BMC BladeLogic Server Automation

Administration Guide

Supporting
BMC BladeLogic Server Automation version 8.1
February 2011

www.bmc.com

Contacting BMC Software
You can access the BMC Software website at http://www.bmc.com. From this website, you can obtain information about the company, its products, corporate offices, special events, and career opportunities.

United States and Canada
Address BMC SOFTWARE INC 2101 CITYWEST BLVD HOUSTON TX 77042-2827 USA Telephone 713 918 8800 or 800 841 2031 Fax 713 918 8000

Outside United States and Canada
Telephone (01) 713 918 8800 Fax (01) 713 918 8000

© Copyright 2002-2011 BladeLogic, Inc. BMC, BMC Software, and the BMC Software logo are the exclusive properties of BMC Software, Inc., are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other BMC trademarks, service marks, and logos may be registered or pending registration in the U.S. or in other countries. All other trademarks or registered trademarks are the property of their respective owners. BladeLogic and the BladeLogic logo are the exclusive properties of BladeLogic, Inc. The BladeLogic trademark is registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other BladeLogic trademarks, service marks, and logos may be registered or pending registration in the U.S. or in other countries. All other trademarks or registered trademarks are the property of their respective owners. AIX and IBM, are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Linux is the registered trademark of Linus Torvalds. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. UNIX is the registered trademark of The Open Group in the US and other countries. The information included in this documentation is the proprietary and confidential information of BMC Software, Inc., its affiliates, or licensors. Your use of this information is subject to the terms and conditions of the applicable End User License agreement for the product and to the proprietary and restricted rights notices included in the product documentation.

Restricted rights legend
U.S. Government Restricted Rights to Computer Software. UNPUBLISHED -- RIGHTS RESERVED UNDER THE COPYRIGHT LAWS OF THE UNITED STATES. Use, duplication, or disclosure of any data and computer software by the U.S. Government is subject to restrictions, as applicable, set forth in FAR Section 52.227-14, DFARS 252.227-7013, DFARS 252.227-7014, DFARS 252.227-7015, and DFARS 252.227-7025, as amended from time to time. Contractor/Manufacturer is BMC SOFTWARE INC, 2101 CITYWEST BLVD, HOUSTON TX 77042-2827, USA. Any contract notices should be sent to this address.

Customer support
You can obtain technical support by using the BMC Software Customer Support website or by contacting Customer Support by telephone or e-mail. To expedite your inquiry, see “Before contacting BMC.”

Support website
You can obtain technical support from BMC 24 hours a day, 7 days a week at http://www.bmc.com/support. From this website, you can
■ ■ ■ ■ ■ ■ ■ ■

read overviews about support services and programs that BMC offers find the most current information about BMC products search a database for issues similar to yours and possible solutions order or download product documentation download products and maintenance report an issue or ask a question subscribe to receive proactive e-mail alerts when new product notices are released find worldwide BMC support center locations and contact information, including e-mail addresses, fax numbers, and telephone numbers

Support by telephone or e-mail
In the United States and Canada, if you need technical support and do not have access to the web, call 800 537 1813 or send an e-mail message to customer_support@bmc.com. (In the subject line, enter SupID:<yourSupportContractID>, such as SupID:12345). Outside the United States and Canada, contact your local support center for assistance.

Before contacting BMC
Have the following information available so that Customer Support can begin working on your issue immediately:

product information — — — product name product version (release number) license number and password (trial or permanent)

operating system and environment information — — — — — machine type operating system type, version, and service pack or other maintenance level such as PUT or PTF system hardware configuration serial numbers related software (database, application, and communication) including type, version, and service pack or maintenance level

■ ■ ■

sequence of events leading to the issue commands and options that you used messages received (and the time and date that you received them) — — — product error messages messages from the operating system, such as file system full messages from related software

3

License key and password information
If you have questions about your license key or password, use one of the following methods to get assistance:
■ ■

Send an e-mail message to customer_support@bmc.com. Use the Customer Support website at http://www.bmc.com/support.

4

BMC BladeLogic Server Automation Administration Guide

Contents
Chapter 1 Introduction 11 11 11 12 12 13 13 14 15 15 16 17 18 19 19 21 29 30 30 31 32 33 33 34 34 39 39 41 41 42 42 42 43 Intended Audience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Shell Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 2 Overview of BMC BladeLogic Server Automation

System architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Client tier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Middle tier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Server tier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Default permissions and security configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Perl support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tools for managing BMC BladeLogic data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Troubleshooting tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Generating data for support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Monitoring and diagnosing issues in the BMC BladeLogic environment . . . . . . Chapter 3 Configuring the Application Server

Understanding the application server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Application server processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Work item threads and the job execution thread . . . . . . . . . . . . . . . . . . . . . . . . . . . Job distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Pooled database connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Authentication framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Application Server Launcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using the Post-Install Configuration wizard to configure the default application server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Changing the configuration of an application server . . . . . . . . . . . . . . . . . . . . . . . . . . . Using the application server configuration wizard to change configuration settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Starting Application Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Starting all Application Servers on the host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Restarting Application Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Restarting all Application Servers on the host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stopping Application Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stopping all Application Servers on the host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Contents

5

Using the Application Server Administration console (blasadmin) to configure Application Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Starting the Application Server Administration console . . . . . . . . . . . . . . . . . . . . . 45 The set Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 The show Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 The help Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Specifying multiple values for a parameter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Changing the default separator for multiple values. . . . . . . . . . . . . . . . . . . . . . . . . 50 Deleting a configuration setting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Managing Application Server behavior with the Application Server Administration console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Configuring the Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Changing the heap size for BMC BladeLogic components . . . . . . . . . . . . . . . . . . . 71 Enabling/disabling SOCKS proxy rule evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . 73 Configuring the file server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Configuring a mail server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Configuring Perl. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Configuring an SNMP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Configuring a database server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Configuring the process spawner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Configuring expiration time for credentials of NSH Script Jobs . . . . . . . . . . . . . . 82 Processing across mount points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Restricting the size of configuration and extended objects . . . . . . . . . . . . . . . . . . . 83 Configuring user interface settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Setting SRP login requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Configuring the PXE Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Configuring the Licensing Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Enabling asynchronous execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Enabling web services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Configuring multiple Application Servers on the same host. . . . . . . . . . . . . . . . . . . . . 93 About Application Server deployments and profiles. . . . . . . . . . . . . . . . . . . . . . . . 94 Creating additional Application Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Viewing and editing an Application Server’s profile . . . . . . . . . . . . . . . . . . . . . . . 100 Listing conflicting attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Getting information about Application Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 The Application Server Launchers node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Reporting Application Server information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Managing multiple Application Servers on the same host . . . . . . . . . . . . . . . . . . . . . 109 Starting a specific Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Stopping a specific Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Redeploying a stopped Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Terminating a specific Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Restarting a specific Application Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Removing an Application Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Adding unmanaged deployments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Editing the list of roles with Application Server Launcher access . . . . . . . . . . . . 113 Resetting database passwords for the Application Server . . . . . . . . . . . . . . . . . . . . . . 114

6

BMC BladeLogic Server Automation Administration Guide

Chapter 4

Administering security

115 117 117 118 119 120 121 122 122 123 123 123 124 124 126 128 128 129 130 130 130 131 132 133 133 134 135 137 140 142 150 153 158 158 159 159 160 160 161 163 163 163 166 166 167 169 170 171 171
7

Fundamentals of BMC BladeLogic security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Session layer security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Impersonation and privilege mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Single sign-on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SRP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RSA SecurID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Active Directory/Kerberos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Domain Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Authentication profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Single sign-on session credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Keytab files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RBAC role selection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Environment variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security for different communication legs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC BladeLogic Console to Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . BLCLI to Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Shell to Network Shell Proxy Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reports client to reports server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Application Server to agent or repeater . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Shell to agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Repeater to agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Implementing single sign-on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring the Authentication Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring the Application Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring the Network Shell Proxy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting override locations for client SSO files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting up certificate verification using OCSP . . . . . . . . . . . . . . . . . . . . . . . . . . . . Implementing LDAP authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overview of LDAP configuration tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . High availability configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Certificate trust store. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Distinguished names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cross-registering users in the BMC BladeLogic database . . . . . . . . . . . . . . . . . . . Configuring LDAP authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Implementing RSA SecurID authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring RSA Authentication Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring SecurID authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cross-registering users in the BMC BladeLogic database . . . . . . . . . . . . . . . . . . . Implementing PKI authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring PKI authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cross-registering users in the BMC BladeLogic database . . . . . . . . . . . . . . . . . . . Implementing Domain Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sample domain structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring BMC BladeLogic for Domain Authentication . . . . . . . . . . . . . . . . .
Contents

. . . . . . . . . . . . . . . . . . . . . . . . . 241 Restricting commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Generating a self-signed certificate for an Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 Registering an Authentication Service in an Active Directory Domain . . . . . . . . . . . . . . .local files . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 Examples . . . . . . . . . . . . . . . . . . . . . . . 211 No authentication – Using a default installation. . . . . . . . . . . . . . . . . . . . 237 Exports file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Configuring the users or users. 258 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 8 BMC BladeLogic Server Automation Administration Guide . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Options for users and users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 Options for exports file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Implementing Security – Repeater to agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Implementing Active Directory/Kerberos authentication. . . . . . . 222 Using certificates to secure communication between clients and Application Servers . . . . 217 Creating a self-signed client-side certificate on the repeater . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 Configuring a BMC BladeLogic Client for AD/Kerberos authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Overview of AD/Kerberos configuration tasks . . 226 Options . . . . and the secure file . . . . . . . . . . . . . . . . . 246 Users and users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 Examples . . . . 228 Typical scenarios . . . . . . . 240 Configuring the exports file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 Using the blcred utility . . . . . . . . . . . . . . . . . . . . . . 180 Configuring an Authentication Service for AD/Kerberos authentication . . . . . . . . . . . . . 202 TLS with client-side certs – Securing a Windows Application Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Implementing security – Application Server to agents or repeaters. . . . . . . . . . . . . . . . 218 Provisioning agents with an SHA1 fingerprint of the repeater’s self-signed certificate. . . . . . . . . 255 Options for secure file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 TLS with client-side certs – Securing a Network Shell client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 Clients. . . . . . . . 223 Securing communication with CA certificates . . . . . . . . . . . . . . . . . . . 202 TLS with client-side certs – Securing a UNIX-based Application Server . . . . . . . . . . . . . . . . 235 Subnet designations . . . . . . . . . . . . . . . . . .local files . . . . . . . . . . . 206 TLS with client-side certs – Discontinuing use of client-side certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Chapter 5 Setting up configuration files 233 Introduction to the configuration files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Configuring agents to authenticate incoming requests with client-side certificates 221 Discontinuing use of client-side certificates. . . 236 How BMC BladeLogic grants access to RSCD agents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Implementing security – Network Shell to agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 Securecert file . . 252 Secure file . . . . . . . . . . . . . . . . . . . . . . . 255 Configuring the secure file . . . . . . . . . 233 Configuration file functions . . . . . . . . . . . . . . . . .local files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Generating a user information file . . . . . . . . . . . . . servers. . . . . . . . . . . . 254 Communication protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . Scheduling the cleanup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scheduling the retention policy utility to mark data for deletion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cleaning up repeater servers . . . . 319 Generate the SSL certificate . .Configuring the securecert file . . . . . . . . . 312 Configuring Advanced File Servers . . . . . . . . 312 Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . About logging configuration for BMC BladeLogic . . . . . . . . . . . . . . . . . . . . . . . . Additional log files of interest . . . . . . . . . . . . . . . . . . . . . . 304 What is the BMC BladeLogic Advanced Repeater? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318 Securing communication between Advanced File Servers and Advanced Repeater servers (optional). . . . . . . . . . . . . . . . . . . . . . Cleaning up historical data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Marking data for deletion. . . . . . . . . . . . . . . . . . . . . PXE Server logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . BMC BladeLogic log file reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 Contents 9 . . . 316 Changing the administrator user and password for Advanced Repeater Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 Performing an unattended (silent) installation . . . . . . . . . . . . . . Scheduling the database cleanup . . . Chapter 7 Configuring Advanced File Servers and Advanced Repeaters Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Key terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cleaning up target servers (Agents) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cleaning up the file server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cleaning the Application Server cache . . . . . . . . . . . . . . Scheduling the file server cleanup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 Installing the BMC BladeLogic Server Automation Advanced Repeater . Collecting log data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . About the clean-up utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overview of BMC BladeLogic log files . . . . . . . . . . . . . . . . . . . . . . . . . . . . Executing the database clean-up utility . . . . . . . . . . . . . . . . . . . 319 Set up the Advanced File Server for secure communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Enable SSL on Advanced File Servers and Advanced Repeaters. . . . . . . . . . 307 Installing using the installation program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Agent logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309 Configuring Advanced File Servers and Advanced Repeater servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .txt file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scheduling the Application Server cache cleanup . . . . . . . . . . . . . . . Scheduling the target server (Agent) cleanup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scheduling the repeater server cleanup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chapter 6 Managing BMC BladeLogic data 263 264 264 264 267 271 271 271 271 272 287 288 288 289 292 293 293 294 295 296 297 297 298 299 299 300 300 303 Cleaning up the BMC BladeLogic database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Application Server logging . . . . . . . . . . . . . . . . . . . . . . . . 312 Configuring Advanced Repeater servers. . . . . . . . . . . . . . . . . . . . About the Log4crc. . . . . . . . . . . . . . . . 305 Best practice information . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336 Security Glossary Index 339 345 10 BMC BladeLogic Server Automation Administration Guide . . . . . . . . . . . 335 Enabling HTTPS support for the BMC Atrium Orchestrator connection . . . . . . . . . . . 327 Chapter 8 Integrating BMC BladeLogic and Change Management 329 Levels of integration. . . . . . . . . . . . . . . . . . . . 324 Configuring bandwidth throttling between Advanced File Servers and Advanced Repeater servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Configure the Advanced File Server to use secure communication. . . 333 Configuring job approval for job types. . . . . . . . . . . . . 326 Starting and stopping the Advanced Repeater .Configure the Advanced Repeater server for secure communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 The BMC Continuous Compliance for Servers solution . . . . . 325 Location of configuration files . . . . . . . . . . . . . . . . . . 330 Requirements for integration . . . . . . . . . . . . . . . . . . . . 324 Location of log files . . . . . . . . . . . . . . 323 Troubleshooting advanced file servers and advanced repeaters . . . . . 334 Setting up the connection to BMC Atrium Orchestrator . . . . 332 Enabling BMC Remedy ITSM integration for job approval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323 Disabling SSL communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 Assigning job approval permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter 1 1 Introduction The BMC BladeLogic Server Automation Administration Guide describes all of the configuration and administration tasks you can perform to ensure the smooth functioning of BMC BladeLogic Server Automation (referred to in this guide as “BMC BladeLogic”). Intended Audience This document is intended for system administrators who manage data centers and networks of remote servers. how to implement security restrictions. The configuration of the RSCD agent on those servers determines whether the client can establish a connection with the server and what permissions the client will have. This document describes how to set up and maintain an Application Server. In the BMC BladeLogic context. the configuration you define for both the client and the server determines how the client and server communicate with each other. Terminology Throughout this document you will see discussions related to client and server machines. and how to define user permissions using the BMC BladeLogic configuration files. Chapter 1 Introduction 11 . Clients establish contact with servers by means of the RSCD agents installed on server machines. If a connection is established. a server is a machine where an RSCD agent is installed. Clients are machines running the BMC BladeLogic Console or Network Shell.

