Chapter 1 Managing the N1 System Manager on the Management Server

This chapter provides information about the N1 System Manager user interfaces, security features, user management, and backup and restore procedures for the management server. For an overview of the Sun N1 System Manager features and components, see the Sun N1 System Manager 1.1 Introduction.

The main sections in this chapter are as follows:

• Introduction to Accessing the N1 System Manager

• Introduction to N1 System Manager User Security

• Managing Users

• Managing Roles

• Backing Up and Restoring N1 System Manager Database and Configuration Files

Introduction to Accessing the N1 System Manager

The two ways to manage a rack of provisionable servers using the N1 System Manager are as follows:

• Command line – The n1sh command. The default method is to use the n1sh shell, which uses an N1–ok> prompt. The shell mode provides a tab completion feature to navigate through all the command options. See the n1sh man page for details.

• Browser interface – A web-based user interface that provides a subset of the command line features. The browser interface also includes the n1sh shell in the Command Line pane. As you use the browser interface to perform management tasks, the corresponding commands are displayed in the Command Line pane. The Command Line pane provides the same features as the n1sh command in shell mode.

The n1sh command provides two other ways to issue management commands. The n1sh -e option, or UNIX® command mode, enables you to type management commands one at a time within a UNIX® shell. The n1sh -f option enables you to specify a custom script of management commands to run. See the n1sh man page for details.

Command Line Tips

This section contains a few tips to help you use the N1 System Manager command line interface.

id Keyword

The id keyword is an optional keyword that can be used on the N1 System Manager command line before some attribute values, typically for the server attribute value. The purpose of this keyword is to provide an attribute value that may be the same name as a reserved keyword (for example, a server named all).

Equal Sign

The equal sign (=) can be optionally used between attributes and values on the N1 System Manager command line. For example, the following commands are equivalent:

N1-ok> set role MyRole description myDescription
N1-ok> set role MyRole description=myDescription

The equal sign variant is not shown in the command line help.

Script Comments

When creating a customized n1sh script, you can specify the comment character (#) at the beginning of the line to indicate that the rest of the line should be ignored. See To Run a Script of N1 System Manager Commands for details.

Multiple Attribute Values

Where allowed, multiple attribute values can be specified as a comma–separated list on the N1 System Manager command line. For example:

N1-ok> set server serverA,serverB,serverC locator on

In the command line help, multiple attribute values are shown using the following syntax notation: set server <server>[,<server>...]

Quotation Marks

Single and double quotation marks are supported on the N1 System Manager command line. If needed, either type of quotation mark can be escaped using the backslash character. For example:

N1-ok> set role myRole description "Some Role that I've made up"
N1-ok> set role myRole description='Some Role that I\'ve made up'

Special Characters

Depending on the shell you are using to run n1sh in UNIX command mode, some special characters may need to be escaped. For example, in the bash shell, quotes need to be escaped with the backslash character, like this:

$ n1sh set role MyRole description=\"Some Role that \\\"Paul\\\" made up\"

See your specific shell's documentation for detailed information on escaping special characters.

In the n1sh shell mode, you do not have to escape special characters, so the same command described above would look like this:

N1-ok> set role MyRole description="Some Role that \"Paul\" made up"

To Access the N1 System Manager Command Line

The following procedure describes how to access the N1 System Manager command line (the n1sh shell) as a valid user from a remote system. You can also access the command line directly on the management server.

Before You Begin

During management server configuration, the superuser (root) account is set up with all the system default roles added to it (Admin, ReadOnly, and SecurityAdmin). If you want to log in as a valid user other than the superuser account, see To Add an N1 System Manager User.

Steps

1. Log in to the management server from a remote system.

   $ ssh -l user-name management-server

   Where user-name is a valid N1 System Manager user, and management-server is the host name or IP address of the management server.

   You are prompted for a password.

2. Type a password for the user account.

   The N1–ok> prompt is displayed and you are logged in with your default N1 System Manager role, unless you use the -r option to specify a role for login.

3. If the N1–ok> prompt does not display, type the following command to access the command line:

   # /opt/sun/n1gc/bin/n1sh [-r role-name]

   The superuser (root) user account typically does not have its login configured to automatically log in to the n1sh shell.

4. (Optional) To switch to a different N1 System Manager role that has been added to your user account, type the following command:

   N1-ok> set session role role

   See set session in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

To Access the N1 System Manager Browser Interface

The following procedure describes how to log in to the N1 System Manager browser interface through the Sun Web Console.

Before You Begin

During management server configuration, the superuser (root) account is set up with all the system default roles added to it (Admin, ReadOnly, and SecurityAdmin). If you want to log in as a valid user other than the superuser account, see To Add an N1 System Manager User.

