Solaris 11 AutoInstaller service profile for ssh to enable root logins?

Hi Guys,
I have got a basic system configuration profile that sets various things for my newly installed solaris 11 client.
I was curious if anyone has a xml service configuration declaration I could use that configures the ssh service to allow remote root logins.
I'd appreciate it.

SSH configuration is not held in SMF but in /etc/ssh/sshd_config so it is not currently possible to use just an AI/SC manifest & profile to do what you ask.
You need do deliver an updated /etc/ssh/sshd_config file with "PermitRootLogin yes", you will also need to have your SC profile setup so that the root account is not configured as a role. Y
ou can deliver the /etc/ssh/sshd_config file either in an IPS package or you could do it with a custom [first boot script|http://docs.oracle.com/cd/E26502_01/html/E28980/firstboot-1.html#scrolltoc] or use a software_type of archive in your AI manifest to deliver it via cpio/tar.

Similar Messages

How to change path of Users Terminal Services Profile for multiple AD users on server 2003?

Hello experts. I am working on a file server migration. All data has been migrated, I am currently working on redirecting users to the new file server. I
am able to select multiple users at once in ADUC -> right-click -> properties -> profile and here I can change the home folder and roaming profile path for each all users to point towards the new file server.
The issue I have run in to is that we have roaming profiles for terminal services users. So, there are hundreds of users that have their terminal services profile
configured in AD -> Right-click user (one at a time) -> properties -> terminal services profile. Here, the profile path is configured for each user as \\OLDserver\Profiles\%username%
and I need to change it to \\NEWserver\profiles\%username%.
I know that you can configure this path via group policy, I set up a GPO; Computer / Administrative Templates / Windows Components / Terminal Services / “Set Path
for TS Roaming Profiles” as \\NEWserver\profiles and applied this GPO to an OU containing the TS servers.
The problem is, the GPO is not working... When I log in to the TS and add a document to My Documents, it is still saving under \\OLDserver\profiles\Username.
So, the settings in AD are trumping the GPO I believe. What is the best way to accomplish my goal? Thanks in advance!

> to change it to \\NEWserver\profiles\%username%.
That is "profile" in opposite to...
> add a document to My Documents, it is still saving under
> \\OLDserver\profiles\Username.
...this one which is Folder Redirection and has NOTHING to do with
server based profiles.
> So, the settings in AD are trumping the GPO I believe.
No, it isn't. When you do not enable FR and you access "Documents", you
will never see an UNC path but the local c:\users\xyz\documents folder.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Service profiles and templates

I was wondering what people are doing when creating service profiles for esxi. Are you creating a single service profile for each esxi server you deploy or are you using a template and then creating service profiles from that template?
Also what is the difference if using an initial template vs an updating template?

Hi Tony,
You need a service profile for each esxi server, template only provides a blue print.
As a best practise you can deploy service profiles from a template to maintain uniformity and consistency and reduce any errors while creating the sp.
Initial template is static and updating is dynamic I.e any change made to the updating template will also be updated on the sp deployed using that template which will not happen with the initial.
Hope this helps!
./abhinav
Sent from Cisco Technical Support iPad App

Handling Service Profiles & RBA

Hi Togheter,
We are using the using the version 1.4(1j) and have the service profile structured like this:
- Environment A
     -Service Profile1
     -Service Profile2
     -Service Profile3
- Environment B
     -Service Profile10
     -Service Profile11
     -Service Profile12
- Environment C
     -Service Profile21
     -Service Profile22
     -Service Profile23
Let's focus on the environment A. There is for example an exchange administrator whos got 2 server (service profile1 & 3). I want to give him the option to administrate his server over the UCS (well just console & reboot in case he is facing some problems). But he only should be authorized to his 2 servers.
The only way I see to handle it that way is to reoganize the structure like this:
-Enironment A
     - Service Exchange
          -Service Profile1
          -Service Profile 3
     - Service B
Now I can create a locale which is refering to "Service Exchange", combine that with the server-profile role and map this to the "exchange-user".
But is it even possible to move an existing service-profile to a sub ou? I just the "copy" possibility which is going to change all values like MAC-address, UUID, WWPN, and so on.
Can somebody give me an input?
Thanks in advanced
Philippe

