Sun Netra CT900 Server Administration and Reference Manual

The Sun Netra CT900 server is configured primarily through the active shelf management card command-line interface (CLI). The active shelf management card CLI enables system-level configuration, administration, and management that includes the node boards, the switch boards, the shelf management cards (ShMM), power entry modules (PEM), and fan trays. The shelf management card CLI interface can be used both locally and remotely.

This chapter includes the following sections:

• Accessing the Shelf Management Cards
• Setting Up U-Boot
• Configuring Shelf Management Card Ethernet Ports
• Setting Up the Shelf Manager Configuration File
• Setting the Date and Time
• Setting Up User Accounts on the Shelf Management Card
• Disabling Remote root Login
• Configuring OpenHPI on the Shelf Manager
• Configuring RADIUS on the Shelf Manager

---

Accessing the Shelf Management Cards

The Shelf Manager runs on top of a specialized implementation of Linux. The lowest layer of Linux is the U-Boot firmware monitor. When you initially access either shelf management card (ShMM), you must do so over the serial port (console), using an ASCII terminal or the Tip program. Each shelf management card supports multiple sessions (Tip and Telnet connections) at once. The default TCP/IP address for the active shelf management card is 192.168.0.2.

When connecting to a shelf management card (ShMM) through a serial port, connect a serial terminal or emulator to the one of the two serial ports on the front of the shelf alarm panel (SAP). Use the Serial 1 port to connect to the upper shelf management card (ShMM1), which is the default active shelf management card. The Serial 2 port connects to the default backup card (ShMM2). FIGURE 2-1 shows the location of the serial ports for the upper and lower shelf management cards. The terminal or modem setting should be set to 115200, N, 8, 1.

FIGURE 2-1 Shelf Alarm Panel Connector

When you first access the shelf management card, log in as root and use the default password sunct900. This account is set to full authorization (permissions). This account can not be deleted. However, you should change the password on this account for security purposes, before your server is operational.

Use the Linux passwd command to change the root password as follows:

# passwd
 
Changing password for root
Enter the new password (minimum of 5, maximum of 8 characters)
Please use a combination of upper and lower case letters and numbers.
Enter new password: xxxxxxx
Re-enter new password: xxxxxxx
Password changed.
# 

Once you are logged on, use the clia shmstatus command to verify that you are logged onto the active shelf management card before continuing. If you are logged onto the standby shelf management card, you can use the clia switchover command to change the shelf management card to Active, or exit and log onto the active shelf management card. (See shmstatus and switchover for more information.)

The following sections provide information on configuring shelf management card Ethernet ports and setting up user accounts and passwords using the shelf management card CLI. For more information on using the shelf management card CLI, see Chapter 3.

---

Setting Up U-Boot

On a power-on and reboot of the shelf management card (ShMM), the hardware starts executing the U-Boot firmware in Flash memory. The firmware performs basic initialization of the ShMM, and unless the user explicitly disables the Autoboot feature (thus forcing the firmware to switch to the maintenance user command interface), commences booting the Linux kernel. Linux is booted from the kernel and root file system images residing in Flash. U-Boot relocates the kernel image to RAM, sets up kernel parameters, and passes control to the kernel entry point.

U-Boot Interface

U-Boot is accessible via the serial port of the ShMM and requires configuration specific to the intended operational environment. When the ShMM is powered up, the following information is displayed on the console:

U-Boot 1.1.2 (Nov 11 2005 - 11:32:08)
 
CPU: Au1550 324 MHz, id: 0x02, rev: 0x00
Board: ShMM-500
S/N: 08004610 
DRAM:  128 MB
Flash:  64 MB
In:    serial
Out:   serial
Err:   serial
Net:   Au1X00 ETHERNET
Hit any key to stop autoboot:  0
#
 

# is the prompt allowing for user commands to be entered.

U-Boot Environment Variables

U-Boot includes a set of environment variables that should be configured prior to use. TABLE 2-1 describes the default set of environment variables.

Displaying Environment Variable Values

Displaying the environmental variables can be done in either the U-Boot shell or the Linux shell.

Displaying Environment Variables in U-Boot Shell

To display the current environment variable values from within the U-Boot shell, use the printenv command. If no arguments is given, the printenv outputs all the environment variable values:

printenv [variable_name]

For example:

shmm500 printenv bootdelay
bootdelay=3

Displaying Environment Variables in Linux Shell

To display the current environment variable values from the Linux shell, use the getenv command. If no arguments is given, the getenv outputs all the environment variable values:

getenv [variable_name]

For example:

# getenv bootdelay
bootdelay=3

Assigning Values to Environment Variables

Assigning values to the environmental variables can be done in either the U-Boot shell or the Linux shell using the setenv command. When variables are set in the U-Boot shell, the saveenv command is needed to save the changes to the Flash.

To assign a value to an environment variable, use the format:

setenv variable_name new_value

For example:

 setenv bootdelay 1

If you are setting variables in the U-Boot shell, save the changes by entering:

 saveenv

Default Environment Variables for the Shelf Manager

When U-Boot is started for the first time, the following default environment variables are defined:

baudrate=115200
ipaddr=192.168.0.22
serverip=192.168.0.7
netmask=255.255.255.0
bootfile=sentry.kernel
ramdisk=sentry.rfs
rootpath=/rootfs
ramargs=setenv bootargs root=/dev/ram rw
net=tftpboot 80400000 $(bootfile); tftpboot 81200000 $(ramdisk); run ramargs
addmisc; bootm 80400000 81200000
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)
addip=setenv bootargs $(bootargs)
ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(ipdevice)
addmisc=setenv bootargs $(bootargs) $(quiet) console=$(console),$(baudrate)
reliable_upgrade=$(reliable_upgrade)
nfs=tftpboot 80800000 $(bootfile); run nfsargs addip addmisc; bootm
bootcmd=run ramargs addmisc; bootm $(kernel_start) $(rfs_start)
console=ttyS0
quiet=quiet
ipdevice=eth0
ip1device=eth1
ip1addr=192.168.1.2
gatewayip=192.168.0.1
rmcpaddr=192.168.0.2
hostname=shmm500
flash_reset=n
password_reset=n
logging=ram
timezone=UTC
rc_ifconfig=n
start_rc2_daemons=y
reliable_upgrade=y
ethact=Au1X00 ETHERNET
stdin=serial
stdout=serial
stderr=serial
ethaddr=00:18:49:00:0c:42
eth1addr=00:18:49:00:0c:43
serial#=08009847
kernel_start=0xbe080000
rfs_start=0xbe440000
rc2=/etc/rc.acb3
bootdelay_old=3
post_normal=
bootdelay=3

Several of these environment variables must reconfigured with values that are appropriate to the network context in which the ShMMs are used.

Recommendations for Changing U-Boot Variables

Because changing certain U-Boot variables can cause system problems, administrators should be aware of the following recommendations before making any changes.

The following U-Boot variables can be changed:

The following variables should only be changed for debugging by advanced users:

The following variables should not be changed:

The following Ethernet configuration variables should not be changed:

---

Configuring Shelf Management Card Ethernet Ports

Each shelf management card uses two Ethernet ports that are connected to the redundant switch cards. Since RMCP is the only shelf external interface that is required by ATCA, the shelf’s external Ethernet ports are referenced as the RMCP ports, though the other shelf’s external interfaces (Telnet) are accessible via this port as well.