The following browsers are supported:

• Netscape Navigator^TM 7.1 or later (Linux or Microsoft Windows version)

• Mozilla^TM 1.4 or later (Solaris, Linux, or Microsoft Windows version)

• Internet Explorer 6 or later (Microsoft Windows version)

Accessibility features in the N1 System Manager browser interface include descriptions of images and tables, keyboard navigation, and tool tips.

When the cursor is positioned at the N1-ok> prompt in the Command Line pane, the arrow keys can be used to view only the previous command typed or the next command in the history. To move the cursor to the top of the Command Line pane, press Shift+Tab and then press the up arrow key. To move focus from the Command Line pane to other areas of the browser interface, press Shift+Tab twice.

Help text near the top of most screens describes the purpose of that screen. Brief help text also appears beneath entry fields and associated check boxes, radio buttons, and text entry fields.

Steps

1. Log in to the Sun Web Console on the management server through the following URL:

   http://management-server

   where management-server is the host name or IP address of the management server.

   The Sun Web Console login page is displayed.

2. Log in to the Sun Web Console by using your N1 System Manager user name and password.

   The Sun Web Console launch page is displayed.

3. Click the Sun N1 System Manager link to launch the Sun N1 System Manager browser interface.

   The browser interface is displayed, and you are logged in with your default N1 System Manager role. See Access the N1 System Manager in Sun N1 System Manager 1.1 Introduction for an overview of the browser interface.

4. (Optional) To switch to a different N1 System Manager role that has been added to your user account, type the following command in the Command Line pane:

   N1-ok> set session role role

   See set session in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

To Show Your Current Session Role

Your role might affect your ability to access certain features of the N1 System Manager. By default, you are logged into the N1 System Manager with your default role.

See Managing Roles for more details about roles.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Show your current session role.

   N1-ok> show session

To Switch Your Session Role

If you have more than one role, you can switch between multiple roles to perform tasks that require specific privileges.

See Managing Roles for more details about roles and privileges.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Switch to a different session role.

   N1-ok> set session role role

   See set session in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

To Exit the N1 System Manager Command Line

Step

Exit the N1 System Manager command line.

N1-ok> exit

The n1sh shell is terminated.

To Run a Script of N1 System Manager Commands

The following procedure describes how to run a custom script of N1 System Manager commands that are saved in a file. Return codes are returned for each command. Also, you can specify a comment character (#) at the beginning of the line to indicate that the rest of the line should be ignored.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

   If the n1sh shell is your default login shell on the management server, you must change this configuration. Otherwise, you won't be able to run the n1sh command and use the script option.

2. Run a custom script that contains the N1 System Manager commands.

   # /opt/sun/n1gc/bin/n1sh -f filename

   where filename is a fully qualified path to the custom script file.

Example 1–1 n1sh Custom Script File

The following example shows an n1sh script file, which can be run with the n1sh -f command.

# n1sh custom script

show group all 

create group RACK1   
create group RACK2   
create group RACK3   
create group RACK4   
create group RACK5   


add group RACK1 server SERVER1  
add group RACK1 server SERVER2  

add group RACK2 server SERVER3  
add group RACK2 server SERVER4  


add group RACK3 server SERVER5  
add group RACK3 server SERVER6  

add group RACK4 server SERVER7  
add group RACK4 server SERVER8  

add group RACK4 server SERVER9  
add group RACK4 server SERVER10  

add group RACK5 server SERVER11  
add group RACK5 server SERVER12  

show group all

Introduction to N1 System Manager User Security

This section provides information about how to set up and manage user security for the N1 System Manager.

The following tasks are used to manage N1 System Manager users:

• To Add an N1 System Manager User

• To Delete an N1 System Manager User

• To Set a User's Default Role

• To Show a User's Default Role

• To Add a Role to a User

• To Remove a Role From a User

• To List the Roles Added to a Specific User

The following tasks are used to manage N1 System Manager roles:

• To Create a Role

• To Delete a Role

• To Add a Privilege to a Role

• To Remove a Privilege From a Role

• To List the Available Roles

• To List Privileges Added to a Role

• To List the Roles Added to All Users

• To List the Available Privileges

The N1 System Manager provides a user account system that allows users to have role-based access to its main features (commands and browser interface areas) through a predefined, fixed set of privileges. A privilege is a predefined set of permissions enabling a user to perform operations within the N1 System Manager, such as installing OS distributions or deleting jobs. A role is a set of privileges to which a user has access. The N1 System Manager provides three system default roles, but customized roles can be created depending on your needs.