Hi Tony,
You need a service profile for each esxi server, template only provides a blue print.
As a best practise you can deploy service profiles from a template to maintain uniformity and consistency and reduce any errors while creating the sp.
Initial template is static and updating is dynamic I.e any change made to the updating template will also be updated on the sp deployed using that template which will not happen with the initial.
Hope this helps!
./abhinav
Sent from Cisco Technical Support iPad App

UCS replicating tamplate / service profile

Hello Experts
I have about 50 datacenters deployed with Cisco UCS
All datacenter have the same exec hardware and using the same UUID pools same MACs
the only diffrence between them is the IP scheme
I want to create a new template or service profile for only one of the B200 Blades and inject it to each one of my datacenters
I have tried to do it with command line script but not much luck
I am familiar with the backup and restore options but I am unable to export only one of the service profile only all of them
Is what I am asking possible ?
Thanks ahead and best wishes
Mitch

Mitch,
Couple of comments - I would use extreme caution when using duplicate MACs. If you ever have to interconnect your DCs you're going to be in a mess of trouble. Since you can craft your own MACs people will normally use one octect to designate the "site".
Ex. 00:25:B5:AA:BB:BB
00:25:B5 = Cisco's OUI
AA = Site ID
BB:BB = Unique Identifier
You should be able to use a Power shell script to inject the new profile to each of your UCSM domains.
Jeremy Waldrop has done a great job utlizing this. Check out his blog. He's put together an incredible PowerShell script you should be able to re-use with some slight modifications.
http://jeremywaldrop.wordpress.com/2012/04/05/cisco-ucs-powershell-configuration-script/
You'll also find some great reference commands in the Quick Start guide:
Regards,
Robert

Service profiles auto association

Hi, if a server goes down, is it possible to configure the service profile for moving automatically to another server from the servers pool?

No. UCS will not do automation like this. The reason is because its a tough call to determine what qualifies a server as "being down" - loss of networking, loss of management, loss of power, OS crash etc We wouldn't want UCSM moving around hosts unless certain criteria were met. This has been heavily discussed internally and it was decided that UCSM would not touch SP movement pertaining to host failures.
There are other management Apps that can handle the orchestration piece like this - which tie into UCSM very nicely via the XML API.
Regards,
Robert

UCS Central: How Global Service Profile match DG

Hi
I'm pretty new to UCS Central and I've got a rudimentary UCS Central question.
I wonder how Global Service Profiles match/relate to domain groups.
To what I've read so far we use different domain groups to apply different operational policies to differenent UCS systems.
How does this relate/interact with global service profiles?
Is there a way to make sure that some service profiles could be associated just to UCS servers belonging to one DG?
Or is everything which is related to global service profiles like MAC-adresses, policies and the service profiles themselves always at the root and therefore can always be applied to all UCS servers managed within one UCS Central installation?
best regards
Dani

Hi Dani,
Global Service Profiles fall under the Organization structure.     And the Organization structure/hierarchy has no relationship/dependency to Domain Groups.
So limitting visibility of Global Service Profiles/Templates to certain Domain Groups --- no, you'd have to limit them within an Organizational context.
Hope this helps,
       -Jeff

Can't add a new vNIC for service profile

Hello,
I'm trying to add an additional vNIC for Service Profile.
B200-M3, VIC1240+expander, IOM 2208XP, 4 links between IOM and FI 6248, firmware 2.2(1f).
At the moment 7 vNICs are configured for this service profile. Service profile is associated with blade server.
When I try to add a new vNIC (it will be 8th vNIC), I see the error (see the attachment).
For some reasons separate vNICs are more useful for Hyper-V servers :)
All vNICs created via vNIC templates. All vNICs configured as VMQ, only iSCSI configured as Dynamic,
As I read the spec, VIC1240 can support up to 250 vNICs. What is wrong ? How to fix that ?

