For things like logs, if you have SupportIQ on, support can gather logs without SSH.  The cluster will perform a regular poll out to our support server and it can grab instructions to perform basic log gathering and auto upload without SSH.  SSH is only really required if someone needs to go in and manually run commands on the cluster.

Andrew,

SupportIQ has been enabled for 2 years now with direct ssh and web access. I don't want to do webex for rudimentary things like collecting logs ..etc, Isilon needs to give 1st level support access to SupportIQ.

Good to know what you tunnel ssh over https, so i don't need to add any special subnets to hosts.allow files.

Thanks

AndrewChung wrote: For things like logs, if you have SupportIQ on, support can gather logs without SSH.  The cluster will perform a regular poll out to our support server and it can grab instructions to perform basic log gathering and auto upload without SSH.  SSH is only really required if someone needs to go in and manually run commands on the cluster.

i agree, yet every time i open a ticket first level support insists on doing webex or asks me to run isi_gather.

/rant

I don't want to do it neither do i have time to do it ..that's why we opened ssh/web access to Isilon support and provided cluster credentials. Sounds like a training opportunity for Isilon support organization.  /rant

Yeah, I also wondered wether there is a policy on pushing vs. pulling isi_gather logs.

We don't do much Webex here, but tunneled ssh as Andrew has described.

Usually I ask the supporter to issue a "script -t 1" command at the start of the session.

It logs all terminal input and output to a single file ("typescript"),

buffering for at most 1 second ("-t 1").

I can then watch all activities with "tail -f typescript" in real time

and discuss issues on the phone at the same time.

Plus, the typescript can be archived for later reference.

(The logging feature of "screen" might also work.)

-- Peter

That impossible, but as you log any attempt, it should be mostly ok.

-- Peter

sudo /bin/bash 

sudo /usr/bin/vi -> :sh  ;-)

Actually I enable ssh access only temporarily, and while having the supporter on the phone.

-- Peter

That still allows other commands, like vi, to be sudo'ed at first,

and then escape to a shell (":sh")...

Even more obvious for "script", "screen", "xterm", ...

And one simply cannot know the details for OneFS specific commands.

Or how about "cp /bin/bash /tmp/mash; sudo /tmp/mash"?

There have been endless debates on this already... anyway, have a nice weekend.

-- Peter

sure it's possible

Cmnd_Alias NSHELLS = /usr/bin/sh,/usr/bin/zsh,/usr/bin/bash

Cmnd_Alias NSU = /usr/bin/su,/usr/local/sbin/visudo

admin ALL=(ALL) NOPASSWD: ALL, !NSU, !NSHELLS

no worries, i googled enough to lock those things down too