Chris's AIX Blog

with Tags: has

SSH Host keys and AIX 7.1 Migration.

cggibbo Tags: has warning: host aix remote identification nim changed lppsource migration ssh 6 Comments 34,745 Views

Recent releases of AIX installation media (for 7.1 and 6.1) now contain the OpenSSH base installation filesets. This is very handy; we no longer need to download or locate the software from other sources.

One thing to consider is what this means for future AIX migrations.

If you are migrating a system (that already has a version of SSH installed) to AIX 7.1 then you may notice that the first time you attempt to connect to the server (after the 7.1 migration) the following ssh message appears:

root@nim1 : / # ssh aixlpar1

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Someone could be eavesdropping on you right now (man-in-the-middle attack)!

It is also possible that a host key has just been changed.

The fingerprint for the RSA key sent by the remote host is

59:68:05:71:60:b5:d1:96:87:df:f6:9c:ca:9a:14:3e.

Please contact your system administrator.

Add correct host key in /.ssh/known_hosts to get rid of this message.

Offending RSA key in /.ssh/known_hosts:17

RSA host key for aixlpar1 has changed and you have requested strict checking.

Host key verification failed.

In the output above I’m attempting to SSH from another system to the newly migrated AIX 7.1 LPAR. This is essentially informing us that the SSH host keys on the AIX 7.1 server don’t match the host key stored in the local systems /.ssh/known_hosts file. Something has changed.

Now of course I could simply accept this change and update my known_hosts files, like so:

root@nim1 : / # ssh-keygen -R aixlpar1

/.ssh/known_hosts updated.

Original contents retained as /.ssh/known_hosts.old

With known_hosts updated, I’m able to SSH to the AIX 7.1 system successfully.

cgibson@nim1 : /home/cgibson $ ssh aixlpar1 date

Mon Aug 20 19:44:20 EET 2012

But that’s just for my SSH known_hosts file only. What about all the users that connect to this system via SSH/SFTP/SCP? Do I really expect all of them to update their known_hosts file with the new host key information?

This could create problems for automated tasks, like file transfers. If these transfers stop working then their could be “hell to pay”. So the question I’m often asked is what can I do to prevent this from happening in the first place? Luckily there is a way.

In this example, we are using nimadm to migrate from AIX 5.3 to 7.1. The AIX 7.1 lpp_source resource was created using the AIX 7.1 installation media DVDs. All filesets were copied from the DVDs, verbatim, to the new 7.1 lpp_source resource on the NIM master.

First we verify that the openssh* filesets are in fact in the AIX 7.1 lpp_source on the NIM master.

root@nim1 : / # nim -o showres lpp_sourceaix710101 | grep -i ssh

openssh.base.client 5.4.0.6100 I N usr,root

openssh.base.client 5.8.0.6101 I N usr,root

openssh.base.server 5.4.0.6100 I N usr,root

openssh.base.server 5.8.0.6101 I N usr,root

openssh.man.en_US 5.4.0.6100 I N usr

openssh.man.en_US 5.8.0.6101 I N usr

openssh.msg.EN_US 5.8.0.6101 I N usr

openssh.msg.en_US 5.4.0.6100 I N usr

openssh.msg.en_US 5.8.0.6101 I N usr

On the NIM client (running AIX 5.3), we verify there is an older version of SSH already installed. The migration will remove these filesets (and the associated /etc/ssh_host_* files). The newer version of SSH will be installed and new ssh_host_key* files will be generated (hence the problem with the remote SSH clients known_hosts files no longer holding the correct host keys).

