Automic Workload Automation

  • 1.  How to allow/restrict access for administrative (root) user running jobs in Unix

    Posted May 11, 2016 06:02 PM

    We’ve had a lot of questions about allowing the root user to execute jobs on Unix, so I thought it would be good to put this together so that we have some basic information available for all customers. There are a few things that need to be done in preparation, mainly the items contained within our documentation (referenced below):

     

    http://docs.automic.com/documentation/AE/11.2/english/AE_WEBHELP/help.htm?product=awa#ucaaks.htm

     

    • For actual operation, the      program ucxj??? can be given the permissions of a privileged user such as      root.
      • Change owner to root

    chown root ucxj???

      • Set S-Bit (Set-Userid)

    chmod 4755 ucxj???

     

    Once this has been set, the only restriction in place is contained within the Agent’s .ini file, with an example of the pertinent section contained below:

     

    ; - access for root user requires:

     [USERID]

    root=START

     

    This is commented out by default, and should only be enabled with strict control and access to the login objects. After this has been configured appropriately, you will need to put the root user/password into a Login object and utilize that for your jobs.

     

    There may be unforeseen issues with individual environments, but in most cases these are the modifications necessary to restrict/allow access such as this.



  • 2.  How to allow/restrict access for administrative (root) user running jobs in Unix

    Posted Jun 23, 2016 09:02 AM
    By any chance, does this require a restart of the Agent?

    I was hoping to get around having to restart it


  • 3.  How to allow/restrict access for administrative (root) user running jobs in Unix

    Posted Jun 23, 2016 09:05 AM
    Rick,

    yes, since there is a change within the .ini File necessary, the Agent needs to be restarted. 

    The .ini file of Automic components is always only read and checked at startup. If you do any changes there, it requires a restart of the component.

    btw, great post, Spencer!


  • 4.  How to allow/restrict access for administrative (root) user running jobs in Unix

    Posted Jun 23, 2016 09:07 AM
    Thanks

    I was pretty sure that there was no way around it, but I figured I would throw the question out there to see if anyone had another way around it