Security Issues | HP Instant Capacity (iCAP) specs

Security Issues

Customer protections which iCAP assumes to be in place

Instant Capacity commands provide system status information and facilitate system configuration modification, and are therefore executable only by users with root level access. An assumption is made that there exist administrative policies which exercise the appropriate degree of control over root level access.

Disabling the iCAP daemon (HP-UX)

On a system with full usage rights (no iCAP components), you can disable the iCAP daemon (icapd) by commenting out its entry in the /etc/inittab system file, resetting the init task (init -q), and killing icapd via kill -9or kill -s SIGTERM.

Note that disabling the daemon in this way on an iCAP or GiCAP system is a violation of the iCAP contract with HP. After 12 to 24 hours, the system goes out of compliance and an exception notification email is sent. Also, other partition management software cannot determine whether the system contains iCAP components and, as a result, refuses to manage any components that are present.

Customer Security Requirements

The Instant Capacity software is designed to provide maximum protection for sensitive customer information. It follows these customer security requirements:

•Sensitive customer data (names, phone numbers, email addresses, hostnames, IP addresses) is not transmitted to HP.

•There are no transmissions of authentication credentials in clear (nonencrypted) text.

•Nonsuperuser access to iCAP commands and data is not allowed.

•Confidential information is encrypted when transmission is required.

•Appropriate protections are accorded to confidential data and authentication credentials.

Security Tuning Options

Instant Capacity asset reporting (via email to HP) is optional and is turned off by default. Customers can enable asset reporting by executing the icapnotify -a on command.

208 Special Considerations

Image 208

HP Instant Capacity (iCAP) manual Security Issues, Customer protections which iCAP assumes to be in place