Once connected, you must be logged in to the shelf management card with a user account that has full permissions. You configure the ports with CLI commands, and then reboot the shelf management card for the changes to take effect.

Using the First Ethernet Interface

Since the RMCP Ethernet port is directly connected to the site network, the IP address should be set up appropriately for that network. For example, if the site uses the IP address range 192.168.0.x, the RMCP Ethernet port should be set to a unique IP address within that range, such as 192.168.0.2. In a redundant ShMM setup, only one ShMM (the active ShMM) has the RMCP IP address enabled on the RMCP Ethernet port. The backup ShMM assigns the same IP address to the RMCP Ethernet port, but only enables it when that ShMM assumes the active role. This way, the RMCP IP address maintains availability in a failover situation.

Assigning an Additional IP Address to the First Network Interface

In the default configuration, no IP address is assigned to the first network interface (and the ShMM is not accessible over the network) until the Shelf Manager starts and the RMCP IP address is assigned. However, it might be useful in some cases to assign an IP address to the RMCP network interface and have the ShMM accessible over the network as soon as the operating system is booted. In that case, it is also desirable for the RMCP IP address to coexist with the originally assigned IP address, rather than replacing it when the Shelf Manager is started.

To achieve this configuration, it is necessary to instruct the Shelf Manager to assign the RMCP IP address not to the first network adapter itself (eth0) but to its first alias (eth0:1). In that case, the initial IP address is assigned to the network adapter itself (eth0) during the start of the operating system. This initial assignment happens in the initialization script /etc/rc; it is accomplished by:

1. Enabling the U-Boot variable rc_ifconfig as follows:

setenv rc_ifconfig y

2. Assigning the original IP address to the U-Boot variable ipaddr. For example:

setenv ipaddr 192.168.1.240

3. Saving the changes before rebooting the ShMM.

U-Boot 1.1.4 (Feb 26 2009 - 06:28:24)
CPU: Au1550 324 MHz, id: 0x02, rev: 0x00
Board: ShMM-500
S/N: 08002600
DRAM:  (Samsung K4S511633F) 128 MB
Flash: 64 MB
In:    serial
Out:   serial
Err:   serial
ADM1060: configuration version 80
Net:   Au1X00 ETHERNET
Hit any key to stop autoboot:  3
 
shmm500 setenv rc_ifconig y
rc_ifconfig=y
shmm500
shmm500 setenv ipaddr 192.168.1.240
shmm500 printenv ipaddr
ipaddr=192.168.1.240
shmm500
shmm500 saveenv
Saving Environment to EEPROM...
shmm500
shmm500 boot

The IP address, 192.168.1.240, will show up as the eth0 interface of the ShMM.

4. Changing the value of the RMCP_NET_ADAPTER in Shelf Manager configuration file /etc/shelfman.conf to eth0:1. For example, changing RMCP_NET_ADAPTER = $IPDEVICE to:

RMCP_NET_ADAPTER = eth0:1

In a redundant configuration, the U-Boot variable ipaddr is allowed to have the same value on both ShMMs. The actual initial IP address assigned to each of the two redundant ShMMs is based on the value of ipaddr but modified depending on the hardware address of the ShMM. The least significant bit of the IP address is set to the least significant bit of the hardware address. In the example above, the IP address would be 192.168.1.240 for the ShMM with an even hardware address, and 192.168.1.241 for the ShMM with an odd hardware address. This modification of the IP address can be turned off by removing the file /etc/readhwaddr.

RMCP Address Propagation

An optional feature of the Shelf Manager allows the backup ShMM to also be exposed on the external network with an IP address that is different from the RMCP IP address only in the least significant bit. The netmask and default gateway on the backup ShMM would be the same as on the active ShMM. For example, if the RMCP IP address is 192.168.0.2, the backup ShMM would have the corresponding IP address 192.168.0.3, with the same netmask and default gateway. To enable this feature, it is necessary to define the Shelf Manager configuration parameter PROPAGATE_RMCP_ADDRESS as TRUE in the Shelf Manager configuration file (/etc/shelfman.conf).

Using the Second Ethernet Interface

The second network interface connects the Shelf Manager with one of the ATCA network hub boards. Dual USB-based network interfaces are used for communication between the redundant Shelf Managers.

Using Dual USB Network Interfaces for Redundant Communication

On the ShMM, two additional network interfaces are implemented over the two USB connections. In this configuration, they always connect the two redundant Shelf Managers. These interfaces are named usb0 and usb1. The interface usb0 always exists, while the interface usb1 exists only if the interface usb0 is active on the peer Shelf Manager (which means that the peer Shelf Manager is physically installed and running). Also, the interfaces are cross-connected: usb0 on the first Shelf Manager is connected to usb1 on the second Shelf Manager, and vice versa.

The Shelf Manager supports usage of the USB network interfaces for communication between the redundant Shelf Managers. To use this feature, it is necessary to define two redundancy network adapters in the Shelf Manager configuration file /etc/shelfman.conf, as follows:

REDUNDANCY_NET_ADAPTER = “usb0”
REDUNDANCY_NET_ADAPTER2 = “usb1”

One additional consideration relates to the definition of the subnet mask for the redundancy network interfaces. In the legacy case, when only one redundant network adapter is used, two different IP addresses are derived from the redundancy IP address specified in /etc/shelfman.conf. They are assigned to the two endpoints of the redundancy connection and differ only in the least significant bit.

However, when two redundancy network adapters are used, four different IP addresses are used, one for each of the endpoints (two endpoints on each of the two redundant Shelf Managers). To ensure proper operation, the two endpoints on the same Shelf Manager (usb0 and usb1) must belong to different logical networks, while usb0 on one Shelf Manager and usb1 on the other Shelf Manager must belong to the same logical network. Based on these considerations, the two additional IP addresses are derived by toggling the least significant bit of the subnet mask in the redundancy IP address specified in /etc/shelfman.conf. The subnet mask must therefore be stricter than the default for the specified redundancy IP address class. If the subnet mask is not specified, it is set by default to 255.255.255.128; this is also a recommended value for this parameter in /etc/shelfman.conf if USB network interfaces are used for redundancy.

Here is an example of deriving IP addresses for the USB network interfaces.

Suppose that the following definitions are in /etc/shelfman.conf:

REDUNDANCY_IP_ADDRESS = 192.168.1.2
REDUNDANCY_NETMASK = 255.255.255.128

On the ShMM with the even hardware address, the assignment of IP addresses would look like the following:

usb0: 192.168.1.2 (no changes)
usb1: 192.168.1.130 (toggling the least significant bit of the netmask)

On the ShMM with the odd hardware address, the assignment of IP addresses would looks like the following:

usb0: 192.168.1.131 (toggling the least significant bit of the IP address and the least significant bit of the netmask)

usb1: 192.168.1.3 (toggling the least significant bit of the IP address)

Changing the Default ShMM Network Parameters

Configuring a ShMM to work in a specific network environment requires changing the following network parameters:

• RMCP IP address
• RMCP GATEWAY address
• RMCP Netmask

Changing the RMCP network parameters is a multistep process. The U-Boot network environment variables must be updated, then the booted ACTIVE ShMM module network settings must be updated using the Shelf Manager CLI.

