An Introduction to Security in a CSM 1.3 for AIX 5L Environment

56 An Introduction to Security in a CSM 1.3 for AIX 5L Environment

5.1 Remote command execution software

CSM provides a tool for distributed command execution from the management

server to the nodes. This tool is called

distributed shell (dsh)

.

The distributed shell in the CSM cluster is used to issue remote commands in a

distributed manner, from the management server to the cluster nodes, in order to

ease system administration work. This tool is not used for internal cluster

communication between the management server and the nodes.

For internal communication, such as resource control and monitoring, the

Reliable Scalable Cluster Technology (RSCT) layer is used. See Figure 5-1 on

page 57.

Remote command execution is needed for administrative actions that have to be

executed on some or all nodes in a CSM cluster.

You can also configure a cluster to support node-to-node remote commands, but

this is not required. The

dsh command is contained in the csm.dsh fileset, which

is installed with AIX 5L Version 5.2. The CSM software provides tools for setting

up remote command execution subsystem from the management server to the

nodes.

By default,

dsh relies on the “classic” rsh command for remote execution.

Unfortunately,

rsh provides only a minimum security level. The authorization is

based on the .rhosts file stored in user’s home directory. The data exchanged

between the management server and the nodes is not encrypted.

You can set up the CSM management server to use another remote command

execution software instead of

rsh in order to improve the security inside the CSM

cluster.

The software you choose to replace

rsh must support the dsh command

arguments. This means that the command you use instead

rsh must support the

parameters and options that the

rsh command allows.

Our recommendation is to use the OpenSSH packet instead of the r commands.

Therefore, the

dsh command uses the ssh command instead of rsh. The

overview of communication between the management server and the node is

shown in Figure 5-1 on page 57.

Chapter 5. Securing remote command execution 57

Figure 5-1 Remote command execution in CSM

You can use the dsh command on every AIX 5L Version 5.2 machine to issue

distributed commands, but only the MS-to-nodes communication is configured

automatically. Example 5-1 shows the execution of the

date command on the

nodes called machine1 and machine2.

Example 5-1 The dsh command to listed nodes

machine0#> dsh -n machine1,machine2 date

machine1: Mon Nov 4 14:46:47 CST 2002

machine2 Mon Nov 4 14:46:15 CST 2002

The dsh command communicates with the CSM database. From the database, it

retrieves the remote execution shell name to be used, as well as information

about the CSM nodegroups membership.

You can use

dsh to pass commands to the nodegroups. In Example 5-2, the dsh

command retrieves the remote command execution shell name and the group

members for group1 from the CSM database and executes the

date command

on the member nodes.

Example 5-2 The dsh command to nodegroup members

MS1#> dsh -N group1 date

node1: Mon Nov 4 15:42:42 CST 2002

node2: Mon Nov 4 15:42:13 CST 2002

node3: Mon Nov 4 15:42:13 CST 2002

Remote

commands

NODE

Management Server

CSM SERVER SW

DSH

SSH

RSH

SSHD

RSHD

RSCT

RSCT

CSM CLIENT SW

Internal

cluster

communication

58 An Introduction to Security in a CSM 1.3 for AIX 5L Environment

In our environment, group1 has three members: node1, node2, and node3. Our

management server is set up to call the /usr/bin/ssh program for remote

command execution whenever a

dsh command is issued. As a result, the dsh

command (as in Example 5-2 on page 57) calls the following commands:

/usr/bin/ssh -n node1 date

/usr/bin/ssh -n node2 date

/usr/bin/ssh -n node3 date

The behavior of the dsh command (as in Example 5-2 on page 57) is shown in

Figure 5-2.

Figure 5-2 Distributed command execution

The remote execution shell program also can be temporarily changed. This can

be achieved by changing the environment variable DSH_REMOTE_CMD, as

follows:

export DSH_REMOTE_CMD=/usr/bin/rsh

You can also use the parameter -r with the dsh command to override both the

database setting and the DSH_REMOTE_CMD environment variable:

dsh -r /usr/bin/rsh -n node1 date

Management Server

SSH

NODE1: DATE

SSH

NODE2: DATE

SSH

NODE3: DATE

DSH

GROUP1:DATE

NODE1

NODE2

NODE3

NODE4

SSHD

SSHD

SSHD

SSHD

nodegroup: GROUP1

nodegroup: GROUP2

Remote shell program:

/usr/bin/ssh

Group1 members:

node1, node2, node3

CSM database