The following table lists the system default roles that are automatically provided by the N1 System Manager. These system default roles cannot be modified.

When you install the Sun N1 System Manager software, the management server's superuser (root) account has all three system default roles automatically added to it, and the Admin role is the account's default role.

Users with the SecurityAdmin role (security administrators) are allowed to create new roles as needed in their organization, which includes adding one or more privileges to those roles. Security administrators can also add roles to users.

For example, you might need to restrict specific users to perform only OS update management on the provisionable servers. A security administrator could create a new role, called OSUpdateAdmin, and add the following privileges to it: GroupRead, JobRead, LogRead, ServerDeployUpdate, ServerRead, UpdateRead, and UpdateWrite. See Table 1–2 for details about privileges. Then, the security administrator would add that role to those specific users. If OSUpdateAdmin is the only role added to the users, the users would not be able to access any part of the N1 System Manager other than the OS update management feature.

Non-root users with only the SecurityAdmin role are not allowed to extend their own privilege set, either by adding new privileges to the SecurityAdmin role (which cannot be modified) or by adding new roles to their own user account. See Security Administrator Rules for more details.

The following table lists the set of predefined privileges that may be added to roles. To display an abbreviated form of this list, use the show privilege command.

For more information about these commands, see the Sun N1 System Manager 1.1 Command Line Reference Manual.

Security Administrator Rules

The following list provides important rules for N1 System Manager security administrators:

• You can securely configure a non-root N1 System Manager user to have only security administrator privileges by adding only the SecurityAdmin role to the user. Such users cannot extend their own privilege set, either by adding new privileges to the SecurityAdmin role (which cannot be modified) or by adding new roles to their own user account.

• You cannot configure the root user to have only security administrator privileges.

• You cannot configure a user to have only security administrator privileges if the user has the SecurityAdmin role and a custom role added to it. Such users could use their SecurityAdmin privileges to add any privileges to the custom role and therefore extend their privilege set.

Managing Users

You can set up new N1 System Manager users at any time. When you install the Sun N1 System Manager software, the management server's superuser (root) account has all three system default roles automatically added to it, and the Admin role is the account's default role.

The following table provides a quick reference to all the tasks and associated commands used to manage users.

# useradd -s
# n1sh create user user role role

# n1sh delete user user
# userdel

For more information about these commands, see the Sun N1 System Manager 1.1 Command Line Reference Manual.

To Add an N1 System Manager User

Before You Begin

You must be superuser (root) to add a new user account to the management server's operating system. The rest of the task must be performed by a user with the SecurityAdmin role, such as the superuser account used in this task.

When you create a new user for the N1 System Manager, you can also configure the user's login shell to be either a UNIX® shell or the n1sh shell. If the user's login is configured with the n1sh shell, the user automatically logs into the n1sh shell (N1–ok> prompt) when logging in to the management server.

Steps

1. Log in to the management server as superuser from a remote system.

   $ ssh -l root management-server

   See To Access the N1 System Manager Command Line for details.

2. Add a new user account to the management server using the useradd command.

   Provide the following configuration details:

   • Use the useradd -s option to configure the user's shell to automatically log into the n1sh shell. For example: useradd -s /opt/sun/n1gc/bin/n1sh

   • Use the passwd command to set the user's password.

   • Add /opt/sun/n1gc/bin to the user's path in order to access the n1sh command.

   See the management server's useradd man page for more information.

3. Add the user to the N1 System Manager with one or more roles.

   # n1sh -r SecurityAdmin create user user role role[,role...]

   The -r option enables you to run the n1sh command with the SecurityAdmin role, which is required for this step. See create user in Sun N1 System Manager 1.1 Command Line Reference Manual for details. You can also use the add user command to later add more roles.

To Delete an N1 System Manager User

Before You Begin

You must be superuser (root) to delete an existing user account from the management server's operating system. The rest of the task must be performed by a user with the SecurityAdmin role, such as the superuser account used in this task.

Steps

1. Log in to the management server as superuser from a remote system.

   $ ssh -l root management-server

   See To Access the N1 System Manager Command Line for details.

2. Delete the user from the N1 System Manager.

   # n1sh -r SecurityAdmin delete user user

   The -r option enables you to run the n1sh command with the SecurityAdmin role, which is required for this step. See delete user in Sun N1 System Manager 1.1 Command Line Reference Manual.

3. (Optional) Delete the user account from the management server by using the management server's userdel command.

To Set a User's Default Role

Users are automatically logged in to the N1 System Manager with their default role.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Show which roles are added to the user.