1. Attach a serial port console connection to the ShMM module.

This typically is 115200 baud, N/8/1. Reboot the ShMM carrier and press the space bar to interrupt the automatic boot process. You should see the following:

U-Boot 1.1.2 (Nov 11 2005 - 11:32:08)
 
CPU: Au1550 324 MHz, id: 0x02, rev: 0x00
Board: ShMM-500
S/N: 00 00 00 00 00 00 00 00 00 03 03 03 
DRAM:  128 MB
Flash: 64 MB
In:    serial
Out:   serial
Err:   serial
Net:   Au1X00 ETHERNET
Hit any key to stop autoboot: <any_key> #Hit any key now
shmm500

2. Echo the current network settings.

shmm500 getenv rmcpaddr netmask gatewayip
rmcpaddr=192.168.0.44
netmask=255.255.255.0
gatewayip=192.168.0.1
shmm500

3. Change the settings and commit to non-volatile storage.

shmm500 setenv rmcpaddr 10.1.1.10
shmm500 setenv netmask 255.255.0.0
shmm500 setenv gatewayip 10.1.1.1
shmm500 saveenv
Un-Protected 1 sectors
Erasing sector  0 ... Erasing sector at 0x  800000
ok.
Saving Environment to EEPROM...done.
shmm500

4. Boot the ShMM to full operational state and log in as user root.

shmm500 reset
 
U-Boot 1.1.2 (Nov 11 2005 - 11:32:08)
 
CPU: Au1550 324 MHz, id: 0x02, rev: 0x00
Board: ShMM-500
S/N: 00 00 00 00 00 00 00 00 00 03 03 03 
DRAM:  128 MB
Flash: 64 MB
In:    serial
Out:   serial
Err:   serial
Net:   Au1X00 ETHERNET
Hit any key to stop autoboot:  0 
## Booting image at bfb00000 ...
   Image Name:   MIPS Linux-2.4.26
   Created:      2005-05-07  17:35:21 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    843144 Bytes = 823.4 kB
   Load Address: 80100000
   Entry Point:  802bc040
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Loading Ramdisk Image at bfc40000 ...
   Image Name:   sentry RFS Ramdisk Image 
...
...
sentry login: root
 
BusyBox v0.60.5 (2005.05.07-17:27+0000) Built-in shell (msh)
# 

5. Allow the ShMM to start.

If this is the first time the Shelf Manager has been booted, or if the flash devices have been reset to factory default prior to boot, then the Shelf Manager uses the network settings provided by U-Boot to set up this networking context (and thus the changes you made in U-Boot are propagated forward).

Otherwise, then the following steps are required to configure the network settings in the Shelf Manager context.

6. Check to see if you are the active Shelf Manager.

You only need to make changes on the active shelf management card using the cpld command which also updates the backup with the network configuration changes through the redundancy interface. If you are not the active ShMM, then connect to the other ShMM device and continue to Step 7.

# cpld
CPLD word: E806
        0002h - Local Healthy
        0004h - Switchover Request Local
        0800h - Hot Swap Latch Open
        2000h - Active
        4000h - Interrupt Status
        8000h - Reboot Was Caused By Watchdog
#

7. Get the current IP settings

# clia getlanconfig 1
 
Pigeon Point Shelf Manager Command Line Interpreter
 
Authentication Type Support: 0x15 ( None MD5 Straight Password/Key )
Authentication Type Enables:
    Callback level: 0x00
    User level: 0x15 ( "None" "MD5" "Straight Password/Key" )
    Operator level: 0x15 ( "None" "MD5" "Straight Password/Key" )
    Administrator level: 0x15 ( "None" "MD5" "Straight Password/Key" )
    OEM level: 0x00
IP Address: 206.25.139.28
IP Address Source: Static Address (Manually Configured) (0x01)
MAC Address: 00:50:c2:22:50:30
Subnet Mask: 0.0.0.0
IPv4 Header Parameters: 0x40:0x40:0x10
Primary RMCP Port Number: 0x026f
Secondary RMCP Port Number: 0x0298
BMC-generated ARP Control: 0x02
    Enable BMC-generated ARP Response
Gratuitous ARP Interval: 2.0 seconds
Default Gateway Address: 206.25.139.3
Default Gateway MAC Address: 00:00:00:00:00:00
Backup Gateway Address: 0.0.0.0
Backup Gateway MAC Address: N/A
Community String: "public"
Number of Destinations: 16
Destination Type:
    N/A
Destination Address:
    N/A
#

8. Change the IP settings as shown.

# clia setlanconfig 1 ip 10.1.1.10
 
Pigeon Point Shelf Manager Command Line Interpreter
IP set successfully
 
# clia setlanconfig 1 subnet_mask 255.255.0.0
 
Pigeon Point Shelf Manager Command Line Interpreter
Subnet Mask set successfully
 
# clia setlanconfig 1 dft_gw_ip 10.1.1.1
 
Pigeon Point Shelf Manager Command Line Interpreter
Default Gateway Address set successfully
#

Assigning Different IP Addresses to Upper and Lower ShMMs

In the default configuration, the active ShMM can be accessed using the RMCP IP address and backup ShMM accessed using the RMCP IP1 address (which is assigned automatically). In some networks is might be desirable to identify the ShMMs using IP addresses that are different from the RMCP address. The advantage being that the active ShMM can be accessed using either its IP address or RMCP address, and backup ShMM can be accessed using its IP address.

To configure ShMMs with one IP address each and a single RMCP address that is shared (that is; only the active ShMM will have the RMCP address), do the following:

1. Configure the upper ShMM.

a. Change the U-Boot variables on the upper ShMM as shown. See Assigning Values to Environment Variables for more information.

setenv ipaddr IP-addr-for-upper-ShMM 
 
setenv ipdevice eth0
# Default DO NOT CHANGE
setenv ip1addr 192.168.1.2
# Default DO NOT CHANGE
setenv ip1device usb0
# Default DO NOT CHANGE
setenv gatewayip gateway-ip-address
 
setenv netmask netmask
# Usually 255.255.255.0
setenv rc_ifconfig y
 
setenv hostname hostname-of-lower-ShMM
# Optional
saveenv
# Optional - use in U-Boot
# shell to save variables

b. Edit the /etc/shelfman.conf file on the upper ShMM:

i. Change the value of the PROPAGATE_RMCP_ADDRESS variable to FALSE.

PROPAGATE_RMCP_ADDRESS = FALSE 

ii. Change the RMCP_NET_ADAPTER to eth0:1.

c. Delete /etc/readhwaddr from active ShMM.

2. Configure the lower ShMM.

a. Change the U-Boot variables on the lower ShMM as shown. See Assigning Values to Environment Variables for more information.

setenv ipaddr IP-addr-for-lower-ShMM 
# Must be different from upper# ShMM
setenv ipdevice eth0
# Default DO NOT CHANGE
setenv ip1addr 192.168.1.2
# Default DO NOT CHANGE
setenv ip1device usb0
# Default DO NOT CHANGE
setenv gatewayip gateway-ip-address
 
setenv netmask netmask
# Usually 255.255.255.0
setenv rc_ifconfig y
 
setenv hostname hostname-lower-ShMM
# Optional-different from# upper ShMM
saveenv
# Optional - use in U-Boot
# shell to save variables

b. Edit the /etc/shelfman.conf file on the lower ShMM:

i. Change the value of the PROPAGATE_RMCP_ADDRESS variable to FALSE.

PROPAGATE_RMCP_ADDRESS = FALSE 

ii. Change the RMCP_NET_ADAPTER to eth0:1.

c. Delete /etc/readhwaddr from active ShMM.