aixlpar1 : / # oslevel -s

5300-12-04-1119

aixlpar1 : / # lslpp -l openssh*

Fileset Level State Description

----------------------------------------------------------------------------

Path: /usr/lib/objrepos

openssh.base.client 4.3.0.5301 COMMITTED Open Secure Shell Commands

openssh.base.server 4.3.0.5301 COMMITTED Open Secure Shell Server

openssh.license 4.3.0.5301 COMMITTED Open Secure Shell License

openssh.man.en_US 4.3.0.5301 COMMITTED Open Secure Shell

Documentation - U.S. English

The following SSH files are regenerated during the new fileset install:

aixlpar1 : /home/cgibson/ssh_orig # ls -ltr /etc/ssh/ssh_host*

-rw-r--r-- 1 root system 210 Feb 03 2006 /etc/ssh/ssh_host_rsa_key.pub

-rw------- 1 root system 887 Feb 03 2006 /etc/ssh/ssh_host_rsa_key

-rw-r--r-- 1 root system 319 Feb 03 2006 /etc/ssh/ssh_host_key.pub

-rw------- 1 root system 515 Feb 03 2006 /etc/ssh/ssh_host_key

-rw-r--r-- 1 root system 590 Feb 03 2006 /etc/ssh/ssh_host_dsa_key.pub

-rw------- 1 root system 668 Feb 03 2006 /etc/ssh/ssh_host_dsa_key

You can confirm the filesets are being installed during the nimadm operation by reviewing your clients nimadm log file in /var/adm/ras/alt_mig:

root@nim1 : /var/adm/ras/alt_mig # grep –i openssh aixlpar1_alt_mig.log

openssh.base.client 5.8.0.6101 USR APPLY SUCCESS

openssh.base.server 5.8.0.6101 USR APPLY SUCCESS

openssh.base.client 5.8.0.6101 ROOT APPLY SUCCESS

openssh.base.server 5.8.0.6101 ROOT APPLY SUCCESS

openssh.man.en_US 5.8.0.6101 USR APPLY SUCCESS

openssh.msg.en_US 5.8.0.6101 USR APPLY SUCCESS

aixlpar1 : / # ls -ltr /etc/ssh

total 352

-rw-r--r-- 1 root system 210 Feb 03 2006 ssh_host_rsa_key.pub

-rw------- 1 root system 887 Feb 03 2006 ssh_host_rsa_key

-rw-r--r-- 1 root system 319 Feb 03 2006 ssh_host_key.pub

-rw------- 1 root system 515 Feb 03 2006 ssh_host_key

-rw-r--r-- 1 root system 590 Feb 03 2006 ssh_host_dsa_key.pub

-rw------- 1 root system 668 Feb 03 2006 ssh_host_dsa_key

-rw-r--r-- 1 root system 2341 Apr 26 2007 ssh_prng_cmds

-rw------- 1 root system 132839 Apr 26 2007 moduli

-rw-r--r-- 1 root system 1288 May 01 2007 ssh_config

-rw-r--r-- 1 root system 1155 May 04 2007 sshd_banner

-rw-r--r-- 1 root system 2867 Oct 29 2008 sshd_config

-rw-r----- 1 root system 7 Aug 20 16:10 sshd.pid

To work around this issue, we can move the openssh* filesets out of the lpp_source directory (installp/ppc), like so:

root@nim1 : / # lsnim -l lpp_sourceaix710101

lpp_sourceaix710101:

class = resources

type = lpp_source

arch = power

Rstate = ready for use

prev_state = ready for use

location = /export/lpp_source/lpp_sourceaix710101

simages = yes

alloc_count = 0

server = master

root@nim1 : / # cd /export/lpp_source/lpp_sourceaix710101

root@nim1 : /export/lpp_source/lpp_sourceaix710101 # find . | grep -i openssh

./installp/ppc/openssh.base

./installp/ppc/openssh.man.en_US

./installp/ppc/openssh.msg.en_US

./installp/ppc/openssh.msg.en_US.5.8.0.6101.I

./installp/ppc/openssh.msg.EN_US.5.8.0.6101.I

./installp/ppc/openssh.man.en_US.5.8.0.6101.I

./installp/ppc/openssh.base.5.8.0.6101.I

root@nim1 : /export/lpp_source/lpp_sourceaix710101 # cd ./installp/ppc/

root@nim1 : /export/lpp_source/lpp_sourceaix710101/installp/ppc # ls -ltr openssh*

