Utility Scripts. Changing Passwords: Prime Network Database Schemas CHAPTER

Transcription

1 CHAPTER 15 The following topics describe some additional Prime Network utility scripts that you can use to do the following: Changing Passwords: Prime Network Database Schemas, page 15-1 Changing Passwords: bosenable, bosconfig, and bosusermanager, and root, page 15-4 Changing Passwords: Diagnostics Tool, page 15-5 Running a Command on All Prime Network Units, page 15-5, page 15-5 Changing Passwords: Prime Network Database Schemas By default, an operating system account for the Prime Network application is created when Prime Network is installed. When the database is created, it uses this operating system account name as the basis for naming the schemas. The following are the database schemas that are created by Prime Network. As an example, in the following table the Prime Network operating system account (network user) is named network39. (For more details about these schemas, see Prime Network Database Schemas, page 10-1.) Schema Name Description Example network user Prime Network general data network39 network user_ep Prime Network event persistence and archiving data network39_ep network user_dwe Prime Network Workflow Engine data network39_dwe network user_xmp Prime Network Change and Configuration Management network39_xmp data network user_admin Prime Network maintenance and administration data network39_admin At installation time, the network-conf script assigns the same password to all of the schemas. After installation, you can assign different passwords to each schema. The following procedure describes how to change any or all of the passwords. that you have to change the password in two places: in the Oracle software and in the Prime Network software. 15-1

2 Changing Passwords: Prime Network Database Schemas In the following procedure, network user-db, network user-ep-db, network user-dwe-db, network user-admin-db, and network user-xmp-db are the user accounts for the four database schemas. Step 1 Step 2 Log into the Prime Network gateway server as network user. To change the network user-db password (for the general data): a. Enter the following sqlplus command to change the network user-db password in the Oracle software: # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql DBA-username DBA-password network user-db network user-db-new-password DB-IP DB-port SID # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql system systempassword network39 network39newdbpassword MCDB b. Enter the following to change the network user-db password in the Prime Network software (the gateway server must be up and running): #./runregtool.sh -gs setencrypted site/persistency/nodes/main/pass network user-db-new-password Step 3 To change the network user-ep-db password (for the event persistence and archiving data): a. Enter the following sqlplus command to change the network user-ep-db password in the Oracle software: # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql DBA-username DBA-password network user-ep-db network user-ep-db-new-password DB-IP DB-port SID # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql system systempassword network39_ep EPnewDBpassword MCDB b. Enter the following to change the network user-ep-db password in the Prime Network software (the gateway server must be up and running): #./runregtool.sh -gs setencrypted site/persistency/nodes/ep/pass network user-ep-db-new-password Step 4 To change the network user-dwe-db password (for the Workflow Engine data): a. Enter the following sqlplus command to change the network user-dwe-db password in the Oracle software: # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql DBA-username DBA-password network user-dwe-db network user-dwe-db-new-password DB-IP DB-port SID # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql system systempassword network39_dwe DWEnewDBpassword MCDB b. Enter the following to change the network user-dwe-db password in the Prime Network software (the gateway server must be up and running): #./runregtool.sh -gs setencrypted avm66/services/workflow/engine/databasepassword network user-dwe-db-new-password 15-2

3 Changing Passwords: Prime Network Database Schemas Step 5 To change the network user-admin-db password (for administration and maintenance data): a. Enter the following sqlplus command to change the network user-admin-db password in the Oracle software: # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql DBA-username DBA-password network user-admin-db network user-admin-db-new-password DB-IP DB-port SID # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql system systempassword network39_admin adminnewdbpassword MCDB b. Enter the following to change the network user-admin-db password in the Prime Network software (the gateway server must be up and running): #./runregtool.sh -gs setencrypted site/persistency/nodes/admin/pass network user-admin-db-new-password Step 6 To change the network user-xmp-db password (for the Change and Configuration Management): The password should not contain ampersand (@) or forward slash (/) characters. If you enter either of these special characters, future installations will fail. a. Enter the following sqlplus command to change the network user-xmp-db password in the Oracle software: # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql DBA-username DBA-password network user-xmp-db network user-xmp-db-new-password DB-IP DB-port SID # sqlplus /nolog \@$ANAHOME/Main/unix/setPassword.sql system systempassword network39_xmp network39xmpnewdbpassword MCDB b. Enter the following to change the network user-xmp-db password in the Prime Network software: # cd $XMP_HOME/bin # xmpchangepw.ksh network user-xmp-db-old-password network user-xmp-db-new-password Step 7 Step 8 Stop the gateway server and units: # networkctl stop Run the unlock command to ensure that the Prime Network Oracle accounts are not locked. A lock can happen if Prime Network accesses the database (which it does constantly) between the time when you run the sqlplus setpassword.sql command and the time when you run the runregtool.sh or xmpchangepw.ksh scripts. In that period of time, the passwords are not in sync. a. As the Oracle UNIX user, log in to sqlplus: # sqlplus /nolog SQL> connect /as sysdba b. Run the unlock command. You need only run the unlock command on accounts that were changed in other words, in the following command, account-name can be network user, network user-ep-db, network user-dwe-db, or network user-xmp-db from the previous steps. SQL> alter user account-name account unlock 15-3