3. After rebooting both ShMMs, can verify the changes by using the commands ifconfig eth0 and ifconfig eth0:1 on both ShMMs.

On the backup ShMM, device eth0:1 will be undefined.

---

Setting Up the Shelf Manager Configuration File

The Shelf Manager configuration file (shelfman.conf) is located in the /etc directory. Each line in the file is either a comment line (starting with #) or a
name = value pair, representing the assignment for the configuration parameter. The name and the value are separated with the equal sign (=).

The configuration parameter name is case insensitive. Each configuration parameter is one of the following types: Boolean, number, string, or IP address.

Format of the value conforms to the type of the configuration parameter as follows:

It is possible to specify a value of an environment variable as a configuration parameter value, using the notation $envvar; in that case, the value of the variable envvar is substituted when the configuration file is read. For example:

DEFAULT_RMCP_IP_ADDRESS = $IPADDR

After the Shelf Manager has been brought up for the first time, the IP addresses are stored with the IPMI LAN configuration parameters. The LAN configuration parameters can be accessed or modified via any of the RMCP or CLI shelf-external interfaces and take precedence over the shelfman configuration file when the Shelf Manager is restarted. This is to ensure the persistency of any modifications that are made to the LAN IP addresses and gateway via those interfaces. If however, the Shelf Manager IP connection record in the Shelf FRU Information contains an IP address, it take precedence over all other settings of the shelf-external or RMCP IP address. It is recommended that the Shelf FRU Information either not specify this address or set it to 0.0.0.0 to ensure that addresses can be controlled through the Shelf Manager configuration file and the IPMI LAN configuration parameters.

The following configuration parameters are currently supported:

By default, the Configuration file variables are used automatically when the ShMM is brought up for the first time. The default configuration file imports the following environment variables set by U-Boot:

The environment variables $CARRIER and $CARRIER_OPTIONS are set by the secondary RC script. The name of this carrier-specific startup script is defined by the U-Boot environment variable rc2. The shelf manager can be reset to factory default parameter values if needed (see Re-initializing the File System).

A copy of default configuration file is shown in EXAMPLE 2-1:

# /etc/shelfman.conf
#
# This is the PPS Shelf Manager configuration file.
# Copyright (c) 2005 Pigeon Point Systems.
# All rights reserved.
#
 
# CARRIER: This parameter is the name of the carrier-specific module to use.
#   Default is PPS.
CARRIER = $CARRIER
 
# CARRIER_OPTIONS: This parameter specifies the carrier-specific options.
#   Default is an empty string.
CARRIER_OPTIONS = $CARRIER_OPTIONS
 
# ALTERNATE_CONTROLLER: This parameter of boolean type specifies whether to
#   use the alternate controller on the Shelf Manager with the address 
#   equal to the ShM hardware address. Default is TRUE.
#
ALTERNATE_CONTROLLER = TRUE
 
# ALLOW_CLEARING_CRITICAL_ALARM: This parameter of boolean type enables the
#   ability to clear the critical alarm condition without the alarm cutoff
#   button. Default is FALSE.
#
ALLOW_CLEARING_CRITICAL_ALARM = FALSE
 
# ALARM_CUTOFF_TIMEOUT: This parameter specifies the time interval in 
# seconds for the Shelf Manager to hold the Alarm Cutoff state. Default 
# interval is 600 seconds.
#
ALARM_CUTOFF_TIMEOUT = 600
 
# COOLING_IGNORE_LOCAL_CONTROL: This parameter of boolean type specifies
#   whether the Shelf Manager should use local control capabilities on fan
#   devices i.e. whether the Shelf Manager should explicitly manage fan 
#   levels or not. Default is FALSE.
#
COOLING_IGNORE_LOCAL_CONTROL = FALSE
 
# COOLING_POLL_TIMEOUT: This parameter specifies the maximum time (in 
# interval is between subsequent invocations of the cooling monitoring and # management facility. Default is 30 seconds.
#
COOLING_POLL_TIMEOUT = 30
 
# DEVICE_POLL_TIMEOUT: This parameter specifies the time (in seconds)
# between subsequent polls of the IPMB-0 devices by the Shelf Manager via 
# sending the "Get Device ID" command to them. Default is 10 seconds.
#
DEVICE_POLL_TIMEOUT = 10
 
# IPMB_ADDRESS: This parameter defines the IPMB address of the Shelf
# Manager's slot. This parameter overrides the hardware address. The default
# value of0 forces the Shelf Manager to use the hardware address and set its 
# IPMB address to hardware address * 2.
#
# IPMB_ADDRESS = 0
 
# IPMB_RETRIES: This parameter is the number of attempts to re-send an IPMB
#   request before finally giving up, if no response is received to this
#   request. Default is 3.
#
IPMB_RETRIES = 3
 
# IPMB_RETRY_TIMEOUT: This parameter is the amount of time (in seconds) the
#   Shelf Manager waits for a response after sending an IPMB request, before
#   retrying it. Default is 4 seconds.
#
IPMB_RETRY_TIMEOUT = 4
 
# M7_TIMEOUT: This parameter specifies the maximum time interval (in 
#   seconds for a FRU to stay in M7 state. After the expiration of this time 
# the FRU automatically transitions into the M0 state. Default is -1 which
# means "forever". Setting this parameter to 0 completely prevents FRUs from
# going into the M7 state.
#
M7_TIMEOUT = -1
 
# MAX_ALERT_POLICIES: This parameter specifies the number of available entries
#   in the PEF Alert Policy table. Default is 64.
#
MAX_ALERT_POLICIES = 64
 
# MAX_ALERT_STRINGS: This parameter specifies the number of available entries
#   in the PEF Alert String table. Default is 64.
#
MAX_ALERT_STRINGS = 64
 
# MAX_DEFERRED_ALERTS: This parameter sets the maximum number of outstanding
#   PEF alerts. Default is 32.
#
MAX_DEFERRED_ALERTS = 32
 
# MAX_EVENT_FILTERS: This parameter specifies the number of available entries
#   in the PEF Event Filter table.
#
MAX_EVENT_FILTERS = 64
 
# MAX_OEM_FILTERS: This parameter specifies the number of available entries
#   in the PEF OEM Event Filter table. Default is 16.
#
MAX_OEM_FILTERS = 16
 
# MAX_PENDING_IPMB_REQUESTS: The parameter sets the maximum number of 
#   pending IPMB requests awaiting response. Default is 192.
#
MAX_PENDING_IPMB_REQUESTS = 192
 
# MAX_SEL_ENTRIES: The parameter defines the SEL capacity in records. 
# Default is 1024.
#
MAX_SEL_ENTRIES = 1024
 
# SEL_HIGH_WATERMARK: This parameter is the "high watermark" for the algorithm
# algorithm that controls automatic SEL purging. The purging process will 
# start when the actual percentage of free entries in SEL falls below this 
# value or the SEL is full. During the purge the oldest SEL records are 
# removed according their timestamp. Default is 10 percent i.e. start
# purging when SEL is full.
#
SEL_HIGH_WATERMARK = 10
 
# SEL_LOW_WATERMARK: This parameter is the "low watermark" for the algorithm
#   that controls automatic SEL purging. When the SEL purging thread starts
#   it removes records one by one until the percentage of remaining occupied
#   entries in the SEL falls below this value. Default is 50 percent.
#
SEL_LOW_WATERMARK = 50
 
# MAX_SESSIONS: This parameter specifies the maximum number of simultaneous
#   IPMI sessions. Default 32.
#
MAX_SESSIONS = 32
 