Network Shell Documentation BMC BladeLogic provides descriptions of all Network Shell commands and utilities as man pages available on both Windows and UNIX-style systems. such as man nsh. select Add.local. users. Monospace fonts also depict file system paths. bold text highlights actions that you should take. Bold fonts identify Network Shell commands and utilities. this document always uses the term client to refer to a machine where someone is using the BMC BladeLogic Console or Network Shell to contact another machine. enter man <command>. a procedural step might read. This document always calls the machine being contacted a server. as well as the exports. The following is an example of system text: ERROR: You must be "root" for pkgadd to execute properly. To display a man page while using Network Shell.Documentation Conventions In some contexts. For example. This can happen because you can install client applications on the same hosts where you have installed an RSCD agent. the BMC BladeLogic Server Automation Network Shell Command Reference provides a full description of all Network Shell commands and utilities. serif fonts depict text that a user might enter at the command line or text that a system generates in response to user input. users. “From the File menu. Documentation Conventions In this document. Within a procedure. and in other contexts the same machine can be a client. this guide uses UNIX-style path separators (forward slashes) except in situations where a Windows-style path separators (backslashes) are specifically required. and secure configuration files. monospace. Despite that possibility for confusion. a machine may be a BMC BladeLogic server. 12 BMC BladeLogic Server Automation Administration Guide . In addition.” When describing paths.

as well as a discussion of other topics that apply to the BMC BladeLogic system as a whole. server. and middle tiers. System architecture A BMC BladeLogic system has a three-tier architecture that consists of client. Chapter 2 Overview of BMC BladeLogic Server Automation 13 .Chapter 2 Overview of BMC BladeLogic Server Automation 2 This chapter provides an overview the system architecture for BMC BladeLogic Server Automation (BMC BladeLogic). The following graphic illustrates the relationship between the major components of the three-tiered BMC BladeLogic system.

It also includes a web interface to the BMC BladeLogic Decision Support for Server Automation server. a command line interface (BLCLI) that provides API-level access to the functionality available through the console.Client tier BMC BladeLogic Console BLCLI reports client (web browser) Network Shell Client Tier PXE / TFTP Server Application Server(s) reports server Network Shell Proxy Server (optional) BMC BladeLogic core database Middle Tier reporting data warehouse Agent File Server Server Tier Remote Server Remote Server Agent Server Agent Server Agent Server Agent Server Agent Server Client tier The BMC BladeLogic client tier includes the BMC BladeLogic console. 14 BMC BladeLogic Server Automation Administration Guide . and Network Shell for ad hoc administration of one or more servers.

The Application Server communicates with RSCD agents and initiates all communication to perform ad hoc and scheduled tasks. The Application Server provides servers being provisioned with the instructions necessary to provision the machine. Network Shell is a network scripting language that enables cross-platform access through a command line interface. Server tier The BMC BladeLogic server tier consists of RSCD agents on remote servers. The PXE Server delivers instructions to servers being provisioned so they can download a bootstrap program. Not only does the Application Server manage communication between consoles and remote servers. If necessary. and Microsoft Windows 2000/2003/2008 servers. The reporting data warehouse is populated using information from the core BMC BladeLogic database. RSCD agents never initiate communication with an Application Server or any other BMC BladeLogic component. If a site is running BMC Service Automation Reporting and Analytics.Middle tier The BMC BladeLogic console is a graphical user interface that gives system administrators a host of sophisticated tools for managing and automating data center procedures. The middle tier also includes several components used for provisioning servers. a BMC BladeLogic system can incorporate multiple Application Servers that cooperate by balancing job processing workloads. which controls how the BMC BladeLogic console communicates with remote servers. it also controls interaction with the database and file servers. Network Shell can optionally incorporate a middle tier component—an Application Server that is configured to run a Network Shell Proxy Server. BMC Service Automation Reporting and Analytics uses the Application Server to authenticate users. Middle tier The primary component of the middle tier is the Application Server. with the principal components being the PXE Server and the Application Server. All BMC BladeLogic client-tier applications let you manage Solaris®. AIX®. Operating as an intermediary between Network Shell clients and the managed servers those clients target. It also lets system administrators provision operating systems onto servers. Chapter 2 Overview of BMC BladeLogic Server Automation 15 . and it reads data from the core BMC BladeLogic database as well as a reporting data warehouse. Linux® (Red Hat and SUSE). HP-UX. The Application Server is completely scalable. allowing administrators to adjust its performance to accommodate added users and increased database activity. the Network Shell Proxy Server authenticates Network Shell client users and ensures traffic is encrypted between clients and managed servers. the middle tier includes an Apache Tomcat server.

Default permissions and security configuration Default permissions and security configuration In BMC BladeLogic. TLS automatically negotiates the strongest form of encryption that clients and servers can support. For more information on managing access at the console level. For many BMC BladeLogic installations. All clients and servers are set to communicate using protocol 5. A role is a set of authorizations and other information that reflects the capabilities of an organizational entity. A system object is an object you can interact with in the BMC BladeLogic Console. a BMC BladeLogic protocol for secure communication based on Transport Layer Security (TLS). The system’s default configuration provides sufficient functionality and appropriate user permissions. the following permissions and security configurations are set by default for each RSCD agent: ■ All clients are granted read/write access to all servers. you do not have to modify the agent configuration files. the successor to Secure Socket Layer (SSL). Configuration files on the RSCD agent let you define who can access servers and how users communicate with those servers. you should understand the default configuration of BMC BladeLogic. you can control user access through a combination of role-based and system object-based authorizations. ■ 16 BMC BladeLogic Server Automation Administration Guide . When a user is assigned to a role. Using the BMC BladeLogic Console. With protocol 5. If your installation requires additional refinement. BMC BladeLogic also lets you control access to servers at the agent level. such as QA engineers or web administrators. he or she is granted the authorizations defined for that role. see the BMC BladeLogic Server Automation User Guide. When you install BMC BladeLogic on clients and servers. The definition of a system object includes a set of authorizations specifying roles who can access the object and the actions those roles can perform. access control can be managed at multiple levels.

If a user does not have an equivalent local identity on the server. Other forms of authentication are possible. read. the core library for BMC BladeLogic. they are set up for SRP authentication when using BMC BladeLogic clients to communicate with Application Servers. “Administering security. users are mapped to user “Anonymous. the agent maps the incoming user to a default user with downgraded permissions.” Incoming users can be granted the permissions of a specified user. ■ For a complete discussion of how users are granted permissions on servers.” Perl support BMC BladeLogic provides built-in support for Perl. On UNIX. If so. Chapter 2 Overview of BMC BladeLogic Server Automation 17 .Perl support ■ Users are granted permissions on managed servers through two different processes: — For Windows servers. see Chapter 4. the script programming language. users are mapped to user “nobody. users can be granted permissions through a process of user impersonation (for all UNIX servers) or user privilege mapping (for Windows). see the BMC BladeLogic Server Automation User Guide. Because of this integration. which functions like a network-enabled version of libc.” On Windows. — In all other situations. The BMC BladeLogic Perl module integrates with libnc.” By default when you add users to the BMC BladeLogic system. For either of these approaches. see Chapter 5. you can use Perl scripts to perform functions on remote hosts (such as open. and members of the Administrator group in Windows are not automatically mapped to Administrator. root users on UNIX are not automatically mapped to root. the agent maps the user to an identity using the following steps: ■ First the agent determines whether the user has an equivalent identity on the server machine. “Setting up configuration files. users can be granted permissions through a process called Windows user mapping. This process allows a role to be mapped to a local or domain user who has permissions for a Windows server. when a user attempts to connect to an agent. For more information on securing communication between all components of a BMC BladeLogic system. and write files) as long as those hosts are running RSCD agents. For more information on Windows user mapping. but they require additional configuration. However. but that requires modification of the configuration files. the connecting user is granted the permissions of that equivalent user.

Tools for managing BMC BladeLogic data BMC BladeLogic provides a suite of tools for managing data in the BMC BladeLogic system and controlling its growth where necessary. An Application Server cache clean-up utility. See the BMC BladeLogic Server Automation Installation Guide for a list of the platforms for which BMC BladeLogic provides Perl support. the Perl module is automatically installed. A repeater server clean-up utility. These tools include: ■ A database clean-up utility (cleanupDatabase) to minimize the amount of space taken up by unused data in the BMC BladeLogic database. You can delete these files by using the repeater server clean-up utility. You can use this utility to delete old files that accumulate on target servers (agents) from Deploy Jobs. The BMC BladeLogic file server clean-up utility. objects marked for deletion with the retention policy utility. Data from Deploy Jobs can also accumulate in the staging directory on repeater servers.” 18 BMC BladeLogic Server Automation Administration Guide . A target server clean-up utility. This utility deletes from the database objects users have deleted in the BMC BladeLogic Console. audit results. you must configure the Application Server so it knows the location of Perl. You can use this utility to delete old temporary files in the Application Server cache (directory). and historical data such as old audit trail entries. ■ ■ ■ ■ For more information on these tools. If you are using Perl in conjunction with the BMC BladeLogic Console. “Managing BMC BladeLogic data. These tools let you delete unused data or data no longer needed for BMC BladeLogic operations. snapshot results and compliance results.Tools for managing BMC BladeLogic data When you install Network Shell on a platform that can support a BMC BladeLogic Application Server. see Chapter 6. You can use this utility to delete unused files from the file server. as described in “Configuring Perl” on page 77.

1 In the BMC BladeLogic Console. (The Select Application Servers dialog lists only Application Servers configured to use the same database and file server and that are currently accessible. select the Application Servers from which you want to collect data. ■ ■ ■ Generating data for support The Generate Support Data tool generates data about the Application Servers and other components in the BMC BladeLogic environment and packages that data into a zip file. 3 Select the data you want to include in the zip file. Accept the default selection (the Application Server to which you are connected) or click the Browse button (three dots) and select one or more Application Servers from the Select Application Servers dialog. use Shift + Click or Ctrl + Click. Database Diagnostics — Run predefined tests from the command line that evaluate the status of the BMC BladeLogic database and identifies potential issues.Read authorization. select Configuration => Generate Support Data. Application Server Diagnostics — Runs predefined tests that evaluate the status of the BMC BladeLogic environment while it is running and identifies problems. your role must be granted the BL_Administration.Troubleshooting tools Troubleshooting tools BMC BladeLogic provides several tools that you can use to collect data for diagnosing issues and working with Customer Support: ■ Generate Support Data — Generates data about Application Servers and other components of the BMC BladeLogic environment and packages that data into a zip file. This data can be useful for diagnostic purposes when you contact Customer Support. Click Select All or click the data types you want. 2 In the Generate Support Data dialog. NOTE To use the Support Data Generation tool.) To select multiple Application Servers. DEBUG_MODE_ENABLED job property . Chapter 2 Overview of BMC BladeLogic Server Automation 19 .provides additional diagnostic information to the job log.

All transaction logs for target servers that failed to execute the specified Deploy Job run. The file’s name is System Properties. if any. Security files included are: ■ ■ ■ ■ ■ System Properties table Agent log Secure Exports Users User. A “rolled-over” log file is one that is generated after a preset size has been reached for the currently active log file. or a Smart Group of servers. the Secure file is included. When the log file reaches that size. or a Smart Group of servers. A file containing the current contents of the SYSTEM_PROPERTY table in the database to which the Application Server is connected. all security files are included. A file containing all status information for the Application Server. If an Agent resides on the Application Server. Click Deploy Job Logs and use the Browse button (three dots) to select one or more jobs.txt. (This information is the same as that generated by the Export Detail Report operation in the Infrastructure Management window. Application Server Deployment files Application Server status The entire deployment directory for the specified Application Servers. 20 BMC BladeLogic Server Automation Administration Guide . Console log The current console log.Generating data for support This selection: Includes: Application Server log The currently active Application Server log. You can also include console logs that have been rolled over. At a minimum. group of servers. For example.log file. Click Agent Log and use the Browse button (three dots) to select a server. a new log file is automatically created (appserver.) The file’s name is StatusReport. You can also include Agent logs that have been rolled over.log. Agent Security Files The current security files from one or more Agents. suppose you set the size to 20 MB for the appserver.1).local home Application Server Security Files Deploy Job Target Logs (Failed Targets Only) Security files from the Application Server. You can also include Application Server logs that have been rolled over. Click Agent Security Files and use the Browse button (three dots) to select a server. group of servers.txt. The log from one or more Agents.

your role must be granted the BL_Administration. suppose you selected configserver1 and appserver1 and specified data_10_08. compare the data to expected behavior. 7 Click Save. Monitoring and diagnosing issues in the BMC BladeLogic environment Application Server Diagnostics The Application Server Diagnostics tool provides tests that can be helpful for monitoring the status of your BMC BladeLogic environment and for working with Customer Support to identify and resolve issues. These predefined tests collect data on the status of the BMC BladeLogic environment while it is running.Monitoring and diagnosing issues in the BMC BladeLogic environment This selection: PXE Server Files Includes: Information about the PXE server and the services it runs.) A file of information about network configuration and status for each Application Server.zip as the file name. the zip file for each has a name based on the file name you specified plus the Application Server name. For each Application Server you selected.txt.zip and data_10_08-appserver1. BMC BladeLogic generates the data and creates a zip file. and analyze it to determine test success or failure.Read authorization. (This information is the same as that reported in the Infrastructure Management window. The file’s name is NetworkInformationReport. The zip files created would have the names: data_10_08configserver1.zip. Chapter 2 Overview of BMC BladeLogic Server Automation 21 . If you selected multiple Application Servers. 6 In the Object Name field. Network Information 4 Click Generate Data. 5 Specify a path to the location where you want to store the zip file. For example. type a name for the zip file. NOTE To use the Support Data Generation tool.

