Is rhosts file required for mcsg with ops ?

[Sammy_2]

Security folks are coming after me for having
.rhosts file for root and oracle. ? Can I remove .rhosts file and put all entries in that file in /etc/cmcluster/cmclnodelist. , without causing any problem ?
Does oracle also need to have .rhosts file ? DBA thinks .rhost file needed for OS and oracle OPS equivalency ?
Thanks

[Simon Hargrave · Accepted solution]

.rhosts is not needed by Service Guard itself, nor I would guess OPS. What you have to ask yourself is, do any of your scripts that run on the servers need it?

If you don't know your systems, you'll need to check through your crontabs (and on any 3rd party schedulers you may have), and see if there is any rcp, remsh reference etc.

If there is you should really, for best security, replace it with secure shell alternatives.

Your cluster control scripts shouldn't rely on any "r" commands either, since the idea of a cluster is that they can continue regardless of other hosts availability. So I'd check your /etc/cmcluster/package/*.cntl scripts etc, to see if there are any references, and consider if they really need to be there.

[Geoff Wild]

/etc/cmcluster/cmclnodelist is used for security among nodes in a cluster - for cluster commands - can give individuals the ability to run ServiceGuard commands. It does NOT grant say a user the ability to rcp files from one node to another - still need .rhosts for that.

Rgds...Geoff

[Carsten Krege]

SG and SGOPS require either .rhosts to be configured or the file /etc/cmcluster/cmclnodelist. THere is no difference in SG functionality no matter which file you're using. If cmclnodelist is configured, SG will use this.

Starting with SG A.11.16 (released soon), a new method for non-root access for Serviceguard commands, both on command line and with Serviceguard Manager, the graphical interface will become available. Non-root access to view or to issue administration commands, is now defined in the new Access Control Policy parameter in the configuration files of the cluster or one of its packages.
Once a node has been configured into a cluster, Serviceguard will consult only the configuration files, checking access roles; it will no longer look at the .rhosts or cmclnodelist file. Root user on a node is always allowed access, but all other users must have an Access Control Policy configured.

Carsten

[YoungHwan, Ko]

For the ServiceGuard commands to work properly each host in the
node must have its own name as well as the other nodes in its
own .rhosts file.

After write all node .rhost file,
try cmquerycl again and then run cmruncl.

[Kent Ostby]

For SG-OPS you can use cmnodelist or .rhosts as Carsten states above.

One other thing you need to make sure of with regards to connectivity when setting up the cluster is that each node exists in the /etc/hosts file of each of the machines as well.

Best regards,

Kent M. Ostby

[Sammy_2]

I concur that if you have cmclnodelist file , then rhosts is not needed for MCSG functionality (cmapplyconf, etc commands). Thanks to Simon and Geoff for clarifying that first. I checked and we don't use any r command. Carsten, Much thanks on advising on upcoming MCSG product. Very Helpful.Kent has similiar suggestion. MAthais, I guess, from everyone answers , I have to believe though rhosts file is fine but cmclnodelist would suffice. So, I removed all occurennces of rhsots file and made sure I have entries in cmclnodelist file.
THANKS TO ALL