Operating Systems and Hosts

• Ensure that the packages bos.perf.tools and OpenSSH or openSSL are installed.
• Disable invalid login attempt fail for the service account.

• For HMC Dynamic Scope Sets, use username-password or username-SSH key authentication for the AIX partition service account.
• For General Discovery Scope Sets (Computer System), use username-password or username-SSH key authentication for the AIX service account.
• The service account can be root or an account with sudo authority.
• The service account must have a user attribute of rlogin=true. You can set this attribute by using SMIT or by editing the /etc/security/user file.
• Go through the following steps to enable a non-root service account for sudo authority for AIX.
  • Install the sudo RPM (sudo-1.6.9p15-2noldap) and SSH file sets (openssh.base.server, openssh.base.client on the AIX instance).
  • On the target AIX instance, create a non-root user ID that TSA can use to access the system.
  • Modify /etc/sudoers file on each AIX instance to allow TSA to run the specified commands by using sudo authority.

    # Cmnd alias specification 
    Cmnd_Alias TSA_CMDS = /usr/bin/lparstat, /usr/sbin/no, /usr/sbin/nfso, /usr/bin/lslicense, /usr/sbin/vmo, /usr/sbin/ioo, /usr/sbin/lvmo, /usr/sbin/schedo, /usr/bin/sysdumpdev, /usr/sbin/smtctl, /usr/sbin/emgr,
    /usr/bin/sissasraidmgr, /usr/sbin/lswpar, /usr/sbin/cpuextintr_ctl, /usr/sbin/lsnim, /usr/sbin/raso, /usr/sbin/bosdebug, /usr/sbin/chedition, /usr/esa/bin/esacli, /usr/sbin/bootinfo, /usr/bin/mpio_get_config, /usr/bin/cat /etc/objrepos/CuData,
    /usr/bin/cat /etc/objrepos/CuData.vc, /usr/bin/cat /var/adm/ras/bootlog, /usr/bin/cat /etc/lpp/diagnostics/data/diagrpt*.dat, /usr/bin/tapeutil, /usr/lpp/OV/bin/opcagt, /usr/DynamicLinkManager/bin/dlnkmgr view, /usr/sbin/powermt version, /usr/sbin/powermt display,
    /usr/bin/pcmpath query, /usr/sbin/datapath query
    

    # User privilege specification
    <User Name> ALL = NOPASSWD: TSA_CMDS

    Note: <User Name> is the non-root service account that TSA uses to collect AIX information. This <User Name> is a user on each AIX instance. The /etc/sudoers file on each AIX instance must be updated with the listed specifications.
  • An alternative to the modifications to /etc/sudoers file is to use the following user privilege specification.

    <User Name> ALL = NOPASSWD: ALL

    Note: <User Name> is the non-root service account that TSA uses to collect AIX information. This user specification allows the service account to use sudo authority on any AIX command.

• For HMC Dynamic Scope Sets, use username-password or username-SSH key authentication for the Linux® partition service account.
• For General Discovery Scope Sets (Computer System), use username-password or username-SSH key authentication for the Linux® service account.
• Go through the following steps to enable a non-root service account for sudo authority for Linux®:
  • On the target Linux® instance, create a non-root user ID that TSA can use to access the system.
  • Modify /etc/sudoers on each Linux® instance to allow TSA to run the specified commands by using sudo authority.

    # Cmnd alias specification 
    Cmnd_Alias TSA_CMDS = /usr/sbin/lsvpd, /sbin/lsvpd, /usr/sbin/lscfg, /sbin/lscfg, /usr/sbin/lsmcode, /sbin/lsmcode, /usr/sbin/lvmdiskscan, /sbin/lvmdiskscan, /usr/sbin/dmidecode, /usr/bin/mtlib, /usr/bin/tapeutil, 

    
    /usr/bin/crontab, /sbin/fdisk, /bin/ls -alR /boot/*, /bin/cat /proc/irq/*, /bin/cat /proc/net/vlan/config, /bin/cat /proc/ppc64/rtas/*, /bin/cat /proc/sys/kernel/cap-bound, /bin/cat /proc/sys/kernel/random/entropy_avail
    

    # User privilege specification
    <User Name> ALL = NOPASSWD: TSA_CMDS
    

    Note: <User Name> is the non-root service account that TSA uses to collect Linux® information. This <User Name> is a user on each Linux® instance. The /etc/sudoers file on each Linux® instance must be updated with the specified configuration.

• On Solaris systems, ensure that the SUNWscpu (Source Compatibility) package is installed.
• On some Solaris systems, SNEEP needs to be installed and configured to obtain serial numbers.

• Computer System - Use username-password or username-SSH key authentication for the service account.
• The service account can be non-root.

• Computer System - Use username-password for the service account.
• The service account can have either Operator or Administrator privileges.

• For VMware Dynamic Scope Sets, use username-password or username-SSH key authentication for the Linux® virtual machine service account.
• For General Discovery Scope Sets (Computer System), use username-password or username-SSH key authentication for the Linux® service account.
• Set /bin/sh as the shell for this account.
• For Linux® (x86), the service account can be root or an account with sudo authority.
• To discover using a non-root service account, add the following to the /etc/sudoers file on the Linux® system.