-rw-r----- 1 root system 14336 Nov 16 2011 openssh.msg.en_US

-rw-r----- 1 root system 138240 Nov 16 2011 openssh.man.en_US

-rw-r----- 1 root system 6024192 Nov 16 2011 openssh.base

-rw-r----- 1 root system 17408 Nov 16 2011 openssh.msg.en_US.5.8.0.6101.I

-rw-r----- 1 root system 17408 Nov 16 2011 openssh.msg.EN_US.5.8.0.6101.I

-rw-r----- 1 root system 153600 Nov 16 2011 openssh.man.en_US.5.8.0.6101.I

-rw-r----- 1 root system 6298624 Nov 16 2011 openssh.base.5.8.0.6101.I

I’ve chosen to move the filesets to a different directory (notice I’ve created a .toc file in the new location). I also need to copy (not move) the openssl* filesets to the new location as well.

root@nim1 : /export/lpp_source/lpp_sourceaix710101/installp/ppc # mkdir /export/lpp_source/lpp_sourceaix710101/ssh

root@nim1 : /export/lpp_source/lpp_sourceaix710101/installp/ppc # mv openssh* /export/lpp_source/lpp_sourceaix710101/ssh

root@nim1 : /export/lpp_source/lpp_sourceaix710101/installp/ppc # cp -p openssl* /export/lpp_source/lpp_sourceaix710101/ssh

root@nim1 : / # cd /export/lpp_source/lpp_sourceaix710101/ssh

root@nim1 : /export/lpp_source/lpp_sourceaix710101/ssh # inutoc .

root@nim1 : /export/lpp_source/lpp_sourceaix710101/ssh # ls -ltr

total 58648

-rw-r----- 1 root system 6298624 Nov 16 2011 openssl.base

-rw-r----- 1 root system 14336 Nov 16 2011 openssh.msg.en_US

-rw-r----- 1 root system 138240 Nov 16 2011 openssh.man.en_US

-rw-r----- 1 root system 6024192 Nov 16 2011 openssh.base

-rw-r----- 1 root system 2350080 Nov 16 2011 openssl.man.en_US

-rw-r----- 1 root system 28672 Nov 16 2011 openssl.license

-rw-r----- 1 root system 2350080 Nov 16 2011 openssl.man.en_US.0.9.8.1800.I

-rw-r----- 1 root system 3072 Nov 16 2011 openssl.license.0.9.8.1800.I

-rw-r----- 1 root system 6307840 Nov 16 2011 openssl.base.0.9.8.1800.I

-rw-r----- 1 root system 17408 Nov 16 2011 openssh.msg.en_US.5.8.0.6101.I

-rw-r----- 1 root system 17408 Nov 16 2011 openssh.msg.EN_US.5.8.0.6101.I

-rw-r----- 1 root system 153600 Nov 16 2011 openssh.man.en_US.5.8.0.6101.I

-rw-r----- 1 root system 6298624 Nov 16 2011 openssh.base.5.8.0.6101.I

-rw-r--r-- 1 root system 4966 Aug 20 20:41 .toc

Now that openssh is no longer in the lppsource, I check the AIX 7.1 lpp_source and update its TOC:

root@nim1 : / # nim -o check lpp_sourceaix710101

The openssh filesets are no longer listed as part of the lppsource:

root@nim1 : / # nim -o showres lpp_sourceaix710101 | grep -i ssh

root@nim1 : / #

At this point we perform a standard nimadm operation to migrate from AIX 5.3 to 7.1. Openssh is not installed during the migration:

root@nim1: /var/adm/ras/alt_mig # grep -i openssh aixlpar1_alt_mig.log

root@nim1: /var/adm/ras/alt_mig #

After the migration, ssh connections to the server function just as they did before the migration.

cgibson@nim1 : /home/cgibson $ ssh aixlpar1 date

Mon Aug 20 20:36:31 EETDT 2012

Now we can update the openssh filesets to the newer level. This will install the newer filesets but preserve the existing SSH host keys.

aixlpar1 : / # mount nim1:/export/lpp_source/lpp_sourceaix710101/ssh /mnt

aixlpar1 : / # installp -Y -a -d /mnt ALL

...etc...

