Preface. Install ConsoleWorks

Transcription

1 Preface IBM pseries servers running logical partitioning (LPAR) or dynamic logical partitioning (DLPAR) capable versions of AIX provide customers a highly scalable virtualization ability that can configure a single computer, or frame, into multiple logical partitions that can be, if configured properly, dynamically altered to meet diverse business needs. A Hardware Management Console (HMC) is required to enable and manage a collection of logical partitions running on a single pseries, or many pseries computers running in a frame. The HMC may also be used to make a connection between ConsoleWorks and the virtual console of each invocation of AIX running on the (D)LPARs providing a method to monitor all hardware, firmware, operating system, and application messages that are generated during all phases of operation: 1. Hardware installation. 2. Hardware configuration. 3. O/S installation. 4. Software installation. 5. Network configuration. 6. Normal operation. 7. Failure modes. This document describes the method for implementing a ConsoleWorks management methodology to an AIX operating environment running on a pseries processor that is managed through an HMC. Install ConsoleWorks A ConsoleWorks invocation must be installed in order to manage the (D)LPARs and HMC configuration(s) as described by the ConsoleWorks V3.1-1 Installation Guide. Although any valid invocation may be utilized to manage an HMC, this document assumes the use of a Linux based installation of ConsoleWorks for all of its examples. The following ConsoleWorks configuration is recommended for an HMC configuration: 1. A pseudo console connector license or the security package A connector license for each (D)LPAR to be managed. 3. A connector license for each HMC to be managed. 4. An operational installation of SSH on the node that will host the ConsoleWorks invocation. 5. An operational installation of expect on the node that will host the ConsoleWorks invocation. 1 The security package includes the pseudo console connection.

2 Verify or Install the HMC, AIX, and ConsoleWorks Environments The normal operational capability of the HMC, pseries hardware, and optionally the AIX environment, must be verified before any ConsoleWorks integration activity is performed. AIX does not have to be installed on the pseries hardware if ConsoleWorks is going to be used to capture the entire installation of a pseries environment. Resources Needed to Complete This Step 1. An HMC that is actively managing the pseries hardware. 2. A pseries set of hardware being monitored by the HMC. 3. An AIX environment on each (D)LPAR to be monitored Username and password to the HMC. 5. root access to each AIX environment to be verified or installed. 6. A server to run ConsoleWorks. 7. ConsoleWorks software distribution. 8. ConsoleWorks licenses. Step 1: Verify Configuration of HMC and pseries Hardware This step may be skipped if the HMC managed pseries environment already exists. If this is a new installation, then install and configure the HMC as defined by the IBM publication entitled Hardware Management Console for pseries Installation and Operation Guide (SA ). During this step you will: 1. Install the HMC(s) 3 2. Install the pseries hardware to be managed. 3. Connect the HMC(s) to the pseries hardware to be monitored. These steps often are performed by your IBM Service Representative or the channel partner that provided the hardware to you. If not, follow the procedures in the IBM documentation to ensure you don t void your warranty or service contract. Step 2: Establish ConsoleWorks Connections to the HMC The instructions in this step assume that the ConsoleWorks invocation does not currently communicate with the HMC and that a user has not been created on the HMC. 4 During this step you will: 2 The AIX environment does not have to be available if ConsoleWorks is going to be monitoring the installation of the entire environment. In this case, only the hardware need be present to continue. 3 In a redundant HMC mode, a backup HMC may be used to manage a set of pseries (D)LPARs. 4 Note that the HMC default username is hscroot and its password is abc123. Additionally, the default root password on the HMC is passw0rd.

3 1. Create one or more HMC usernames to be used by the ConsoleWorks invocation. 2. Install ConsoleWorks and create the ConsoleWorks invocation that will communicate wit the HMC. 3. Generate public/private key pairs to be used with SSH Public Key Identification. 4. Establish ConsoleWorks connections to the HMC. 5. Configure (D)LPARs Establish ConsoleWorks connections to each (D)LPAR. Create one or more ConsoleWorks users on the HMC A user must either exist or be created to manage the environment on the HMC and (D)LPARs through ConsoleWorks. TDi recommends that you create a user that is used solely by ConsoleWorks and has the appropriate role membership to execute all tasks that are required by each of the Profiles that will have access to the HMC. You may have multiple user Profiles connected to the HMC through ConsoleWorks that have different responsibilities. The HMC supports this by providing six predefined roles: 1. System Administrator 2. Advance Operator 3. Service Representative 4. Operator 5. User Administrator 6. Viewer If you wish to manage the entire HMC/pSeries environment with ConsoleWorks, then configure a user with System Administrator role to be accessed by ConsoleWorks. After this is accomplished, most remaining HMC tasks may be performed through ConsoleWorks providing an auditable, traceable log of all activities performed. If you wish to use PKI to communicate between ConsoleWorks and the HMC, then at least one account associated with the role System Administrator, Advanced Operator, or Service Representative must be created. The HMC does not allow a secure copy (scp) operation to occur with lesser privileged roles. If you want this step to be monitored by ConsoleWorks as well, then establish an initial connection to the HMC following the instructions below under the heading of Establish ConsoleWorks connections to the HMC using the hscroot username and the abc123 password. TDi strongly discourages leaving this configuration in place and highly recommends the creation of a specific user to be used with ConsoleWorks. 5 Only if this is a new installation, or an additional (D)LPAR is being created.