  # Cmnd alias specification
  Cmnd_Alias TSA_CMDS = /usr/sbin/dmidecode

  # User privilege specification
  <User Name> ALL = NOPASSWD: TSA_CMDS

  Note: <User Name> is the non-root service account that TSA uses to collect Linux® information. The <User Name> is a user on each Linux® instance. The /etc/sudoers file on each Linux® instance must be updated with the specified configuration.
• An alternative to the modifications to /etc/sudoers is to use the following user privilege specification.

  <User Name> ALL = NOPASSWD: ALL

  Note: <User Name> is the non-root service account that TSA uses to collect Linux® information. This user specification allows the service account to use sudo authority on any Linux® command.

• Computer System - Use username-password or username-SSH key authentication for the service account.
• To enable a non-root service account for sudo authority for HP-UX -
  • Modify /usr/local/etc/sudoers on each HP-UX device to allow TSA to run the specified commands using sudo authority.

    # Cmnd alias specification
    Cmnd_Alias TSA_CMDS =/usr/sbin/diskinfo,/opt/hpvm/bin/hpvmstatus

    # User privilege specification
    <User Name> ALL=(ALL) NOPASSWD:TSA_CMDS

    Note: <User Name> is the non-root service account that TSA uses to collect HP-UX information.

The most common way to prepare the environment is to use a server certificate generated by a certificate authority that is installed on the target Windows® server. The certificate must meet the following conditions.

• The root and intermediate certificates from the certificate authority are in the Trusted Root Certification Authorities certificates.
• The server certificate is installed in the Personal certificates.
• The server certificate must show that it is issued to the fully qualified hostname of the server.
• The server certificate must include the private key for this server.

To configure WINRM for remote HTTPS connections, use the command - winrm quickconfig -transport:https.

WinRM service is already running on the system.
WinRM is not set up to allow remote access to this machine for management.
The following changes must be made -
Create a WinRM listener on HTTPS -//* to accept WS-Man requests to any IP on this machine.
Configure a CertificateThumbprint setting for the service to be used for CredSSP authentication.
Configure LocalAccountTokenFilterPolicy to grant administrative rights remotely to local users.


Make these changes [y/n]? y
WinRM has been updated for remote management.
Created a WinRM listener on HTTPS://* to accept WS-Man requests to any IP on this machine.
Configured required settings for the service.
Configured LocalAccountTokenFilterPolicy to grant administrative rights remotely to local users.

Finally, to allow username-password authentication over HTTPS, run the command - winrm set winrm/config/service/auth @{Basic="true"}

An alternative is to use a self-signed certificate. For more information, see section Windows that use WINRM.

• For VMware Dynamic Scope Sets, use username-password for the VMware ESXi™ service account.
• For General Discovery Scope Sets (Computer System - Windows®), use username-password for the VMware ESXi™ service account.
• The service account must be a member of one of the following groups:
  • Administrators
  • WinRMRemoteWMIUsers__

  To add a user to the WinRMRemoteWMIUsers__ group, use the command: net localgroup WinRMRemoteWMIUsers__ [user_id] /add

• Make sure that Windows Scripting Host (WSH) or the Windows Management Instrumentation (WMI) service and VBScript are enabled on the target device.
• Make sure that the port 445 is not blocked by firewall or IP security policies as TSA uses the Server Message Block (SMBv1) protocol over TCP/IP.
• To apply security policies, go to Start > Control Panel > Administrative Tools, then choose the following navigation based on whether your policies are stored locally or in an Active Directory.
  • Locally stored policy: Administrative Tools → Local Security Policy → IP Security Policies on Local Computer
  • Policies Stored in Active Directory: Administrative Tools → Default Domain Security Settings → IP Security Policies on Active Directory or Administrative Tools → Default Domain Controller Security Settings → IP Security Policies on Active Directory
• TSA requires access to the hidden remote administration disk share for access to the system %TEMP% and other directories. Access to the Interprocess Communications share (IPC$) is also required for TSA to access remote registries. Make sure the Interprocess Communication share server service is started. To start the server service, go to the Control Panel > Administrative Tools > Services > Server.
• Make sure that the Remote Registry Service is active, which helps TSA to establish a session with the Windows® device.

• Computer System - Use the username-password for the service account.
• The service account must have SMAdmin authority.

• Computer System - Use the username-password authentication for the service account.
• The service account must have at least operator authority.

• Computer System - Use the username-password authentication for the service account.
• The service account must have at least operator authority.

• Computer system - Use username-password authentication for the service account.
• The service account must have either OA administrator, OA operator, or OA user authority on the HP Onboard Administrator. The OA user authority role is recommended.

• Computer System - Use the username-password for the service account.
• The service account can have any valid authority.

• Computer system - Use username-password authentication for the service account.
• The service account must have at least administrator authority level.
• The credential must have SSH access to run CLI commands.