Installation Summary

--------------------

Name Level Part Event Result

-------------------------------------------------------------------------------

openssl.man.en_US 0.9.8.1800 USR APPLY SUCCESS

openssl.license 0.9.8.1800 USR APPLY SUCCESS

openssl.base 0.9.8.1800 USR APPLY SUCCESS

openssl.base 0.9.8.1800 ROOT APPLY SUCCESS

openssh.base.client 5.8.0.6101 USR APPLY SUCCESS

openssh.base.server 5.8.0.6101 USR APPLY SUCCESS

openssh.base.client 5.8.0.6101 ROOT APPLY SUCCESS

openssh.base.server 5.8.0.6101 ROOT APPLY SUCCESS

openssh.msg.en_US 5.8.0.6101 USR APPLY SUCCESS

openssh.msg.EN_US 5.8.0.6101 USR APPLY SUCCESS

openssh.man.en_US 5.8.0.6101 USR APPLY SUCCESS

Rather than update these filesets manually after the migration, you can include this step as a post migration task with nimadm.

An alternative way to work around this problem (after the fact) would be to restore the original ssh_host_key* files from a backup. For example, I copied the original ssh_host_key* files to my home directory before starting the AIX migration.

aixlpar1 : / # cd /etc

aixlpar1 : /etc # cp -pr ssh /home/cgibson/ssh_orig/

In the output below, I discover that my ssh_host_key* files have all been recreated during the migration.

aixlpar1 : /etc/ssh # ls -ltr

total 352

-rw-r--r-- 1 root system 1288 May 01 2007 ssh_config

-rw-r--r-- 1 root system 1155 May 04 2007 sshd_banner

-rw-r--r-- 1 root system 2867 Oct 29 2008 sshd_config

-rw-r----- 1 root system 7 Aug 20 21:00 sshd.pid

-rw-r--r-- 1 root system 2341 Aug 20 21:19 ssh_prng_cmds

-rw------- 1 root system 132839 Aug 20 21:19 moduli

-rw-r----- 1 root system 382 Aug 20 21:45 ssh_host_rsa_key.pub

-rw------- 1 root system 1679 Aug 20 21:45 ssh_host_rsa_key

-rw-r----- 1 root system 630 Aug 20 21:45 ssh_host_key.pub

-rw------- 1 root system 965 Aug 20 21:45 ssh_host_key

-rw-r----- 1 root system 590 Aug 20 21:45 ssh_host_dsa_key.pub

-rw------- 1 root system 668 Aug 20 21:45 ssh_host_dsa_key

I copy the original files back to the /etc/ssh directory. The sshd subsystem is also restarted to pick up the updated ssh_host* files.

aixlpar1 : /etc/ssh # cp -p /home/cgibson/ssh_orig/ssh_host_* .

aixlpar1 : /etc/ssh # ls -ltr

total 352

-rw-r--r-- 1 root system 210 Feb 03 2006 ssh_host_rsa_key.pub

-rw------- 1 root system 887 Feb 03 2006 ssh_host_rsa_key

-rw-r--r-- 1 root system 319 Feb 03 2006 ssh_host_key.pub

-rw------- 1 root system 515 Feb 03 2006 ssh_host_key

-rw-r--r-- 1 root system 590 Feb 03 2006 ssh_host_dsa_key.pub

-rw------- 1 root system 668 Feb 03 2006 ssh_host_dsa_key

-rw-r--r-- 1 root system 1288 May 01 2007 ssh_config

-rw-r--r-- 1 root system 1155 May 04 2007 sshd_banner

-rw-r--r-- 1 root system 2867 Oct 29 2008 sshd_config

-rw-r----- 1 root system 7 Aug 20 21:00 sshd.pid

-rw-r--r-- 1 root system 2341 Aug 20 21:19 ssh_prng_cmds

-rw------- 1 root system 132839 Aug 20 21:19 moduli

aixlpar1 : /etc/ssh # stopsrc -s sshd

0513-044 The sshd Subsystem was requested to stop.

aixlpar1 : /etc/ssh # startsrc -s sshd

0513-059 The sshd Subsystem has been started. Subsystem PID is 3997822.

Check your WPAR filesets

cggibbo Tags: un-supported hdisk5 type. mkwpar: has wio.vscsi 0960-587 wio.fco wio.common subclass 2 Comments 6,543 Views

Got an issue with mkwpar? Have you checked your WPAR filesets?

