Home | History | Annotate | Download | only in man1cl
 te
 CDDL HEADER START

 The contents of this file are subject to the terms of the
 Common Development and Distribution License (the "License"). 
 You may not use this file except in compliance with the License.

 You can obtain a copy of the license at CDDL.txt
 or http://www.opensolaris.org/os/licensing.
 See the License for the specific language governing permissions
 and limitations under the License.

 When distributing Covered Code, include this CDDL HEADER in each
 file and include the License file at CDDL.txt.
 If applicable, add the following below this CDDL HEADER, with the
 fields enclosed by brackets "[]" replaced with your own identifying
 information: Portions Copyright [yyyy] [name of copyright owner]

 CDDL HEADER END
 Copyright 2008 Sun Microsystems, Inc.
 All rights reserved. Use is subject to license terms.
 claccess 1CL "11 Sep 2008" "Sun Cluster 3.2" "Sun Cluster Maintenance Commands"
 NAME
claccess - manage Sun Cluster access policies
for nodes

 SYNOPSIS


/usr/cluster/bin/claccess -V






/usr/cluster/bin/claccess [subcommand] 
-?






/usr/cluster/bin/claccess subcommand 
[options] -v [hostname[,.\|.\|.]]






/usr/cluster/bin/claccess allow -h hostname[,.\|.\|.]






/usr/cluster/bin/claccess allow-all 






/usr/cluster/bin/claccess deny -h hostname[,.\|.\|.]






/usr/cluster/bin/claccess deny-all 






/usr/cluster/bin/claccess list 






/usr/cluster/bin/claccess set -p protocol=authprotocol






/usr/cluster/bin/claccess show 




 DESCRIPTION

The claccess command controls the network
access policies for machines that attempt to access the cluster configuration.
The claccess command has no short form.


The cluster maintains a list of machines that can access the
cluster configuration. The cluster also stores the name of the authentication
protocol that is used for these nodes to access the cluster configuration. 


When a machine attempts to access the cluster configuration,
for example when it asks to be added to the cluster configuration
(see clnode(1CL)), the cluster checks this list to determine
whether the node has access permission. If the node has permission,
the node is authenticated and allowed access to the cluster configuration.


You can use the claccess command for the
following tasks:




To allow any new machines to add themselves to the
cluster configuration and remove themselves from the cluster configuration






To prevent any nodes from adding themselves to the
cluster configuration and removing themselves from the cluster configuration






To control the authentication type to check




You can use this command only in the global zone.


The general form of the claccess command
is as follows:


 claccess [subcommand]
[options]


You can omit subcommand only if options specifies the -? option or 
the -V option.


Each option of this command has a long form and a short form.
Both forms of each option are provided with the description of the
option in the "OPTIONS" section of this man page.

 SUBCOMMANDS

The following subcommands are supported:


.na
allow
.ad


Allows the specified machine or machines to access
the cluster configuration. 
Users other than superuser require solaris.cluster.modify role-based
access control (RBAC) authorization to use this subcommand. See rbac(5).
See also the description of the deny and
the allow-all subcommands.





.na
allow-all
.ad


Allows all machines to add themselves to access the
cluster configuration.
Users other than superuser require solaris.cluster.modify RBAC authorization to use this subcommand. See rbac(5).
See also the description of the deny-all and
the allow subcommands.





.na
deny
.ad


Prevents the specified machine or machines from accessing
the cluster configuration.
Users other than superuser require solaris.cluster.modify RBAC authorization to use this subcommand. See rbac(5).
See also the description of the allow and
the deny-all subcommands.





.na
deny-all
.ad


Prevents all machines from accessing the cluster configuration.
No access for any node is the default setting after the cluster
is configured the first time.
Users other than superuser require solaris.cluster.modify RBAC authorization to use this subcommand. See rbac(5).
See also the description of the allow-all and
the deny subcommands.





.na
list
.ad


Displays the names of the machines that have authorization
to access the cluster configuration. To see the authentication protocol
as well, use the show subcommand. 
Users other than superuser require solaris.cluster.read RBAC authorization to use this subcommand. See rbac(5).