4 Once the usernames that are going to be used with ConsoleWorks have been established, then the default username and password should be changed to new values or the account should be disabled. The remainder of this document assumes the use of the cw account name on the HMC for management operations. Users can be created by using the mkhmcusr HMC command line command from a ConsoleWorks connection. Install ConsoleWorks and Create an Invocation Using the ConsoleWorks Installation Guide as a reference, install ConsoleWorks and configure the invocation that is going to be used to communicate with the HMC using the cw_add_invo script. Verify SSH Connectivity between ConsoleWorks Server and the HMC 1. If a version of secure shell (SSH) is not installed on the ConsoleWorks host server, then install it now. TDi Engineering prefers OpenSSH of at least version 0.9.7d 6, but most competent SSH implementations will work. 2. Execute the command ssh hmc.tcp.ip.address 7 l cw 8 to verify that the ConsoleWorks server has SSH access to the HMC. If this command does not establish communication to the HMC and provide a password prompt, then resolve this problem before continuing since no further work can proceed until the HMC is accessible from the server hosting ConsoleWorks via SSH. 3. When prompted with the password: prompt, enter the password for the cw account (that you created earlier). 4. If you successfully log in to the HMC, then the test is complete and you may log out (using the exit command) and proceed. If not, then diagnose the connectivity problems between the server hosting ConsoleWorks and the HMC. Generate public/private key pairs to be used with SSH Public Key Identification SSH PKI should be used as the communication paradigm between ConsoleWorks and the HMC so that no files containing clear-text passwords have to be installed on the ConsoleWorks server. This methodology provides a secure method for communication that does not open the HMC to attacks due via stored passwords. A few simple steps need to be performed to make sure that ConsoleWorks can communicate with the HMC in order to manage the environment: 6 Versions of OpenSSH previous to 0.9.7d have not been verified to work with the HMC. 7 You may use an IP address or DNS name of the HMC. 8 Remember, we re assuming you created a user called cw on the HMC.

5 1. Create a user account that corresponds to each HMC username that will be used to communicate to ConsoleWorks on the node that will host ConsoleWorks. This step is necessary since the ssh-keygen facility reads the username of the caller to generate the keys. Below, the -l and -i qualifiers will be used to identify the connectivity credentials in the SSH command. 2. The following steps are to be performed for each user account created in Step 1: a. Login to the account. b. Issue the ssh-keygen t rsa command. This command will generate two files: id_rsa (the private key) and id_rsa.pub (the public key). c. Issue the command scp.ssh/id_rsa.pub userid@hostname:/home/<username>/.ssh/authorized_keys2. The userid in the scp command is the username of one of the privileged accounts on the HMC. The <username> value is the username on the HMC that corresponds to the local account being used to generate the keys. d. Test the connectivity by issuing the command ssh l usename i.ssh/id_rsa t. If this command connects directly to the HMC without asking for a username, the SSH/PKI configuration is successful and complete. If it is not, then diagnose the problems and correct them. A few notes about SSH/PKI configuration management: 1. A new secure copy (scp) of the public key must be performed to the HMC if the public/private key pairs are regenerated by rerunning the sshkeygen command for any of the accounts being used to communicate between ConsoleWorks and the HMC. 2. The public/private key pairs may be copied to a location other than the /home/<account>/.ssh directory if the user wishes to protect them from accidentally being overwritten. Verify Functionality of Tools to be Used with ConsoleWorks If you plan to use expect scripting for logging into the HMC, verify the version of expect functions in the scripting environment that you intend to use. Any other tools, such as public key identification, need to be verified to be operational between the host ConsoleWorks server and the HMC as well. Configure (D)LPARs At this point, configuration of the (D)LPARs may be performed through ConsoleWorks using the HMC Command Line utilities. This method offers an auditable trail of how the pseries (D)LPARs were configured. Follow the instructions in the Hardware Management Console for pseries Installation and Operation Guide to setup up (D)LPARs on the pseries.