If you attempt to create a rootvg WPAR with a VSCSI disk, on a system running AIX 6.1 TL6 and you encounter the following error:

# mkwpar –O -D rootvg=yes devname=hdisk5 -n rootvgwpar1

**********************************************************************

ERROR

mkwpar: 0960-587 hdisk5 has un-supported subclass type.

**********************************************************************

Then you should check that the following filesets are installed:

# lslpp -L | grep wio
wio.common    6.1.6.0    C F Common I/O Support for
wio.fcp 6.1.6.0    C F FC I/O Support for Workload
wio.vscsi 6.1.6.0    C F VSCSI I/O Support for Workload

Once these filesets are installed (from the AIX 6.1 install media), then you should be able to create a rootvg WPAR using a VSCSI disk.

Managing users with dsh and chpasswd - (plus info on DSM and dping).

cggibbo Tags: run if remote exit installed pwdadm a accepted. code expired dping csm has not been you aix have license had dsh shell -l new release admchg 255 csmconfig 2651-095 or chpasswd 1 Comment 21,280 Views

Starting with AIX 7.1, CSM is no longer supported or available. It has been replaced by Distributed Systems Managment (DSM). Section 5.2 of the IBM AIX 7.1 Differences Guide Redbook provides details of the new DSM capabilities.

Fortunately DSM still provides access to the dsh command. I’ve written about how I’ve used this utility in the past. The new dsh command (and other tools) are provided in the new DSM filesets named dsm.core and dsm.dsh.

root@nim# lslpp -L dsm*

Fileset Level State Type Description (Uninstaller)

----------------------------------------------------------------------------

dsm.core 7.1.1.2 A F Distributed Systems Management

Core

dsm.dsh 7.1.0.0 C F Distributed Systems Management

Dsh

root@nim# lslpp -w /usr/bin/dsh

File Fileset Type

----------------------------------------------------------------------------

/usr/bin/dsh dsm.dsh Symlink

These filesets are NOT installed by default. You must manually install them. They can be found on your AIX 7.1 media.

If dsh is something you use, then I recommend you read the section on DSM in the Redbook. Also take a look at section 5.2.7 Using DSM and NIM, in which it describes how you can integrate DSM and NIM and completely automate the installation of AIX:

“The AIX Network Installation Manager (NIM) has been enhanced to work with the Distributed System Management (DSM) commands. This integration enables the automatic installation of new AIX systems that are either currently powered on or off.”

Although I’ve written about the dsh command before, there’s one usage I’ve not covered. And that is using dsh to manage users across a group of LPARs. In particular, changing a user’s password.

Before I go any further, I should state that for the following to work you must first configure ssh keys on your NIM master (or central mgmt AIX system) so that you can communicate with all of your AIX systems via SSH, as root, without being prompted for a password. Read my article on dsh to find out how to do this if necessary.

In the following example, I use dsh from my NIM master. It is my central point of control for my AIX environment.

My ssh keys for root on my NIM master have been generated and distributed to all of my LPARs.

root@nim# ssh-keygen -d

Generating public/private dsa key pair.

Enter file in which to save the key (/.ssh/id_dsa):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /.ssh/id_dsa.

Your public key has been saved in /.ssh/id_dsa.pub.

The key fingerprint is:

ed:18:e9:00:37:13:7c:7c:74:6a:a9:e0:ad:c0:09:a9 root@nim

The key's randomart image is:

+--[ DSA 1024]----+

| ... .. . |

| . ..o .+ |

| o . =. .+ |

| . o = = = |

|E + o S . |

| . + + |

| . o . |

| |

+-----------------+

root@nim# ls -ltra

total 40

-rw------- 1 root system 214 17 Sep 2010 authorized_keys

drwxr-xr-x 7 root system 4096 16 Nov 11:43 ..

-rw-r--r-- 1 root system 3615 16 Nov 12:04 known_hosts

-rw-r--r-- 1 root system 601 16 Nov 12:06 id_dsa.pub

-rw------- 1 root system 672 16 Nov 12:06 id_dsa

drwx------ 2 root system 256 16 Nov 12:06 .