.na
set
.ad


Sets the authentication protocol to the value that
you specify with the -p option. By default, the system
uses sys as the authentication protocol. See the -p option in "OPTIONS".
Users other than superuser require solaris.cluster.modify RBAC authorization to use this subcommand. See rbac(5).





.na
show
.ad


Displays the names of the machines that have permission
to access the cluster configuration. Also displays the authentication
protocol. 
Users other than superuser require solaris.cluster.read RBAC authorization to use this subcommand. See rbac(5).




 OPTIONS

The following options are supported:


.na
-?
.ad
.na
--help
.ad


Displays help information. When you use this option,
no other processing is performed.
You can specify this option without a subcommand or with a subcommand.
If you specify this option without a subcommand, the list of subcommands
of this command is displayed. If you specify this option with a subcommand,
the usage options for the subcommand are displayed.





.na
-h hostname
.ad
.na
--host=hostname
.ad
.na
--host hostname
.ad


Specifies the name of the node being granted or denied
access. 





.na
-p protocol=authentication-protocol
.ad
.na
--authprotocol=authentication-protocol
.ad
.na
--authprotocol authentication-protocol
.ad


Specifies the authentication protocol that is used
to check whether a machine has access to the cluster configuration.
Supported protocols are des and sys (or unix). The default authentication type is sys,
which provides the least amount of secure authentication. For more
information on adding and removing nodes, see Adding a Cluster Node in Sun Cluster
System Administration Guide for Solaris OS. For
more information on these authentication types, see Chapter 16, Using Authentication Services (Tasks), in System Administration Guide: Security Services.





.na
-V
.ad
.na
--version
.ad


Displays the version of the command.
Do not specify this option with subcommands, operands, or other
options. The subcommands, operands, or other options are ignored.
The -V option displays only the version of the command.
No other processing is performed.





.na
-v
.ad
.na
--verbose
.ad


Displays verbose information to standard output (stdout).




 EXIT STATUS

If the command is successful for all specified operands, it 
returns zero (CL_NOERR). If an error occurs for an
operand, the command processes the next operand in the operand list. The
returned exit code always reflects the error that occurred first.


The following exit codes can be returned:


.na
0 CL_NOERR
.ad


No error
The command that you issued completed successfully.





.na
1 CL_ENOMEM
.ad


Not enough swap space
A cluster node ran out of swap memory or ran out of other operating system resources.





.na
3 CL_EINVAL
.ad


Invalid argument
You typed the command incorrectly, or the syntax of the cluster
configuration information that you supplied with the -i option
was incorrect.





.na
6 CL_EACCESS
.ad


Permission denied
The object that you specified is inaccessible. You might need superuser 
or RBAC access to issue the command. See the 
su(1M) 
and 
rbac(5) 
man pages for more information.





.na
18 CL_EINTERNAL
.ad


Internal error was encountered
An internal error indicates a software defect or other defect.





.na
39 CL_EEXIST
.ad


Object exists
The device, device group, cluster interconnect component, node, cluster, resource, resource type, or resource group that you specified already exists.




 EXAMPLES

Example 1 Allow a New Host Access


The following claccess command allows a new
host to access the cluster configuration.


# claccess allow -h phys-schost-1





Example 2 Set the Authentication Type


The following claccess command sets the current
authentication type to des.


# claccess set -p protocol=des





Example 3 Deny Access to All Hosts


The following claccess command denies all
hosts access to the cluster configuration.


# claccess deny-all




 ATTRIBUTES

See attributes(5) for descriptions of the following attributes:







ATTRIBUTE TYPEATTRIBUTE VALUE
AvailabilitySUNWsczu
Interface StabilityEvolving



 SEE ALSO

Intro(1CL), clnode(1CL), cluster(1CL)

 NOTES

The superuser user can run all forms of this command.


Any user can run this command with the following subcommands
and options:




-? option






-V option




To run this command with other subcommands, users other than
superuser require RBAC authorizations. See the
following table.







SubcommandRBAC Authorization
allowsolaris.cluster.modify
allow-allsolaris.cluster.modify
denysolaris.cluster.modify
deny-allsolaris.cluster.modify
listsolaris.cluster.read
setsolaris.cluster.modify
showsolaris.cluster.read