■ 22 BMC BladeLogic Server Automation Administration Guide . including parallel execution. Checks whether the bladelogic. The Select Application Servers dialog lists Application Servers configured to use the same database and file server. For example. Tests the Application Server’s deployment to determine if the Application Server has been properly configured Database Diagnostic Test Environment KeyStore Test File Manager Diagnostic Test Pseudo Job Diagnostic Test Service Deployment Diagnostic Test Accept the tests listed in the Application Server Diagnostics area or refine the list in one of the following ways: ■ Select one or more tests from the Application Server Diagnostics area.Tests are grouped by the type of evaluation they do. Tests the job framework. Tests the Application Server’s connectivity with the File Server. 3 The Application Server Diagnostics area lists the tests to be run. Tests the job execution framework.keystore files are properly synchronized between the various deployments (each deployment has its own keystore file). they do not need to be running on the same host. using a job created for test purposes. Tests the Application Server’s connectivity with the database and executes test queries. using a job created for test purposes. Selecting a test group lists those tests in the Application Server Diagnostics area. select the Application Servers from which you want to collect data.) Select a group of tests from the Diagnostic Group drop-down menu. You can select one or more tests from the list. 2 In the Application Server Diagnostics view. Test AppServer Test BlExec Job Diagnostic Test Description Tests the Application Server’s configuration connectivity with other Application Servers. selecting the Configuration test group runs both the AppServer Test and the Service Deployment Test. however. select Configuration => Application Server Diagnostics View. Accept the default selection (the Application Server to which you are connected) or click Browse and select one or more Application Servers.Monitoring and diagnosing issues in the BMC BladeLogic environment 1 In the BMC BladeLogic Console. (Use Shift + click or Ctrl + click to select multiple tests. both of which test the Application Server configuration.

NSH/bin folder. NOTE The warning messages displayed for any of the DB diagnostics are in most cases an indication that the system needs to be tuned with the recommended values suggested for optimum performance of the product. Lists only the ID. Then click the Test Output. Lists all diagnostics with full details (for example.. 5 In the Application Server Diagnostics area. run dbdiagnostics list to determine the ID for each specific diagnostic test. and description for all diagnostics. the Status column shows an icon that indicates the success or failure of each test. 6 On the Diagnostic Results dialog. 2 From the . Or click Run Selected Tests to run only the tests you selected in that area. Table 1 Parameter help list listFull Parameters for the DBdiagnostic command (part 1 of 2) Description Displays the help for the command. execute either dbdiagnostic. Chapter 2 Overview of BMC BladeLogic Server Automation 23 . name. click Close. Database Diagnostics The Database Diagnostics tool provides tests that can be helpful for monitoring the status of the database and for working with Customer Support to identify and resolve issues. Select a test and click the View Results icon to show detailed test results. Log. or Failure Advice tab. which are listed in the BMC BladeLogic Server Automation Installation Guide. select the Application Server for which you want to display test results.. the parameters and their children). Consult with your DBA to see whether these recommendations can be applied. To run the Database Diagnostics tool 1 On the BMC BladeLogic Application Server.sh with any of the parameters shown in Table 1. For the diagId argument used by some of the parameters.Monitoring and diagnosing issues in the BMC BladeLogic environment 4 Click Run All Tests to run all tests listed in the Application Server Diagnostics area. 7 When you are finished viewing test results.exe or dbdiagnostic. open a shell (in Linux) or a command prompt (in Microsoft Windows). These predefined tests collect data on the configuration of the BMC BladeLogic database and provide feedback.

To run a diagnostic test. first obtain the list of IDs by running dbdiagnostics list and then use the ID of the particular diagnostic that you want to run as input to the utility. 24 BMC BladeLogic Server Automation Administration Guide . such as statistics on the last execution of the diagnostic. delAllRes runDiag Deletes all results for all diagnostics. IDs for the diagnostics Each diagnostic test has an associated ID. delRes diagId=diagId Delete the results for a specific diagnostic.Monitoring and diagnosing issues in the BMC BladeLogic environment Table 1 Parameter getDiag Parameters for the DBdiagnostic command (part 2 of 2) Description diagId=diagId Displays information for a specific diagnostic. You can find the list of parameters for a diagnostic by running the diagnostic with the getDiagParams parameter followed by the diagId. diagId=<diagId> optName1=val1 optName2=val2 Runs a specific diagnostic using optional parameters. NOTE The Top_N_tables_chk and JRE_Row_Count_Chk diagnostic tests apply to both Oracle and SQL Server databases. and the parameters used for that run. getDiagParams diagId=diagId Displays the parameters for a diagnostic. getResLastExec diagId=diagId Displays the results for the last execution for a specific diagnostic. The remaining tests apply to Oracle databases only. Table 2 on page 25 shows example IDs for each of the diagnostic tests available with the dbdiagnostics tool. the status of the run. getResAfterDate diagId=diagId afterDate=MM-dd-yy[yy] (you can enter a two or four digit year) Displays all of the results for diagnostics recorded on or after the specified date starting at 00:00:00 AM. Note that these IDs are not fixed and can be different in different environments.

1000004 TOP_N_TABLES_CHK Checks the data volumes/sizes of the top N tables.Monitoring and diagnosing issues in the BMC BladeLogic environment Table 2 ID 1000000 Diagnostic names and description Diagnostic name and description ORACLE CHECK BLOCK SIZE Checks the Oracle block size and provides advice. 1000005 JRE_ROW_COUNT_CHK Checks the job_run table and returns the record with the largest number of events. see the “Before you install” chapter of the BMC BladeLogic Server Automation Installation Guide Example syntax and output The following example shows the command format you would use to run the ORACLE CHECK BLOCK SIZE diagnostic. which displays the results of the last execution for this diagnostic (shown in Figure 2). 1000001 ORACLE CHECK NUMBER PROCESSES ALLOWED Checks the number of Oracle processes and provides advice. For a description of how to use this diagnostic to verify that Schema statistics are current. Chapter 2 Overview of BMC BladeLogic Server Automation 25 . and recommends remediation if the statistics are not current. 1000003 ORACLE OPTIMIZER SETTINGS CHK Checks the Oracle optimizer settings. dbdiagnostics runDiag diagId=1000000 Figure 1 output from the command You can then view the results of the diagnostic by running the command with the getResLastExec parameter. 1000006 DBMS_STATS_CHK Checks to see if the Schema statistics are current (based on a user-supplied expiration). while Figure 1 shows the output returned from the command.

— In the Properties tab. you can use the DEBUG_MODE_ENABLED job property to provide additional diagnostic information to the job log. Select DEBUG_MODE_ENABLED from the Name drop-down list. as running the job in debug mode does have a negative impact on performance. 2 Do one of the following: — Right-click the job and select Set Property. select DEBUG_MODE_ENABLED from the Extended properties list. NOTE Be sure to set the DEBUG_MODE_ENABLED property back to FALSE when not diagnosing an issue. 4 Click OK. messageTime=2010-03-22 12:47:03. select a job.Monitoring and diagnosing issues in the BMC BladeLogic environment dbdiagnostics getResLastExec diagId=1000000 Figure 2 Sample output for ORACLE CHECK BLOCK SIZE diagnostic diagId=1000000 execDiagId=2000002 execStartTime=2010-03-22 12:47:02. To set the DEBUG_MODE_ENABLED job property 1 In the Jobs folder. The Set Job Properties window is displayed. 26 BMC BladeLogic Server Automation Administration Guide . The default value for the DEBUG_MODE_ENABLED property is FALSE.0 messageLevel=INFO message=ORACLE CHECK BLOCK SIZE: Block size on the Database is 8192.0 Running a job in debug mode If you are experiencing issues with job execution. The additional level of logging provides you or BMC Software Customer Support representatives with more detailed information when diagnosing issues with job execution. which is large enough. 3 Set the property value to TRUE.

or All. Click the Up arrow or the Down arrow to scroll through messages one by one.0. right-click the job or Execution Task and select Show Results to display its job runs. By default. right-click.00/NSH/br/appserver. 2 Select a run of a job. and select Show Log. 4 To display messages in a dialog that allows you to scroll through messages one by one.Monitoring and diagnosing issues in the BMC BladeLogic environment To view the job log 1 Open the Jobs folder. 3 To filter messages so the job log only shows servers with specific job results. Click Close to close the dialog.log If you are running a multiple Application Server environment.0. see “Considerations for troubleshooting jobs in a MAS environment” on page 57. The Log Item Details dialog opens. You can also review the log file on the Application Server for the additional diagnostic information. 5 Click Close to close the log messages window. the Application Server log file is located in: UNIX /opt/bmc/BladeLogic/8. Warnings. Success.00\NSH\br/appserver. use the Run Details drop-down to select Errors. navigate to a job or Execution Task. double-click on a message. A window displays log messages generated by the job.log Windows installationDirectory\BladeLogic\8. Chapter 2 Overview of BMC BladeLogic Server Automation 27 .

Monitoring and diagnosing issues in the BMC BladeLogic environment 28 BMC BladeLogic Server Automation Administration Guide .

you use the PostInstall Configuration wizard to perform the initial configuration of the Application Server. With this basic configuration. see “Using the application server configuration wizard to change configuration settings” on page 39. NOTE The Application Server and the RCP client (BMC BladeLogic console) must be located on the same Local Area Network (LAN). Controlling communication between clients and servers as well as access to database. For information.Chapter 3 3 Configuring the Application Server The core of the three-tier architecture in BMC BladeLogic is the Application Server. There are two general configurations for Application Servers in the BMC BladeLogic environment: ■ Single (Default) Application Server on the Host This configuration is the most common one and can be performed as a last step in the installation of an Application Server. During installation. the Application Server can be adjusted to scale a system and to fine tune its performance. Chapter 3 Configuring the Application Server 29 . Remote users can use the console through either RDP or Citrix from a remote machine to the machine where the console resides. file. See “Using the Post-Install Configuration wizard to configure the default application server” on page 34. and mail servers. Use the following tools to make configuration changes: ■ To make changes to basic configuration settings at a later time. you can run the Application Server Configuration wizard. See “Configuring multiple Application Servers on the same host” on page 93. you can start the Application Server and then fine-tune it as needed. ■ Multiple Application Servers on the Same Host This configuration lets you add multiple Application Servers to the host and configure them to perform one or more functions.

the Application Server picks a worker thread from the pool to execute that task. Process spawning is primarily used for Network Shell Script Jobs and some types of extended objects. which launches new processes external to the Application Server process. which is a command line utility that allows you to set all parameters used by the Application Server. For information. See “Configuring the process spawner” on page 79 for more on configuration. When a client requests any type of activity. the BMC BladeLogic Application Server runs as two distinct processes. So is the number of open client connections. and you can also use it to set other more complex configuration options. BMC BladeLogic calls these worker threads. Spawning processes externally to the Application Server can be beneficial for memory management.Understanding the application server ■ BMC BladeLogic provides a utility called the Application Server Administration console. use the Infrastructure Management window. See “Scaling the Application Server” on page 52 for more on configuration. 30 BMC BladeLogic Server Automation Administration Guide . the Application Server maintains a pool of threads that can be used for processing client activity. you can configure the Application Server so the process spawner does not run as an external process. the worker thread is returned to the pool. When the request is complete. One process runs the core functionality of the Application Server. ■ Understanding the application server Application server processes The BMC BladeLogic Application Server is designed to process connections from many clients simultaneously. For information. If you prefer. The Application Server Administration console lets you set the same parameters as those available in the Post-Install Configuration wizard.) Typically. To manage multiple Application Servers on the host or change their configurations. the Application Server can handle many more client connections than it has worker threads. The other process is a process spawner. see “Using the Application Server Administration console (blasadmin) to configure Application Servers” on page 44. Using this approach. see “Managing multiple Application Servers on the same host” on page 109. (The number of worker threads in the pool is configurable. Rather than dedicating a thread to each client connection.

but there are exceptions to this rule. all jobs can begin processing as soon as a work item thread becomes available. when a work item thread becomes available. In this case. it is assigned to the first job in the queue of pending jobs. For most job types. the number of job parts equals the number of target servers. When allocating work item threads. When the next work item thread becomes available.) When a job comes due. After initiating a job in this way. When an Application Server is running multiple jobs. In addition. the job execution thread loads the job and allocates work item threads. With this system. (For a description of how multiple Application Servers can process jobs cooperatively.) The number of work item threads needed for any job varies by job type. see the BMC BladeLogic Server Automation User Guide. The job execution thread constantly watches for scheduled jobs. the Application Server assigns equal preference to all pending jobs. and so forth. see “Scaling the Application Server” on page 52. see “Job distribution” on page 32. starting with the first job in the queue. Then the cycle of allocating work item threads begins again. All jobs require one work item thread for pre-execution and another for post-execution. the job execution thread continues to watch for other scheduled jobs. For more information on specifying the number of available work item threads. it is assigned to the second job in the queue.Work item threads and the job execution thread Work item threads and the job execution thread A single Application Server processes BMC BladeLogic jobs using one job execution thread and a configurable number of work item threads. one work item thread is required to execute each part of the job. until a work item thread has been assigned to all jobs in the queue. jobs with fewer job parts may complete sooner than jobs with many job parts. Deploy Jobs can optionally utilize a special pool of lightweight work item threads used only for processing Deploy Job phases that access target servers. However. which perform all work required for that job. Chapter 3 Configuring the Application Server 31 . For a description of how jobs are divided into job parts. a sufficient number of work item threads may not be available for simultaneously processing all jobs. (Note that a job set to run immediately is considered a scheduled job. The next work item thread goes to the third job in the queue.