# MAX_USERS: This parameter specifies the maximum number of IPMI users.
#   Default is 32.
#
MAX_USERS = 32
 
# INITIAL_FAN_LEVEL: This parameter specifies the initial fan level that the
# Shelf Manager applies to fan trays. Usually fan levels values are in 
# 0..15 range where 0 is the slowest, and 15 is the fastest possible fan 
# speed. This parameter has an alias CTCA_INITIAL_FAN_LEVEL for CompactPCI 
# systems. Default is 5.
#
INITIAL_FAN_LEVEL = 5
 
# MIN_FAN_LEVEL: This parameter specifies the minimal fan level that can be
# set by the Cooling Management. Default is 0.
#
MIN_FAN_LEVEL = 1
 
# PHYSICAL_SENSORS: This parameter of boolean type specifies whether the 
# Shelf Manager should create IPMI sensors based on physical sensors hosted 
# by ADM1026 and LM75. Default is TRUE.
#
PHYSICAL_SENSORS = TRUE
 
# POWER_UNLISTED_FRUS: This parameter of boolean type specifies whether the
# Shelf Manager should power up and activate FRU devices that are not listed
# in the Power Management table of the Shelf FRU Information. Default is
# TRUE.
#
POWER_UNLISTED_FRUS = TRUE
 
# AUTO_SEND_MESSAGE: This parameter of boolean type specifies whether to 
# auto-convert RMCP requests targeting a non-ShM IPMB address into "Send
# Message" requests directed to that address. Default is TRUE.
#
AUTO_SEND_MESSAGE = TRUE
 
# SHORT_SEND_MSG_RESPONSE: This parameter of boolean type determines the 
# type of response on the Send Message command provided by the Shelf
# Manager:required by the PICMG 3.0 R1.0 ECN-001 if TRUE or compatible with
# previous versions of the Shelf Manager if FALSE. Default is TRUE.
#
SHORT_SEND_MSG_RESPONSE = TRUE
 
# SDR_READ_RETRIES: This parameter sets the number of times the Shelf
# Manager retries the "Read Device SDR" command. Default is 3.
#
SDR_READ_RETRIES = 3
 
# RESERVATION_RETRIES: This parameter specifies the number of times the 
# Shelf Manager retries the "Reserve Device SDR" command. Default is 10.
#
RESERVATION_RETRIES = 10
 
# TASKLET_RETRIES: This parameter specifies the number of times each Shelf
# Manager tasklet (activation, deactivation, getting information) is 
# retried before finally giving up. The default is 3.
#
TASKLET_RETRIES = 3
 
# SHELF_FRU_IN_EEPROM: This parameter of boolean type tells the Shelf 
# Manager if it should use SEEPROMs as the Shelf FRU Info storage. If set 
# to FALSE the "/var/nvdata/shelf_fru_info” file contents are used. Default # is TRUE.
#
SHELF_FRU_IN_EEPROM = TRUE
 
# LOCAL_SHELF_FRU: This parameter of boolean type specifies whether the
# Shelf Manager should create a local FRU#1 that will expose the Shelf FRU 
# Info (obtained from the "/var/nvdata/shelf_fru_info" file). If the Shelf 
# FRU Info is acquired from EEPROM as a result of the SHELF_FRU_IN_EEPROM 
# set to TRUE then this parameter ignored. Default is TRUE.
#
LOCAL_SHELF_FRU = TRUE
 
# SHELF_FRU_TIMEOUT: This parameter specifies the time interval (in seconds)
# during which the Shelf Manager detects and reads the Shelf FRU Information
# source devices at initial startup. Default is 15 seconds.
#
SHELF_FRU_TIMEOUT = 15
 
# MIN_SHELF_FRUS: This parameter specifies the minimum number of valid and
# equal Shelf FRU Information instances that must be found to determine the
# true Shelf FRU Information. Default is 2.
#
MIN_SHELF_FRUS = 2
 
# EXIT_IF_NO_SHELF_FRU: This parameter of boolean type tells the Shelf 
# Manage if it should exit if no valid Shelf FRU Information data is found. 
# Default is FALSE.
#
EXIT_IF_NO_SHELF_FRU = FALSE
 
# VERIFY_SHELF_FRU_CHECKSUM: This parameter boolean type specifies whether 
# the Shelf FRU Information record checksums should be validated. The
# default is TRUE.
#
VERIFY_SHELF_FRU_CHECKSUM = TRUE
 
# WATCHDOG_ENABLED: This parameter of boolean type tells the Shelf Manager
# whether it should use the hardware watchdog timer supported by the CPLD or
# not. The default is TRUE.
#
WATCHDOG_ENABLED = TRUE
 
# REDUNDANCY_ENABLED: This parameter of boolean type tells Shelf Manager if 
#   it should run in redundant mode or not. Default is TRUE.
#
REDUNDANCY_ENABLED = TRUE
 
# REDUNDANCY_PORT: The parameter specifies the TCP port number used for 
# inter-host communications by redundant instances of the Shelf Manager.
# Default is 1040.
#
REDUNDANCY_PORT = 1040
 
# REDUNDANCY_NET_ADAPTER: This parameter specifies the name of network
# adapter used for communication between redundant ShMMs. Default is eth0 if 
# it does not conflict with RMCP_NET_ADAPTER.
#
REDUNDANCY_NET_ADAPTER = $IP1DEVICE
 
# REDUNDANCY_NET_ADAPTER2: This parameter specifies the name of the second 
# network adapter used for communication between redundant ShMMs (if USB 
# interface is used for redundancy). By default, this parameter is not 
# defined.
#REDUNDANCY_NET_ADAPTER2 = “usb1”
 
# REDUNDANT_IP_ADDRESS: This parameter specifies the IP address for network
# adapter used for redundant communications. This address actually provides
# a pair of IP addresses that differ in the least significant bit. They are
# assigned to redundant ShMs according to their hardware addresses, so they
# are equal on both ShMs. This parameter has no default value and must
# always be set.
#
REDUNDANT_IP_ADDRESS = $IP1ADDR
 
# REDUNDANCY_NETMASK: This parameter sets the network mask for the network
# adapter used for redundancy communications. Default is 255.255.255.0
#
# REDUNDANCY_NETMASK = 255.255.255.0
 
# RMCP_NET_ADAPTER: This parameter specifies the name of network adapter 
# used for RMCP-based communications. Default is eth0:1 if it does not 
# conflict with REDUNDANCY_NET_ADAPTER.
#
RMCP_NET_ADAPTER = $IPDEVICE
 
# RMCP_NET_ADAPTER2: This parameter specifies the alternate name of network
# adapter used for RMCP-based communications, if cross-connect links are
# supported by hardware. Undefined by default.
#
#RMCP_NET_ADAPTER2 = "eth1"
 
# DEFAULT_RMCP_IP_ADDRESS: This parameter specifies the default IP address 
# for network adapter used for RMCP communications. It is switched over 
# between redundant instances of the Shelf Manager. This address is only
# used if no IP address is set in the LAN Configuration Parameters for
# channel # 1. Default is the REDUNDANT_IP_ADDRESS parameter value.
#
DEFAULT_RMCP_IP_ADDRESS = $RMCPADDR
 