I have seen the VMQ limit being reached when applying the VMQ policy to the vNIC template. Can you try not selecting the VMQ policy for these new vNICs. If this works, you might be reaching the VMQ limits as described below:
Number of VMQ's:
128 is the Maximum number per vNIC
256 is the max number per Blade

Create Action Profile for Service Complaint

Hi All,
How to create the action profile for service complaint. I am working in CRM Standalone server. I gone through that service complaint doc and found that for this transaction we have to define the actions like CREATE RETURN REQUEST, CREATE SPARE PART DELIVERY, CREATE QUALITY NOTIFICATION, CREATE CREDIT/DEBIT MEMO REQUEST AND CREATE TASK. Can Anybody guide me how can I achieve this ans assign to my transaction type ie Service Complaint.If any body has the doc to achieve this can send it to
[email protected]
Valuable answer will be appreciated.
Thanx
Saravana

Hi saravana
want actions in transactions then use this link
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/c87bb93d-0b01-0010-a0b4-b04d7fda745f
regards
Vinay

Which Color profile for softprofing to print to Apple's book services?

I'm looking for a simple, specific and official answer as to which specific ColorSync profile should I choose for 'Onscreen Proofing' in Aperture? My intended output is Apples Print Services (Hardcover book).
I've crawled the web looking for this simple answer with no luck.
It seems to me that this profile (ie an accurate characterization of Apple's Printing Services) should be at the top of the list (in View/Proofing Profile/). Instead all I could find are discussion forums which hint or guess as to which profile to use.
Alternatively. It should be documented in the manual or the "How to create great looking books?" articles something like: "If you are going to order a book from Apple, then choose the sRGB profile for onscreen proofing. Apple's services are calibrated to this profile and guarantee consistent results". <-- Something like this appears nowhere!
So again. I'm printing my books ($$$) on Apple. Which Proofing profile should I choose?

I'm looking for a simple, specific and official answer as to which specific ColorSync profile should I choose for 'Onscreen Proofing' in Aperture? ... Alternatively. It should be documented in the manual or the "How to create great looking books?" articles something like: "If you are going to order a book from Apple, then choose the sRGB profile for onscreen proofing. Apple's services are calibrated to this profile and guarantee consistent results".
Not sRGB, argghhh -:)
In a colour matching conversion, you have a source colour space (in this case, your ICC type MNTR Monitor profile for your RGB working space) and a destination colour space (in this case an unknown ICC profile, probably of type PRTR Printer).
Your aim in the ICC architecture is to capture into and correct in as large a source colour space as is necessary to contain the colours you can render on the largest colour spaces of displays, printers and presses. This excludes sRGB as source by definition.
The sRGB colour space is the colour space of an HDTV cathode ray tube. This colour space cannot hold colours a lot of output devices can render, including the pure cyan of an ISO 12647 offset printing condition on art paper, and for inkjet sRGB is even worse as source.
Open the Apple ColorSync Utility, select sRGB in the RGB profiles list, click the Disclosure (triangle) icon in the CIELa*b plot, and select Hold for Comparison. Then pick an inkjet profile in the RGB profiles list or a large gamut offset profile in the CMYK profiles list, and turn the 3D graphic to see what can be matched directly and what can be matched only by reshaping the colours.
PDF printing masters can either have only the source ICC profile(s) embedded or both the source and destination ICC profiles. In the former case, the colour matching is done at runtime and you have to wait to see what prints.
In the latter case, you embed the destination ICC profile as OutputIntent and submit PDF/X-3. Since you are allowed to embed either type PRTR Printer or type MNTR Monitor profiles as OutputIntent, and since both are bidirectional for printing as well as for proofing, you have a contract proofing condition.
But in order to work with PDF/X-3 you need to know enough about rendering intents and gamut mapping behaviours that you don't set the wrong rendering intent per object in the page. So a runtime rendering workflow ensures that you get to draw to the maximum gamut available in the printing service, without giving you advanced controls.
/hh

Prerequisite to enable Profiling for posture assessment to check the AV, Patches, OS update

Hi Experts,
I have wireless set-up with two SSID , one is used for corporate users with dot1x auth and other one for guest using CWA .
I understood that , i do not need to buy any license or pay to cisco for Wireless license however i want to understand for enabling profiling for posture assessment .
I understood that I need have advance license for posture assessment however I am looking out for information about costing to buy advance license and is there any prereuisite to configure posture assessment other than additional license?