Application Servers are configured to cooperate when executing jobs. For more information on configuring cooperation between Application Servers. Using additional Application Servers increases the job execution capacity of the system and in most cases speeds overall job processing. When multiple Application Servers are configured to execute jobs. If this attribute is set to False. local work item threads on an Application Server will process all work items for a job before those work items can be distributed to other Application Servers. scheduled jobs are delegated to the first Application Server that requests a job. only one Application Server manages each individual job. if a BMC BladeLogic installation consists of two Application Servers that are both configured to run the same maximum number of jobs. the Application Server will distribute work items to other Application Servers that have idle work item threads. (That maximum number can be configured. This work item sharing capability is controlled by the MultiAppServerEnabled attribute (which is set to true. By default. provided that the Application Server making the request is not already executing the maximum number of jobs that it can run simultaneously. Application Servers make an effort to distribute work items to each other to increase the number of concurrently executing work items and shorten overall execution time.Job distribution Job distribution If you have multiple Application Servers installed and they all access the same database. each Application Server will be given the same number of jobs to run (assuming there are an even number of jobs to execute). Best Practice: Do not mix-and-match the value of the MultiAppServerEnabled attribute between Application Servers. those Application Servers can cooperate by distributing jobs to balance their processing workloads. by default) in the Application Server’s profile. if all local work item threads are already processing work items. Generally. Typically. or all Application Servers should have the attribute set to False. Although work for an individual job can be spread among multiple Application Servers. the number of work items processed during a job run directly corresponds to the number of target servers for the job.) For example. NOTE You cannot enable or disable work item sharing at the job type level. see “Setting up job distribution between multiple Application Servers” on page 55. However. all Application Servers should have this attribute set to True. During job execution. work items are not shared to or from that Application Server. 32 BMC BladeLogic Server Automation Administration Guide .

the thread attempts to trim the number of database connections back to the low boundary. If authentication succeeds. Based on the authentication protocol. Chapter 3 Configuring the Application Server 33 . When the database activity is complete. For more information. Application Service—An entity that encapsulates the functionality of a BMC BladeLogic Application Server. That framework is based on three services: ■ Authentication Service—An entity dedicated to authenticating users by means of all supported authentication protocols. the database connection is returned to its pool. A thread watches the pool of database connections. You can configure the high and low boundaries to accommodate user needs. ensuring that the number of connections stays within high and low boundaries.Pooled database connections Pooled database connections The BMC BladeLogic Application Server maintains two different pools of database connections—one is used for processing jobs running the BMC BladeLogic Console and the other is used for processing all other activity. The client application can then initiate a session by presenting the session credential to an Application Service or Network Shell Proxy Service. it acquires one from the appropriate pool of database connections. the Authentication Service uses the appropriate mechanism to authenticate that user. such as client connections. the Authentication Service issues a session credential to the client application. see “Setting the number of database connections” on page 64. A Network Shell Proxy Service can be located on the same host. Authentication framework A BMC BladeLogic Application Server employs a unified framework for processing all user authentication requests. ■ ■ The Authentication Service and the Application Service are always located on the same host. If the number of database connections reaches the high boundary. or it can be set up on a stand-alone machine even though it is still associated with an Application Server. Network Shell Proxy Service—An entity that encapsulates the functionality of a Network Shell Proxy Server. the client contacts the Authentication Service using any supported authentication protocol. When a worker thread or a work item thread needs a database connection. When users on a BMC BladeLogic client application (except BMC BladeLogic Decision Support for Server Automation) want to authenticate.

stop. Although the BMC BladeLogic Application Server Administration console provides commandline mechanisms for configuring all possible Application Server options. The BMC BladeLogic environment supports one Application Server Launcher per host. remove and redeploy) each additional Application Server on the host. only a few must be set to make a BMC BladeLogic system functional. See “Configuring multiple Application Servers on the same host” on page 93. stops. and restarts the Application Server Launcher. including a description of how BMC BladeLogic Decision Support for Server Automation authenticates users.The Application Server Launcher For more information on authentication and other security features. Using the Post-Install Configuration wizard to configure the default application server The BMC BladeLogic Post-Install Configuration wizard consolidates the minimum configuration steps that must be performed to set up an Application Server. “Administering security. see Chapter 4. the configuration wizard allows you to set the following configuration options: ■ Database connection parameters—The BMC BladeLogic Console works in conjunction with an Oracle or SQL Server database server in its middle tier. Starting. terminate. 34 BMC BladeLogic Server Automation Administration Guide . restart. The Post-Install Configuration wizard presents those essential tasks in a graphical user interface and provides explanatory information for each step in the process. The Application Server Launcher must be running on the host in order for you to perform these operations. and restarting the Application Server on the host also starts. Available for both Windows and UNIX-style installations. It is so called because it launches (starts) and controls these additional Application Servers. stopping. Use the configuration wizard to configure your database connection.” The Application Server Launcher An Application Server Launcher is a mechanism for configuring and controlling multiple Application Servers on the same host. The Application Server Launcher lets you configure and manage (start. Installing the Application Server on a host also installs the Application Server Launcher.

and the SNMP destination to which all SNMP traps are sent. — On a Windows system. ■ 1 To start the Post-Install Configuration wizard. Use the configuration wizard to provide SRP passwords for the RBACAdmin and BLAdmin users. Network Shell scripts. The BLAdmin user has Read access for all system objects within the BMC BladeLogic Console. enter the following: ■ ■ Chapter 3 Configuring the Application Server 35 . Obtain the necessary connection information and run the PostInstall Configuration wizard again to complete your system configuration. Use the configuration wizard to identify an SMTP server. and other types of information that is not easily stored in a database. The installation program gives you the option of launching the wizard at the end of the installation procedure. If you are running the Post-Install Configuration wizard on UNIX. Windows installables. do one of the following: ■ Perform an installation that includes installation of the Application Server. From the Windows Start menu. select Programs => BMC Software => BladeLogic Server Automation Suite => Utilities => Application Server Configuration Wizard. the address from which the notification emails originate. you cannot configure the Application Server. Super-user passwords—The BMC BladeLogic Console provides several predefined users. ■ ■ NOTE Be aware of the following: ■ If your database is not set up or you do not currently have the information needed to establish a connection to that database. The RBACAdmin user has full permission to manage roles and users in the RBAC Manager workspace in the BMC BladeLogic Console. BLPackages. Click Cancel to close the wizard. Start the wizard manually by running one of the following commands in the directory where BMC BladeLogic is installed. Notification servers—The BMC BladeLogic Console optionally generates email and SNMP traps that send notifications when a job completes. where you can assign permissions for all users. the OS-specific x11 libraries must be installed. Use the configuration wizard to identify the file server and a directory within the file server.Using the Post-Install Configuration wizard to configure the default application server ■ File server—The BMC BladeLogic Console uses a file server to store large snapshots of files.

Database Port—Port the database listens on./br/blappconf NOTE If you invoke the wizard without passing the -install flag.) SID—System ID of the Oracle database. 2 Read the introductory page and click Next. The configuration wizard opens. (This option is only available for Oracle databases. 3 Choose a Database Type—either Oracle or SQL Server. the wizard will display configuration settings that have already been entered for the Application Server and allow you to change those settings. provide the following database configuration information: 36 BMC BladeLogic Server Automation Administration Guide . By default the database name is bladelogic.. or. (This option is only available for SQL Server databases..Using the Post-Install Configuration wizard to configure the default application server \bin\ blappconf. The Database page displays. By default a BMC BladeLogic installation uses the following database ports: Database Type Oracle SQL Server Port Number 1521 1433 Database Name—SQL Server database name. If you are using a custom connection string. 4 If you are not using a custom connection string.) User ID—User name that the database needs to authenticate your connection. provide the following database configuration information (and do not select the Advanced option): Database Server—Server running the database.exe — On a UNIX-style system. enter the following: . Password—Password assigned to the user ID.

Using the Post-Install Configuration wizard to configure the default application server User ID—User name that the database needs to authenticate your connection. non-redundant. File Server Storage Location—Directory on the file server where data is stored. create an entry like the following in the users. disk space. and all users must be mapped to that user. ■ The internal System:System role/user must be mapped to the user name defined on the file server. as a minimum. 5 Click Next. By default. A user name must be defined on the file server. All users need to be mapped to the same user on the file server. 72 GB of available. Connection String—Type the custom connection string in the field below the Advanced checkbox. The File Server page displays. Advanced—Select this option to indicate that you are providing a custom connection string.local file on the file server: Chapter 3 Configuring the Application Server 37 . ■ A file server must have. the directory of the file server is appserverInstallDirectory/storage. One way to accomplish the necessary mapping is to create an entry like the following in the exports file on the file server: appServer rw. Without this mapping a user may not be able to access a file that another user has stored on the file server. the file server is created on the same machine as the Application Server. To accomplish the mapping. 6 Provide the following file server configuration information: File Server Name—Name of the server where data is stored. By default. A file server should meet the following requirements: ■ An RSCD agent must be installed and licensed. NOTE Do not limit access to the file server by pushing agent ACLs to the agent on the file server. BMC BladeLogic recommends that the file server have 200 GB or more of available RAID 5 disk space. Password—Password assigned to the user ID.user=userName ■ where appServer is a comma-separated list of Application Server names or IP addresses and userName is the name to which all users are mapped.

If the required directory structure does not already exist on the file server. SNMP Port—The port on the SNMP server that listens for SNMP traps. 8 Provide information identifying an email server by entering the following under SMTP Options: SMTP Server—Name or IP address of the host managing email.Using the Post-Install Configuration wizard to configure the default application server System:System rw. 38 BMC BladeLogic Server Automation Administration Guide . BMC BladeLogic jobs can generate email upon their completion. The Notification Servers page displays. 11 Under both RBACAdmin User and BLAdmin User. typically bladmin or administrator. Passwords are used to authenticate the RBACAdmin and BLAdmin users via the SRP authentication protocol. The RBACAdmin user has full permission to manage roles and users in the RBAC Manager workspace in the BMC BladeLogic Console. 12 Click Finish. 9 If you are using SNMP trap notifications. 7 Click Next. enter a password and then retype the password to confirm your entry. the process will attempt to create it. where you can assign permissions for all BMC BladeLogic users. For more information on the RBACAdmin and BLAdmin users. By default the port is set to the standard SNMP port of 162. 10 Click Next. The BLAdmin user has Read access for all system objects within BMC BladeLogic.user=userName where userName is the name to which all users are mapped.) Email From—Email address from which BMC BladeLogic-generated email is sent. see the BMC BladeLogic Server Automation User Guide. You will not be able to enter a password if a password has already been set. (SMTP stands for simple mail transfer protocol. The User Passwords page displays. provide information identifying the SNMP server by entering the following under SNMP Options: SNMP Server—Name or IP address of the host to which SNMP traps should be sent.

To change. Clocks should be synchronized to the minute. the clock on client machines in San Francisco should be set to 4:04. This wizard presents the same information as the Post-Installation Configuration wizard. Attributes (configuration settings) specified The Infrastructure Management window. See “Using the Application Server Administration console (blasadmin) to configure Application Servers” on page 44.. see “Using the application server configuration wizard to change configuration settings” on page 39. You can also use the Application Server Administration console (blasadmin) to change these settings. For example.. host) Using the application server configuration wizard to change configuration settings To change configuration settings on an Application Server. you can use the Application Server Configuration wizard (blappconf).. if an Application Server is in Boston. The Application Server Configuration wizard. For information. Database connection File server Notification servers Most configuration settings or to set additional configuration parameters on an Application Server The Application Server Administration console (blasadmin).Changing the configuration of an application server NOTE BMC BladeLogic recommends that you synchronize the clock on the Application Server and all client machines. Which tool you use depends on the settings you want to change. See in an Application Server’s profile (when there “Viewing and editing an Application Server’s are multiple Application Servers on the same profile” on page 100. where the time is 7:04.. Initial (post-installation) configuration settings for the Application Server: ■ ■ ■ You can use. Chapter 3 Configuring the Application Server 39 . Changing the configuration of an application server There are three tools you can use to change an Application Server’s configuration. except that it is in a tabbed format and shows current settings in the text boxes.

use one of the following methods: — From the Windows Start menu. select Programs => BMC Software => BladeLogic Server Automation Suite => Utilities => Application Server Configuration Wizard. enter the following: \bin\blappconf — On a UNIX-style system./br/blappconf. — From the directory where BMC BladeLogic is installed.Using the application server configuration wizard to change configuration settings You can change the following settings: ■ Database connection parameters File server name and storage location Notification servers — SMTP server and email address from which notification emails originate and SNMP server and port to which SNMP traps are sent ■ ■ NOTE After super-user passwords are set in the Post-Installation Configuration wizard. You must use the RBAC Administration tool. from the directory where BMC BladeLogic is installed. For example: blappconf -s JobServer1 40 BMC BladeLogic Server Automation Administration Guide . you cannot use the Application Server Configuration wizard to change them. 1 Start the Application Server Configuration wizard: ■ To change the configuration of the default Application Server. enter the following: \bin\blappconf -s applicationServerName Where applicationServerName is the name of the Application Server you want to change. enter the following: .exe ■ To change the configuration of a specific Application Server when there are multiple Application Servers on the same host.