Contents

HP Instant Capacity users guide for Version Copyright 2000-2010 Hewlett-Packard Development Company, L.P Table of Contents Temporary Instant Capacity 101 129 137143 149 223 209229 List of Figures 10-1 List of Tables10-2 List of Examples 110111 138 About This Guide Intended AudienceNew and Changed Information in This Edition This chapter covers the following topics Publishing History Document Organization Typographic Conventions Instant Capacity user’s guide for Version Location of Instant Capacity InformationLocating the Instant Capacity release notes for Version HP Encourages Your Comments Manpages Introduction to Instant Capacity For more in-depth information, see icap5 Instant Capacity Summary Memory Terminology Software Product Overview OverviewSystem Overview Instant Capacity System Hardware Instant Capacity Software Utility Pricing Solutions Portal Instant Capacity Administration SystemOther System Management Commands Instant Capacity Database B9073BA Introduction to Instant Capacity Past Versions and Supported Operating Systems Page Getting Started Instant Capacity Requirements Program RequirementsSoftware Requirements HP-UX 11i v1 Requirements and Dependent Products Required Patches for HP-UX 11i HP-UX 11i v2 Requirements and Dependent Products Network Requirements Email RequirementsHP-UX 11i v3 Requirements and Dependent Products OpenVMS Version 8.4 Requirements Usage Rights Requirement System Contact RequirementInstant Capacity Integration with Virtual Partitions HP-UX Http//docs.hp.com Instant Capacity Components OverviewProcessors and Cores Cell Boards and Memory Getting Started Global Instant Capacity Instant Capacity Codewords Temporary Instant Capacity Instant Capacity Compliance and Enforcement Configuration Change Notification Core Activation Increasing Processing Capacity by Purchasing RTUs Instant Capacity Cell Board Command will display the message Verification succeeded Instant Capacity Software ValidationOn HP-UX Systems On OpenVMS Systems Status Reporting on Instant Capacity Systems Time Zone Considerations Installing and Removing Instant Capacity Software Installing Instant Capacity Software Command output displays the message Verification succeededInstall the B.09.x bundle B9073BA from the DVD Factory Integrated Systems For All HP-UX Installations Installing Instant Capacity on OpenVMS Systems Reinstalling Instant Capacity Software Preserving current Instant Capacity information Removing Instant Capacity Software Page Using Instant Capacity to Manage Processing Capacity Checking the Status of your Instant Capacity System Example 4-1 Sample Session of icapstatus on HP-UX Usr/sbin/icapstatus Setting System Contact Information Usr/sbin/icapmodify -c mjones@corp.com Applying a Right To Use RTU Codeword Example 4-2 Applying an RTU Codeword HP-UX Permanent Activation of Instant Capacity Components Activating Cores in nPartitions Activating CoresConstraints Example Core Activation Session Example 4-3 Activating an Additional Core HP-UX Deactivating Cores in nPartitions Deactivating CoresPartition Constraints Example 4-4 Deactivating an Active Core HP-UX Overriding Deferred Activation and Deactivation Example 4-6 Undoing an Accidental Deferred Activation HP-UX Load-Balancing Active Cores Understanding and Managing Intended Active Values What is Unused Capacity When to Use the vparmodify or icapmodify CommandsStatic Virtual Partitions Activating Cores in a Virtual Partition Environment Deactivating Cores in a Virtual Partition Environment Boot Time Compliance Example 4-7 vPar Boot-Time Compliance Message Assigning a Cell to a Partition Using Instant Capacity to Manage Processing Capacity Unassigning a Cell from a Partition Cell Available Usage Rights Software Application Considerations Test Activation of Cores Using Temporary Capacity Replacement of Failed Cores Using Instant Capacity to Manage Processing Capacity Temporary Instant Capacity Temporary Instant Capacity Overview Temporary Instant Capacity Overview Ordering Temporary Instant Capacity HP-UX Licensing and Support with Temporary Instant Capacity Using Temporary Instant Capacity Acquiring and Configuring Temporary Instant CapacityUsing Temporary Instant Capacity Example 5-1 Applying a Temporary Capacity Codeword HP-UX Usr/sbin/icapmodify -t -a Temporary Capacity and Virtual Partitions Usr/sbin/icapstatus Yes Zoo8 Zoo9 Zoo10 Zoo11 Zoo12 Zoo13 Unassigned Cells Tracking Usage of Temporary Instant Capacity Temporary Capacity Expiration Reminder Example 5-4 Temporary Capacity Expiration Reminder Temporary Instant Capacity Warning Period Icapmodify -w Temporary Instant Capacity Error for Activation with Insufficient Temporary Capacity Temporary Instant Capacity ExceptionsTemporary Capacity Balance Needing Action Temporary Capacity Negative Balance Temporary Instant Capacity Temporary Instant Capacity Exceptions Page Instant Capacity Cell Board Instant Capacity Cell Board Ordering Instant Capacity Cell Board HP-UX and OpenVMS License and Support Acquiring Usage Rights for Instant Capacity Cell Board Cell Board Activation Requiring Additional Core Usage Rights Activation of an Instant Capacity Cell Board Accidental Activation of an Instant Capacity Cell Board Instant Capacity Cell Board Activation Exception Error Instant Capacity Cell Board and Temporary Instant Capacity Global Instant Capacity Global Instant Capacity Overview Using Global Instant Capacity Global Instant Capacity Requirements Global Instant Capacity Group Managers Standby Group Managers Run icapmanage -Q Global Instant Capacity Grouping Rules Global Instant Capacity Sharing Rights Example 7-1shows how to apply a sharing rights codewordExample 7-1 Applying a Sharing Rights Codeword Creating Global Instant Capacity Groups Example 7-2 Creating a Group Example 7-3 Adding a Member to a Group Usr/sbin/icapstatus Example Core Rights Sharing Global Instant Capacity Resource SharingEffect of Temporary Capacity Status Reporting Example Cell/Memory Sharing Example Activation Using Pooled Temporary Capacity Global Instant Capacity and Temporary CapacityTemporary Capacity and Freed Usage Rights Temporary Capacity and Status Reporting Temporary Capacity Prefetch Removing a Global Instant Capacity Group Member Reinstalling a Group Member Group Manager Availability No Standby Manager Group Manager Failover Considerations Upgrades and Global Instant Capacity Adding New Partitions Rights Seizure When to Migrate Usage Rights and When to Seize Usage RightsEffects of Rights Seizure Down Partitions with Powered-On Cells Temporary Capacity and Rights Seizure Other Considerations Additional HA SolutionsSummary of Rights Seizure Rights Seizure Http//docs.hp.com Considerations for Multiple Groups Additional Considerations ICAP From compliance check paradigm to self enforcement Using Instant Capacity on HP Integrity SuperdomeCase 3 GiCAP Installing iCAP on HP Integrity Superdome Important ConsiderationsSizing