Executing MC/SG Cluster Commands by user other than root

[roobala]

Dear all

I am having MC/SG Installed and Configured
on HPUX 11.00 HP 9000 L-1000 Servers.
Now Only system Administrator is checking cluster status by cmviewcl.

How to make this "cmviewcl" command available to users other than ROOT.
Thanks in Advance,
Roobala

[Carlo Henrico_1]

Try SUDO. This is a software package (free) which give a user the rights to execute commands "as if" he were the root user. Small bit of configuration to be done but I found it works very well.

sudo can be obtained from the porting center or from www.courtesan.com

Good luck

[Rainer Weinmann]

Try the following: Create a file called cmclnodelist under /etc/cmcluster in which you put all the users who are allowed to execute the cluster commands with the ip-address on which they connect; don't forget to include root, eg. ip.ip.ip.ip user

[roobala]

Hi Rainer,

cmclnodelist worked, but I think that user will be able to
halt and run cluster/pkg/node.
I wanted that user to view only(cmviewcl).

Any suggestions

Regards
Roobala

[Darrel Louis]

Roobala,

If you just want users to run some commands, sudo is the best solution.
This will log everything users are doing.

Good Luck

[James R. Ferguson]

Hi:

From the MC/SG 11.05 documentation, it looks like the cmclnodelist file extensions enable the cmviewcl ability only.

http://docs.hp.com/hpux/onlinedocs/B3935-90015/B3935-90015.html

...JRF...

[Ralph Grothe]

James is right,
the cmclnodlist seems to apply only to the extension of permissions to run the cmviewcl command.
At least on my system the mere mortal accounts (i.e. $> > 9) cannot submit any cm* commands other than cmviewcl.
I for instance, put the www account (an account with usually very restricted privileges) in the cmclnodelist to have my CGI scripts also display the cluster's status (possibly a somewhat lenient measure for the paranoid)

[Denver Osborn]

Another idea for you is to use a restricted sam for the user.

As root
# /usr/sbin/sam
Actions -> add custom application
give it a Label -> command should be /usr/sbin/cmviewcl -v and execute using root's id. After it's added test it out as root.

# /usr/sbin/sam -r
Select the user's id, select the custom app you added, Actions -> enable -> Actions -> save privileges. Exit sam.

Now your user should be able to execute cmviewcl from within sam and wihtout loading additional software.