Using acl on depots.

[David Heath_1]

Hello,

I am having trouble with swacl.

I have a software depot on one machine. I have a user who needs to have root permissions to use the depot to install software on another machine. How can I give this user access to the depot and the other machine so he can install the software but not give him root access for the whole machine?

Depot stored on: host1
target machine: host2
user = user1

I have been tinkering with swacl but a little unsure as to where I want the permissions to lie and where I want to run it.

At the moment I typed the following command on the host2, the target machine:

swacl -l depot -M user:user1:crwit \@host1:/swdepot_address

This gives the error I dont have permissions to run this command even though I am running it as root.
Also, do I want to run this command on the depot machine?

[Sanjay_6]

Hi David,

Try,

swacl -l depot -M user:user1@host2:crwit \@host1:/swdepot_directory

Also take a look at this thread,

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=807658b11dbedaeabd/screen=ckiDisplayDocument?docId=200000058669037

and do a "man swacl" for more info.

Hope this helps.

Regds

[David Heath_1]

Hello, thanks for the reply. I have only just got round to testing this but have still got some problems. Looking under the man pages I have been learing all about swacl!

As I understand it, I want to create a swacl for the depot on the source machine - where the depot is stored. In the swacl I have to give the user who needs to install software all permissions so he can install all the software on differnt remote hosts.

There on the source host I typed the following command:

swacl -l depot -M user:username:cwrit /depot_path

However, this gave back the following error:

There is no depot ACL at portal:/var/spool/sw. The object is or part of a read only depot.

Frstly, why is it looking at /var/spool/sw, this is not the depot I want it to look at?

Secondly, how can I create a swacl for the depot I require so that one user can install all software on multiple hosts.

Your help is very much appreceiated.

David.

[Mateja Bezjak]

Hi David,

1. The command you typed was missing a @. It should be:

swacl -l depot -M user:username:crwit @ /depot_path

/var/spool/sw is the default SD (Software Distributor) depot. Commands like swpackage, swlist, swacl use this depot by default if no other path is specified. By adding "@" to your command, you will change the path to /depot_path.

To check if swacl was performed OK, check:

swacl -l depot @ /depot_path

2. To be able to push to different hosts, you will have to modify swacls on host systems. But to enable the push you will need /var/adm/sw/.sdkey file. This is the SD-OV license.

On host systems you need to add:

swacl -l host -M user:username@controller_name:crwit

Do the same on the root level (swacl -l root)

You can find more information on the SD security in the SD-OV Administartor's guide (Chapter 13):

http://ovweb.external.hp.com/lpe/cgi-bin/doc_serv/prod_req.pl?sd_a.02.10

Regards,
Mateja

[David Heath_1]

Excellent!! I understand now. I ran this command and the user is in the acl for the depot.

So to allow the user to install software from this depot on to other remote machines I just have to run the other command? I'm sorry, i've only been doing unix for about 9 months and a little unsure as to what you mean by "controller_name"?


Many thanks again for all your help.

Oh, I have openview installed so thats ok.

David.

[Mateja Bezjak · Accepted solution]

Hi David,

By controller I ment the system that initiates all the SD functions (installing the software, listing the software on a depot or target node, removing software,...).

Target system is the system being acted on by the controller when software is distributed, listed, removed, etc.

Mateja