There were a few changes in ISE v1.3:
- Base License = The same
- Plus License = The same (with some more features)
- Advanced License = Apex
- Wireless = Mobility (Now it includes VPN based authentications as well)
So your plan is to run the new version of ISE (1.3) and AnyConnect 4 then you will need to have:
- ISE Mobility License (Includes Base, Plus and Apex for wireless and VPN)
- AnyConnect APEX license - This one is on the honer system and it is not installed on ISE
If you plan to use posture on wired as well then instead of the "mobility" license you will need to get:
- ISE Base
- ISE Plus
- ISE Apex
- AnyConnect Apex
Thank you for rating helpful posts!

Enable logging for SSH

Hi
I am trying to enable logging for SSH. Using sun 5.9. The SSH was preinstalled.
The logging should be able to track who logs in, time and ip address. Is it possible to also track what each user has done?
Any help would be appreciated.
Thanks
Darren

No, auth.debug would not help.
As far as I know, theres no facility in ssh to track what happens in an ssh session.
Just the logins.
I theory you can change the users shell into something logs the session.
Possibly something scripted with the "script" command.
But it would be non trivial.

Change Boot Policy and Firmware Version for Service Profile using UCS PowerTool

I'm looking for the PowerTool syntax to modify both of these values on individual service profiles. The documentation behind most of these cmdlests is almosts non-existent.
I believe the boot policy may be able to be changed like this:
Set-UcsServiceProfile -BootPolicyName
As for the host firmware version under the policies tab of the SP... I have no idea what that cmdlet would be.
See attached images for examples.
Thanks in advance,
JD

Hello,
One version of the User guide for UCS powertool can be found here:
http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/sw/msft_tools/powertools/ucs_powertool_book/ucs_pwrtool_bkl1.html
That guide makes notes of the following commands in regards to HFPs:
Host Firmware Package
Create a Host Firmware package and set IgnoreCompCheck to No.
$host_firm_pack = Add-UcsFirmwareComputeHostPack -Name host_firm_pack -IgnoreCompCheck no
Add a Host Firmware pack item.
$host_firm_pack | Add-UcsFirmwarePackItem -Type adaptor -HwModel N20-AC0002 -HwVendor "Cisco Systems Inc"
-Version '1.4(1i)'
Set version of Host Firmware pack item.
$host_firm_pack | Get-UcsFirmwarePackItem -HwModel N20-AC0002 | Set-UcsFirmwarePackItem -Version '2.0(1t)'
Remove Host Firmware package.
$host_firm_pack | Remove-UcsFirmwareComputeHostPack
I would also like to recommend the Cisco Developed integrations section which may be more specific to the powertool:
https://communities.cisco.com/community/technology/datacenter/ucs_management/cisco_ucs_developed_integrations/content?filterID=contentstatus[published]~category[ucs-powertool]
As well as the Cisco Developers Network:
https://developer.cisco.com/site/devnet/home/index.gsp
Regards,
-Gabriel

How to create mandatory (read-only) profile for Terminal Services user (HP Thin Client) on Server2003... aaarrgghhh!