# PROPAGATE_RMCP_ADDRESS: This parameter specifies whether the RMCP IP 
# address should be propagated to the backup Shelf Manager. If set, the 
# backup Shelf Manager configures its network interface specified by 
# RMCP_NET_ADAPTER using given IP address with the least significant bit 
# inverted. Default is FALSE.
#
PROPAGATE_RMCP_ADDRESS = FALSE
 
# DEFAULT_RMCP_NETMASK: This parameter specifies the network mask for 
# network adapter used for RMCP communications. Default is 255.255.255.0
#
# DEFAULT_RMCP_NETMASK = 255.255.255.0
 
# DEFAULT_GATEWAY_IP_ADDRESS: This parameter specifies the default gateway 
# IP address used for RMCP-based communications. It should be equal for the
# redundant instances of the Shelf Manager. This address is only used if no
# gateway address is set in the LAN Configuration Parameters for channel 1.
# Default is no gateway.
#
DEFAULT_GATEWAY_IP_ADDRESS = $GATEWAY
 
# SWITCHOVER_TIMEOUT_ON_BROKEN_LINK: This parameter sets the number of 
# seconds to wait before switchover if the RMCP link is down, i.e. system 
# manager is inaccessible from the shelf manager. A zero value of this 
# parameter leads to an immediate switchover on RMCP link fault detection.
# With a -1 value, no automatic switchovers on RMCP link faults will occur. # The default value is 10 second.
#
SWITCHOVER_TIMEOUT_ON_BROKEN_LINK = 10
 
# CONSOLE_LOGGING_ENABLED: This parameter of boolean type enables or 
# disables log messages output to the console from which the Shelf Manager 
# was started. Default is FALSE.
#
CONSOLE_LOGGING_ENABLED = FALSE
 
# SYSLOG_LOGGING_ENABLED: This parameter of boolean type enables or disables
# logging messages to the syslog facility. Default is TRUE.
#
SYSLOG_LOGGING_ENABLED = TRUE
 
# VERBOSITY: This parameter sets the Shelf Manager verbosity level. This 
# value is actually a bitmask with each bit enabling a corresponding class
# of output messages. The current bit layout has 8 classes:
#      Errors:               0x01
#      Warnings:             0x02
#      Information:          0x04
#      Verbose Info:         0x08
#      Debug Trace Messages: 0x10 (not recommended)
#      Verbose Debug Trace:  0x20 (not recommended)
#      Demo Messages:        0x40 (not recommended)
#      Locks Information:    0x80 (not recommended)
# The default verbosity level is 7 i.e. errors, warnings and information.
#
VERBOSITY = 7
 
 
### PICMG 2.x specific settings
 
# 2_X_SYSTEM: If configured, this parameter explicitly specifies the current
# system as CompactPCI (if TRUE) or AdvancedTCA (if FALSE). If not specified
# the choice of the system type is made automatically. It is not recommended
# to specify this parameter, unless it is necessary to override an incorrect
# hardware detection algorithm for the system type. Default is FALSE.
#
# 2_X_SYSTEM = FALSE
 
# CTCA_FRU_RESET_TIMEOUT: This parameter specifies the time interval in 
# msecs which is used to holds the BD_SEL# line low in order to reset a
# CompactPCI board. Default is 500 milliseconds.
#
# CTCA_FRU_RESET_TIMEOUT = 500
 
# CTCA_HEALTHY_TIMEOUT: This parameter specifies the time interval in 
# seconds during which the Shelf Manager waits for the HEALTHY# signal to 
# appear after powering on a CompactPCI board. If the board HEALTHY# signal 
# is not detected within the specified time, the Shelf Manager will 
# deactivate this board. Default is 0 which means endless waiting.
#
# CTCA_HEALTHY_TIMEOUT = 0
#
### Notification settings
 
# MAX_EVENT_SUBSCRIBERS: The parameter defines the maximum number of
# entities
# that can simultaneously subscribe to receive event notifications
# from the Shelf Manager.
#
MAX_EVENT_SUBSCRIBERS = 64
 
# MAX_PENDING_EVENT_NOTIFICATIONS: The parameter defines the maximum number
# of outstanding event notifications for each active subscriber.
#
MAX_PENDING_EVENT_NOTIFICATIONS = 1024
 
# MAX_EVENT_SUBSCRIBER_IDLE_TIME: This parameter defines the maximum timeout
# for an event subscriber, in seconds, between the moment when an event 
# arrives and the moment when the subscriber retrieves this event from the
# Shelf Manager. If this timeout is exceed, the subscriber is considered
# dead and is automatically unregistered.
#
MAX_EVENT_SUBSCRIBER_IDLE_TIME = 60

Carrier-Specific Configuration File

After reading the common configuration file /etc/shelfman.conf, the Shelf Manager reads the carrier-specific configuration file /etc/shelfman.conf.carrier-name, where carrier-name is the name of the ShMM carrier used in the relevant shelf, in lowercase characters. Settings in the carrier-specific configuration file override settings for the same variable in the common configuration file.

This mechanism allows redefinition of common settings on a carrier-specific basis. Typically, only a few critical configuration variables are defined in the carrier-specific file. For instance, the appropriate value for the MIN_FAN_LEVEL parameter may well be determined by the shelf architecture and the fan facilities that it implements. This mechanism allows such shelf-specific constraints to be enforced.

One result of this mechanism is that to change the effective value of a configuration parameter that is specified in the carrier-specific configuration file, the change must be made in that configuration file. A change for such a variable in the common configuration file will not have any effect.

Caution - Avoid changing the variables in the shelfman.conf.acb file. They contain carrier-specific settings and take precedence over the values in the /etc/shelfman.conf file. Changing these system-specific variables can result in an unstable system. Two exceptions are the SWITCHOVER_TIMEOUT_ON_BROKEN_LINK and PROPAGATE_RMCP_ADDRESS variables. In releases prior to R3U1, these variables must be changed in shelfman.conf.acb file to take effect. In release R3U1 and above, these variables are removed from the shelfman.conf.acb file and should be changed in /etc/shelfman.conf file.

Verbosity Level Description

The verbosity level allows for additional output to be sent to either the console or to the Syslog depending on how the configuration parameters CONSOLE_LOGGING_ENABLED and SYSLOG_LOGGING_ENABLED are set. The VERBOSITY configuration parameter is a hexadecimal bit mask, each bit enabling output of a specific type of message:

The default debug level is 7 which allows error, warning, and informational messages to be output.

---

Setting the Date and Time

When the system is brought up for the first time, the clock is not set and must be initialized. Initially the clock is set to January 1, 1970. The date can be accessed via the serial console.

# date
Thu Jan  1 03:16:30 UTC 1970

To change the date, type in the correct date using the date application. The format for the date command is MMDDHHmmCCYY.ss, where:

For example:

# date 092916282007.10
Sat Sep 29 16:28:00 UTC 2007

To make the date persistent, you must store it using the hwclock application.

# hwclock -systohc

In some cases, you might get the error message:

mktime: cannot convert RTC time to UNIX time

This error can be ignored. It is due to the original date being in an uninitialized state.

Obtaining Date and Time from a Time Server

If the shelf management card does not have an real-time clock (RTC) battery, it is possible to obtain the system date and time from a time server during system startup and synchronize it periodically thereafter. The selected time server must support RFC 868 over TCP as required by the rdate utility. To enable this feature, it is necessary to define the U-Boot variable time_server and optionally the additional variable timezone.

