Sun Fire E25K Server
 
Sun Fire 12K Server
 
Sun Fire 15K Server
 
Sun Fire E20K Server
 

PLA-Support>Sun Systems>SPARC>Enterprise>SN-SPARC: SF-Exxk
 
_Old GCS Categories>Sun Microsystems>Servers>High-End Servers
 

Applies to:

Goal

The purpose of this document is to detail the permissions required for the various SMS command line interfaces.

Solution

Administration tasks on Sun Fire[TM] 12K/15K/E25K/E20K are divided and secured by group permissions. There are five SMS user role defined:

• Platform Administrator (platadmn)
• Platform Operator (platoper)
• Domain Administrator (dmnXadmn)
• Domain Configurator (dmnXrcfg)
• Platform Servicer (platsvc)

For the domain user roles, a user group is defined for each domain A-R. root also is permitted to run a small subset of commands.
The table below details which SMS commands are available to each user role.

|                  | Plat. | Plat. | Domain | Domain | Plat. |      |
| Command          | Oper. | Admin | Admin  | Conf   | Serv. | root |
+------------------+-------+-------+--------+--------+-------+------+
| addboard (2)     | no    | yes   | yes    | yes    | no    | no   |
| addcodlicense    | no    | yes   | no     | no     | no    | no   |
| addtag           | no    | yes   | no     | no     | no    | no   |
| audithotspares   | yes   | yes   | no     | no     | yes   | no   |
| cancelcmdsync    | yes   | yes   | no     | no     | yes   | no   |
| checkcodlog      | no    | no    | no     | no     | yes   | no   |
| codcheck         | no    | no    | no     | no     | yes   | no   |
| codlogrotate     | no    | no    | no     | no     | yes   | no   |
| codsendlog       | no    | no    | no     | no     | yes   | no   |
| console          | no    | no    | yes (1)| no     | no    | no   |
| deleteboard      | no    | yes(3)| yes (1)| yes (1)| no    | no   |
| deletecodlicense | no    | yes   | no     | no     | no    | no   |
| deletetag        | no    | yes   | no     | no     | no    | no   |
| disablecomponent | no    | yes   | yes (1)| yes (1)| yes   | no   |
| enablecomponent  | no    | yes   | yes (1)| yes (1)| yes   | no   |
| flashupdate      | no    | yes   | yes (1)| no     | yes   | no   |
| help             | yes   | yes   | yes    | yes    | yes   | yes  |
| initcmdsync      | yes   | yes   | no     | no     | yes   | no   |
| marginclock      | no    | no    | no     | no     | yes   | no   |
| marginvoltage    | no    | no    | no     | no     | yes   | no   |
| moveboard (4)    | no    | yes   | yes    | yes    | no    | no   |
| poweron          | yes   | yes   | yes (1)| yes (1)| yes   | no   |
| poweroff         | yes   | yes   | yes (1)| yes (1)| yes   | no   |
| rcfgadm (5)      | no    | yes   | yes    | yes    | no    | no   |
| reset            | no    | no    | yes (1)| no     | no    | no   |
| resetsc          | no    | yes   | no     | no     | no    | no   |
| rotatecodlog     | no    | no    | no     | no     | yes   | no   |
| runcmdsync       | yes   | yes   | no     | no     | yes   | no   |
| savecmdsync      | yes   | yes   | no     | no     | yes   | no   |
| savecodlog       | no    | no    | no     | no     | yes   | no   |
| setbus           | no    | yes   | yes (1)| yes (1)| yes   | no   |
| setcsn           | no    | yes   | no     | no     | yes   | no   |
| setdatasync      | yes   | yes   | no     | no     | yes   | no   |
| setdate          | no    | yes   | no     | no     | no    | no   |
| setdefaults      | no    | no    | yes (1)| no     | no    | no   |
| setfailover      | yes   | yes   | no     | no     | yes   | no   |
| setkeyswitch     | no    | no    | yes (1)| no     | no    | no   |
| setobpparams     | no    | no    | yes (1)| no     | no    | no   |
| setupplatform    | no    | yes   | no     | no     | no    | no   |
| showboards       | yes   | yes   | yes (1)| yes (1)| yes   | no   |
| showbus          | yes   | yes   | yes (1)| yes (1)| yes   | no   |
| showcmdsync      | yes   | yes   | no     | no     | yes   | no   |
| showcodlicense   | yes   | yes   | no     | no     | no    | no   |
| showcodusage     | yes   | yes   | no     | no     | no    | no   |
| showcomponent    | no    | yes   | yes (1)| yes (1)| yes   | no   |
| showdatasync     | yes   | yes   | no     | no     | yes   | no   |
| showdate         | yes   | yes   | yes    | yes    | yes   | yes  |
| showdevices      | no    | no    | yes (1)| yes (1)| no    | no   |
| showkeyswitch    | yes   | yes   | yes (1)| yes (1)| yes   | no   |
| showlogs         | yes(6)| yes(6)| yes (1)| yes (1)| yes(6)| no   |
| showobpparams    | no    | no    | yes (1)| no     | no    | no   |
| showplatform     | yes   | yes   | yes (1)| yes (1)| yes   | no   |
| showxirstate     | no    | no    | yes (1)| no     | no    | no   |
| smsbackup        | no    | no    | no     | no     | no    | yes  |
| smsconfig        | no    | yes   | no     | no     | no    | no   |
| smsconnectsc     | no    | yes   | no     | no     | no    | no   |
| smsrestore       | no    | no    | no     | no     | no    | yes  |
| smsversion       | no    | no    | no     | no     | no    | yes  |
| sysid            | no    | no    | no     | no     | yes   | no   |
| thermcal         | no    | no    | no     | no     | yes   | no   |
+------------------+-------+-------+--------+--------+-------+------+

Notes:

1. Execution against the group's respective domain only.
2. For Platform Admin, only the assign function is permitted. Domain Admin/Conf can execute against the respective domain. If the board(s) is not already assigned to the domain, it must be in the available component list.
3. For Platform Admin, only the unassign function is permitted and only when the board is in the assigned state (i.e., not active in a running domain)
4. For Platform Admin, only the unassign and assign functions are permitted. unassign is only possible when the board is in the assigned state (i.e., not active in a running domain). Then, and only then, is the assign function to the destination domain possible. For Domain Admin/Conf, the user must belong to both domain groups affected. If the board is not already assigned to the destination domain, it must be in the available component list for that domain.
5. For Platform Admin, only the assign and unassign functions are permitted. unassign is only possible when the board is in the assigned state (i.e., not active in a running domain). Domain Admin/Conf can execute against the respective domain. If the board(s) is not already assigned to the domain, it must be in the available component list.
6. Platform logs only.

Reference the System Management Services (SMS) documentation set for more details.


Internal Section

Keywords> 12K, 15K, E25K, E20K, starcat, sms

Previously Published As 50572

This solution has no attachment