Repository Management

Transcription

1 APPENDIX A Repository management tools are handled through any Web browser, as shown in Chapter 4, VPN Console: File Menu. Additionally, you can do the following: Run dbbackup from the command line to back up your repository, as shown in the Backup from the Command Line section on page A-1. Run recovertool from the command line to recover events recorded in a journal file to re-create a Repository, as shown in the Recovery from the Command Line section on page A-2. Run dbrestore from the command line to restore your repository, as shown in the Restore from the Command Line section on page A-2 Back up a repository using a third party backup program, as shown in the Backup from Third Party Backup Program section on page A-3. Grant access permission to the tools, as shown in the Access Permission to Tools section on page A-3. Populate the VpnInventory Repository by reading information from a file, as shown in the Repository Import Tool section on page A-5. Export the entire Repository into a flat file, as shown in the Repository Export Tool section on page A-7. Backup from the Command Line This section provides the description and syntax for the dbbackup command that can be run from the command line to back up a repository. The dbbackup command backs up a repository from the command line. You can run dbbackup from $ECSP_HOME/bin/solaris. A-1

2 Recovery from the Command Line Appendix A dbbackup -db <dbpath> [-dest <destdir>] [-tar -compress] [-v] [-p <progname>] [-help] -db <dbpath> is the path to the repository you wish to back up. -dest <destdir> is the existing destination directory into which to place the backed up repository. If this parameter is not specified, the default destination directory is /tmp. -tar indicates to tar the backed up repository into the existing destination directory. -compress indicates to tar and compress the backed up repository into the existing destination directory. -v indicates to supply verbose log output. -p <progname> indicates to use <progname> to do the database backup. -help indicates to print this message. Recovery from the Command Line This section provides the description and syntax for the recovertool command that can be run from the command line to recover a repository. The recovertool command can be run from the command line to play back events recorded in a journal file to re-create a repository. You can run recovertool from $ECSP_HOME/bin/solaris. execjava.sh netsys.repository.journal.recovertool.main <journal_dir> <rep_dir> <journal_dir> is the path to the directory containing the journal files dir.jnl and vi.jnl. <rep_dir> is the destination directory (complete path) that contains the Repository on which the journal files are to be played back. Restore from the Command Line This section provides the description and syntax for the dbrestore command that can be run from the command line to restore a repository. The dbrestore command restores a repository from the command line. You can run dbrestore from $ECSP_HOME/bin/solaris. A-2

3 Appendix A Backup from Third Party Backup Program dbrestore <backupfile> -dest <destdir> [-c] [-v] [-help] <backupfile> is the path to the backup file or directory you wish to restore from. -dest <destdir> is the destination directory (complete path) into which to place the restored repository. -c indicates to create the destination directory, as specified, if it does not exist. -v indicates to supply verbose log output. -help indicates to print this message. Backup from Third Party Backup Program This section provides the description and syntax for the dbbackup command that can back up a repository using a third party backup program that is running with the same user ID as the VPN software. The dbbackup command backs up a repository using a third party backup program. You can run dbbackup from $ECSP_HOME/bin/solaris. When you execute the dbbackup command, it automatically does the following: 1. Locks the repository 2. Executes your backup program 3. Unlocks the repository. dbbackup -db <dbpath> -p "<progname -parameters>" -db <dbpath> is the path to the repository you wish to back up. -p "<progname -parameters>" is the backup program name and all its parameters. Access Permission to Tools This section includes the following categories: How to Define the Access Permission File of the Access Permission File Example of Access Permission File A-3

4 Access Permission to Tools Appendix A This feature allows you to specify which machines have access permission to the Repository Management tools. Without an access permission file, every machine has permission to use the tools. How to Define the Access Permission File In $ECSP_HOME/etc, create a file called SecureAccess.id. For example: $ECSP_HOME/etc/SecureAccess.id Within this file, define the machines to which you want to permit and deny access permission, as specified in the section of the Access Permission File. Then restart the httpd server by issuing the following command: wdclient restart httpd. of the Access Permission File {permit deny} {<IPaddress> <MachineName> <SubnetAddress>} You must choose one of the following two arguments: permit gives access permission to the tools. deny denies access permission to the tools. You must choose one of the following three arguments: <IPaddress> is the IP address of the machine. <MachineName> is the name of the machine. <SubnetAddress> is the address of the subnet of multiple machines. Example of Access Permission File The following example of an access permission file, SecureAccess.id, gives permission to the machine with the IP address and the machine with the name machine1.company1.com to use the tools. This example also denies permission to the machine with the name machine2.company1.com and the machines in the subnet /24 to use the Repository Management tools. # start of the id file # # # # end of the comment block permit permit machine1.company1.com deny machine2.company1.com deny /24 A-4

