topic Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg in Operating System - HP-UX

Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Justo Exposito — Wed, 12 Dec 2001 15:56:17 GMT

Hi everybody,

Can someone tell me how to delegate the commands cmrunpkg, cmhaltpkg, cmmodpkg to other user not root?.

Thanks in advance.
Justo.

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Jeff Machols — Wed, 12 Dec 2001 16:00:51 GMT

The best way is sudo, if you don't have to get it for free. That allows you to setup users that can run commands as root. Another way, but this is risky, you can get sid bit on those commands so they will execute as root

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Uday_S_Ankolekar — Wed, 12 Dec 2001 16:01:21 GMT

Hi,

No these commands to be run by superuser only..
Try configuring sudo or su , if you want to keep track of all super user activity

-USA..

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Sridhar Bhaskarla — Wed, 12 Dec 2001 16:07:51 GMT

Justo,

Sudo will do this for you as suggested by others.

And the best way would be to setup restricted SAM that will allow package handling by users.

#sam -r

It's easy to setup.

-Sri

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Justo Exposito — Wed, 12 Dec 2001 16:09:00 GMT

Hi,

Thanks, but how can I configure su or sudo?

Regards,
Justo.

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Sridhar Bhaskarla — Wed, 12 Dec 2001 16:16:22 GMT

Justo,

It's easy. Download sudo from here.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.2b1/

It's all in the /etc/sudoers file. Read the page

http://www.courtesan.com/sudo/man/sudoers.html

For the syntax.

I would suggest you try it with restricted SAM for the users.

-Sri

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Uday_S_Ankolekar — Wed, 12 Dec 2001 16:18:48 GMT

Hi,

Download sudo from here..
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.2b1/

-USA..

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Jeff Machols — Wed, 12 Dec 2001 16:20:07 GMT

when you get sudo installed, you can run visudo, this is an example of what you want the file to look like

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification
User_Alias CMUSERS = user1,user2

# Cmnd alias specification
Cmnd_Alias CMCOMMANDS=/usr/sbin/cmrunpkg, /usr/sbin/cmruncl
l
# User privilege specification
CMUSERS ALL = CMCOMMANDS

Re: Delegate the cmhaltpkg, cmrunpkg, cmmodpkg

Jeromy Gregg — Tue, 18 Dec 2001 20:56:08 GMT

SUDO is a good tool and would definately solve your problem.

Also, if memory serves me correctly, even though the commands you asked about are world executable, and any user can run the MC/Svc Guard commands, the commands have logic built into them so that only the superuser (root) can affect the package/cluster.

I don't have a test server to confirm this right now, but I remember when we were setting up our clusters, I had the same concern, so I executed the commands as a non-priveldged user and got an error message back...the verbiage of the error stated that I could not run the command because I was not root.

If you have a test environment, try this out, but I am almost sure this is the case.