Double-click Administrative Tools. changes affect only the default deployment. Starting Application Servers There are two methods for starting Application Servers. ■ Starting all Application Servers on the host This operation starts all Application Servers on the host.d/blappserv start ■ Chapter 3 Configuring the Application Server 41 . changes affect the specified deployment. Right-click BladeLogic Application Server and select Start from the pop-up menu.Starting Application Servers NOTE If you specify blappconf -s. If you specify blappconf with no -s option. See “Starting a specific Application Server” on page 109. 4 Restart the Application Server. Make changes you want. On a UNIX-style system. from the directory where BMC BladeLogic is installed. The method you use depends on the Application Servers you want to start: ■ To start all Application Servers on the host. and double-click Services. Application Servers created on the host in the future will not have the changes. whether a single (default) Application Server or multiple Application Servers. from the Start menu. select Settings => Control Panel. To start all Application Servers on the host. whether a single (default) Application Server or multiple Application Servers. use the Infrastructure Management window. 3 Click OK. To have changes affect future Application Servers. enter the following: /etc/init. To start a specific Application Server (when additional Application Servers are configured on the host). do one of the following: ■ On Windows. use this command to configure the template deployment: blappconf -s _template 2 The Application Server Configuration wizard appears. see “Starting all Application Servers on the host”.

select Settings= > Control Panel. whether a single (default) Application Server or multiple Application Servers. To use this stop method. and double-click Services. the default Application Server must already be started. use the Infrastructure Management window. The method you use depends on the Application Servers you want to stop: ■ To stop all Application Servers on the host.Restarting Application Servers Restarting Application Servers There are two methods for restarting Application Servers. See “Restarting a specific Application Server” on page 111. see “Stopping all Application Servers on the host” on page 43. ■ 42 BMC BladeLogic Server Automation Administration Guide . enter the following: /etc/init. ■ Restarting all Application Servers on the host This operation restarts all Application Servers on the host. whether a single (default) Application Server or multiple Application Servers. Double-click Administrative Tools. The method you use depends on the Application Servers you want to restart: ■ To restart all Application Servers on the host. see “Restarting all Application Servers on the host”. whether a single (default) Application Server or multiple Application Servers. To use this restart operation. from the Start menu. the default Application Server must already be started. Do one of the following: ■ On Windows. To stop a specific Application Server (when additional Application Servers are configured on the host). Right-click BladeLogic Application Server and select Restart from the pop-up menu. See “Stopping a specific Application Server” on page 109.d/blappserv restart ■ Stopping Application Servers There are two methods for stopping Application Servers. To restart a specific Application Server (when additional Application Servers are configured on the host). On a UNIX-style system. use the Infrastructure Management window.

resume.d/blappserv stop ■ ■ Shutting down Application Servers gracefully The BLCLI provides commands that allow you to shut down an Application Server after all jobs running on it have completed or after a specified period of time has elapsed. To stop all Application Servers on the host. pause. or resume a specific Application Server or all Application Servers on the host. From the Windows Start menu. select Settings => Control Panel. NOTE You can also use the Infrastructure Management window to gracefully shut down a specific Application Server (when multiple Application Servers are configured on the host).Stopping all Application Servers on the host Stopping all Application Servers on the host Performing this procedure immediately stops all Application Servers on the host. Double-click Administrative Tools. enter the following: /etc/init. The BLCLI provides commands that allow you to shut down Application Servers more gracefully (see “Shutting down Application Servers gracefully”). See the BLCLI Help for specific information on AppServerShutdown. On a UNIX-style system. Right-click BladeLogic Application Server and select Stop from the pop-up menu. See “Stopping a specific Application Server” on page 109. or shut down an Application Server When you pause an Application Server. You can also use related commands to pause an Application Server while it processes all active jobs or resume service after you have paused the Application Server. What happens when you pause. the following occurs: ■ The job execution thread on the Application Server no longer processes newly scheduled jobs. even though they may be currently processing jobs. and double-click Services. You can use these commands to shut down. These commands are available in the AppServerShutdown name space of the BLCLI. Chapter 3 Configuring the Application Server 43 . do one of the following: ■ From the Windows command line window where the Application Server is running. enter Control-C.

Using the Application Server Administration console (blasadmin) to configure Application Servers ■ The Application Server is temporarily set so other Application Servers cannot distribute jobs to it. database. the Authentication Service. as described above. ■ ■ NOTE When you pause an Application Server. file. versus the subset you can configure with the Post-Install Configuration Wizard. The blasadmin utility lets you configure all parameters. mail. you essentially undo the actions listed above. the Application Server continues to give out work item threads to other Application Servers. When you use AppServerShutdown commands to shut down an Application Server. the Application Server’s job framework is paused. it continues to process all of its current work items. and SNMP servers. This section provides procedures to control all aspects of the Application Server’s behavior. The Application Server is temporarily set so it can no longer request work item threads from other Application Servers. To expedite the processing of any currently active jobs. These parameters define the location and behavior of the application. When all jobs and work items have completed or a specified period of time has elapsed. Using the Application Server Administration console (blasadmin) to configure Application Servers The BMC BladeLogic Application Server Administration console (blasadmin) is a command line utility that lets you set parameters needed for an Application Server. if requested. 44 BMC BladeLogic Server Automation Administration Guide . When you instruct a paused Application Server to resume work. the Application Server will not appear to be paused until all of those work items are complete. the shutdown sequence begins. The job execution thread can again process scheduled jobs and the Application Server can request work item threads from other Application Servers. and other components of an Application Server. If any of those work items take a long time to finish.

How you start this utility determines the Application Server configuration affected by the commands. do one of the following: ■ On Windows. Starting blasadmin to Configure the Default Application Server To start the Application Server Administration console when there is a single Application Server on the host. 2 At the prompt. do one of the following: — From the Start menu.exe Chapter 3 Configuring the Application Server 45 . For example. enter the commands.Starting the Application Server Administration console To configure Application Servers with the Application Server Administration Console (blasadmin): 1 Start the Application Server Administration Console. select Programs => BMC Software => BladeLogic Server Automation Suite => Utilities => Application Server Administration. Starting the Application Server Administration console To start the Application Server Administration console. run the blasadmin command. TIP If you want to enter just one or two commands. you can both run the blasadmin utility and pass it a command at the same time. 4 Restart the Application Server to have your configuration settings take effect. enter the following: \bin\blasadmin. see: ■ ■ ■ The set Command The show Command The help Command 3 Exit the blasadmin utility. — From the directory where BMC BladeLogic is installed. For information. you can change the location of a file server (on the default Application Server) by entering the following command blasadmin set fileserver location /tmp/Storage. How you enter the command depends whether you want to configure the default Application Server or one of multiple Application Servers on the host. See “Starting the Application Server Administration console”.

Starting the Application Server Administration console

Both options run the same command.

On a UNIX-style system, from the directory where BMC BladeLogic is installed, enter the following:
./br/blasadmin

This command starts the blasadmin utility and you can use blasadmin set and show commands.

NOTE
All commands you enter during the session affect only the default Application Server. Application Servers created on the host in the future do not have the changes. To have changes affect future Application Servers, use this command to start blasadmin and configure the _template deployment: blasadmin -s _template For information on the default and _template deployments, see “Editing the list of roles with Application Server Launcher access” on page 113

Starting blasadmin when there are multiple Application Servers on the same host
If there are multiple Application Servers on the same host, you need to specify whether you want to use blasadmin to configure one specific Application Server or all Application Servers on the host. Do one of the following:

To start blasadmin and configure one specific Application Server, use:
blasadmin -s appServerName

Where: -s appServerName is the Application Server’s name. For example:
blasadmin -s OtherJobServer

This command starts the blasadmin utility and you can enter blasadmin commands. All commands you enter during the session (until you enter exit at the blasadmin prompt) affect only the Application Server you specified.

To start blasadmin and configure all Application Servers on the host, use:
blasadmin -a

46

BMC BladeLogic Server Automation Administration Guide

The set Command

This command starts the blasadmin utility and you can enter set and show commands. All commands you enter during the session affect: — All additional Application Servers configured on the same host — The _template deployment — The default Application Server For information on deployments, see “Editing the list of roles with Application Server Launcher access” on page 113.

The set Command
The set command sets the parameter to the specified value in the configuration. The setting takes effect when you restart the Application Server.The format for the set command is:
set component parameter value

Where:
■ ■ ■

component is the Application Server functionality you can configure parameter is an option that controls the Application Server behavior value is the value for the parameter

For example:
blasadmin> set fileserver name redhat1

This example sets the file server’s name to redhat1.

NOTE
When configuring settings on the Application Server, you must restart the Application Server for a setting to take effect.

TIP
When there is no ambiguity about the command you are typing, you can enter a shortened version of a command. For example, you can type set f n instead of typing set fileserver name.

Chapter 3 Configuring the Application Server

47

The show Command

The show Command
The show command shows components, parameters, and current settings for an Application Server. The format is: show [component] [component parameter] [all]
To Show Descriptions of all parameters for all components At the bladmin> prompt, enter show descriptions For example:
bladmin> show descriptions [AccountConfig] AccountLockoutDuration - How long (in minutes) to keep the account locked AccountLockoutThreshold - How many failed logins before the account is locked MaxPasswordAge - How many days before a password needs to be changed MinPasswordLength - Minimum length of password required [AgentConfig] EnableAgentRpc - Enable or disable agent RPC communication [true, false] SecureFilePath - Path to the rsc “‘secure’ file. [AppServer] AppServerName - name of application server AppSvcPort - listening port for Application service . . .

All components and parameters, plus settings for parameters that have them

show all For example:
bladmin> show all [AccountConfig] AccountLockoutDuration:0 AccountockoutThreshold:0 MaxPasswordAge:0 MinPasswordLength:0 [AgentConfig] EnableAgentRpc:false SecureFilePath: . . .

48

BMC BladeLogic Server Automation Administration Guide

The show Command

To Show

At the bladmin> prompt, enter

A component’s parameters show component (with descriptions) For example:
bladmin> show fileserver available options: [all|location|name] all - display all configuration parameters for this option location - the NSH style </c/temp> location name - the name of the fileserver

A component’s parameters show component all and settings For example:
bladmin> show snmpconfig all [SnmpConfig] SnmpPort:162 SnmpServer:

The current setting for a single parameter

show component parameter For example:
bladmin> show database MaxGeneralConnections MaxGeneralConnections:100

Chapter 3 Configuring the Application Server

49

The help Command

The help Command
The help command provides help on the set and show commands.
To get help on At the bladmin> prompt, enter

A list of components (with help set | show descriptions) you can specify with the command For example:
bladmin> help set AccountConfig - minimum password length configuration AuthServer - authorization configuration ConfigManagerUI - configuration for UI Database - the database configuration parameters . . .

All of the parameters for a help set | show component component For example:
bladmin> help set Database

A description of a parameter

help set | show component parameter For example:
bladmin> help show pxeserver listen_port the server port the PXE server listens on

Specifying multiple values for a parameter
Some Application Server parameters accept more than one value. To specify multiple values for a parameter, use a comma-separated list. For example:
blAdmin> set ManagementService EmailRecipients adA@ACo.com,adB@ACo.com

Changing the default separator for multiple values
In the blasadmin utility, the comma is the default separator for specifying multiple parameter values. If the values you want to specify include commas, you can change the separator to a different character. To change the default separator, enter the blasadmin command with the -c option.

50

BMC BladeLogic Server Automation Administration Guide

Deleting a configuration setting

blasadmin -c value_separator_character

For example, to change the value separator to a semicolon, you would enter:
blasadmin -c ;

The setting is in effect only for the blasadmin session (until you exit the blasadmin utility).

Deleting a configuration setting
You can delete a parameter value from an Application Server’s configuration. To delete the value, use the blasadmin set command and specify an empty value surrounded by quotation marks (““). For example:
blasadmin -s OtherConfigServer set AuthServer AppServiceURLs ““

This example removes the AppServiceURLs value for Application Server named OtherConfigServer.

Chapter 3 Configuring the Application Server

51

Managing Application Server behavior with the Application Server Administration console

Managing Application Server behavior with the Application Server Administration console
Using the Application Server Administration console, (the blasadmin utility) you can perform a variety of tasks to manage all aspects of Application Server behavior. The following list describes the procedures you can perform to manage the Application Server. Many of these procedure include subordinate procedures.
■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■

Configuring the Application Server Configuring the file server Configuring a mail server Configuring Perl Configuring an SNMP server Configuring a database server Configuring the process spawner Processing across mount points Restricting the size of configuration and extended objects Configuring user interface settings Setting SRP login requirements Configuring the PXE Server Configuring the Licensing Module Enabling asynchronous execution Enabling web services

Configuring the Application Server
The Application Server is the core of the middle tier in a BMC BladeLogic installation. Not only does the Application Server control communication between clients and servers, it also regulates activity between the client and the database, file, and mail servers. The Application Server provides many adjustable parameters that allow you to scale a BMC BladeLogic system to virtually any size.

Scaling the Application Server
The Application Server provides several options that you can adjust to accommodate increased activity. An Application Server should be configured so that even when all of its work item threads are busy, the Application Server still has additional resource capacity.

52

BMC BladeLogic Server Automation Administration Guide

Configuring the Application Server

1 Start the Application Server Administration console, as described in “Starting the
Application Server Administration console” on page 45.

2 To specify the maximum number of worker threads, enter the following:
set appserver maxworkerthreads #

where # is the maximum number of threads that can process requests from clients. For example, you might set this to 10, which means that only 10 client connections can be serviced at a time even though many more users might actually be connected to the Application Server. Worker threads should not be confused with work item threads, which process BMC BladeLogic Console jobs (see step 5).

3 To specify the maximum number of client connections that the Application Server
can manage, enter the following:
set appserver MaxClientContexts #

where # is the maximum number of connections to clients.

4 To specify the maximum number of jobs, enter the following:
set appserver MaxJobs #

where # is the maximum number of jobs. By controlling the number of jobs that are processed simultaneously, you can avoid overtaxing Application Server resources.

5 To specify a maximum size for the pool of threads that can be used to process BMC
BladeLogic Console jobs, enter the following:
set appserver MaxWorkItemThreads #

where # is a number of work item threads. All BMC BladeLogic jobs let you specify how many targets to process in parallel. You can set a value from 1 to 10 or allow an unlimited number of targets to be processed in parallel. The MaxWorkItemThreads and MaxLightweightWorkItemThreads (see step 6) also can control how many targets can be processed in parallel. If your system uses one Application Server, the maximum number of targets that can be processed is based on the Application Server’s available work item threads. If your system uses multiple Application Servers, the maximum number of targets that can be processed in parallel is based on the sum of all available work item threads on all Application Servers.

