Servicecontrol Manager 3.0 problem with user permissions

[Tom Geudens]

Hi All,
I've just installed SCM (for the first time) on two HP-UX 11.00 servers (sv00276 and sv00315). sv00276 is the management server. Next to user root I defined my own logonid (tgdc008) with the same permissions. My logonid only exists (/etc/passwd) on the management server.

My problem : If I understand SCM correctly I should be able to do the following :
tgdc008/sv00276$mxexec -t df -n sv00315.dolmen.be
Running tool df with task id 19.
Task ID :19
Tool Name :df
Task State :Failed
User Name :tgdc008
Execute As User :tgdc008
Start Time :Thursday, June 12, 2003 6:33:19 AM CEST
End Time :Thursday, June 12, 2003 6:33:20 AM CEST
Elapsed Time :1 second 301 milliseconds
Node :sv00315.dolmen.be
Status :Failed
Exit Code :0
EXCEPTION :
The name "tgdc008" does not represent a user in this system.

But as you can see ... I can't.
I can execute on the Management Node, and the permissions seem to be allright :
root/sv00276#mxauth -lt
USER ROLE NODE/NODEGROUP
root Master Role sv00276.dolmen.be
root Master Role g:Managed Nodes
tgdc008 Master Role g:Managed Nodes

root/sv00276#mxngroup -ld -g "Managed Nodes"
Node group name :Managed Nodes
Description :
Member nodes :sv00276.dolmen.be
sv00315.dolmen.be
Creation time :Jun 11, 2003 3:50:26 PM
Created by user :root
Last modification time :Jun 11, 2003 3:50:49 PM
Last modified by user :root

The way I understand SCM is that the whole point is that I don't need to define "tgdc008" on every system in order to execute tasks.
So I'm doing something wrong ... and probably something very obvious ;-). Can anyone tell me what it is ?

Regards,
Tom Geudens

[Jarle Bjorgeengen]

Hi,

I don't know if this is feature or a bug, but what you could do is run one useradd command as root, and define the same user on all nodes in one go. Therafter do your stuff with the user you created....

Rgds Jarle

[Tom Geudens]

Hi Jarle,
And that's exactly what I want to avoid ... and why we installed SCM. If I can logon to every server ... there's no point in using this tool.

Nice try, but no cylindrical smoking thingie ...
Tom Geudens ;-)

[John Meissner]

Tom - I've been using SCM 2.5 for about a year and a half. I'm upgrading to 3.0 next week. you are correct in your understanding that if you have an account on the CMS you don't need to have an account on a client server in order to run a tool. I'm not sure why you are getting this error.

some troubleshooting guides:
-check log files for errors
-make sure the daemons are running on the client server
-try running a GUI tool
-make sure the servers are time synced

also the SCM manual (it's small) has a lengthier trouble shooting. It can be found here:

http://www.software.hp.com/scmgr/download.html

[Tom Geudens]

Hi John,
I already had the manual next to me ... there's nothing that describes this behavior. Another SysAdmin in our firm also installed 2.5 some time ago (I picking up her thread) and tells me that she could do the execute. We "walked" through the installation (of 3.0) together and everything seems to be all right.

I tried executing the df command in the WEB-gui as well. It gives me a "Failed" but no further messages. The troubleshooting manual tells me to execute the mxexec-command for the exact errorcode (which I did and which you can see in my posting).

So, still searching ...
Regards,
Tom

[Tom Geudens]

Back to top ...
I cannot be the only one using SCM 3.0 ... or am I ?

Regards,
Tom ;-)

[John Meissner]

Tom - on Monday it'll be the two of us. I'm upgrading out managed cluster to 3.0 - about 90 servers. I can't wait... :)

[Tom Geudens]

Once more ... back to top.

Anyone ? Once, twice ...
Tom :-(

[Tom Geudens]

Hi,
I've located the problem. Apparantly (as of version 3.0 ?) the "General Tools" do not automatically execute under user root. When I altered the tooldefinition of "df" with the following line everything works as I expect it to :
root

Can anyone confirm that this is indeed the problem ?

John, can you post the output of the following command in your version 3.0 (since it's an upgrade, you should keep the "permissions") :
mxtool -lf -t df

Points will be rewarded !
Regards,
Tom Geudens

[Steven E. Protter]

Hi Tom,

We're considering SCM 3.0 as a tool to assist systems sdministration and operations in managing multiple machines.

At last years HP-World I saw the demo where they not only managed HP-9000 boxes but Linux boxes as well.

That being said, I have some input though I can't guarantee it will be of any help.

In your initial post you state:

.....
Next to user root I defined my own logonid (tgdc008) with the same permissions.
......

If this means you created tgdc008 user with super user permissions, thats a mistake and not needed. Its almost never a good idea to have to super users on a system even if you own both users. This however is not my main point.

A lot of SCM 3.0 is system management tasks that require super user priviledges. It makes sense that you needed to configure the tool to execute certain tasks as root.

For multi-system management Secure Shell provides a means to provide root accounts root pvilidedges on other machines. The means with secure shell is by the exchange of public encryption keys. rlogin and those insecure tools work the same way by running a daemon and having unencrypted configuration files. In both of the above cases this access does not require a passsword, merely a login.

I've done some reading on SCM based on management requests here and have the idea that similar concepts exist within the tool.

There has to be a mechanism for the root account on the management server to have root priviledges on all machines managed by SCM.

I am not sure what that mechanism is, but figureing it out is the root of success in your situation.

Good Luck.

We should be using SCM in about two months and perhaps further collaboration will be possible.

SEP

[Tom Geudens]

Hi Steven,
-- The new hat looks good on you b.t.w. --
When I stated that I defined "tgdc008" with the same permissions as "root", I meant this on the SCM level. On the OS-level "tgdc008" is just "an ordinary guy" ;-).

Everything in SCM works fine when I log on with the "root" user. Since it is defined on every system, there is no problem with executing tools that use the "current user" as the "executing user" on every system that is defined in SCM.

However, our security officers would like everyone to log on with their own user (tgdc008) in my case. Since I am a SysAdmin I am allowed access to the "Master Role". And I thought that would be enough to use all the tools. It is not. I can for example start SAM on every system since the tool "SAM" is defined to execute as root. The tool "df" however is defined to run as the "current user" and since "tgdc008" is not defined on every system (which is the whole idea) it does not work. Strange but true.

Regards,
Tom Geudens

P.S. When I installed SCM 3.0 I was counting on a slightly broader user base ;-)