cmviewcl Permission

[santosh jha]

Can anybody tell me how do i assign cmviewcl executing permission to a normal user.

Regards
Santosh

[Duncan Edmonstone]

Santosh,

Add the user to the file

/etc/cmcluster/cmclnodelist

(If the file doesn't exist, you will need to create it on all nodes and make sure it has entries for root on all cluster nodes too)

The format of this file is the same as a .rhosts file.

HTH

Duncan

[santosh jha]

Thanks for the instant reply.In one of the system the cmclnodelist file doesnot exsist but even then one user is able to do that.He is not even in the bin group he is in users group only.
Regards
Santosh

[Jdamian]

Check the permissions of /usr/sbin/cmviewcl file in both servers.

[Jakes Louw]

Simply changing the permissions to /usr/sbin/cmviewcl for o+x will not help.

I just tested it from a "normal" user, and got a permissions failure. Now this could be the cmclnodelist file, or else cmcld simply doesn't allow a non privileged user to query cluster info.

[melvyn burnard]

The correct and supported way of doing this is for all nodes to have a cmclnodelist file in /etc/cmcluster, and in that file have entries for the users you wish to be able to run cmviewcl.
It is the same syntax as a .rhosts file
If you wish to enable all users to be able to do this, simply add + to the end of the cmclnodelist.
All this is documented on page 176 of the Managing Serviceguard Manual at:
http://docs.hp.com/hpux/pdf/B3936-90073.pdf

[Paul Torp]

From your 2nd. post, it seems like you want to remove executing permissions to this user.

In that case, make sure that this user doesn't exist in root's .rhost.

[Jakes Louw]

I tested as per Melvyn's posting, and it works.

Firstly, to execute cmviewcl for USERA on a node (SERVER1) in a cluster, there simply has to be an entry in /etc/cmcluster/cmclnodelist ON THAT SERVER:
SERVER1 USERA
You DON'T have to copy this nodelist over to all the nodes if you are only executing on the one server.
Then the execute permissions for cmviewcl must allow "Other" users to call the command:

-r-xr-xr-x

Then it works.

[santosh jha]

Hpw to do it in HP-UX 11.0 there is no cmclnodelist file in the server but still the user in able to do cmviewcl

Regards
Santosh

[Jakes Louw]

Create the cmclnodelist under /etc/cmcluster.

[santosh jha]

that user is already able to do cmviewcl
I want to how he is able to do that when cmclnodelist doesnot exsist .

Regards
Santosh

[Jakes Louw]

No idea. I played around with removing the cmclnodelist, as well as modifying root .rhosts, but couldn't reproduce what you are seeing.
Maybe check the permissions on the daemon/agent software under /usr/lbin (cmclconfd, cmcld, cmlogd, cmlvmd, etc).

They should be 544 (-r-xr--r--).

[SSP_1]

Hi Experts,

This is just in continuation with the current thread. If I want to add permission of cmviewcl to a group of 8 users, would it be possible to add a line in the cmclnodelist file.

Please Reply.

Regards
Shripad