Re: ignite-root

Emilio Brusa — Thu, 13 May 2004 16:39:29 GMT

Sundar and Patrick thanks,

Where can i find SUDO...is software of hp??

E.

Re: ignite-root

Francesco Campalastri — Thu, 13 May 2004 17:08:38 GMT

HP-UX 11.11 (11i) include a yellow label CD named Internet Express for HP-UX with sudo. Sudo is not released by HP, it is public domain.

See also on the web

http://hpux.cs.utah.edu/
sudo-1.6..7p5 (15 Oct 2003)

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

Ciao

Re: ignite-root

Sundar_7 — Thu, 13 May 2004 18:41:29 GMT

You can download from this link

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.7p5/

Once installed, add an entry in the /etc/sudoers file

ALL=/opt/ignite/bin/make_recovery

Now the operator can use sudo to create recovery tape.

operator> sudo /opt/ignite/bin/make_recovery -ACvi -d /dev/rmt/0mn
Password:

Operator will be prompted for password. The password to be entered is the OPERATOR's password and NOT the root's password.

Re: ignite-root

Dani Seely — Thu, 13 May 2004 21:45:23 GMT

In my experiences with Ignite restores I have had weird and unusual problems occur after a restore of an Ignite backup that was performed in multi-user mode. As general practice from now on I always shut down to single-user mode in order to ensure minimal files are open or in use and my backup is cleaner and finishes faster, too.

You may want to rethink your backup strategy. If you're trusting someone to do your system backups but you're not going to give him/her the root password in order to run the backup, it makes me kind of wonder ...

Re: ignite-root

Emilio Brusa — Fri, 14 May 2004 09:08:39 GMT

But,
whenever to make a restore of a tape made with I Sudo, is the process the same one that when the tape make with root?
Or are any considireations for that ?

Thanks everybody

E.

Re: ignite-root

Pete Randall — Fri, 14 May 2004 09:12:39 GMT

Emilio,

There should be no difference in the restore process whether the tape was made by an actual root or a "sudo'd" root.

Pete