topic Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to? in Operating System - HP-UX

Serv.Guard 11.16 cmviewcl for all (200) users. how to?

Henk Geurts — Thu, 17 Nov 2005 02:05:01 GMT

hi Guys.
i want to let every use use the cmviewcl command.
I know that version 11.16 uses Access Control Policy Parameters, but don't want to add 200 users in the ascii file....
don't want to fix it with sudo either...

adding a + sign to cmclnodelist doesn't work in this version...

Can you help ?

Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to?

RAC_1 — Thu, 17 Nov 2005 02:33:13 GMT

You have very limited options.
I would suggeset to go with sudo.

Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to?

melvyn burnard — Thu, 17 Nov 2005 02:33:20 GMT

Create a MONITOR role for everyone in the cluster ascii file.
Take a look at page 278 of the managing Serviceguard manual for 11.16 at:
http://docs.hp.com/en/B3936-90079/B3936-90079.pdf

Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to?

Henk Geurts — Thu, 17 Nov 2005 03:27:25 GMT

thanks
but is there a way to apply wild cards in the clusterascii file so all users can monitor?
USER_NAME *
USER_HOST *
USER_ROLE MONITOR

doesn't do the trick.

Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to?

melvyn burnard — Thu, 17 Nov 2005 05:07:59 GMT

Again, read the manual, you will see that allowed entries are:
ANY_USER or up to 8 user names as per the password file ;in this case use ANY_USER

ANY_SERVICEGUARD_NODE
ANY_CLUSTER_NODE
or a specfific node name, in this case use ANY_SERVICEGUARD_NODE

Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to?

Steven E. Protter — Thu, 17 Nov 2005 05:19:43 GMT

Henk,

I would suggest a carefully written suid script that runs the command as root, just as passwd lets users update the passwd file which root owns and is the only authorized writer.

This is a security hazard if poorly written.

Also Just because you want to give cmviewcl to all users does not make it a good idea.

Another suggestion:

Have cron run a cmviewcl status report, regularly to /tmp directory and let all users view the output.

My second suggestion has the advantage of not being a security hazard.

SEP

Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to?

Stephen Doud — Thu, 17 Nov 2005 08:36:04 GMT

To permit anyone to use cmviewcl, configure the cluster ASCII file with:

USER_NAME ANY_USER
USER_HOST ANY_SERVICEGUARD_NODE
USER_ROLE MONITOR

cmapplyconf can be done while the cluster is running.

Re: Serv.Guard 11.16 cmviewcl for all (200) users. how to?

Henk Geurts — Thu, 24 Nov 2005 08:38:40 GMT

thanks to all!