Tightening up SSH for SIM

[Richard Munn]

We have an environment that has more than 2000 hosts.
While a few are Windows, the bulk are unix (i.e. Linux) proliant servers that are setup into compute farms of various forms.
All of these have PSP's and trap to HPSIM.

One problem I have is that there is no single owner of the hosts, they are owned in groups by several different parties. Because of this, there is a general security policy that prohibits various types of accounts including group and gloabl accounts. In general, service
accounts are quite OK if they conform to some rules. For example under Linux most accounts of this type have a login shell of /sbin/nologin which effectively prevents a user logging in externally.

But this is a problem. HPSIM uses SSH to run tasks on the clients etc. But if it attempts to run these under a global user account which has it's shell set to nologin, the SSH session is terminated (or appears to be). An alternative approach is to have different accounts on different hosts with different passwords but the management of all of this is painful to say the least.

There are other applications that do similar things but most of them seem to have remote agents which run the tasks under some local account like root or some other account. This sort of thing is also quite acceptable since it is not a general login therefore the range of things that can be done are tied down.

As far as HPSIM is concerned Can anyone suggest some way to let HPSIM get into these machines (I assume it will need to be via SSH) but not allow a user to SSH into the same host?

My inital thoughts were to do something like check that the orginating host was the CMS and only allow SSH from it and nowhere else and maybe even only if it was coming from mxdtf.