5 Appendix A Repository Import Tool # end of the id file # Repository Import Tool This section provides the description, prerequisites, and syntax for the Repository import tool, the VpnInvImport command. This tool can be run either on the server that runs VPNSC or on a remote machine. Warning You must install the Repository Import/Repository Export license before using this tool. To get this license, send an to the following address, requesting this license: csg-license@cisco.com. Then refer to the License Administration section on page 9-71 to add this license. The VpnInvImport command enables you to populate the VpnInventory Repository by reading information from a file. The file /tmp/vpninvimport.log contains information about each element that was created. In addition, this tool writes output information to stdout for the Inventory Elements that are created as well as the elements that already exist. If an error occurs while populating the Repository, the program exits and a message is printed to stderr. This tool cannot be used to modify an existing Repository. It can only be used to populate an empty Repository or add elements to an existing Repository. This tool populates the Repository currently being used by IPsec VPN Solution. Prerequisites Be sure that the following steps are taken before implementing either of the commands listed in the section on page A-6: Step 1 Step 2 Be sure the IPsec VPN Solution watchdog has been started. In the $ECSP_HOME directory, source as follows. For csh users, enter: source vpnenv.csh For sh and ksh users, enter:../vpnenv.sh Perform Step 3 and Step 4 when running IPsec VPN Solution as a user other than the VPNSC owner. A-5

6 Repository Import Tool Appendix A Step 3 If you choose to run the tool on a remote machine rather than on the same server that runs VPNSC, be sure the Naming Server (NS) and the VpnInvServer running on the VPNSC server have their permissions set correctly. For example: to allow a user (<username>) to run this tool on a remote machine, enter the following commands on the VPNSC server: chmodit NS i+<username> chmodit VpnInvServer i+<username> Step 4 The lowercase letter i indicates to invoke. If the environment variable IT_DAEMON_PORT is not already set, enter the following command: setenv IT_DAEMON_PORT 1570 Be sure you have implemented the prerequisites, as specified in the Prerequisites section on page A-5, before implementing either of the following commands: VpnInvImport -xml <filename> [-u <username>] [-p <password>] [-f <password_file>] [<hostname>] -xml indicates to read from an XML formatted file. If the format of the input file, the Document Type Definition, is not known, run the VpnInvExport tool explained in the Repository Export Tool section on page A-7. All values are case sensitive. Therefore, be sure the Boolean variables are all specified in lowercase. Also be sure that the character & is replaced by & before using XML import format. This is required because the character & has a special meaning in XML. <filename> is the name of the file from which to read data. -u <username> is the name of the valid user on VPNSC. If this optional parameter is not specified, the default for the valid user name is admin. -p <password> is the password for the valid user specified by the -u option above or the password for the default user admin. If this optional parameter is not specified, the default for the password is admin. -f <password_file> is the file during VPNSC installation against which the <username> and <password>, specified above, will be validated. If this optional parameter is not specified, the default for the password_file is the password_file created during VPNSC installation. <hostname> is the name of the host where the Naming Server is running, for example: abc.efgh.com, where abc is the machine name. When this optional parameter is not specified, the default is localhost. or VpnInvImport -h help -h and help (case insensitive) request help text about the VpnInvImport command. A-6

7 Appendix A Repository Export Tool Repository Export Tool This section provides the description, prerequisites, and syntax for the Repository export tool, the VpnInvExport command. This tool can be run either on the server that runs VPNSC or on a remote machine. Warning You must install the Repository Import/Repository Export license before using this tool. To get this license, send an to the following address, requesting this license: csg-license@cisco.com. Then refer to the License Administration section on page 9-71 to add this license. The VpnInvExport command allows the entire VPNSC Repository to be exported into a flat file. With this Repository Export tool, you can get output of the VpnInventory Repository in text format. Prerequisites Be sure that the following steps are taken before implementing either of the commands listed in the section on page A-8: Step 1 Step 2 Be sure the IPsec VPN Solution watchdog has been started. In the $ECSP_HOME directory, source as follows. For csh users, enter: source vpnenv.csh For sh and ksh users, enter:../vpnenv.sh Step 3 Perform Step 3 and Step 4 when running IPsec VPN Solution as a user other than the VPNSC owner. If you choose to run the tool on a remote machine rather than on the same server that runs VPNSC, be sure the Naming Server (NS) and the VpnInvServer running on the VPNSC server have their permissions set correctly. For example: to allow a user (<username>) to invoke this tool on a remote machine, enter the following commands on the VPNSC server: chmodit NS i+<username> chmodit VpnInvServer i+<username> The lowercase letter i indicates to invoke. A-7

8 Repository Export Tool Appendix A Step 4 If the environment variable IT_DAEMON_PORT is not already set, enter the following command: setenv IT_DAEMON_PORT 1570 Be sure you have implemented the prerequisites, as specified in the Prerequisites section on page A-7, before implementing either of the following commands: VpnInvExport -xml <filename> [-u <username>] [-p <password>] [-f <password_file>] [<hostname>] -xml indicates to dump the VPNSC Repository into a flat file in XML format. The Document Type Definition (DTD) is part of the output in the XML document. <filename> is the name of the file to which to dump the Repository. -u <username> is the name of the valid user on VPNSC. If this optional parameter is not specified, the default for the valid user name is admin. -p <password> is the password for the valid user specified by the -u option above or the password for the default user admin. If this optional parameter is not specified, the default for the password is admin. -f <password_file> is the file during VPNSC installation against which the <username> and <password>, specified above, will be validated. If this optional parameter is not specified, the default for the password_file is the password_file created during VPNSC installation. <hostname> is the name of the host where the Naming Server is running, for example: abc.efgh.com, where abc is the machine name. When this optional parameter is not specified, the default is localhost. or VpnInvExport -h help -h and -help requests help text about the VpnInvExport command. A-8