This describes how to get SSH access to a Linux system on a HP blade system, which requires you to work through the ILO:

First of all, you need to know the ILO IP address. Simply open up an SSH session to this IP address:

# ssh -l ilo-admin 10.250.21.37
ilo-admin@10.250.21.37's password:
User:ilo-admin logged-in to 10.250.21.37
iLO 2 Advanced 1.60 at 16:05:58 Jul 11 2008
Server Name:
Server Power: On

</>hpiLO->

The next thing you need to do is type "VSP", hit ENTER and login to the server:

hpiLO-> VSP
Starting virtual serial port
Press 'ESC (' to return to the CLI Session
</>hpiLO-> Virtual Serial Port active: IO=0x02F8 INT=3
[ENTER]
</>hpiLO-> Virtual Serial Port active: IO=0x02F8 INT=3
Red Hat Enterprise Linux ES release 4 (Nahant Update 8)
Kernel 2.6.9-89.ELsmp on an i686
hostname login:

To make this magic happen, we need to spawn a getty on /dev/ttyS1. You might see somthing like this in /etc/inittab:

mo1::off:/sbin/mgetty -x 0 -D -s38400 -a /dev/ttyS1

The mgetty will not work. That expects a modem. Comment it out (it is off anyways). Add this line:

ilo:2345:respawn:/sbin/agetty ttyS1 115200 vt100

Then allows root to login on that tty:

# echo "ttyS1" >> /etc/securetty

Then reread the /etc/inittab and spawn any missing processes, like the new getty:

# kill -HUP 1

Now you should be able to ssh to the servers ILO IP address, login as ilo-admin, run VSP and get a login prompt.

HACMP 5.4 supports changing the default community name from "public" to something else. SNMP is used for clstatES communications. Using the "public" SNMP community name, can be a security vulnerability. So changing it is advisable.

First, find out what version of SNMP you are using:

# ls -l /usr/sbin/snmpd
lrwxrwxrwx 1 root system 9 Sep 08 2008 /usr/sbin/snmpd -> snmpdv3ne

(In this case, it is using version 3).

Make a copy of your configuration file. It is located on /etc.

/etc/snmpd.conf <- Version 1
/etc/snmpdv3.conf <- Version 3

Edit the file and replace wherever public is mentioned for your new community name. Make sure to use not more that 8 characters for the new community name.

Change subsystems and restart them:

# chssys -s snmpmibd -a "-c new"
# chssys -s hostmibd -a "-c new"
# chssys -s aixmibd -a "-c new"
# stopsrc -s snmpd
# stopsrc -s aixmibd
# stopsrc -s snmpmibd
# stopsrc -s hostmibd
# startsrc -s snmpd
# startsrc -s hostmibd
# startsrc -s snmpmibd
# startsrc -s aixmibd

Test using your locahost:

# snmpinfo -m dump -v -h localhost -c new -o /usr/es/sbin/cluster/hacmp.defs nodeTable

If the command hangs, something is wrong. Check the changes you made.

If everything works fine, perform the same change in the other node and test again. Now you can test from one server to the other using the snmpinfo command above.

If you need to backout, replace with the original configuration file and restart subsystems. Note in this case we use double-quotes. There is no space.

# chssys -s snmpmibd -a ""
# chssys -s hostmibd -a ""
# chssys -s aixmibd -a ""
# stopsrc -s snmpd
# stopsrc -s aixmibd
# stopsrc -s snmpmibd
# stopsrc -s hostmibd
# startsrc -s snmpd
# startsrc -s hostmibd
# startsrc -s snmpmibd
# startsrc -s aixmibd

Okay, now make the change to clinfoES and restart and both nodes:

# chssys -s clinfoES -a "-c new"
# stopsrc -s clinfoES
# startsrc -s clinfoES

Wait a few minutes and you should be able to use clstat again with the new community name.

Disclaimer: If you have any other application other than clinfoES that uses snmpd with the default community name, you should make changes to it as well. Check with your application team or software vendor.

Everybody is usually quite familiar with how to open an X11 windows GUI on a Windows PC. It involves running an X-server on the PC, for example Xming. Install this with all default settings. Make sure you have PuTTY installed on your PC before installing Xming. Then on your PC run Xlaunch, and make sure to set your DISPLAY to a higher value, for example "10" and to check "No Access Control".

Log in to the UNIX host through PuTTY, and before starting the session to your UNIX host, go to "Connection" -> "SSH" -> "X11" in PuTTY and select "Enable X11 forwarding", and then click "Open". Once logged in, set the DISPLAY variable to the IP address of your PC and set the correct display, for example:

# export DISPLAY="154.18.20.31:10"

And then, to test, run xclock or xeyes:

# xeyes

The program xeyes should open on your window.

Now, how do you get around opening an X window if you have to go through a jumpserver first to get to the correct UNIX server, where you would like to start an X-based program? That's not too difficult also. After logging in on the UNIX jumpserver, following the procedure described above, issue the following command:

# ssh -X -Y -C otherunixhost

Of course, replace "otherunixhost" with the hostname of the UNIX server you'd like to connect to through your jump server. Then, again, to test, run "xeyes" or "xclock" to test. It should open on your PC. Now you have X11 forwarding from a UNIX server, to a jumpserver, and back to your PC, in fact double X11 forwarding.

If your HMC is located behind a firewall and your only access is through SSH, then you have to use SSH tunneling to get browser-based access to your HMC. The ports you need to use for setting up the SSH tunnel are: 22, 23, 8443, 9960, 9735, 657, 443, 2300, 2301, 2302 and 12443. This applies to version 7 and up of the HMC. For example, if you're using a jump server to get access to the HMC, you need to run:

# ssh -l user -g -L 12443:10.48.32.99:12443 -L 8443:10.48.32.99:8443 -L 9960:10.48.32.99:9960 -L 9735:10.48.32.99:9735 -L 2300:10.48.32.99:2300 -L 2301:10.48.32.99:2301 -L 443:10.48.32.99:443 -L 2302:10.48.32.99:2302 -L 657:10.48.32.99:657 -L 22:10.48.32.99:22 -L 23:10.48.32.99:23 jumpserver.domain.com -N

When you've run the command above (and have logged in to your jumpserver), then point the browser to https://jumpserver.domain.com.

You can do something similar within PuTTY on your desktop system. Basically create a new PuTTY session to your HMC, and then in the SSH tunnel section, enter an entry for each port to the HMC, e.g. add port 12443 to 10.48.32.99:12443. Repeat this for all ports mentioned above and then save your PuTTY session. After that, login to your session, and open a browser to https://localhost, which should then redirect you to your HMC's web GUI.

If you wish to restrict the maximum number of login sessions for a specific user, you can do this by modifying the .profile of that user:

A=`w| grep $LOGNAME | wc -l`
if [ $A -ge 3 ] ; then
  exit
fi

This example restricts the number of logins to three. Make sure the user can't modify his/her own .profile by restricting access rights.