On my AIX LPARs, the authorized_keys file has been updated with the public ssh key from my NIM master:

root@aixlpar1 [/.ssh]# chmod 600 known_hosts authorized_keys

root@aixlpar1 [/.ssh]# ls -ltr

total 0

-rw------- 1 root system 406 Sep 29 15:30 known_hosts

-rw------- 1 root system 601 Nov 16 12:07 authorized_keys

root@aixlpar1 [/.ssh]# cat authorized_keys

ssh-dss AAAAB3NzaC1kc3MAAACBAPJpekVQgV2CTu5tCOsukwXwMrkfBabLAN7vwjgPk3S2p65COJkFwaDRWwBoK87cnMrrc7/GuOLdk/RiqYw1K8Z0d9RWnsymYrNm0MBALWioGGXwQ+YlLiYHIQsSArnajZOH6Ye36qz81uWNoj6u4xIxi/iGSYoU4x3UE/c/H833AAAAFQDKEtWVFk3G+KAyxUsI6FcpbJZqDQAAAIAVUVRak/s+X0mMElCaEs8Rh96GDfhorXWV1YzI0nbRo8QX2AMix+3LSdEmYCRn8TYpk1Udln3GG4gzy5oI/3Rd1RTWgAo+067LwytR6IJfwYt219Pwh2ktrm5iZu3c+yDBqQj6hsga2YIun5lxqYFy39CZNtslnR1wTx9uCcYkowAAAIEAuVFTsW9ugVM76CgluspNo0faz9xFo4DCOjCgye+k/ZqSDaNq6Xrvxktw+dkHuKHbhvofPgeiMrlqhdbrE0ovLUr8aadxArRhitnu10CFYbRwlrjAxyAaRwjD2pXG8M3a5D1XXAWDCDm6bEs5yxJqcl1wq+8UAhpKiS5yj2pwApk= root@nim

On the NIM master, the root user was configured for the DSH environment. The following entry was placed in roots .profile:

root@nim# cat /.profile

ENV=$HOME/.kshrc

The following entry was placed in roots .kshrc file:

root@nim# cat /.kshrc

export DSH_NODE_RSH=/usr/bin/ssh

export DSH_NODE_LIST=/usr/local/etc/nodes

A /usr/local/etc/nodes file was created on the NIM master. This file contains a list of each of the nodes that dsh can communicate with from NIM:

root@nim# cat /usr/local/etc/nodes

aixlpar1

aixlpar2

aixlpar3

aixlpar4

aixlpar5

aixlpar6

aixlpar7

aixlpar8

aixlpar9

aixlpar10

aixlpar11

The first time that the dsh command is run against a new host, the following message will be displayed. dsh uses the FQDN, and the FQDN needs to be added to the known_hosts file for ssh. Therefore you must make an ssh connection first with FQDN to the host:

root@nim# dsh uptime

aixlpar1.cg.com.au : Host key verification failed.

dsh: 2617-009 aixlpar1.cg.com.au remote shell had exit code 255

It is necessary to ssh directly to each node using its FQDN. This step is only required once for each node. For example:

root@nim# ssh aixlpar1.cg.com.au

The authenticity of host 'aixlpar1.cg.com.au (172.1.6.17)' can't be established.

RSA key fingerprint is 83:13:1d:cb:97:ee:00:7a:04:75:62:98:bd:e8:30:79.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added 'aixlpar1.cg.com.au ' (RSA) to the list of known hosts.

Last unsuccessful login: Tue Sep 27 03:04:33 GMT+10:00 2011 on ssh from 172.1.6.15

Last login: Wed Nov 16 12:08:08 GMT+11:00 2011 on /dev/pts/3 from nim

root@aixlpar1 [/root]# exit

Connection to aixlpar1.cg.com.au closed.

Now we can use the dsh command to run a command across all the nodes defined in the DSH_NODE_LIST. For example, the following command will run the uptime command on all nodes:

root@nim# dsh uptime

aixlpar1.cg.com.au : 12:14PM up 10 days, 22:32, 3 users, load average: 0.47, 0.53, 0.64

aixlpar2.cg.com.au : 12:14PM up 21 days, 21:13, 1 users, load average: 0.11, 0.31, 0.51

aixlpar3.cg.com.au : 12:14PM up 15 days, 20:33, 5 users, load average: 0.17, 0.43, 0.54

...etc...

