topic Re: Using cmviewcl as regular user in Operating System - HP-UX

Using cmviewcl as regular user

Henrik Rasmussen — Fri, 25 Feb 2005 05:19:01 GMT

I am making a script which functionality depends on whether a package is present on the node or not. For that I use cmviewcl to determine the package status.

The script will be used by regular users, but when a user runs cmviewcl it seems like it hangs (does not return anything and I don't get the Unix prompt back until I do a ctrl/c).

Since cmviewcl is executable by regular users, I wondered if the command ought to be available to regular users (and why it doesn't output anything when not root) or if my permissions is wrong.

Is there any other command that users can use to get package status (package present/notpresent)?

Henrik

Re: Using cmviewcl as regular user

Thevenet_1 — Fri, 25 Feb 2005 12:16:08 GMT

Hi

It could be rights to execute cmviewcl for regular users. You can check this by waiting enough the error message cmviewcl should return you.

You can allow a regular user to use cmviewcl by adding an entry in /etc/cmcluster/cmclnodelist in all nodes. For ex :

# for root
node1.yahoo.com root
node1 root
# for user oracle
node1.yahoo.com oracle
node1 oracle

Re: Using cmviewcl as regular user

RAC_1 — Fri, 25 Feb 2005 12:20:50 GMT

1. You can use sudo give rights to users to do that.
2. You can also use /etc/cmcluster/cmclnodelist file for it. This file can be ised upto certain versions of MCSG.
3. With latest versions you need to specify the users in cluster config file siteself.

Anil

Re: Using cmviewcl as regular user

Stephen Doud — Fri, 25 Feb 2005 15:47:31 GMT

Serviceguard version A.11.16 has the ability permit non-root users to manipulate both packages and the cluster - let alone run cmviewcl. (new role-based access parameters in the cluster and package configuration files)

Before 11.16, the non-root users had to be listed in /etc/cmcluster/cmclnodelist to be permitted to run cmviewcl.

Re: Using cmviewcl as regular user

Henrik Rasmussen — Thu, 03 Mar 2005 08:36:43 GMT

Thank you.

However using cmnodelist will allow my users to do maintenance on the chuster, which I don't want them to. I just want then to be able to check the package status.

Thank you Doud for the info about A.11.16. I will look forward to next version, but I am currently using A.11.15.00

Re: Using cmviewcl as regular user

RAC_1 — Thu, 03 Mar 2005 08:49:47 GMT

sudo looks your best option here. Give sudo access for cmviewcl command only.

Anil

Re: Using cmviewcl as regular user

Geoff Wild — Thu, 03 Mar 2005 08:59:46 GMT

See: http://docs.hp.com/en/B3936-90073/ch05s01.html

"Allowing Non-Root Users to Run cmviewcl"

It does NOT allow the user to run all commands - only cmviewcl and cmgetconf....only status type commands...

Example - here's output when a "normal" user trys a cmcheckconf:

$ cmcheckconf -v -C pcha.ascii
cmcheckconf : Must be super-user to run this command.

So you can add them to cmclnodelist...

Rgds...Geoff

Re: Using cmviewcl as regular user

melvyn burnard — Thu, 03 Mar 2005 09:03:03 GMT

adding non-root users to your cmclnodelist does NOT allow them to maintenance on the cluster, just to use cmviewcl.