UNSOLVED
Symacl and access type
I would like to implement symacl in my environment but would like to get clarification on a few items.
Let's say i have a system that will need to be able to issue timefinder/clone commands. So first i create a group that consists of that system, then i create a pool that consists of devices that will be cloned and lastly i create an ACL with Rights=BCV. Let's say i have a knucklehead system admin who decides to play around with symclone command and issues "symclone restore" instead of establish. Symacl will not be able to stop him because "Rights=BCV" applies to all timefinder/clone commands ? Any way to get more granular control on timefinder operations ? ( i want to stay away from using symauth to restrict who runs the command)
Thanks
Let's say i have a system that will need to be able to issue timefinder/clone commands. So first i create a group that consists of that system, then i create a pool that consists of devices that will be cloned and lastly i create an ACL with Rights=BCV. Let's say i have a knucklehead system admin who decides to play around with symclone command and issues "symclone restore" instead of establish. Symacl will not be able to stop him because "Rights=BCV" applies to all timefinder/clone commands ? Any way to get more granular control on timefinder operations ? ( i want to stay away from using symauth to restrict who runs the command)
Thanks
600
0
Posted November 13th, 2007 01:00
The code internally allows you to record each and every command your hosts issue. You can check with symaudit the "history" of your box. I think that symacl MAY be expanded to filter narrower classes of commands and/or actions for any given command (but again it is my own speculation on the subject) .. Maybe it's a good RFE for ENG.. Unfortunatly eng usually listen to customers and not to me :-P .. Maybe you can ask for such an RFE
-s-600
0
Posted November 13th, 2007 05:00
i guess i will go ahead and submit an RFE ..maybe in SE 8.4 we will see this functionality ?600
0
Posted November 13th, 2007 06:00
Don't be too harsh600
1
Posted November 13th, 2007 06:00
To add to the discussion.
With the audit commands you can get very granular information about what command was run.
you can check to see if a restore was done recently
symaudit list -sid XXX -v -activity_id BeginRestore -start_date 11/1 -end_date 11/2
A list of the activity ID's is in the help for the symaudit command and also the command reference
also you can restrict a range of devices too; This functionality is available in se 6.4385
0
Posted November 13th, 2007 08:00
ThX385
0
Posted November 13th, 2007 08:00
Paul,
i would like to stop the knucklehead system admin before he destroys production data. Auditing will be good for root-cause analysis ..but at that point business has suffered.291
0
Posted November 14th, 2007 01:00
Would this be a "symm management" product ? I can't find symacl or symcli as the product to choose.600
0
Posted November 14th, 2007 01:00
I can only underline that the more customers pushes for an RFE, the more is likely that ENG can work on the feature requested291
0
Posted November 14th, 2007 01:00
Done
The RFE is sent.
xe2sdc
6 Operator
•
2831 Posts
600
0
Posted November 13th, 2007 01:00