4 Changing Passwords: bosenable, bosconfig, and bosusermanager, and root Step 9 Start the gateway server and units: # networkctl start Changing Passwords: bosenable, bosconfig, and bosusermanager, and root The passwords for bosenable, bosconfig, bosusermanager, and root are established during the Prime Network installation. Use the following to change the bos passwords. To change the root password, you can use Changing a User s Prime Network Password, page If you have lost the root password, you can use this procedure to reset it. Step 1 Step 2 Step 3 Step 4 Using an SSH session, log in to the Prime Network gateway as network user. (network user is the operating system account for the Prime Network application, created when Prime Network is installed; for example, network39.) Switch to the Main directory: Encrypt the new password in Prime Network using the following command: java -classpath./jars/classes.jar com.sheer.metromission.authentication2.passwordencrypt password The encrypted password is listed in the command output (after the comma). You will need this information in Step 4. For example, the following command creates a new password for test. The portion of the output that is in bold is what you will need in the subsequent step. # java -classpath./jars/classes.jar com.sheer.metromission.authentication2.passwordencrypt test 'test' -> 'PEv1:DC57A2A7', '7E84D3A8F60F30B7B62946D532E24608' Log in to the Oracle database and change the password for bosenable, bosconfig, bosusermanager, and root in the database. a. Log in to the Oracle database as network user. In the following example, network user is network39 and the network user password is admin. sqplplus network39/admin b. Change the password using the following command, where xxx is the second string of output from Step 3, and user is bosenable, bosconfig, bosusermanager or root. In this example, the bosenable password is being changed: update bosuser set ENCRYPTEDPASSWORD='xxx' where username='bosenable'; SQL> update bosuser set ENCRYPTEDPASSWORD='7E84D3A8F60F30B7B62946D532E24608' where username='bosenable'; 1 row updated. To update the root user password, you would use the following command: 15-4

5 Changing Passwords: Diagnostics Tool update bosuser set ENCRYPTEDPASSWORD='xxx' where username='root'; c. Commit the change: SQL> commit; Commit complete. d. Repeat Step b and Step c for bosconfig and bosusermanager. Changing Passwords: Diagnostics Tool The username and password for the Diagnostics Tool (described in Obtaining Diagnostic Information Using Graphs, page 9-6) is established during the Prime Network installation. To change the passwords: Step 1 Step 2 Step 3 Using an SSH session, log in to the Prime Network gateway as network user. (network user is the operating system account for the Prime Network application, created when Prime Network is installed; for example, network39.) Switch to the Main directory: # cd $ANAHOME Change the username and password for the Diagnostics tool using the following command, where operating-system is either linux or solaris, depending on your configuration: # utils/operating-system/apache/bin/htpasswd./main/webroot/.passwd new-username The utility will prompt you for a new password for new-username. Running a Command on All Prime Network Units The script rall.csh is a utility used to run a given command on all units (not on the gateway), as follows: # $ANAHOME/rall.csh script where script is the script name. The following script example restarts all units: # $ANAHOME/rall.csh./Main/networkctl restart In general, you should use the Prime Network Administration GUI client to add VNEs. The GUI has built-in mechanisms to ensure that you enter data correctly. 15-5

