Serv.Guard 11.16 cmviewcl for all (200) users. how to?

[Henk Geurts]

hi Guys.
i want to let every use use the cmviewcl command.
I know that version 11.16 uses Access Control Policy Parameters, but don't want to add 200 users in the ascii file....
don't want to fix it with sudo either...

adding a + sign to cmclnodelist doesn't work in this version...

Can you help ?

[RAC_1]

You have very limited options.
I would suggeset to go with sudo.

[melvyn burnard]

Create a MONITOR role for everyone in the cluster ascii file.
Take a look at page 278 of the managing Serviceguard manual for 11.16 at:
http://docs.hp.com/en/B3936-90079/B3936-90079.pdf

[Henk Geurts]

thanks
but is there a way to apply wild cards in the clusterascii file so all users can monitor?
USER_NAME *
USER_HOST *
USER_ROLE MONITOR

doesn't do the trick.

[melvyn burnard · Accepted solution]

Again, read the manual, you will see that allowed entries are:
ANY_USER or up to 8 user names as per the password file ;in this case use ANY_USER

ANY_SERVICEGUARD_NODE
ANY_CLUSTER_NODE
or a specfific node name, in this case use ANY_SERVICEGUARD_NODE

[Steven E. Protter]

Henk,

I would suggest a carefully written suid script that runs the command as root, just as passwd lets users update the passwd file which root owns and is the only authorized writer.

This is a security hazard if poorly written.

Also Just because you want to give cmviewcl to all users does not make it a good idea.

Another suggestion:

Have cron run a cmviewcl status report, regularly to /tmp directory and let all users view the output.

My second suggestion has the advantage of not being a security hazard.

SEP

[Stephen Doud]

To permit anyone to use cmviewcl, configure the cluster ASCII file with:

USER_NAME ANY_USER
USER_HOST ANY_SERVICEGUARD_NODE
USER_ROLE MONITOR

cmapplyconf can be done while the cluster is running.

[Henk Geurts]

thanks to all!