   N1-ok> show user user

   See show user in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

3. Set a user's default role.

   N1-ok> set user user defaultrole defaultrole

   See set user in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

Example 1–2 Setting a User's Default Role

The following example shows setting the SecurityAdmin role as the default role for the root user.

N1-ok> show user root

Name:         root
Default Role: Admin
Roles:        SecurityAdmin, ReadOnly, Admin


N1-ok> set user root defaultrole SecurityAdmin

To Show a User's Default Role

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Show a user's default role.

   N1-ok> show user user

   See show user in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

Example 1–3 Showing a User's Default Role

The following example shows that the root user has the Admin default role.

N1-ok> show user root

Name:         root
Default Role: Admin
Roles:        SecurityAdmin, ReadOnly, Admin

To Add a Role to a User

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Add one or more roles to a user.

   N1-ok> add user user role role[,role...]

   See add user in Sun N1 System Manager 1.1 Command Line Reference Manual for details. You can use the show role all command to list all of the valid roles.

To Remove a Role From a User

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Remove one or more roles from a user.

   N1-ok> remove user user role role[,role...]

   See remove user in Sun N1 System Manager 1.1 Command Line Reference Manual for details. You can use the show user user command to list all the roles currently added to the user.

To List the Roles Added to a Specific User

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. List the roles that are added to a user.

   N1-ok> show user user

   See show user in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

Example 1–4 Listing the Roles that are Added to a Specific User

The following example shows that the root user currently has the SecurityAdmin, ReadOnly, and Admin roles.

N1-ok> show user root

Name:         root
Default Role: Admin
Roles:        SecurityAdmin, ReadOnly, Admin

Managing Roles

Table 1–1 lists the system default roles that are automatically provided by the N1 System Manager. These system default roles cannot be modified. However, you can create customized roles for your users to fit your organizational and business needs.

The following table provides a quick reference to all the tasks and associated commands used to manage roles.

For more information about these commands, see the Sun N1 System Manager 1.1 Command Line Reference Manual.

To Create a Role

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Create a new role with one or more privileges.

   N1-ok> create role role [description description] privilege privilege[,privilege...]

   Use the show privileges all command to list all of the valid privileges or see Table 1–2.

   See create role in Sun N1 System Manager 1.1 Command Line Reference Manual for details. You can also use the add role command to later add privileges to the role.

To Delete a Role

Before You Begin

A role cannot be deleted if it is currently added to one or more users. If you try to delete a role that is being used, an error occurs. To successfully delete a role, an authorized user must first remove the role from all users and then attempt the role deletion.

Use the show role all command to list all of the valid roles.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Delete a role.

   N1-ok> delete role role

   See delete role in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

To Add a Privilege to a Role

Before You Begin

Use the show privilege all command to list all of the valid privileges or see Table 1–2.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Add one or more privileges to a role.

   N1-ok> add role role privilege privilege[,privilege...]

   See add role in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

   ---

   Tip –

   If you want to add most of the privileges to a role, you can use the all option to add all the privileges and then use the remove role command to remove the unneeded privileges.

   ---

To Remove a Privilege From a Role

Before You Begin

Use the show role role command to list all of the privileges currently added to a role.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. Remove one or more privileges from a role.

   N1-ok> remove role role privilege privilege [,privilege...]

   See remove role in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

To List the Available Roles

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. List the available roles.

   N1-ok> show role all

To List Privileges Added to a Role

Before You Begin

Use the show role all command to list all of the valid roles.

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. List the privileges that are added to a role.

   N1-ok> show role role

   See show role in Sun N1 System Manager 1.1 Command Line Reference Manual for details.

Example 1–5 Listing Privileges Added to a Role

The following example shows that the SecurityAdmin role has five privileges added to it.

N1-ok> show role SecurityAdmin

Name:       SecurityAdmin
Privileges: UserWrite, RoleWrite, RoleRead, PrivilegeRead, UserRead

To List the Roles Added to All Users

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. List the roles that are added to all users.

   N1-ok> show user all

To List the Available Privileges

Steps

1. Log in to the N1 System Manager.

   See To Access the N1 System Manager Command Line for details.

2. List the available privileges.

   N1-ok> show privilege all

Backing Up and Restoring N1 System Manager Database and Configuration Files

This section provides the following procedures:

• To Back Up the N1 System Manager Database and Configuration Files

• To Restore the N1 System Manager Database and Configuration Files

These procedures describe how to back up and restore the N1 System Manager database and configuration files. Successful completion of these procedures enables you to do the following:

• Swap management server and management server-related hardware without losing the N1 System Manager database and configuration files.

• Replicate the database and configuration files from one N1 System Manager installation to another installation.

To Back Up the N1 System Manager Database and Configuration Files

This procedure describes how to back up the database and configuration files from a running management server.

