ego.sudoers

Contents

  • About ego.sudoers

  • The ego.sudoers file

  • File format

  • Creating and modifying ego.sudoers

  • Parameters

About ego.sudoers

The ego.sudoers file is an optional file to configure security mechanisms. It is not installed by default.

You use ego.sudoers to grant permission to users other than root to perform certain operations as root in EGO.

The parameters in this file apply to UNIX hosts only. They are not required for Windows hosts because all users with membership in the Platform services admin group can start EGO daemons.

If ego.sudoers does not exist, only root can perform these operations in EGO on UNIX.

The ego.sudoers file

In EGO, certain operations such as daemon startup can only be performed by root. The ego.sudoers file grants root privileges to specific users or user groups to perform these operations.

Location

ego.sudoers must be located in /etc on each host.

Permissions

ego.sudoers must have permission 600 and be readable and writable only by root.

File format

Each entry can have one of the following forms:
  • NAME=VALUE

  • NAME=

  • NAME="STRING1 STRING2 ..." except for the parameter EGO_STARTUP_ALTERNATE_PATHS, which has the format NAME=STRING1:STRING2 ...

The equal sign = must follow each NAME even if no value follows and there should be no space beside the equal sign.

NAME describes an authorized operation.

VALUE is a single string or multiple strings. The value for EGO_STARTUP_USERS is separated by spaces and enclosed in quotation marks. The value for EGO_STARTUP_ALTERNATE_PATHS is separated by colons.

Example ego.sudoers file

EGO_STARTUP_PATH=/usr/share/ego/etc EGO_STARTUP_ALTERNATIVE_PATHS=/usr/share/ego_cluster_1/ego/1.2/aix5-64/etc:/usr/share/ego_cluster_2/ego/1.2/aix5-64/etc EGO_STARTUP_USERS="user1 user10 user55"

Creating and modifying ego.sudoers

You can modify ego.sudoers with a text editor if you need to specify an alternate path or paths for a parallel installation.

This file enables the EGO daemon startup control feature when EGO_STARTUP_USERS is also defined. Define both parameters when you want to allow users other than root to start EGO daemons.

Parameters

  • EGO_STARTUP_PATH

  • EGO_STARTUP_ALTERNATE_PATHS

  • EGO_STARTUP_USERS

EGO_STARTUP_PATH

Syntax

EGO_STARTUP_PATH=path

Description

Specifies the absolute path name of the directory in which the EGO daemon binary files (lim, vemkd, and egosc) are installed. EGO daemons are usually installed in the path specified by EGO_SERVERDIR defined in the cshrc.ego or profile.ego files.

Default

Not defined. Only the root user account can start EGO daemons.

EGO_STARTUP_ALTERNATE_PATHS

Syntax

EGO_STARTUP_ALTERNATE_PATHS=path:path...

Description

For parallel installations and clusters, provides alternate paths to control multiple clusters. Define both parameters when you have multiple parallel installation paths to the directories of the EGO daemon binary files (lim, vemkd, and egosc) and want to allow users other than root to start EGO daemons.

EGO daemons are usually installed in the path specified by EGO_SERVERDIR defined in the cshrc.ego or profile.ego files.

The maximum length of the path string is 4000 characters.

Default

Not defined. Only the root user account can start EGO daemons.

EGO_STARTUP_USERS

Syntax

EGO_STARTUP_USERS=all_admins | "user_name..."

Description

Enables the EGO daemon startup control feature when EGO_STARTUP_PATH is also defined. Define both parameters when you want to allow users other than root to start EGO daemons.

On UNIX hosts, by default only root can start EGO daemons. To manually start EGO daemons, a user runs the command egosh, which has been made setuid root by the egosetsudoers script. EGO_STARTUP_USERS specifies a list of user accounts that can successfully run the command egosh to start EGO daemons.
all_admins
  • Allows all UNIX users defined as EGO administrators in the file ego.cluster.cluster_name to start EGO daemons as root by running the egosh command.

  • Not recommended due to the security risk of a non-root EGO administrator adding to the list of administrators in the ego.cluster.cluster_name file.

"user_name..."
  • Allows the specified user accounts to start EGO daemons by running the egosh command.

  • Separate multiple user names with a space.

  • For a single user, do not use quotation marks.

Default

Not defined. Only the root user account can start EGO daemons.