Download User Manual

1. Introduction
OneCommand Manager Secure Management
and remote adapters. When running in Secure Management mode, users must log on
with their user name and password to run the OneCommand Manager application.
When users are authenticated, they can only perform the functions allowed by the
OneCommand Manager user group to which they belong. If your systems are running
in an LDAP or Active Directory domain, the OneCommand Manager application will
authenticate the user with those defined in that domain. For Linux and Solaris systems
this is done using PAM.
Note: OneCommand Manager Secure Management is supported on Linux, Solaris,
and Windows, but is not supported on VMware hosts.
Administrators set up user accounts such that a user belongs to one of the
OneCommand Manager application user groups. The user groups define the
management capabilities for the user. The following table defines the OneCommand
Manager application user groups and each group's management capabilities.
Table 1-1 Secure Management User Privileges
Group Name
OneCommand Manager Capability
ocmadmin
Allows full active management of local and remote adapters.
ocmlocaladmin
Permits full active management of local adapters only
ocmuser
Permits read-only access of local and remote adapters
ocmlocaluser
Permits read-only access of local adapters.
On Linux or Solaris systems, the unix “getent group” utility can be run on the target
host system’s command shell to verify the correct configuration of the groups. The
groups, and users within the groups, will appear in the output of this command.
Note: Although a user may belong to the administrator group or be the root user, they
will not have full privileges to run OneCommand Manager unless they are also
a member of the ocmadmin group. Otherwise, when secure management is
enabled, a root user or administrator can only manage local adapters (similar to
the ocmlocaladmin user).
Remote management operations between two machines is allowed or denied
depending on the OneCommand Manager secure management status of the machines,
and the domains to which the machines belong. The following tables list the behavior
(assuming appropriate user credentials are used).
Table 1-2 Active Commands: machines on same domain
Remote Server
(Secure)
Remote Server
(Not Secure)
Client (Secure)
Allowed
Denied *
Client (Not Secure)
Denied
Allowed
OneCommand Manager Command Line Interface Version 6.3 User Manual
P009403-01A Rev. A
14