6 The vne_creation_script.pl allows you to add VNEs in bulk. This includes Cloud VNEs, AVMs, and maps, and associating all of the VNEs to specific units. The vne_creation_script.pl resides in NETWORKHOME/Main/scripts. This script reads a configuration file with the relevant VNE information, adds the VNEs to Prime Network, and produces a report log file for your reference. Follow these steps to import a list of VNEs into Prime Network Step Description See: 1. Create a configuration file that contains the VNEs that you want to add. 2. If any of the VNEs to be imported use reduced polling, create a new version of the vne_creation_script.pl and update it to ensure that the reduced polling settings are preserved. Create the Configuration File, page 15-6 Additional Step for VNEs Using Reduced Polling, page Run the vne_creation_script.pl command. Running the vne_creation_script.pl, page Create the Configuration File The vne_creation_script.pl script takes the name of a configuration file as its argument. The configuration file contains information about the VNEs that you want to add to Prime Network and uses a flat text file format. Table 15-1 describes the format of the configuration file and how to enter the various types of information that describe your network. A defined variable will be applied to any applicable elements that follow it. For example, after adding an AVM, all VNEs will be added to that AVM until another AVM is defined. Similarly, all VNEs will use a configured scheme until another scheme is specified. 15-6

7 Table 15-1 Supported Entries for a vne_creation_script.pl Configuration File Format gateway gateway-ip user root-user password root-user-password unit unit-ip unit auto} scheme scheme-name [[vne-name] vne-ip vne-properties]... avm {number [memory] auto]} [[vne-name] vne-ip vne-properties]... [vne-name] vne-ip vne-properties Description and Usage s Adds the Prime Network gateway, units, and network user that will manage the items in the configuration file. The units are uplinked to the gateway. root-user is the root user for the Prime Network GUI applications. If no units are specified, enter the unit line as unit. unit unit-ip specifies additional unit server(s). Any AVMs or VNEs that follow will be allocated to that unit. If there are no other units, use unit gw-ip. unit auto specifies that any AVMs or VNEs 1 that follow will be allocated among all available units. (See Adding AVMs Using Auto-Add, page 4-8 and How VNE Auto-Add Works, page ) Defines the scheme to be used by the VNEs listed in the lines that follow. Supported schemes are ipcore, product, or default. VNEs listed on the line that directly follow scheme scheme-name will use that scheme. To add a different scheme, enter scheme scheme-name on a new line, followed by VNEs that should use that scheme. Creates an AVM. If no VNEs follow the avm line, the AVM is created but is empty. avm number [memory] specifies additional AVMs (and, optionally, their memory allocation). Any VNEs that follow will be allocated to that AVM. avm auto specifies that any VNEs that follow will be auto-allocated among all of the AVMs in the previously-created unit (or gateway, if no units are created). Creates a VNE with the specified properties. If vne-name is not supplied, device will use SYSNAME. See Table 15-2 for vne-properties format guidelines. If a VNE definition does not directly follow an AVM declaration, the VNE creation will fail (the log will contain error information). If a VNE definition is mistakenly repeated but has conflicting information, the VNE creation is ignored (the log will contain error information). cloud-vne-name vne-ip cloud Creates a Cloud VNE. [map map-name] [[vne-name] vne-ip vne-properties]... [map] load avm-number... read_file BQL-filename (Optional) Creates a map named map-name. If you do not want to create any maps, do not supply a name. VNEs listed on the line that follows map map-name will be added to that AVM. To continue to create VNEs but stop adding them to a map, end the VNEs list with the word map (with no map-name argument). (Optional) Starts the AVMs after they have been created. You can leave this line out and manually start AVMs after they are created. Places the specified BQL file content into the gateway. (This can be used for adding static links.) For information on BQL, see the Cisco Prime Network Integration Developer Guide. 1. VNEs are allocated as long as there is a safe target AVM in the system. See How VNE Auto-Add Works, page

