topic Re: mcsg 11.16 rolling upgrade and cmclnodelist in Operating System - HP-UX

mcsg 11.16 rolling upgrade and cmclnodelist

Denver Osborn — Tue, 08 Aug 2006 15:05:45 GMT

Hey all,

I've seen ralphs thread re: ACP's and cmclnodelist at http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1042110

However, it doesn't really address my problem.

I'm planning on an 11.14 rolling upgrade to 11.16. However in testing I've had a problem with cmviewcl running as a nonroot user on the 11.16 node. The debug output points to no ACP for the nonroot user. Problem here is we can't add the ACP entry until after the other node is at 11.16. The way a package was designed is the nonroot user needs to run some mcsg commands (don't ask me why...). If it can't it fails. I hope this makes sense to someone. :)

Anyhow, long story short. From what I've read I thought that the ACP entries wouldn't be a factor until all nodes were at 11.16. Until then, it should still use cmclnodelist file. Right?

Thanks for the feedback!
-denver

Re: mcsg 11.16 rolling upgrade and cmclnodelist

Steven E. Protter — Tue, 08 Aug 2006 15:23:16 GMT

Shalom Denver,

I think you should use cmclnodelist because thats where SG is going as it moves away from rhost based security, which really is not secure.

You will need to modify your inetd.conf file for the ha entries and add the -i parameter.

SEP

Re: mcsg 11.16 rolling upgrade and cmclnodelist

Stephen Doud — Wed, 09 Aug 2006 07:46:47 GMT

So on the node that is still at 11.14, do you have the following syntax in cmclnodelist?

Under normal circumstances, this would allow the non-root user to perform cmviewcl.
However, once upgraded to 11.16, I believe cmclnodelist is no longer consulted by that node, so no permission will be granted to non-root for that node and cmviewcl will fail. Since package startup is dependent on this, suggest completing the rolling upgrade as quickly as possible.

Re: mcsg 11.16 rolling upgrade and cmclnodelist

Denver Osborn — Wed, 09 Aug 2006 07:52:26 GMT

Thanks Stephen (and Steven)

We'll just have to plan an outage for the upgrade. It'll make life easier on us to have the package down if cmclnodelist on the 11.16 node won't work.

-denver

Re: mcsg 11.16 rolling upgrade and cmclnodelist

Denver Osborn — Wed, 09 Aug 2006 11:33:20 GMT

ok, I missed something w/ my orignal post. Upgrading mcsg ops 11.14 to sgerac 11.16. Rel Notes state rolling upgrade isn't supported from 11.14 ops to 11.16 sgerac. Could explain some of the other issues seen in testing.