Chapter 3 Configuring the Application Server

53

For more on the role of work item threads. work item threads often sit idle while target servers process deployment tasks. To avoid this kind of inefficiency. An Application Server can optionally provide a secondary pool of lightweight work item threads. lightweight work item threads behave exactly like work item threads. 54 BMC BladeLogic Server Automation Administration Guide . By default this value is set to 0. 6 To specify a maximum size for the pool of lightweight work item threads that can be used for Deploy Jobs.Configuring the Application Server When processing Deploy Jobs. the Application Server can use a pool of lightweight work item threads to process phases of a Deploy Job that access target servers. Lightweight work item threads primarily perform tasks on target servers and consequently consume almost no memory on an Application Server. These threads are only used during the Simulate and Commit phases of a Deploy Job. Using lightweight work item threads helps you run more Deploy Jobs in parallel more efficiently. 7 Restart the Application Server. see “Work item threads and the job execution thread” on page 31. Other than being limited to particular types of tasks. enter the following: set appserver MaxLightweightWorkItemThreads # where # is a number of lightweight work item threads.

enter the following: set appserver ServerMonitorInterval # where # is the frequency with which an Application Server updates its own time stamp (that is. the following prerequisites must be met: ■ Each Application Server must be configured to access the same database and have the same bladelogic. To accomplish this. For information on synchronizing bladelogic.Configuring the Application Server Setting up job distribution between multiple Application Servers When Application Servers are configured to access the same database.keystore file. the Application Server is considered out of service. System clocks on all Application Servers must be synchronized to within a few seconds of each other. ■ 1 Start the Application Server Administration console. each Application Server periodically updates its time stamp. NOTE For Application Servers to cooperate. 2 To specify a time span that indicates a remote Application Server has timed out. it also checks for the heartbeat of any remote Application Servers. They accomplish this by distributing the processing of entire jobs or work items for large individual jobs to other Application Servers.keystore files. which functions as its heartbeat. as described in “Starting the Application Server Administration console” on page 45. For example. When an Application Server updates its heartbeat. they automatically attempt to cooperate by balancing their job processing workloads. For Application Servers to cooperate. 3 To specify an interval between heartbeats for an Application Server. if RemoteServerTimeout is set to 5. Chapter 3 Configuring the Application Server 55 . enter the following: set appserver RemoteServerTimeout # where # is number of seconds between heartbeats before a remote Application Server is considered out of service. Application Servers that are cooperating monitor each other’s heartbeat to determine which Application Servers are in service. and 10 seconds elapse between heartbeats. see “Synchronizing keystore files of multiple Application Servers” on page 58. they must know which Application Servers are in service. its heartbeat).

enter the following: set appserver UseSSLSockets true where true indicates that connections to this Application Server must be encrypted using SSL. the connection times out. 7 To specify that remote Application Servers contacting the Application Server must authenticate. the connection times out. 9 Restart the Application Server. 5 To specify a time-out for responses from a remote Application Server. 8 To specify a port used for communication between Application Servers. enter the following: set appserver SocketTimeout # where # is the maximum number of seconds to wait for a response from an Application Server after the initial connection has already been established. Generally.Configuring the Application Server 4 To specify a time-out for connecting to a remote Application Server. enter the following: set appserver SocketConnectTimeout # where # is the maximum number of seconds for obtaining an initial socket connection to a remote Application Server. 56 BMC BladeLogic Server Automation Administration Guide . enter the following: set appserver RegistryPort # where # is a port number. Once the maximum is exceeded. connections encrypted with SSL also require client authentication. enter the following: set appserver RequireClientAuthentication true where true instructs the Application Server to require authentication from remote Application Servers. 6 To specify that a socket connection use SSL. Once that maximum is exceeded. By default the RegistryPort is set to 9836.

Therefore you would need to review the log files on both Application Servers.log There are also individual log files for each Application Server deployment.1/NSH/br/deploymentProfileName. In this example. When Application Servers are configured to access the same database. with one job server running on each. By default. the logging information for the job is actually distributed between the log files on both appserver1 and appserver2.log Windows installationDirectory\BladeLogic\8.1\NSH\br/deploymentProfileName. you may have two physical Application Servers (appserver1 and appserver2). the Application Server log file is located in: UNIX /opt/bmc/BladeLogic/8.1/NSH/br/appserver.Configuring the Application Server Considerations for troubleshooting jobs in a MAS environment Each Application Server has a log file which contains information about what is being executed on that Application Server. which means that the log information is also distributed. which by default are located in: UNIX /opt/bmc/BladeLogic/8. For example.lo g Chapter 3 Configuring the Application Server 57 . they automatically attempt to cooperate by balancing their job processing workloads.1\NSH\br/appserver. and the Distribution Manager is dynamically allocating resource and running jobs on both Application Servers as needed.log Windows installationDirectory\BladeLogic\8.

) For this cooperation to take place. (For information. but with a low maximum parallelism level. see BMC BladeLogic Server Automation User Guide. By default. For a list of the permissions and authorizations required to modify Job Priority. Normal. if two concurrent jobs are competing for resources.keystore file. once the initial work item assignment quota for that Critical priority job is reached. or a class of jobs. its target vector. ■ ■ For more information on setting the job priority level. and Lowest. For example. do the following on each cooperating Application Server: 58 BMC BladeLogic Server Automation Administration Guide . High. Synchronizing keystore files of multiple Application Servers Multiple Application Servers on different hosts can be set up to cooperate on processing jobs. as it controls the maximum number of simultaneous work items that can be allocated for a given job. Such a job would appear to relinquish resources to a lower priority job with a high parallelism level. For example. There is no guarantee about the order of completion of each job (which is dependent on various extraneous factors including the actions performed in each job. Note that these priority levels are meaningful only in relation to each other. The parallelism configuration of a job can significantly impact the appearance of the effectiveness of the job’s priority level.Configuring the Application Server Job distribution and job priority in a MAS environment You can use the PRIORITY* property to mark a job. all Application Servers must have the same bladelogic. If you have implemented a multiple Application Server environment. the responsiveness of the target space. Low. with a relatively higher priority to ensure they are executed first in case of resource contention. You can assign one of any of the following priorities: Critical. see “Authorizations for changing job priority” and “Setting job priority” in the BMC BladeLogic Server Automation User Guide. all job types have a priority of Normal. the individual work items of the higher priority job are queued to be processed before the work items of the lower priority job. the Distribution Manager queues work items in respect to priority. see “Setting up job distribution between multiple Application Servers” on page 55. To synchronize keystore files of cooperating Application Servers. and so on). consider the case of a job with a priority of Critical. note the following considerations regarding job priority: ■ While queuing work items across all jobs.

change the keystore password for that deployment. start the Application Server Administration console for the deployment.keystore 3 Make sure that the passwords match for bladelogic. If the new bladelogic. enter: set appserverlauncher KeyStorePassword password F If the process spawner is in use. 2 Copy the bladelogic.keystore file from the _template directory of the central Application Server to each deployment directory of the cooperating Application Server.keystore file you copied into a deployment has a different password from that of the old bladelogic. if it is in use. The file location is: installationDirectory/br/deployments/_template/bladelogic.) To change the password needed for the bladelogic. enter: blasadmin -s _launcher E At the blasadmin prompt.Configuring the Application Server 1 Stop the cooperating Application Server. enter: Chapter 3 Configuring the Application Server 59 . (If keystore passwords match.keystore file.keystore file for all Application Server deployments: A On the cooperating Application Server.keystore files of all deployments of the cooperating Application Server. At the command prompt. you can skip this step. D Change the keystore password for the _launcher deployment. enter: blasadmin -s deployment_name For example: blasadmin -s default or blasadmin -s _template B At the blasadmin prompt. change the keystore password for the _spawner deployment. At the command prompt. At the command prompt. enter: set appserver CertPasswd password C Repeat these steps for each deployment whose keystore file has changed. including the PXE server.

as described in “Starting the Application Server Administration console” on page 45. 60 BMC BladeLogic Server Automation Administration Guide . 1 Start the Application Server Administration console. the connection is considered expired. the connection is closed. When there is no traffic over the connection between a client and the Application Server for this period of time. 2 To specify an idle prune time. This prevents situations where cancellation of a job is not performing as expected and the act of canceling the job can potentially hang the job. as described in “Starting the Application Server Administration console” on page 45. the job part is classified as stuck and the job part is aborted. such as a prune time for idle connections or the maximum amount of time a client can perform read operations from the Application Server. If the client exceeds these maximums. If cancellation of a job part exceeds this maximum. Setting limits for client connections The Application Server lets you specify certain limits for connections to the Application Server. enter: set ProcessSpawner KeyStorePassword password 4 Restart the cooperating Application Servers. 3 Restart the Application Server. Specifying a maximum time for canceling a job part You can specify a maximum period of time that can elapse for a job part to be canceled.Configuring the Application Server blasadmin -s _spawner G At the blasadmin prompt. enter the following: set appserver MaxTimeForCancelToFinish # where # is the maximum amount of time in minutes that should elapse for job cancellation. 2 To set a maximum period for job cancellation. enter the following: set appserver IdleConnectionPruneTime # where # is a value in minutes. 1 Start the Application Server Administration console.

and the connections that have expired are pruned. which means the connection never expired. use this procedure. as described in “Starting the Application Server Administration console” on page 45. if you assign job part time-outs. 3 Restart the Application Server. 4 Restart the Application Server. enter the following: set appserver PropagateWorkItemTimeout true|false Setting this value to true means all work item threads acting on the same server are canceled when one work item thread times out. Enabling automatic restart of provisioning jobs after Application Server restart A restart of an Application Server cancels provisioning jobs that have been submitted but are waiting idle (for example. a job waiting for the PXE client to boot). By default. a work item thread is canceled when it exceeds the time period you have defined in the JOB_PART_TIMEOUT property. enter the following: set appserver SocketTimeout # where # is the maximum number of seconds for client socket reads before the socket times out. idle connections with non-zero IdleConnectionPruneTime values are checked. Setting it to false means only the one work item thread is canceled. you can use this procedure to override the default behavior so that only one work item thread times out automatically. 1 Start the Application Server Administration console. Setting time-out behavior for work item threads The Application Server lets you specify time-out behavior for work item threads. all other work item threads acting on the same server are also canceled. If necessary. 2 To set time-out behavior. To ensure that these jobs are automatically restarted when the Application Server restarts. In addition. By default this value is set to 0. Chapter 3 Configuring the Application Server 61 .Configuring the Application Server When a new incoming connection is made. This prevents situations where multiple work item threads time out serially on the same unresponsive server. 3 To specify a time-out for client socket read operations from the Application Server.

an Update Server Properties Job always ends successfully. even if the RSCD agents on the remote target servers are unresponsive. If results for a Compliance Job exceed the limits you set in this procedure. A Compliance Job examines a component and compares its parts to conditions defined in compliance rules for a component template. Parts that do not comply are shown in Compliance Job results. you may tax your system resources. as described in “Starting the Application Server Administration console” on page 45. set the Update Server Properties Job to end in failed status whenever agents do not respond. as described in “Starting the Application Server Administration console” on page 45. 62 BMC BladeLogic Server Automation Administration Guide . You can. Setting the value to false means that the Update Server Properties Job will be reported (in the log and in the display of job results) as having ended in failed status if the agent on the remote target is unreachable or not licensed. 2 Enable automatic restart of provisioning jobs by entering the following: set appserver restartIdleProvisionJobs true 3 Restart the Application Server. Setting a maximum number of Compliance Results displayed The Application Server lets you specify the maximum number of compliance results that are displayed for any failed condition in a compliance rule. Setting the outcome of Update Server Properties Jobs when target agents are unresponsive By default. If you are running a Compliance Job that examines many server objects that fail a compliance condition. as the AGENT_STATUS property for the target servers is updated in any case. however.Configuring the Application Server 1 Start the Application Server Administration console. the job run is marked with a warning and the job log includes a message saying that job results have been truncated. 2 Set the outcome of Update Server Properties Jobs by entering the following: set JobFactory UspJobSucceedsWhenAgentDown true|false The default value is true. particularly disk space. 1 Start the Application Server Administration console.

Configuring the Application Server 1 Start the Application Server Administration console. as described in “Starting the Application Server Administration console” on page 45. ■ NOTE This procedure only defines behavior for new jobs. 1 Start the Application Server Administration console. 3 Restart the Application Server. enter the following: set scheduler MaxJobTimeInSchedulerQ # where # is a value in minutes. as described in “Starting the Application Server Administration console” on page 45. 3 Restart the Application Server. 2 To set past due job execution behavior. Setting this value to 0 means that all past due jobs execute when the Application Server starts. all existing jobs remain in the job queue for the default amount of time—60 minutes. 2 To set a maximum for compliance results displayed. Setting behavior for past due jobs The Application Server lets you specify a period of time that a newly created job can remain in a queue while the Application Server is down or too busy to process the job. the scheduled occurrence of a job does not execute. enter the following: set appserver ComplianceResultMaxNumberOfAssets # where # is a the maximum number of server objects displayed per failed condition in a compliance rule. No matter how you define this value. Setting a value for this option specifies that: ■ If you restart the Application Server and the specified period has not elapsed. the scheduled occurrence of a one-time-only job does not execute but the scheduled occurrence of a recurring job does execute. If you restart the Application Server and the specified period has elapsed. The period of time is measured from the scheduled occurrence of the job to the time the Application Server starts. By default this value is set to 60. Chapter 3 Configuring the Application Server 63 .