8 VNEs are added using the format [vne-name] vne-ip vne-properties, as described in the previous table. The values for vne-properties depend on the protocols and credentials for the device. Table 15-2 provides guidelines for adding VNEs to a configuration file. If you do not enter any SNMP read/write information, Prime Network uses public/private. If Prime Network is installed with Cisco Prime Central, be sure to use a device s SYSNAME as its VNE name. This allows the device to be recognized across the common inventory. Also, do not use None or All as the SYSNAME, because those names have internal meaning to Cisco Prime Central. Table 15-2 Defining VNEs in a vne_creation_script.pl Configuration File Value for vne-properties Description All values for vne-properties should be in one line; do not insert a carriage return. telnet telnet-seq [snmpr read-commu-string] [snmpw write-comm-string] Creates a VNE that uses Telnet with SNMP v1. sshv1 cipher;username;password;prompt_sequence [snmpr read-community-string] snmpv2 authentication;username;password;encryption;password Creates a VNE that uses SSH v1 with SNMP v2. sshv2 username;password;server-auth[;pre-fingerprint];prompt_sequence [snmpr read-community-string] snmpv3 authentication;username;password;encryption;password Creates a VNE that uses SSH v2 with SNMPv3. server-auth can be none, save, or pre. If you use pre, enter it as: pre;fingerprint When you are done, your configuration file might resemble the following: gateway user root password rootpassword unit avm VNE_example telnet ":,admin,router>,enable,:,admin,router#," load 150 scheme ipcore avm VNE_example telnet ":,admin,router>,enable,:,admin,router#," load 200 avm auto map mymap VNE_example telnet "Password:,admin,myPrompt#" snmpr snmpreadcomm snmpw snmpwritecommn VNE_example sshv1 des;myuser;mypassword;:,admin,myprompt# snmpr public VNE_example sshv2 myuser;mypass;none;# snmpr public snmpv3 sha;myuser;mypass;des;myencpass telnet "Password:,admin,myPrompt#" snmpr snmpreadcomm snmpw snmpwritecommn map 15-8

9 avm 300 Cloud cloud Cloud cloud load 300 Additional Step for VNEs Using Reduced Polling If any of the VNEs are using reduced polling, you must modify the vne_creation_script.pl file to add instructions that will preserve the reduced polling settings after the import. We recommend you create a special form of the script which you can use with reduced polling VNEs. Other VNEs can use the standard script. The following procedure adds the necessary information to three points in the script. Step 1 Step 2 Step 3 Step 4 Step 5 Log into the Prime Network gateway as user network user. (network user is the operating system account for the Prime Network application, created when Prime Network is installed; for example, network39.) Go to NETWORKHOME/Main/scripts. Create a copy of vne_creation_script.pl and give it a meaningful name; for example: # copy vne_creation_script.pl vne_reducedpolling_creation_script.pl Open the new script file with a text editor. Locate the three instances of the $add_agent_command variables, which appear below the sub set_bql_commands. You can locate the instances using the following information: Variable Instance Instance is preceded with the following text: VNEs that use Telnet $telnet_used = 0 ; $add_agent_command... VNEs that use SSHv1 } elsif ($sshv1_used){ $sshv1_used = 0; VNES that do not use Telnet or SSHv1 $add_agent_command... } else { $add_agent_command... Step 6 Step 7 Add the following line to end of the $add_agent_command variable: <ReducedPollingMode type=\"com.sheer.types.enums.reducedpollingmodeenum\">reduced polling (event-based) *</ReducedPollingMode> Save the file and exit the text editor. The following is an example of an $add_agent_command definition after being edited:... <SnmpVersionEnum type=\"integer\">$_snmpv3_enum</snmpversionenum> <TelnetEnabled type=\"boolean\">true</telnetenabled> <TelnetSequence type=\"string\">$tel_seq</telnetsequence> <ReducedPollingMode type=\"com.sheer.types.enums.reducedpollingmodeenum\"> Reduced polling (event-based) *</ReducedPollingMode> </management.ielementmanagement> </value> </param> 15-9

10 </command> \n.\n" ; Running the vne_creation_script.pl Log into the Prime Network gateway as user network user to run this command. (network user is the operating system account for the Prime Network application, created when Prime Network is installed; for example, network39.) The vne_creation_script.pl script uses the following command format: perl vne_creation_script.pl configuration_filename The command will display output similar to the following Summary Trying to login. [OK] + Executing commands. [OK] + Logs: - Log file path: /export/home/network39/main/logs/vnecreation txt - Verbose log file path: /export/home/network39/main/logs/vnecreation verbose Finished with: 0 ERRORs 0 WARNINGs When the vne_creation_script.pl script has successfully executed, you can view the additions in Prime Network Administration or the log files. The log files are placed in NETWORKHOME/Main/logs and are named vnecreation-mmddyy-hhmmss.txt and vnecreation-mmddyy-hhmmss.verbose. If errors appear, check your setup in Prime Network Administration, correct the configuration file accordingly, and run the command again