The time_server variable contains the IP address of the time server that the Shelf Manager is to query for the system time after the startup. This variable is propagated to the Linux level as the environment variable TIMESERVER. If this variable is set, the startup script /etc/netconfig starts the script /etc/timesync as a daemon, which runs in an endless loop and queries the time server with a default interval of 300 seconds. To change this interval, edit the script /etc/timesync and change the value of the variable INTERVAL.

The variable timezone contains the name of the current time zone followed by its offset from Greenwich Mean Time (GMT). The offset is positive for time zones to the west of Greenwich and negative for time zones to the east of Greenwich. This variable is propagated to the Linux level as the environment variable TZ. The default value of this variable is UTC0; that is, Universal Coordinated Time (UTC), which matches Greenwich time.

The time sent by time servers is GMT; if the time zone on the Shelf Manager is not set or not set correctly, the time obtained from the time server will be interpreted incorrectly. The three-letter name of the time zone is not used by the Shelf Manager, but is propagated to set the Linux time zone. (For instance, if the time zone name XXX0 is used, the date command produces output like Thu Sep 9 21:24:24 XXX 2004.

Here is an example of a timezone definition for US Eastern Time:

timezone = EST5

Here the digit 5 specifies that the time zone is five hours west of GMT. Any arbitrary three letters can replace EST; they are used to identify the time zone in (for example) Linux date command output.

Setting the Time Zone for Daylight Saving

The U-Boot timezone variable must be set accordingly to set the timezone for daylight saving. The timezone variable is propagated to the Linux level as the environment variable TZ and uses a format similar that of the TZ Linux variable.

1. Stop the autoboot process at the U-Boot prompt by hitting any key at the prompt:

U-Boot 1.x.x (Nov 11 2008 - 11:32:08)
     :
     :
Hit any key to stop autoboot: 0

2. Set the timezone variable (for example PST/PDT)

shmm500 setenv timezone PST8PDT,M3.2.0/2,M11.1.0/2

3. Save the new timezone value:

shmm500 saveenv

4. Reset the ShMM:

shmm500 reset

---

Setting Up User Accounts on the Shelf Management Card

User accounts for RMCP access are set up using the Shelf Manager’s CLI. User information is entered on the active shelf management card, and immediately mirrored, or shared, on the standby shelf management card. The shelf management card supports 32 accounts with passwords.

1. Log in to the active shelf management card.

2. Add a user:

# clia user add userid user-name channel-access-flags privilege-level password

where the variable parameters have the following meaning:

userid - a valid user ID

user-name - the user name (up to 16 characters)

channel-access-flag - the first byte of the SetUserInfo commands (only bits 4, 5, and 6 are meaningful)

• bit 6 - IPMI messaging enabled
• bit 5 - Link authentication enabled
• bit 4 - Restricted to callback

privilege-level - the user privilege level

password - the user password (it is truncated to 16 characters without any notice)

The following example shows how to add user 9 with the name root, administrator privilege level, and password PICMG guru.

# clia user add 9 "root" 0x40 4 "PICMG guru"
Pigeon Point Shelf Manager Command Line Interpreter
User 9 added successfully
#
# clia user
Pigeon Point Shelf Manager Command Line Interpreter
1: "" 
        Channels 0-15 Privilege level: "Administrator"
            Flags: "IPMI Messaging" 
9: "root" 
        Channels 0-15 Privilege level: "Administrator"
            Flags: "IPMI Messaging" 
#

See user for more information about permissions and the clia user command.

Username Restrictions

The username field has a maximum length of 16 characters. It must contain at least one lowercase alphabetic character, and the first character must be alphabetic.

Valid characters for username include:

• Alphabetic characters
• Numeric characters
• Period (.)
• Underscore (_)
• Hyphen (-)

Passwords

Passwords can be up to 16 characters long, anything over 16 is truncated.

---

Disabling Remote root Login

When using telnet, ssh, and ftp to remotely logging into the ShMM as root, the root password can be visible over the network. Disabling these remote root logins provides the additional security needed to protect the root password.

Disabling remote root login involves removing the root userid from the telnet, ssh, and ftp configuration files on both the active and standby ShMMs, adding a non-root user, and giving the new user su - capability. To do this, use the following procedures:

1. Log on the active ShMM as root.

2. Disable remote root login for SSH

Edit the /etc/inetd.conf file and add the -g option to /bin/sshd -i command at the end the line starting with ssh. For example:

ssh stream  tcp     nowait  root    /bin/tcpd /bin/sshd -i -g

3. Disable root login for ftp

Edit the /etc/ftpaccess file and comment out the allow-uid %0 parameter by inserting a # (pound sign) in the beginning of the line and add the deny-uid %0 parameter as a new line in the file. For example:

#allow-uid %0
deny-uid %0

4. Disable root login for telnet

Edit the /etc/securetty file and remove or comment out all the entries starting with ttyp. Be sure not to delete or comment out the console and ttyS0 lines or else root access on serial console will also be denied.

5. Add a new non-root user:

#adduser username
password: password
#

6. Give the new userid su - capability

a. Create an /etc/busybox.conf file and add the two lines shown in example.

# cat /etc/busybox.conf
[SUID]
su = ssx root.0     # su can be performed from non-root
passwd = ssx root.0 # non-root user can change his password
#

b. Change the file ownership and group to root. For example:

# chown 0.0 /etc/busybox.conf
# chmod 600 /etc/busybox.conf

7. Repeat the same steps on Standby ShMM and reboot

---

Configuring OpenHPI on the Shelf Manager

The Shelf Manager includes support for OpenHPI which is an open source implementation of the SA Forum’s Hardware Platform Interface (HPI). HPI provides an interface to managing computer hardware, typically for chassis and rack based servers. Access to HPI is done through the OpenHPI SNMP subagent using the SNMP MIB. Refer to the Sun Netra CT900 Server Software Developer’s Guide for more information on OpenHPI and SNMP.

There are two configuration files that require the system administrator’s attention:

• /etc/openhpi.conf - OpenHPI configuration file
• /etc/snmpd.conf - SNMP agent configuration file

The /etc/openhpi.conf File

If you are using an ATCA release earlier than R3U3, the OpenHPI configuration file, /etc/openhpi.conf, must be updated to provide the correct IP address for the ShMM. After the configuration file is updated, the ShMM must be reset to implement the changes.

With R3U3 and newer releases, it is not necessary to set the RMCP address in /etc/openhpi.conf. The ShMM software automatically reads the Shelfman IP connection record from the midplane FRU that has the RMCP address and starts openhpid with that RMCP address.

1. If using an ATCA release earlier than R3U3, edit the /etc/openhpi.conf file and change the value of the libpigeonpoint addr parameter to the ShMM’s IP address.

A snip of the /etc/openhpi.conf file follows:

handler libpigeonpoint {
    entity_root = "{SYSTEM_CHASSIS,1}"
    name = "lan"           # RMCP
    addr = "10.12.235.18"  # Host name or IP address
    port = "623"           # RMCP port
    auth_type = "none"     # none, md5 or straight
    auth_level = "admin"   # operator or admin
    logflags = ""          # "" means logging off; also use "file stdout"
    logfile = "openhpi"    # log file name prefix; ${logfile}.log
    logfile_max = "50"     # maximum log file size in kilobytes
    UseCachedSdrs = "no"   # set it to "yes" to use Cached Device SDR repository
}

2. Reboot the ShMM by issuing the reboot command at the prompt.

For example:

# reboot

The /etc/snmpd.conf File

The SNMP agent configuration file, /etc/snmpd.conf, defines how the SNMP agent operates and includes directives for access control and setting traps. Information on access control, SNMPv3 configuration, and setting traps is provided in the subsequent sections. Refer to the Sun Netra CT900 Server Software Developer’s Guide for more information.