Partitions Resizing Partitions Viewing number of active cores ICAP commandsGenerating snapshot Setting usage rights for a partition Using iCAP MemoryDeactivating Cores Activating Cores Use Case 1 Initial Configuration ICAP Use CasesCore migration between partitions in a complex NPar2 Use Case 1 Configuration of Complex After Core Migration Use Case 2 Initial Configuration4contains Initial configuration of Complex2 Configuration of Complex1 post core migration Configuration of Complex2 post core migration 136 Troubleshooting Handling Compliance Exceptions More cells active than expected Negative temporary capacity balance Troubleshooting the Instant Capacity Software Additional Troubleshooting Steps for Email Connectivity Diagnosing Email Configuration As root, execute the command Frequently Asked Questions Instant Capacity Software Icapmodify if a configuration change Asset reporting email sent by the Instant Capacity software Triggered By Instant Capacity Hardware Global Instant Capacity Instant Capacity HP-UX Manpages ICAP5 Initializing an Instant Capacity ServerCodewords ICAP --Instant Capacity software for HP-UX Software Removal Status of Instant Capacity Components Virtual Partitions HP Integrity Virtual Machines Integrity VMProcessor Sets Temporary Capacity TiCAP Program Global Instant Capacity Instant Capacity Cell BoardGiCAP Groups GiCAP Group Manager Standby GiCAP Group ManagerGiCAP Group Members GiCAP Grouping Rules Upgrades and GiCAP GiCAP Group CreationGiCAP Resource Sharing GiCAP Member Removal Group Compliance Groups and the TiCAP BalanceMultiple Group Considerations Group Manager Failover Considerations Additional GiCAP Considerations Compliance See Also Icapmanage1M Synopsis Options Group, you are prompted for the root password for each Specified host. The password is used for initialSpecify virtual machine or guest OS instances Communication only and is not saved or stored If there are intermittent problems with network Used when the vPar or nPar configuration of a memberHost to be added. The password is used for initial For a given command execution, host removals are Provide verbose status information. Include all levels Information group, manager and member. For GroupManagers, include resources being held by the Group Manager including temporary capacity. For members 164 Using the -zoption before failback Available in the GiCAP group or the command failsThis option can be useful particularly when core usage Containing the specified host. Core usage rights must be Hardware and grouping rules. Specification of the -U File instead of the installed rule file, and can be used toHost system to be set up as a standby Group Manager This command will prompt for the root password Symbols used in the display Status InformationInformation displayed for each GiCAP group Host names comprising each member complex For inactive cells associated with inaccessible Inaccessible members no partitions could beInactive because usage rights have not been Purchased Field is displayed only when the -voption is From member systems where noneSeized from members where none Specified Members for disaster recovery When the -voption is specified. However, ifPartitions could be contacted. This member Summary field is not displayed when Members for purposes of disaster recovery Is specified and only for systems where usageMember system from which they were Seized Environment Variables International Code Set Support Show the full status of the ADMIN1 group Remove the ADMIN1 groupRemove host mystandby from use as a standby Group Manager Take control as an active Group Manager Icapmodify1M Compliance Intended Active Options and Arguments Reboot. This option modifies the default behavior Pending deferred request and resets the values forCausing an immediate activation or deactivation Rights across the complex, on the next reboot of any Not necessary to use the -toption when using the -d Command temporarily reduces the consumptionTemporary capacity. a subsequent core activation using Configuration change notification email Apply an iCAP codeword Set the system contact email address to superuser@corp.com Set the systemid to AssetNum234Icapmodify was developed by HP Icapnotify1M Obsolescent Turn configuration change notification on Turn configuration change notification offTurn email asset reporting on Turn email asset reporting off Icapstatus1M Symbols used in the displayIcapstatus display fields Information displayed for a GiCAP group Information displayed for the local virtual partition From the GiCAP groupBorrowed/Loaned memory usage Local virtual partition that are currently active Information displayed for the local nPartition Instant Capacity Resource Summary Complex Activated during a boot operation. Typically, this is Command. Other commands such as parmodifyMember of a group For the hard partition Icapstatus was developed by HP Icapd --Instant Capacity iCAP daemon Icapd1MIcapd was developed by HP 190 Special Considerations This appendix covers the following topics Assumed Processor Values Assumed Values in icapstatus CommandAssumed Memory Values Upgrading to Instant Capacity version B.06.x or later HP-UX Execute the following command Usr/sbin/icodmodify command Dual-Core Support in Instant Capacity Systems New Partition Creation and Instant Capacity Table A-1 Removing a Cell and Decreasing Inactive Cores Shutting Down a Partition with Instant Capacity Cores Page Par Commands from PC System Management Station Psets on nPars Instant Capacity Compatibility with Processor Sets HP-UXPsets on vPars Configuring Email on Instant Capacity Systems Email ConfigurationOn Partitionable Systems Before you start Sendmail application Overview of email routing across the internet Steps to Confirm or Diagnose Email Configuration Configuring Instant Capacity’s From Email AddressConfiguring a Specified From Address Reverting to the Default From Address Configuring Your Server to Send but Not Receive Email Testing Email Transmission of the Asset Report Measurement Software and Instant Capacity Systems HP OpenView Measurement ProductsOther Measurement Software On HP Integrity Superdome Systems Dynamic Processor Resilience HP-UX Monarch Processors Security Issues Security Tuning OptionsCustomer protections which iCAP assumes to be in place Disabling the iCAP daemon HP-UX Considerations for OpenVMS Systems HP-UX Style Commands OpenVMS Command MappingTable B-1 HP-UX and OpenVMS Command Equivalents CLI Support on OpenVMS OpenVMS iCAP Files Table B-2 OpenVMS iCAP Files DCL Commands DCL Icap CommandName Format Icap Apply Parameter Icap Deactivate Icap Reconcile Parameters Value Icap SET Warningdays days Icap Show Description Icapserver iCAP server process Core Activation and Deactivation Special OpenVMS-Specific Features and ConsiderationsEmail Considerations Restrictions 222 Glossary Activate cell EFI Inactive RTU TiCAP Wbem Index Hpmc RTU Wbem