With dsh now configured, we can use it to perform several admin tasks from a central location. For example, the following commands will do the following:

1. Create a user, named cg, on all nodes.

2. Set cg’s password to abc123 using the chpasswd command.

3. Remove the ADMCHG flag for the user cg. This will stop them from being prompted to change their password on their first login attempt.

First I check that user does not exist on the AIX systems.

root@nim# dsh lsuser cg

aixlpar1: 3004-687 User "cg" does not exist.

aixlpar2: 3004-687 User "cg" does not exist.

aixlpar3: 3004-687 User "cg" does not exist.

aixlpar4: 3004-687 User "cg" does not exist.

aixlpar5: 3004-687 User "cg" does not exist.

...etc...

I create the user with the mkuser command.

root@nim# dsh mkuser cg

I confirm that the user has been created on all the AIX systems, with the lsuser command.

root@nim# dsh lsuser cg

aixlpar1: cg id=204 pgrp=staff groups=staff home=/home/cg shell=/usr/bin/ksh login=true su=true rlogin=true daemon=true admin=false sugroups=ALL admgroups= tpath=nosak ttys=ALL expires=0 auth1=SYSTEM auth2=NONE umask=22 registry=files SYSTEM=compat logintimes= loginretries=0 pwdwarntime=0 account_locked=false minage=0 maxage=0 maxexpired=-1 minalpha=0 minother=0 mindiff=0 maxrepeats=8 minlen=0 histexpire=0 histsize=0 pwdchecks= dictionlist= fsize=-1 cpu=-1 data=262144 stack=65536 core=2097151 rss=65536 nofiles=2000 roles=

aixlpar2: cg id=204 pgrp=staff groups=staff home=/home/cg shell=/usr/bin/ksh login=true su=true rlogin=true daemon=true admin=false sugroups=ALL admgroups= tpath=nosak ttys=ALL expires=0 auth1=SYSTEM auth2=NONE umask=22 registry=files SYSTEM=compat logintimes= loginretries=0 pwdwarntime=0 account_locked=false minage=0 maxage=0 maxexpired=-1 minalpha=0 minother=0 mindiff=0 maxrepeats=8 minlen=0 histexpire=0 histsize=0 pwdchecks= dictionlist= fsize=-1 cpu=-1 data=262144 stack=65536 core=2097151 rss=65536 nofiles=2000 roles=

aixlpar3: cg id=204 pgrp=staff groups=staff home=/home/cg shell=/usr/bin/ksh login=true su=true rlogin=true daemon=true admin=false sugroups=ALL admgroups= tpath=nosak ttys=ALL expires=0 auth1=SYSTEM auth2=NONE umask=22 registry=files SYSTEM=compat logintimes= loginretries=0 pwdwarntime=0 account_locked=false minage=0 maxage=0 maxexpired=-1 minalpha=0 minother=0 mindiff=0 maxrepeats=8 minlen=0 histexpire=0 histsize=0 pwdchecks= dictionlist= fsize=-1 cpu=-1 data=262144 stack=65536 core=2097151 rss=65536 nofiles=2000 roles=

I set the users password to abc123, using the chpasswd utility. I also remove the ADMCHG flag so that the user is not prompted to change their password on their first logon attempt.

root@nim# dsh 'echo cg:abc123 | chpasswd -c'

I confirm that I can logon with the new user with the specified password, on one of the AIX LPARs.

root@nim# ssh cg@aixlpar1

cg@aixlpar1’s password:

Last login: Thu Mar 1 20:05:01 CST 2012 on /dev/pts/1 from aix71

$ id

uid=204(cg) gid=1(staff)

Another nice feature of dsh is the dshbak utility. This utility presents formatted output from the dsh command. For example:

root@nim 520 [/.ssh]# dsh errpt | dshbak

HOST: aixlpar1.cg.com.au

------------------------------------

IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION

AA8AB241 1116110811 T O OPERATOR OPERATOR NOTIFICATION

A6DF45AA 1104135011 I O RMCdaemon The daemon is started.

