HP Serviceguard manual Username john Userhost bit, Role Conflicts, Username root

only. These roles are not exclusive; for example, you can configure more than one PACKAGE_ADMIN for the same package.

NOTE: You do not have to halt the cluster or package to configure or modify access control policies.

Here is an example of an access control policy:

USER_NAME john

USER_HOST bit

USER_ROLE PACKAGE_ADMIN

If this policy is defined in the cluster configuration file, it grants user john the PACKAGE_ADMIN role for any package on node bit. User john also has the MONITOR role for the entire cluster, because PACKAGE_ADMIN includes MONITOR. If the policy is defined in the package configuration file for PackageA, then user john on node bit has the PACKAGE_ADMIN role only for PackageA.

Plan the cluster’s roles and validate them as soon as possible. If your organization’s security policies allow it, you may find it easiest to create group logins. For example, you could create a MONITOR role for user operator1 from ANY_CLUSTER_NODE. Then you could give this login name and password to everyone who will need to monitor your clusters.

Role Conflicts

Do not configure different roles for the same user and host; Serviceguard treats this as a conflict and will fail with an error when applying the configuration. “Wildcards”, such as ANY_USER and ANY_SERVICEGUARD_NODE, are an exception: it is acceptable for ANY_USER and john to be given different roles.

IMPORTANT: Wildcards do not degrade higher-level roles that have been granted to individual members of the class specified by the wildcard. For example, you might set up the following policy to allow root users on remote systems access to the cluster:

USER_NAME root

USER_HOST ANY_SERVICEGUARD_NODE

USER_ROLE MONITOR

This does not reduce the access level of users who are logged in as root on nodes in this cluster; they will always have full Serviceguard root-access capabilities.

Consider what would happen if these entries were in the cluster configuration file:

#Policy 1: USER_NAME john USER_HOST bit

USER_ROLE PACKAGE_ADMIN

#Policy 2:

USER_NAME john

USER_HOST bit

USER_ROLE MONITOR

# Policy 3:

USER_NAME ANY_USER

USER_HOST ANY_SERVICEGUARD_NODE USER_ROLE MONITOR

In the above example, the configuration would fail because user john is assigned two roles. (In any case, Policy 2 is unnecessary, because PACKAGE_ADMIN includes the role of MONITOR.)

Policy 3 does not conflict with any other policies, even though the wildcard ANY_USER includes the individual user john.

196 Building an HA Cluster Configuration