2 To set a maximum and minimum number of job-related database connections. increasing the value for MaxJobExecutionConnections can sometimes increase the performance of large Audit Jobs. 3 To set a maximum and minimum number of non-job-related database connections. NOTE Because each work item in an Audit Job requires a dedicated database connection. You can also set the maximum and minimum number of database connections used for general. 4 Restart the Application Server. as described in “Starting the Application Server Administration console” on page 45. you can help to prevent situations where client connections seem to hang because large jobs are using all available database connections. By providing separate settings for job-related and non-job-related activity. use either of the following commands: set database MaxJobExecutionConnections # set database MinJobExecutionConnections # where # is a number of database connections. NOTE The sum of the maximum numbers you define for MaxJobExecutionConnections and MaxGeneralConnections cannot exceed the connection limit specified by the database server. such as client connections to the database.Configuring the Application Server Setting the number of database connections Use this procedure to set maximums and minimums for database connections. You can set the maximum and minimum number of database connections that jobs use. use either of the following commands: set database MaxGeneralConnections # set database MinGeneralConnections # where # is a number of database connections. non-job-related purposes. 64 BMC BladeLogic Server Automation Administration Guide . 1 Start the Application Server Administration console.

When you deploy a new Application Server with its type set to NSH_PROXY or ALL. By default the Application Service runs and listens on port 9841. This port is used in a multiple Application Server configuration for Application Server to Application Server communication. This port is used for BMC BladeLogic Console to Application Server communication. the ProxySvcPort is automatically set to the Base Port plus 42. coordinate job work item execution. the Application Server does not run a Network Shell Proxy Service. the service that accepts client connections). and so on. update the remote heartbeat status. Chapter 3 Configuring the Application Server 65 . By default the Authentication Service runs and listens on port 9840. the Application Server does not run an Authentication Service. This communication is used for various administration tasks. ProxySvcPort 9842 RegistryPort 9836 Listening port for traffic between Application Servers that cooperate by distributing jobs to each other. Application Server ports By convention the Application Server listens to the ports listed in the following table: Port Number (By Convention) 9840 Traffic Type AuthSvcPort Description Listening port for the Authentication Service associated with an Application Server. If this value is set to 0. the Application Server does not run an Application Service. such as to pull Application Server statistics. AppSvcPort 9841 Listening port for the Application Service (that is. You must manually define a listening port for the default deployment of an Application Server.Configuring the Application Server Setting communication ports The following sections list the port requirements for both the Application Server and the Application Server Launcher. and is used in conjunction with the JMX Management Port 9838 (by default) to authenticate the client AppSvcPort (port 9841 by default). If this value is set to 0. Typically. The listening port for a Network Shell Proxy Service. If this value is blank. It is used in conjunction with the RMI Execution Port 9850+ (which is obtained from the MaxPort/MinPort range when the Application Server starts). ProxySvcPort is set to 9842 for the default Application Server. You can modify this value if necessary.

2 To specify a listening port. Default communications port used for Application Server communication with the Application Server Launcher. enter the following: set appServerComponent listeningport # where appServerComponent is the option category you want to modify. it requires a user name and password. Each managed Application Server uses this port to notify the Application Server Launcher that the Application Server is up and in a ready state. such as AuthServer. If the HTTP proxy server authenticates users. This communication is all local traffic for this port Incoming messages 9701 RMI execution 9702 In a firewall environment. Setting up HTTP proxy server support This procedure describes how to set up a user name and password for authentication on an HTTP proxy server. 66 BMC BladeLogic Server Automation Administration Guide . Many organizations provide Internet access through a proxy server. as described in “Starting the Application Server Administration console” on page 45. Ports used in a multiple application server deployment by the Application Server Launcher By default. and # is the number of the port. 3 Restart the Application Server. the following ports are used by the Application Server Launcher for BMC BladeLogic Console to AppServerLauncher communication: Port Number (By default) 9700 Traffic Type JMX Description Default Java Management Extensions (JMX) port used by the BMC BladeLogic Console to communicate with the Application Server Launcher. The patch management component of BMC BladeLogic incorporates the ability to download files from the Internet. which the Application Server can provide if you perform the following procedure. listeningport is the type of listening port.Configuring the Application Server 1 Start the Application Server Administration console. such as AuthSvcPort. use this port is used for BMC BladeLogic Console /Application Server Launcher communication.

3 To specify a listening port for the HTTP proxy server. enter the following: set appserver HTTPProxyName serverName where serverName is the name of the HTTP proxy server. enter the following: set appserver HTTPProxyPassword password where password is the password assigned to the proxy user you identified in the previous step. 6 Restart the Application Server. as described in “Starting the Application Server Administration console” on page 45. 2 To identify a proxy server.Configuring the Application Server 1 Start the Application Server Administration console. 5 To specify a password. as described in “Starting the Application Server Administration console” on page 45. enter the following: set appserver SocketsBindAddress IP_address|all Chapter 3 Configuring the Application Server 67 . 1 Start the Application Server Administration console. enter the following: set appserver HTTPProxyUser userName where userName is the name of a valid user on the proxy server. enter the following: set appserver HTTPProxyPort # where # is the port used to contact the proxy server. You can also instruct the Application Server to listen for connections on all of its IP addresses. Binding the Application Server to an IP address Use this procedure to specify an IP address to which an Application Server should listen. This procedure is primarily useful when an Application Server has more than one network interface and you want the Application Server to listen for connections on only one. 4 To specify a user name provided to the HTTP proxy server. 2 To specify an IP address to which the Application Server should listen.

When this inspection reveals a problem. You can use this procedure to turn off packet inspection. If you have previously instructed an Application Server to listen for a specific IP address. the Application Server listens on all of its IP addresses. 1 Start the Application Server Administration console. as described in “Starting the Application Server Administration console” on page 45. enter the following: set appserver RMIExecutionPort # where # is the number of the port. the packet is not delivered. 3 Restart the Application Server. you must use all in this command to change those instructions so the Application Server listens on all IP addresses. 5 Restart the Application Server. Configuring ports for remote execution objects Use this procedure to configure ports used to access remote execution objects. BMC BladeLogic inspects data packets traveling between Network Shell clients and proxy servers. the Application Server listens on all IP addresses. 3 To specify a port used to access JConsole. if you enter all in the command shown above. Enabling and disabling Network Shell proxy inspection To ensure data integrity. Similarly. If you do not specify an IP address or host name. enter the following: set ProcessSpawner RMIExecutionPort # For more on the process spawner. 2 To specify a port used to access the Application Server’s remote execution objects. 68 BMC BladeLogic Server Automation Administration Guide . see “Configuring the process spawner” on page 79. enter the following: set appserver JMXManagementPort # 4 To specify a port used to access the process spawner’s remote execution objects. such as the management object used by JConsole.Configuring the Application Server In the command shown above IP_address is the IP address or host name to which the Application Server should listen.

5.125 and the client version is 7. you can set up a version compatibility check.0. and micro parts of the version numbers. If you specify: set appserver VersionCompatibilityCheck micro The check would find that the version numbers are the same and allow the connection.Configuring the Application Server 1 Start the Application Server Administration console. minor — Sets the check to compare the major and minor parts of the version numbers. 7 is the major part. build — Sets the check to compare all four parts of the version numbers. and so on. as described in “Starting the Application Server Administration console” on page 45. suppose the Application Server version is 7.125. as described in “Starting the Application Server Administration console” on page 45. By default proxy inspection is turned on.) major — Sets the check to compare only the major part of the version numbers. 2 Enter the following command: set appserver VersionCompatibilityCheck major|minor|micro|build (In the version number 7.5.5. 1 Start the Application Server Administration console. the Application Server refuses the connection. If the version numbers are not the same. minor. micro — Sets the check to compare the major.0. This is the default. 2 Enable or disable packet inspection by entering the following: set appserver EnableProxyInspection true | false where false turns off proxy inspection and true turns it on. Ensuring version compatibility between Application Server and client To ensure that a connection does not take place when an Application Server and client are at different versions.0. Chapter 3 Configuring the Application Server 69 .123. This check compares the version numbers of the client and the Application Server. 5 is the minor part. For example. 3 Restart the Application Server. at a level of detail you specify.

The default value is 5000. enter the following: set appserver FileSystemObjectCacheMaxSize # where # is a the maximum number of file system objects that will be stored in the cache. as the file system object is stored in the cache and can be reused. Setting a maximum cache size for file system objects The Application Server lets you specify the maximum number of file system objects that are stored in the cache. For example. 3 Restart the Application Server. if you take a snapshot of a directory structure contains multiple instances of the same.Configuring the Application Server If you specify: set appserver VersionCompatibilityCheck build The check would find that the version numbers differ and would refuse the connection. 70 BMC BladeLogic Server Automation Administration Guide . 1 Start the Application Server Administration console. as described in “Starting the Application Server Administration console” on page 45. You can use this setting to improve database performance. 2 To set a maximum cache size for file system objects. the Job does not have to write the same file to the database multiple times. 3 Restart the Application Server.

smart groups. and server objects in the Configuration Object Dictionary. search groups. TIP In the BMC BladeLogic Console. and other BMC BladeLogic components as described in the following sections. enter the following: set appserver MaxPageSize # where # is a the maximum number of items retrieved per page. folders. as described in “Starting the Application Server Administration console” on page 45. large numbers of objects are presented in groups of 50. Changing the heap size for BMC BladeLogic components You can change the heap size for the Application Server. from the Configuration menu. From the BMC BladeLogic Console 1 In the BMC BladeLogic Console. for example. Expand BMC and Paging Options to change the default. database assets. 1 Start the Application Server Administration console. You can adjust this display number by selecting Window => Preferences. custom objects. per page. Changing the heap size for the Application Server You can the heap size for the Application Server from the BMC BladeLogic Console or using the blasadmin utility. the Application Server Launcher. 2 Expand the hierarchy of the Application Servers node. 2 To set a maximum page size. The default value is 1000. Chapter 3 Configuring the Application Server 71 . These records are used when working with groups. select Infrastructure Management. by default. You must choose File => Refresh after changing the default to have the change take effect. 3 Restart the Application Server. You can then page through these groups to make working with large numbers of objects more manageable.Changing the heap size for BMC BladeLogic components Setting the maximum number of items per page The Application Server lets you specify a maximum number of records retrieved from a managed server.

2 Enter the following command: set AppServer MaxHeapSize heapSize For example: set AppServer MaxHeapSize 1024M TIP Assuming that the Application Server has the recommended configuration of 4GB or more of physical memory. Using the Application Server Administration console (blasadmin utility) To change the heap size for the Application Server using the blasadmin utility.1536 MB Solaris . update the registry key HKEY_LOCAL_MACHINE\SOFTWARE\BladeLogic\Operations Manager\Application Server\option1 72 BMC BladeLogic Server Automation Administration Guide .1024 MB Linux . In a multiApplication Server environment.2048 MB Changing the heap size for the Application Server Launcher You can also change the heap size for the Application Server Launcher. To change the heap size for the Application Server Launcher.Changing the heap size for BMC BladeLogic components 3 Right-click the Application Server you want to edit and select Edit. Application Servers inherit the heap size value from the Application Server Launcher. perform the following steps: 1 Start the Application Server Administration console. perform the following steps according to your environment. by default. The Edit Application Server Profile dialog opens. the recommended Max Heap Size value for each platform is as follows: ■ ■ ■ Windows . 4 In the Edit Application Server Profile dialog. as described in “Starting the Application Server Administration console” on page 45. change the values for the MaxHeapSize attribute. ■ On Windows platforms.

tmpdir=$BLADELOGIC_HOME/tmp…….. you can disable routing rule evaluation. you modify the blclient script.io. In the configuration file. where -Xmx512M specifies a max heap size of 512Mb. Enabling/disabling SOCKS proxy rule evaluation By default../usr/nsh/br directory: $JAVA_HOME/bin/java -Xss2m -Xmx512M Djava. ■ For UNIX and Linux platforms. for example. Changing the value to Xmx1G. specifies a max heap size of 1GB.Enabling/disabling SOCKS proxy rule evaluation ■ For UNIX and Linux platforms.tmpdir=$BLADELOGIC_HOME/tmp……. By default. where -Xmx512M specifies a max heap size of 512Mb. Changing the heap size for other BMC BladeLogic components To change the heap size for other BMC BladeLogic components. ■ For Windows platforms.cfg) file in the br directory. you modify the blasadmin. modify the following line in the blappserv script. modify the corresponding configuration (. to change the heap size for the blasadmin utility on Windows. For example. which is located in the .arg=-Xmx1024M.io.. If your system does not use SOCKS Proxy Servers to route to remote servers.cfg file.. the format for setting the max heap size is jvm. the BMC BladeLogic system evaluates communication requests to remote servers against routing rules to determine if the communication needs to be routed through a SOCKS Proxy Server. the configuration files are located in C:\Program Files\BMC Software\Bladelogic\versionNumber\NSH\br. for example. Chapter 3 Configuring the Application Server 73 . specifies a max heap size of 1GB. you modify the configuration script or file for the component./usr/nsh/br directory: $JAVA_HOME/bin/java -Xss2m -Xmx512M Djava. Changing the value to Xmx1G. which is located in the . modify the following line in the corresponding script. To change the heap size for the BMC BladeLogic Console on UNIX or Linux.

Before you can start BMC BladeLogic for the first time after a fresh installation. BLPackages. Network Shell scripts. BMC BladeLogic uses the file server to store the contents of files included in snapshots. and metabase values longer than 255 characters. For information on setting up communications to remote servers through SOCKS Proxy Servers. 2 To enable or disable routing rule evaluation. Configuring the file server To configure a file server you must specify a host and directory where BMC BladeLogic stores content. 74 BMC BladeLogic Server Automation Administration Guide . 3 Restart the Application Server. ■ The file server should have substantial disk space (see the BMC BladeLogic Server Automation Installation Guide for exact recommendations). as described in “Starting the Application Server Administration console” on page 45. In addition. you must perform this procedure. routing rule evaluation is turned on. All users need to be mapped to the same user on the file server. enter the following: set RoutingConfig EvaluateSocksProxyRules true|false Where: true — Turns on routing rule evaluation. the system does not evaluate communication requests against routing rules. A file server should meet the following requirements: ■ An RSCD agent should be installed and licensed.Configuring the file server 1 Start the Application Server Administration console. false — Turns off routing rule evaluation. software packages. NOTE Do not limit access to the file server by pushing agent ACLs to the agent on the file server. The system evaluates communication requests against routing rules. and other types of information that is not easily stored in the database. the file server stores registry. see the BMC BladeLogic Server Automation User Guide. By default. COM+.

