topic Re: Confguring Ignite for SSH in Operating System - HP-UX

Confguring Ignite for SSH

Thom_Fitzpatrick — Tue, 20 Mar 2007 09:16:57 GMT

I would like to know how to configure Ignite to use ssh as the communication mechanism instead of rsh. I know that you can specify a -S on the command line when running the gui, but where can I permanently set an option to do this automatically?

Re: Confguring Ignite for SSH

Steven E. Protter — Tue, 20 Mar 2007 09:24:46 GMT

Shalom,

You can't really run Ignite using ssh. I remember asking for the enhancement in 2003. The person at HP I talked about thought it was a nice idea and promised to pass it on. Some parts of the restore process require the r protocols be enabled in inetd.conf

You can use an alias to make the application run the -S instead of the normal application.

alias ignite='ignite -S'

That might mess up some of your scripts.

SEP

Re: Confguring Ignite for SSH

Thom_Fitzpatrick — Tue, 20 Mar 2007 09:55:30 GMT

This page sez SSH is supported (I know, that and 50 cents will get me a cup of coffee...)

http://docs.hp.com/en/IUX/whatsnew.html

"The choice to use of ssh for initiating make_net_recovery, make_tape_recovery, and bootsys sessions is introduced, providing enhanced security."

Re: Confguring Ignite for SSH

Al Miller_1 — Tue, 20 Mar 2007 23:08:27 GMT

Beginning with Ignite-UX version C.6.8, "bootsys" and the "ignite" GUI contain support for performing certain operations via SSH.

When running bootsys with the "-S" option, SSH will be used in place of remsh/rexec/rcp when contacting client systems from an Ignite-UX server. Because the bootsys command performs several operations on the client in sequence, it must be able to log in unattended. Historically, this was done via .rhosts, but in ssh-mode, bootsys looks for the user's public key and prompts the user whether to copy that key to the client system. It then starts an ssh-agent process and registers the user's private key using ssh-add. Once all this is set up, bootsys copies the install kernel and install filesystem to the client and performs the operations necessary to initiate the reboot to begin the installation.

Similarly, the "ignite" GUI supports using SSH to initiate make_*_recovery sessions on clients from an Ignite-UX server. Because only one command needs to be executed on the client, it does not go through the process of copying public keys and starting an ssh-agent. It simply attempts to log in in ssh batch mode, and if denied tries again prompting for a password. The actual data transfer during the make_net_recovery session still occurs via NFS.

Al

Re: Confguring Ignite for SSH

Al Miller_1 — Tue, 20 Mar 2007 23:46:25 GMT

I forgot to mention a few additional points regarding ssh and Ignite-UX. The original poster asked whether ssh can be set as the default in "ignite". The answer is yes, this can be set via the "Use ssh to gather client data" question in the "Options->Server Configuration" menu. bootsys does not have a similar option, it will default to legacy r-command behavior unless "-S" is specified.

Finally, there have been some usability problems reported since the original release of this functionality in C.6.8. These are described in the Ignite-UX C.7.1 release notes, available at http://docs.hp.com/en/IUX/docs/Cver_release_note.html. In particular, look for JAGag30060, JAGag30076, JAGag30456 and JAGag23043.

Re: Confguring Ignite for SSH

Thom_Fitzpatrick — Wed, 21 Mar 2007 14:24:10 GMT

Ok, I made the one change via the i/f, and I guess I'll just have to remember the -S option from here on out. Seems there *should* be a global config variable for that....