topic Re: Automation in Operating System - HP-UX

Automation

Spark_2 — Wed, 27 Jan 2010 06:03:50 GMT

Hi,

Direct root login is diabled in all my servers. Now how can things be automated in such kind of environment. I made a second user with uid 0 and tried to use that for small tasks like user addition or running of script from one box to multiple but its being denied as the uid 0 is being captured as root's

How can automation be done in such kind of an environment please. Would appreciate any help.

Re: Automation

Michal Kapalka (mikap) — Wed, 27 Jan 2010 06:09:00 GMT

hi,

i think its better if you use SUDO.

if you like to download it :

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.7.2p1/

mikap

Re: Automation

Jupinder Bedi — Wed, 27 Jan 2010 06:31:22 GMT

Install sudo on your system and you can do all your system administrator tasks accordingly.

Re: Automation

Spark_2 — Wed, 27 Jan 2010 06:42:10 GMT

I already have sudo on my boxes. Please consider the scenario:

I want to create a user on multiple boxes sitting in one server. Now all the others have direct root login disabled. Now how to go about it please.

Similarly in case I want to have output like mirroring information and want to run some script from one server to all...

Re: Automation

Horia Chirculescu — Wed, 27 Jan 2010 07:48:00 GMT

Hello

I just wanted to underline the fact that

" its being denied as the uid 0 is being captured as root's"

it is the normal behavior of any Unix like SO meaning that any program is looking at the UID not at the user name. This is done by invoking getuid(). Two users with the same UID are treated in the same way.

Horia.

Re: Automation

Spark_2 — Wed, 27 Jan 2010 07:49:39 GMT

Thanks Horia, I understand that fact now.

Someone please help with the basic problem also

Re: Automation

Horia Chirculescu — Wed, 27 Jan 2010 09:34:09 GMT

Hello,

Michael already suggested a good approach of the problem.

Once installed sudo, you should play with visudo in order to configure access to the non-root user to the desired programs (/usr/sbin/useradd , whatever your script/scrips are)

man sudo

man visudo.

Best regards
Horia.

Re: Automation

Spark_2 — Wed, 27 Jan 2010 09:36:27 GMT

Its not just within this server that I want to do things....I want configure a central from where scripting could be done to perform things on several other servers.

Passwordless ssh doesnt help as direct root login is diabled on all the boxes. What else can be done please

Re: Automation

Horia Chirculescu — Wed, 27 Jan 2010 09:48:36 GMT

>Its not just within this server that I want to do things....I want configure a central

You must create a common user on all your servers that you want to perform the tasks.

let's say you will create the user

maintenance.

On every managed server you must configure sudo for user maintenance to run useradd and

From your station, you can create a script that would perform the same tasks on all servers. This script would

ssh to your 1st server as maintenance,
sudo

ssh to your 2nd server as maintenance and so on...

Best regards,
Horia.

Re: Automation

Spark_2 — Wed, 27 Jan 2010 10:05:40 GMT

I add a user 'maintenance' and make its entry passwordless in sudoers file.

Now to perform root taska like useradd one must have appropriate permission. Till reaching the other box using ssh, things are fine but as soon as 'sudo useradd..' comes permission denied is being prompted.

Re: Automation

Horia Chirculescu — Wed, 27 Jan 2010 10:11:25 GMT

Pls read "to run useradd and "

as

"to run useradd and any other commands you need"

Re: Automation

Spark_2 — Wed, 27 Jan 2010 10:19:00 GMT

Thank you for continous help.It seems you missed some part of my previous post. Please go through again and suggest

Re: Automation

Horia Chirculescu — Wed, 27 Jan 2010 10:35:20 GMT

> are fine but as soon as 'sudo useradd..' comes permission denied is being prompted.

Let's say:

which useradd
/usr/sbin/useradd

In this case you did something wrong when configure sudo. Review your sudoers (edit the sudoers file only with visudo command!)

Cmnd_Alias PRIV_CMDS = /usr/sbin/useradd, /path_to_yourscript/yourscript

maintenance ALL= NOPASSWD: PRIV_CMDS

Save the file sing :wq command

You can also specify /usr/sbin/ and all your executables from /usr/sbin will be executed by maintenance user.

This should do the job.

Best regards
Horia.

Re: Automation

Robert Salter — Wed, 27 Jan 2010 16:39:16 GMT

If you have your ssh public keys set up on all of your servers you can use 'ssh' to execute your remote commands without logging in directly. Then you can write your scripts to perform the work you want from on server, i.e. useradd, etc. Just maek sure to use the full path to the commands in your scripts.

Beers,

robert

Re: Automation

melvyn burnard — Wed, 27 Jan 2010 16:54:23 GMT

Have you taken a look at DSAU? (Distributed Systems Administration Utilites).
It is designed to "fan out" commands to a number of servers.
http://docs.hp.com/en/T2786-90327/T2786-90327.pdf

Re: Automation

Nido — Wed, 27 Jan 2010 20:52:10 GMT

Hi & How are you?

Playing with SSH and SUDO would require you to log into each system and have setup.

I will need to check "Distributed Systems Administration Utilities"

How about a dirty way of using expect.
Write some 10-15 liners by putting conditions in expect program ( you may switch to uid 0 later within expect program and thats what your system expects to NOT login as uid 0).

Put expect on either HPUX box or find expect in any redhat.

http://hpux.connect.org.uk/hppd/hpux/Tcl/expect-5.43/

p.s. No points for a dirty way.

Chocolates?

Cheers!!

Re: Automation

D. Jackson_1 — Wed, 27 Jan 2010 22:55:19 GMT

Can you please provide examples of what you are trying to get done.
SSH access with a sudo implementation will work. Just take some scripting to do it.