6 Establish ConsoleWorks Consoles for Each (D)LPAR and the HMC ConsoleWorks can provide monitoring and management to all features provided by the HMC: 1. Virtual console monitoring, management, and connectivity to each (D)LPAR regardless of whether an operating system is running on the LPAR or not. 2. Command line connectivity to the HMC to provide monitored and logged connectivity for all provisioning activities. 3. An automated (through cwterm) methodology to periodically poll the HMC for alerts and status of all managed components. TDi recommends a console connection for each (D)LPAR and one additional connection to communicate with the HMC command line. The examples in this section assume you know the Managed System Names and the Partition Names of the HMC LPARs that you want to connect to. The following commands are useful in determining these values: 1. Utilize the lsyscfg r sys --all from the HMC command prompt to list all managed systems known to the HMC. 2. Utilize the lsyscfg r lpar m <specific_system_name> --all command from the HMC command prompt to list all partitions associated with a specific managed system. The following steps demonstrate how to connect to each (D)LPAR: 1. Create a pseudo_console command file in the /opt/consoleworks/<invo_name>/pseudo_consoles directory (usually named HMC.pki.<LPARname>) that contains the command /opt/consoleworks/<invo_name>/pseudo_consoles/hmc_pki_<lparnam e>_pseudo.sh. 2. Create the hmc_pki_<lparname>_pseudo.sh command file containing the following commands: #!/bin/bash 9 /usr/local/bin/expect f /opt/consoleworks/<invo_name>/pseudo_consoles/hmc.pki.<lparname >.expect 3. Create the hmc.pki.<lparname>.expect file and place the following expect script in it: spawn /usr/bin/ssh hmc.ip.address l <usename> -I /home/<username>/.ssh/id_dsa t expect { HMCprompt:~> { 9 This is a critical component of this feature and must not be omitted. Please see the section entitled An Important Note about Using Expect with SSH below.

7 Sleep 1 Send mkvterm m <managed_system_name> -p PartitionName\r } } Interact 4. Create a pseudo console within ConsoleWorks to use the file created in Step 1 for connectivity. At this point, the console should be operational and you should be able to connect to the LPAR and either see the hardware (firmware) prompt of the pseries partition or AIX if it is already configured. 10 The following steps describe how to configure a ConsoleWorks console to communicate with the HMC command line: 1. Create a pseudo_console command file in the /opt/consoleworks/<invo_name>/pseudo_consoles directory (usually named HMC.pki.<LPARname>) that contains the command /opt/consoleworks/<invo_name>/pseudo_consoles/hmc_pki_<lparnam e>_pseudo.sh. 2. Create the hmc_pki_<lparname>_pseudo.sh command file containing the following commands: #!/bin/bash /usr/bin/ssh hmc.ip.address l username I /home/<username>/.ssh/id_rsa -t 3. Create a pseudo console within ConsoleWorks to use the file created in Step 1 for connectivity. Notice that the expect scripting is not required for this console since no virtual console is created on the HMC. An Important Note about Using Expect with SSH Experienced expect script users will want to remove the -f qualifier from expect and initiate expect as the shell to run the scripting example. Do not do this! OpenSSH, and many other SSH toolkits, require features of the pseudo-tty support which are not implemented by the expect shell. Therefore, a full-featured command shell must be utilized in order to make the SSH connectivity function well with ConsoleWorks. Unexpected behavior will result if you omit the creation of a command shell. 10 In some cases, an invocation of AIX is already running on the partition, but is not configured to allow the console stream to be sent to the HMC virtual console. This problem and its resolution are described later in this document.

8 Step 3: Install and Configure AIX on (D)LPARs If you install AIX from the LPAR hardware prompt configured earlier in this document, AIX will be automatically configured to direct console output to the virtual console associated with the HMC LPAR and no further configuration is required. This can be verified by executing the following command: Lsdev Cl sa0 If the response is: Sa0 Available LPAR Virtual Serial Adapter Then the configuration is correct. If the response is: Sa0 Available 01-S1 Standard I/O Serial Port Then the virtual serial adapter has not been loaded properly and the steps below need to be performed. Also, if a Full System Partition was previously being used, and the pseries was configured in SMP mode instead of LPAR mode, the following steps may be required to redirect the console output to the HMC virtual console: 1. Log into the AIX partition using root. 2. Verify the bse CHRP LPAR Device Support is loaded by executing the following commands: a. Lslpp L devices.chrp_lpar_base.rte b. Omget q subclass=lpar PdDv 3. If these commands don t indicate the LPAR Device Support is loaded, then reconfigure AIX to load the missing pieces. If you don t know how to do this, get help it s beyond the scope of this document. 4. Use SMIT to create a virtual terminal device. 5. Use SMIT to redirect the console to the virtual terminal device. Note that this change will not occur until AIX is rebooted. 6. Reboot AIX. If you can t reboot the console immediately, then you can redirect console output to the virtual console by issuing the chcons command fro AIX. Note that output will be directed to the virtual console, but interactive login will not be possible until AIX is rebooted. Useful Documents The following links and documents will be very valuable to you if you don t know much about AIX, pseries computers, and/or HMCs:

9 1. m -- AIX and pseries Accessibility 2. docs/pdf/ pdf -- The pseries Planning for Partitioned-System Operations AIX Installation in a Partitioned Environment Effective System Management Using the IBM Hardware Management Console for pseries IBM pseries System Handbook 2003 Edition 6. Hardware Management Console for pseries Installation and Operations Guide (SA )