I've been tearing my hair out for a couple of days now...
I'm trying to create a mandatory profile for users logging in from hp thin clients on a 2003 server at a school.
I've set up a prototype user, then copied the proto user's NTUSER.DAT to NTUSER.MAN and renamed
NTUSER.DAT to NTUSER.DAT_unused.
At that point, logging in as the prototype user looks ok. It was my understanding that renaming NTUSER.DAT to NTUSER.MAN would make it a mandatory profile, and the user (in this case the proto user) would be unable to change it. However, in this
case the user can still modify the desktop and those modifications are preserved across logins. The NTUSER.MAN file is being updated, judging by the timestamp changes.
What am I missing?
I've tried putting the NTUSER.MAN in the user's dir on the server
(C:\Documents and Settings\ProtoUser),
in the DefaultUser, and in AllUsers.
Right now I'm getting a default, unmodifiable profile which I have no idea where it comes from.
In case it matters, the original user and directory tree from which the NTUSER.MAN I'm trying to use has been deleted, but I wouldn't think that should matter.
For example, I have the option to not show the security tab set in the group policy, but it is showing up.
The Start menu is showing as the classic start menu, and I had it set for the "new" (2 column) one.
I've got hide network places on the desktop set, but it's showing up.
Is there a way to tell where a profile is coming from?
I'm pretty confused at this point; any clarifications / tips would be much appreciated.
Related questions:
If both an NTUSER.DAT and an NTUSER.MAN exist, which is used?
If no profile is found for a user in the normal place, what happens?

Hi,
Thank you for posting in Windows Server Forum.
A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. With mandatory user profiles, a user can modify his or her desktop, but the changes are not saved when the user
logs off. The next time the user logs on, the mandatory user profile created by the administrator is downloaded. There are two types of mandatory profiles: normal mandatory profiles and super-mandatory profiles.
User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) on the server to NTuser.man. The .man extension causes the user profile to be a read-only profile.
User profiles become super-mandatory when the folder name of the profile path ends in .man; for example, \\server\share\mandatoryprofile.man\.
More information:
Mandatory User Profiles
http://msdn.microsoft.com/en-us/library/windows/desktop/bb776895(v=vs.85).aspx
Using User Profiles in Windows Server 2003
http://technet.microsoft.com/en-us/library/cc776120(v=ws.10).aspx
Hope it helps!
Thanks.
Dharmesh Solanki