The N1 System Manager service is restarted several times during this process. Therefore, perform these steps only when the N1 System Manager is not currently running jobs.

Do not change the configuration or OS usage of the provisioned servers during the period between the backup and restore procedures.

Before You Begin

Identify a server with similar hardware and network configurations as that of the original management server.

Steps

1. Log in to the management server as superuser (root).

   See To Access the N1 System Manager Command Line for details.

2. Run the n1smbackup.sh script.

   For example:

   # /opt/sun/n1gc/bin/n1smbackup.sh This program will back up Sun N1SM on this Linux/SunOS machine. The N1SM services will be restarted and N1SM will be interrupted during the process. All files related to N1SM, including network interface configuration, will be backed up. Therefore, it is recommended that these files are restored to an identical hardware setup. Verify that N1SM does not have outstanding jobs before proceeding. The backup process will take about 8 minutes. Would you like to continue? [y/N] y Backing up configuration files (done) Backing up SCS database (done) Backing up SPS database (done) N1SM restarted. N1SM backup completed. Backup saved to file /var/tmp/n1smbackup/n1smbackup.tgz.

   The backup file and the /var/tmp/n1smbackup directory are created.

3. Save the /var/tmp/n1smbackup/n1smbackup.tgz file to a safe location, for example, to CD media, FTP, or NFS.

Next Steps

To Restore the N1 System Manager Database and Configuration Files

To Restore the N1 System Manager Database and Configuration Files

This procedure describes how to restore the database and configuration files to a newly installed management server.

The N1 System Manager service is restarted several times during this process. Therefore, perform these steps only when the N1 System Manager is not currently running jobs.

These steps require that the N1 System Manager is not yet installed on the server. Also, preferably, a new installation of either Linux or the Solaris OS is installed on the server.

The n1smbackup.sh script backs up only the N1SM database and configuration files. The actual OS files are not backed up. After running n1smrestore.sh, OS distributions and OS profiles that exist in the database will need to be deleted and recreated.

Before You Begin

• Follow the instructions in To Back Up the N1 System Manager Database and Configuration Files to backup the database and configuration files.

• Identify a server with similar hardware and network configurations as that of the original management server.

Steps

1. Log in to the management server as superuser (root).

   See To Access the N1 System Manager Command Line for details.

2. Run the n1smconfig utility.

   # /usr/bin/n1smconfig

   The current system configuration appears, and lists the network interfaces. You are then asked to enter the interface for the provisioning network.

3. Specify the port for the provisioning network interface.

   The available interfaces are listed in the prompt. Type the interface name that is to be used for the provisioning interface, for example eth0, hme0, bge0 and so on depending on the machine architecture and installed OS.

4. Answer the remaining questions in the n1smconfig utility.

   Note that the remaining answers given in n1smconfig will be overwritten by the following steps in this procedure. But, it is important to provide the answers and to apply the new settings in order to complete the restore process.

5. Create the /var/tmp/n1smbackup directory on the management server.

   # mkdir /var/tmp/n1smbackup

6. Copy the n1smbackup.tgz backup file to the /var/tmp/n1smbackup directory.

7. Restore the N1 System Manager database and configuration files:

   # /opt/sun/n1gc/bin/n1smrestore.sh -f /var/tmp/n1smbackup/n1smbackup.tgz This program will restore Sun N1SM from backup files. The N1SM services will be restarted and N1SM will be interrupted during the process. All files related to N1SM, including network interface configuration, will be restored. Therefore, it is recommended that these files are restored to an identical hardware setup. The restore process will take about 8 minutes. Would you like to continue? [y/N] y Restoring configuration files (done) Restoring SCS database (done) Restoring SCS database (done) N1SM restarted. N1SM restore completed. Run n1smconfig and verify that N1SM settings are correct.

8. Verify that the N1 System Manager configuration settings are still valid or modify them as appropriate.

   # /usr/bin/n1smconfig

9. Verify that the N1 System Manager is working as expected, using the browser interface or n1sh command line.

   See To Access the N1 System Manager Command Line for details.

10. (Optional) Remove any OS distributions or OS profiles that exist on the management server before creating new OS distributions and OS profiles.

    N1-ok> show os all ID Name Type Version 2 s10 solaris solaris10x86 N1-ok> show osprofile ID Name Distribution 2 s10 s10 N1-ok> delete osprofile s10 N1-ok> delete os s10 N1-ok> show os No items found. N1-ok> show osprofile No items found.

Next Steps

You will need to copy new OS distributions and create new OS profiles. See Copying OS Distributions and Flash Archives and To Create an OS Profile.