2BFA76F6 1104134111 T S SYSPROC SYSTEM SHUTDOWN BY USER

9DBCFDEE 1104134111 T O errdemon ERROR LOGGING TURNED ON

HOST: aixlpar2.cg.com.au

-------------------------------

IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION

DE9A52D1 1111012611 I S rmt10 AAA1

4865FA9B 1111012211 P H rmt10 TAPE OPERATION ERROR

DE9A52D1 1110233511 I S rmt0 AAA1

4865FA9B 1110225511 P H rmt0 TAPE OPERATION ERROR

DE9A52D1 1109180311 I S rmt0 AAA1

4865FA9B 1109180011 P H rmt0 TAPE OPERATION ERROR

DE9A52D1 1108180411 I S rmt2 AAA1

4865FA9B 1108180211 P H rmt2 TAPE OPERATION ERROR

DE9A52D1 1108165711 I S rmt6 AAA1

4865FA9B 1108165111 P H rmt6 TAPE OPERATION ERROR

A2205861 1102085311 P S SYSPROC Excessive interrupt disablement time

F7FA22C9 1031134111 I O SYSJ2 UNABLE TO ALLOCATE SPACE IN FILE SYSTEM

DE9A52D1 1030163411 I S rmt0 AAA1

4865FA9B 1030163411 P H rmt0 TAPE OPERATION ERROR

....etc....

WARNING: Please be VERY CAREFUL when using the dsh command. Issuing the wrong command can cause damage to all your AIX LPARS!

The dsm.dsh package contains the following utilities:

# lslpp -f dsm.dsh | grep /usr/bin

/usr/bin/dcp -> /opt/ibm/sysmgt/dsm/bin/dcp

/usr/bin/dsh -> /opt/ibm/sysmgt/dsm/bin/dsh

/usr/bin/dping -> /opt/ibm/sysmgt/dsm/bin/dping

/usr/bin/dshbak -> /opt/ibm/sysmgt/dsm/bin/dshbak

If you are a fan of the dping command, you are going to be disappointed. Although the command is currently included in the dsm.dsh fileset, it probably won’t be for much longer.

The command works, “sort of”:

root@nim# dping aixlpar1

aixlpar1: ping (alive)

But if you run ‘dping –a’:

root@nim# dping -a

dping: 2651-095 CSM license has expired or has not been accepted. Run csmconfig -L if you have installed a new release.

According to the developers, dping is no longer supported and will eventually be removed from the DSM package. The response from the developers was as follows:

"The reason "dping -a" is failing with the license check is because the command is calling “/usr/bin/runact-api –c IBM.DmsCtrl::::isLicenseValid" and the license is not set. So the command fails. Since CSM is not supported anymore and went end of life. "

“... please consider the dping command as being "deprecated" code pending removal from the dsm.dsh package.”

When I asked why the command was listed in the AIX 7.1 online documentation if it was no longer available, I was informed: “We are in the process of working with component owner regarding the DOCs and updating them.”. At this stage I’ve not been able to find an alternative command (in AIX). If I find one, I’ll update this post.

If you are planning on migrating to AIX 7.1 please be aware that CSM is no longer supported or available with AIX 7.1. CSM is now ‘end of life’.

http://www.ibmsystemsmag.com/aix/tipstechniques/systemsmanagement/DSH-Simplifies-the-Task-of-Managing-Multiple-Syste/

http://www.redbooks.ibm.com/abstracts/sg247910.html?Open

http://publib.boulder.ibm.com/infocenter/aix/v7r1/topic/com.ibm.aix.cmds/doc/aixcmds1/chpasswd.htm

Feed for Blog Entries ▼

Blogs

Chris's AIX Blog

▼ Tags

▼ Similar Blogs

AIX Down Unde...

Application P...

Asset Managem...

Application I...

AIXpert Blog

▼ Similar Ideation Blogs

IBM PureData-...

IBM Forms Exp...

WebSphere App...

Rational Soft...

IBM Configura...

▼ Archive

▼ Blog Authors

Chris's AIX Blog

SSH Host keys and AIX 7.1 Migration.

Check your WPAR filesets

Managing users with dsh and chpasswd - (plus info on DSM and dping).