PAM_CONV not working for SSH logins

I have a problem implementing PAM_CONV for SSH logins on Solaris 9 with the latest OS patches. I am using my own PAM module.
I am trying to utilize PAM_CONV from pam_sm_acct_mgmt.
I am using the following definition in /etc/pam.conf :
other account optional pam_gabi.so
Here is how I use PAM_CONV from pam_sm_acct_mgmt :
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <syslog.h>
void gabi_pam_free_msg (int num_msg,
struct pam_message **msg);
void gabi_pam_free_resp (int num_msg, struct pam_response *resp);
int gabi_pam_conv (int (*conv_funp)(), int num_msg,
char **messages,
struct pam_response **resp);
#define PAM_MSG(pamh, number, string)\
(char *) __pam_get_i18n_msg(pamh, "pam_unix", 3, number,
string)
void gabi_pam_free_msg (int num_msg, struct pam_message *msg)
if (msg && num_msg > 0) {
while (num_msg--) {
if (msg[num_msg].msg)
free((void*)msg[num_msg].msg);
free(msg);
void gabi_pam_free_resp (int num_msg, struct pam_response *resp)
int i;
struct pam_response *r;
for (i = 0, r = resp; i < num_msg && r; i++, r++) {
if (r->resp) {
free(r->resp);
if (resp)
free(resp);
extern
int pam_sm_acct_mgmt (pam_handle_t *pamh,
int flags,
int argc ,
const char **argv)
char message[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
char *pmessage = &message[0];
struct pam_response *ret_resp;
struct pam_conv *pam_convp;
int rv=0;
syslog(LOG_WARNING, "pam_sm_acct_mgmt");
memset(&message[0],0x00,PAM_MAX_MSG_SIZE);
if (pam_get_item(pamh, PAM_CONV, (void*)&pam_convp) == PAM_SUCCESS) {
syslog(LOG_WARNING, "pam_sm_acct_mgmt: PAM_CONV
== PAM_SUCCESS");
(void) snprintf(message[0],sizeof (message[0]),
(const char *) PAM_MSG(pamh,
1,"pam_sm_acct_mgmt : "));
rv=gabi_pam_conv(pam_convp->conv, 1, &pmessage,
&ret_resp);
syslog(LOG_WARNING, "pam_sm_acct_mgmt:seos_pam_conv
returned rv=%d",rv);
else
syslog(LOG_WARNING, "pam_sm_acct_mgmt: PAM_CONV !
= PAM_SUCCESS");
return PAM_IGNORE;
int gabi_pam_conv (int (*conv_funp)(), int num_msg, char **messages,
struct pam_response **resp)
struct pam_message *msg;
int retcode, i;
struct pam_response *ret_resp = NULL;
msg = (struct pam_message *)calloc(num_msg, sizeof(struct
pam_message));
if (msg == NULL)
return PAM_BUF_ERR;
for (i = 0; i < num_msg; i++) {
char nl = 0;
msg.msg = (char *)malloc(PAM_MAX_MSG_SIZE);
if (resp && (i == num_msg - 1)) {
msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
ret_resp = *resp;
nl = '\0';
else
msg[i].msg_style = PAM_TEXT_INFO;
snprintf(msg[i].msg, PAM_MAX_MSG_SIZE, "%s%c",
messages[i], nl);
retcode = conv_funp(num_msg, &msg, &ret_resp, NULL);
syslog(LOG_WARNING, "seos_pam_conv: conv_funp returned
retcode=PAM_SUCCESS=%c",
((retcode == PAM_SUCCESS) ? 'Y' : 'N'));
gabi_pam_free_msg(num_msg, msg);
if (resp)
*resp = ret_resp;
else
gabi_pam_free_resp(num_msg, ret_resp);
return retcode;
I compile the source file like :
cc -K pic -I. -c -o <obj_file> <src_file>
cc -o pam_gabi.so -G -h pam_sample.so.1 -z text -z defs
-Bsymbolic <obj_file> -lc -lpam -lnsl
I copied pam_gabi.so to /usr/lib/security.
From a remote machine I run :
ssh -l <user_id> my_machine (<user_id> is a regular user)
I expect to get prompted with "pam_sm_acct_mgmt :" after I put in the
user password but I never see it and I am logged in successfully.
If I try :
rlogin -l <user_id> my_machine
I do get the "pam_sm_acct_mgmt :" prompt after providing the user's
password and login successfully.
The syslog messages show that 'conv_funp' in gabi_pam_conv
returned PAM_CONV_ERROR when called for the SSH login and
returned PAM_SUCCESS when called for the rlogin.
Kerberos is NOT installed on my Solaris 9 system.
Can anyone please explain this behavior ?
Thanks,
Gabi

After reading a little about this it looks like you have users enter user exec mode by default and after typing "enable" then entering the TACACS+ password you probably get denied. If this is the case you are kind of left to your own devices. I'll provide you some information and let you determine the best course.
R1(config-line#) privilege level [0-15]
This line sets the privilege level of users that are logging in via SSH or other teleterminal services.
Here is an excerpt from the documentation for tac_plus provided at http://www.shrubbery.net/tac_plus/
CONFIGURING ENABLE PASSWORDS
The default privilege level for an ordinary user on the NAS is usually
1. When a user enables, she can reset this level to a value between 0
and 15 by using the NAS "enable" command. If she doesn't specify a
level, the default level she enables to is 15.
You can enable via tacacs+ e.g. by configuring on the NAS:
        aaa authentication enable default tacacs+
then whenever you attempt to enable, an authentication request is sent
with the special username $enab<n>$ where <n> is the privilege level
you are attempting to enable to.
(Note: in order to be compatible with earlier versions of tacacs, when
the requested enable level is 15, the daemon will also try the
username $enable$ before trying username $enab15$).
For example, with the above declaration, in order to enable on the
NAS, you need a user declaration like this one, on the daemon:
user = $enab15$ {
    login = cleartext "the enable password for level 15"
Note: Be aware that this does have the side effect that you now have a
user named $enab15$ who can then login to your NAS if she knows the
enable password.
Here is a similar declaration allowing users to enable to level 4:
user = $enab4$ {
    login = des bsoF4OivQCY8Q

Solaris 11 AutoInstaller service profile for ssh to enable root logins?

Similar Messages

Maybe you are looking for