Access Control

The SNMP agent supports the View-Based Access Control Model (VACM) a defined in RFC 2575. To this end, it recognizes the following keywords in the configuration file:

• com2sec
• group
• access
• view

In addition, it recognizes some easier-to-use wrapper directives:

• rocommunity
• rwcommunity
• rouser
• rwuser

This section defines how to configure the snmpd program to accept various types and levels of access.

rouser user [noauth|auth|priv] [OID]
rwuser user [noauth|auth|priv] [OID]

Creates an SNMPv3 USM user in the VACM access configuration tables. It is more efficient (and powerful) to use the combined group, access, and view directives, but these wrapper directives are much simpler.

The minimum level of authentication and privacy the user must use is specified by the first token (which defaults to auth). The OID (object identifier) parameter restricts access for that user to everything below the given OID.

rocommunity community [source] [OID]
rwcommunity community [source] [OID]

Create read-only and read-write communities that can be used to access the agent. They are a quick wrapper around the more complex and powerful com2sec, group, access, and view directive lines. They are not as efficient as these, because groups are not created, so the tables are potentially larger. These directives are not recommended for complex environments. If your environment is relatively simple or you can sustain a small negative performance impact, use these directives.

The format of the source token is described in the com2sec directive section below. The OID token restricts access for that community to everything below that given OID.

com2sec name source community

Specifies the mapping from a source/community pair to a security name. source can be a hostname, a subnet, or the word default. A subnet can be specified as IP/mask or IP/bits. The first source/community combination that matches the incoming packet is selected.

group name model security

Defines the mapping from securitymodel/securityname to a group. model is one of v1, v2c, or usm.

access name context model level prefx read write notify

Maps from group/security and model/security level to a view. model is one of any, v1, v2c, or usm. level is one of noauth, auth, or priv. prefx specifies how context should be matched against the context of the incoming PDU, either exact or prefix. read, write and notify specify the view to be used for the corresponding access. For v1 or v2c access, level is noauth, and context is empty.

view name type subtree [mask]

Defines the named view. type is either included or excluded. mask is a list of hex octets, separated by a period (.) or a colon (:). The mask defaults to ff if not specified. Use of the mask allows you to control access to one row in a table in a relatively simple way. As an example, as an ISP you might consider giving each customer access to his or her own interface:

view cust1 included interfaces.ifTable.ifEntry.ifIndex.1 ff.a0
view cust2 included interfaces.ifTable.ifEntry.ifIndex.2 ff.a0
 
# interfaces.ifTable.ifEntry.ifIndex.1 == .1.3.6.1.2.1.2.2.1.1.1
# ff.a0 == 11111111.10100000

These entries cover up and include the row index, yet still allow the user to vary the field of the row.

The following are VACM examples:

# sec.name source community
com2sec local localhost private
com2sec mynet 10.10.10.0/24 public
com2sec public default public
 
# sec.model sec.name
group mygroup v1 mynet
group mygroup v2c mynet
group mygroup usm mynet
group local v1 local
group local v2c local
group local usm local
group public v1 public
group public v2c public
group public usm public
 
# incl/excl subtree mask
view all included .1 80
view system included system fe
view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc
 
# context sec.model sec.level prefix read write notify
access mygroup "" any noauth exact mib2 none none
access public "" any noauth exact system none none
access local "" any noauth exact all all all

SNMPv3 Configuration

engineID string

The subagent needs to be configured with an engineID to be able to respond to SNMPv3 messages. With this configuration file line, the engineID is configured from string. The default value of the engineID is configured with the first IP address found for the hostname of the machine.

createUser username (MD5|SHA) authpassphrase [DES][privpassphrase]

MD5 and SHA are the authentication types to use, but you must have built the package with OpenSSL installed in order to use SHA. The only privacy protocol currently supported is DES. If the privpassphrase is not specified, it is assumed to be the same as authpassphrase.

Setting Up Traps and Informing Destinations

trapcommunity string

Defines the default community string to be used when sending traps. Note that this command must be used prior to any of the three commands (immediately following) that are intended for use with this community string.

trapsink host [community [port]]
trap2sink host [community [port]]
informsink host [community [port]]

Define the hosts to receive traps (or inform notifications with informsink). The daemon sends a Cold Start trap when it starts up. If enabled, it also sends traps on authentication failures. You can specify multiple trapsink, trap2sink and informsink lines to specify multiple destinations. Use trap2sink to send SNMPv2 traps and informsink to send inform notifications. If community is not specified, the string from a preceding trapcommunity directive is used. If port is not specified, the well-known SNMP trap port (162) is used.

trapsess [snmpcmdargs] host

A more generic trap configuration token that allows any type of trap destination to be specified with any version of SNMP. This requires that you specify a version number of v2c or v3 as well.

1. Edit the /etc/snmpd.conf file to add, change, or delete directives as needed.

2. Reboot the ShMM by issuing the reboot command at the prompt.

Enabling the OpenHPI Daemon Monitor

When you enable the daemon monitor, the OpenHPI process is monitored and, if the daemon for any reason dies or exits, the following actions are taken.

• When active and backup ShMMs are running on a system:
• If daemon dies or exits on active ShMM, then switchover occurs
• If daemon dies or exits on backup ShMM, then reboot occurs

• If only one ShMM is running on a system, the ShMM is rebooted

By default this feature is disabled. After installing the R3U1 updates on the ShMM, you can enable the monitor as follows.

1. Set the U-Boot variable monitor_daemons to y.

See Setting Up U-Boot for more information.

# setenv monitor_daemons y
# reboot

2. Repeat the same commands for the backup ShMM.

---

Configuring RADIUS on the Shelf Manager

RADIUS (Remote Authentication Dial-In User Service) is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize their access to the requested system or service. The protocol is covered by RFC2865.

The Shelf Manager version 2.4.x (and above) provides RADIUS client support. The system administration only needs to edit the /etc/raddb/server file on the Shelf Manager and provide the server information. The following is a sample /etc/raddb/server file:

#<radius_server_ip_address> <radius_secret> <wait_period>
127.0.0.1	       secret           1
other-server	    other-secret     3

Where

• radius_server_ip_address is the IP address of a RADIUS server.
• radius_secret is a secret text string that the RADIUS server and RADIUS client share. Both server and client must be configured with the same secret text string in order for them to communicate.
• wait_period is the timeout in seconds and controls how many seconds the module waits before deciding that the server has failed to respond. The default timeout is 3 seconds.

If multiple RADIUS servers are provided, they are tried in order. The first server to return success or failure causes the module to return success or failure. Only if a server fails to response is it skipped and the next server in turn is used.

By default, the superuser (root) can log in to Shelf Manager using console, telnet, or ssh using either the factory default password or RADIUS password.

To enble the Shelf Manager to accept only RADIUS passwords or to accept only local root password, the standard PAM configuration files need to be modified accordingly. These files are /etc/pam.d/login and /etc/pam.d/sshd on the Shelf Manager. (Refer to standard PAM (Port to Application Mapping) rules for configuration).

Sun Netra CT900 Server Administration and Reference Manual

819-1177-18

Copyright © 2011, Oracle and/or its affiliates. All rights reserved.