Without this mapping a user may not be able to access a file that another user has stored on the file server. enter the following: set fileserver location directory where directory is the directory on the file server where data is stored. 2 To specify the name of the file server. 4 Restart the Application Server. 3 To specify the location of the file server directory. Updating a file server You can update the status or change the properties of a file server using the Infrastructure Management window. as described in “Starting the Application Server Administration console” on page 45. One way to accomplish the necessary mapping is to create an entry like the following in the exports file on the file server: applicationServer rw. enter the following: set fileserver name hostname where hostname is the name of the server where data is stored. For more information see “Exports file” on page 240. and all BMC BladeLogic users must be mapped to that user. such as /c/FileServer.Configuring the file server ■ A user name must be defined on the file server. 1 Select Configuration => Infrastructure Management. such as C:\FileServer. 2 Right-click the file server and select choose from the following options: Option Update File Server Status Description Contacts the file server to determine current status Chapter 3 Configuring the Application Server 75 . user=userName where applicationServer is a comma-separated list of Application Server names or IP addresses and userName is the name to which all users are mapped. Setting up the file server 1 Start the Application Server Administration console. as opposed to a Windows-style path. Use a Network Shell style path to a directory.

you must configure a mail server. 76 BMC BladeLogic Server Automation Administration Guide .) 3 To specify the email address from which system-generated email is sent. For more information. enter the following: set emailconfig smtpserver hostname where hostname is the name or IP address of the host managing email. select the Enable Advanced File Server option. 4 To display the email address for technical support. as described in “Starting the Application Server Administration console” on page 45. 2 To specify the name or IP address of the SMTP server. You do not have to configure a mail server if you are not using the system’s ability to generate email. 5 Restart the Application Server. enter the following: show emailconfig techsupport NOTE The techsupport parameter is a read-only parameter.Configuring a mail server Option Refresh Properties Description Updates the status of the server Launches the properties dialog. To modify the file server to an advanced file server. To enable this capability. 1 Start the Application Server Administration console. where you can modify the host name or the file server root directory. enter the following: set emailconfig fromaddress address where address is the address from which mail should be sent. (SMTP stands for simple mail transfer protocol. see “Configuring Advanced File Servers and Advanced Repeater servers” on page 312 Configuring a mail server BMC BladeLogic jobs can generate email upon their completion.

3 Restart the Application Server. 2 Specify the path and name of the Perl executable by entering the following: set perlconfig location pathToPerl where pathToPerl is a Network Shell-style path. To enable SNMP traps. 2 To specify the name or IP address of the SNMP server. If you are using Perl. it can generate an SNMP trap. such as /c/perl/bin/perl. you should configure the Application Server so it knows the location of the Perl executable. 4 Restart the Application Server.exe. enter the following: set snmpconfig snmpport # where # is the port used to contact the SNMP server. In addition. as described in “Starting the Application Server Administration console” on page 45.Configuring Perl Configuring Perl The BMC BladeLogic Console and Network Shell both support the Perl scripting language. you must configure an SNMP server. enter the following: set snmpconfig snmpserver hostname where hostname is the name or IP address of the host managing SNMP trap notifications. 1 Start the Application Server Administration console. it too can generate an SNMP trap. 3 To specify a listening port for the SNMP server. 1 Start the Application Server Administration console. as described in “Starting the Application Server Administration console” on page 45. Chapter 3 Configuring the Application Server 77 . when an Audit Job detects consistent or inconsistent results. Configuring an SNMP server When a BMC BladeLogic job completes.

as described in “Starting the Application Server Administration console”. the port the database listens on. as described in this procedure.jdbc. you can manually configure the Application Server to communicate with the database. enter the following: set database driverclass class where class is the Java® class used to communicate with the database. enter the following: set database connectionstring string where string is a string that specifies the database type. However.DatabaseName=DBNAME. the server running the database. The installation program can configure the Application Server to communicate with this database. and SQL Server database name or Oracle SID. a BMC BladeLogic installation uses the following database ports: Port Number 1521 1433 ■ ■ Database Type Oracle SQL Server 3 To specify the driver class for the database. The connection string can use one of the following formats: ■ ■ jdbc:oracle:thin:@DBSERVER:PORT:SID jdbc:sqlserver://DBSERVER:PORT. By default. you can define the class with one of the following strings: ■ oracle.driver. do the following: ■ Replace DBServer with the name or IP address of the server running the database.SelectMethod=cursor When using one of the formats shown above. Replace PORT with the port number the database is listening on. 1 Start the Application Server Administration console. Depending on the type of database you are using.Configuring a database server Configuring a database server BMC BladeLogic works in conjunction with an Oracle® or SQL Server database server. 2 To specify a connection string for the database. Replace DBNAME with the name of the database or replace SID with the Oracle SID.OracleDriver 78 BMC BladeLogic Server Automation Administration Guide .

which starts a new child process. Configuring the process spawner An Application Server can be configured to spawn processes externally to the Application Server process itself. enter the following two commands: set database userid id set database password ****** where id is the user name that the database needs to authenticate your connection and ****** is the password assigned to that user ID. enter the following: set database commitsize size where size is the maximum number of rows that can be updated in an Oracle database before you either have to commit your updates or roll them back. Commit size is primarily used when taking snapshots or performing audits in BMC BladeLogic. Chapter 3 Configuring the Application Server 79 .sqlserver. TIP Because Oracle databases can be highly tuned. an Application Server spawns processes for Network Shell Script Jobs and some types of extended objects. 6 Restart the Application Server. it contacts the process spawner. The Application Server transfers the necessary information to the child process. a separate dedicated process (the process spawner) is used only for spawning processes. If you configure an Application Server in this way.SQLServerDriver 4 To specify the user ID and password for the database. When the Application Server needs to spawn a process.microsoft. but at the same time you run the risk of losing more data should a database process fail. 5 To specify a commit size for an Oracle database. Primarily. Spawning processes externally can be beneficial for memory management. A larger commit size means database processes execute more quickly.jdbc.Configuring the process spawner ■ com. you may want to consult your Oracle DBA to achieve best results when defining a commit size.

BMC Software recommends that you run the following command before starting the Application Server service (to avoid ‘connection refused’ failures for any scheduled jobs): ■ ■ run /etc/init. By default. see “Starting the Application Server Administration console” on page 45.Configuring the process spawner To configure the process spawner. Enter the following: set ProcessSpawner RegistryPort # where # is the number of a port. The default port is 1067 and is the port recommended by BMC BladeLogic. do the following: 1 Configure the Application Server to use the process spawner. NOTE If you set the ProcessSpawner SpawnExternally value to true. 80 BMC BladeLogic Server Automation Administration Guide .d/blprocserv start (UNIX) net start “BladeLogic Process Spawner” (Windows) 3 Specify a port for communicating with the process spawner. See “Configuring the process spawner” on page 81. See “Configuring an Application Server to use the process spawner”. 4 Restart the Application Server. Enter the following: set ProcessSpawner SpawnExternally true Setting this value to false indicates the process spawner runs within the Application Server process. 2 Specify that processes be spawned externally from the Application Server process. 2 Configure the process spawner itself. Configuring an Application Server to use the process spawner 1 Start the Application Server Administration console for the Application Server that you want to execute the NSH jobs. this value is set to false. For example: blasadmin -s JobServer1 For more information on methods for starting this console.

and double-click Services. select Settings > Control Panel. The default port is 1067 and is the port recommended by BMC BladeLogic. blasadmin -s _spawner For more information on methods for starting this console. from the Start menu. Do one of the following: ■ On Windows. see “Starting the Application Server Administration console”. enter the following: /etc/init. Enter the following: set AppServer RegistryPort # where # is the number of a port. Double-click Administrative Tools.Configuring the process spawner Configuring the process spawner 5 Start the Application Server Administration console for the process spawner deployment. On a UNIX-style system. 7 Restart the process spawner. Right-click BMC BladeLogic Process Spawner and select Restart from the pop-up menu. 6 Set the Registry Port for the process spawner to match the port specified to the when you configured the Application Server to use the process spawner.d/blprocserv restart ■ Chapter 3 Configuring the Application Server 81 .

you can perform a snapshot or audit of / and processing can traverse other volumes such as /home or /usr that may reside under /. 2 To specify how UNIX mount points are processed. an error message is written to the Application Server log and the job log. enter the following: set ProcessSpawner NshScriptJobCredentialTimeout # where # is the number of hours (minimum of 24). Choosing not to cross mount points can substantially increase the speed of snapshots. and packaging of BLPackages. 3 Restart the Application Server. 1 Start the Application Server Administration console. For example. and BLPackages in BMC BladeLogic can be processed across UNIX mount points and network mount points for remote file systems shared through NFS. Processing across mount points Use this procedure to configure the Application Server so snapshots. For more on the process spawner. NOTE If a job exceeds the timeout value in the NshScriptJobCredentialTimeout setting. 2 To set a timeout value for the job session credentials. The default setting is 96 hours. enter the following: set mountconfig SnpAudPkgCrossMounts true|false 82 BMC BladeLogic Server Automation Administration Guide . as described in “Starting the Application Server Administration console” on page 45. audits. 1 Start the Application Server Administration console. as described in “Starting the Application Server Administration console” on page 45. audits. By default. The NshScriptJobCredentialTimeout setting is a global setting that applies to all jobs. see “Configuring the process spawner” on page 81. if you want to cross mount points. processing does not cross mount points.Configuring expiration time for credentials of jobs Configuring expiration time for credentials of jobs Use this procedure to set a timeout value for the session credentials that are passed to jobs. Once the credentials expire. all active client connections are closed.

000. Processing large numbers of records for a configuration object or extended object can consume large quantities of memory. enter the following: set AssetThresholds MaxConfigRecords # where # is the maximum number of records to be processed. as described in “Starting the Application Server Administration console” on page 45. the SnpAudPkgCrossMounts option must also be set to true (see step 2). and BLPackages crosses mount points. false means that processing does not cross network mount points (this is the default value). 3 To specify how network mount points are processed. Snapshot. true means processing of audits. snapshots. the job fails on that server with a parsing error. and BLPackages crosses network mount points. true means processing of audits. To set SnpAudPkgNetworkMounts to true. Audit. 1 Start the Application Server Administration console. snapshots. Using this procedure can help prevent the Application Server from running out of memory. particularly when the Application Server processes multiple configuration objects or extended objects on multiple servers simultaneously. By default this value is set to 50. Setting this value to 0 means no records are processed.Restricting the size of configuration and extended objects In the command shown above. 2 To limit the number of records that an Application Server can process for a single configuration object or extended object. and in live browsing. 4 Restart the Application Server. 3 Restart the Application Server. Restricting the size of configuration and extended objects Use this procedure to limit the number of records that a server can provide to an Application Server for a single configuration object or extended object. Chapter 3 Configuring the Application Server 83 . Configuration objects and extended objects can be used in component templates. false means that processing does not cross mount points (this is the default value). and Compliance Jobs. If a job targets a server that returns more records for a configuration object or extended object than the limit set in this procedure. enter the following: set mountconfig SnpAudPkgNetworkMounts true|false In the command shown above.

users cannot display no access nodes. which users can always delete. BMC BladeLogic calls these type of objects no access nodes. BMC BladeLogic users have the option of hiding or displaying no access nodes. This procedure lets you globally show or hide no access nodes. 3 Restart the Application Server. Deleting groups in the BMC BladeLogic Console Use this procedure to specify that users of the BMC BladeLogic Console cannot delete groups or folders unless they are empty. If you use this procedure to show no access nodes at the Application Server level. as described in “Starting the Application Server Administration console” on page 45.Configuring user interface settings Configuring user interface settings The Application Server Administration console gives you several options for controlling the behavior of the BMC BladeLogic Console and the BLCLI. users can potentially see system objects even when those users do not have appropriate permissions to interact with those objects. The following procedures describe the available options: ■ ■ ■ ■ ■ ■ ■ Displaying no access nodes in the BMC BladeLogic Console Deleting groups in the BMC BladeLogic Console Creating properties automatically in the BMC BladeLogic Console Limiting the number of results displayed when browsing Controlling the permissions of copied objects Enabling export and import of property dictionaries and classes Setting temporary group location for update Displaying no access nodes in the BMC BladeLogic Console In the BMC BladeLogic Console. enter the following: set ConfigManagerUI ShowNoAccessNodes true|false In the command shown above. 84 BMC BladeLogic Server Automation Administration Guide . 1 Start the Application Server Administration console. users can delete groups and folders even when they contain system objects. By default. This setting has no effect on smart groups. 2 To show or hide no access nodes. If you use this procedure to hide no access nodes. true indicates that no access nodes can be shown in the BMC BladeLogic Console. false indicates no access nodes are hidden.

false indicates properties are not automatically created. enter the following: set ConfigManagerUI GroupsMustBeEmpty true|false In the command shown above. properties are automatically created.Configuring user interface settings 1 Start the Application Server Administration console. false indicates users can delete groups and folders even when they contain objects. as described in “Starting the Application Server Administration console” on page 45. 2 To turn the automatic creation of properties on or off. This procedure lets you set an arbitrary limit to the number of results that can be displayed during live browse. true indicates that properties are automatically created. as described in “Starting the Application Server Administration console” on page 45. which can slow your system performance. BMC BladeLogic can automatically create properties so you can map them to the properties referenced by the imported object. 3 Restart the Application Server. This procedure lets you specify whether properties should be created automatically during the import process. 3 Restart the Application Server. 1 Start the Application Server Administration console. enter the following: set ConfigManagerUI AutoCreate true|false In the command shown above. Creating properties automatically in the BMC BladeLogic Console When you import objects into the BMC BladeLogic Console and those objects reference properties not defined on the destination system. Chapter 3 Configuring the Application Server 85 . Limiting the number of results displayed when browsing Use this procedure to limit the number of results displayed when a user is browsing in the BMC BladeLogic Console. By default. 2 To specify whether users can delete groups or folders. true indicates that groups must be empty before they can be deleted. Selecting some nodes while browsing can potentially display large numbers of results.

Controlling the permissions of copied objects Use this procedure to control the permissions that are assigned to objects during copy and paste operations in the BMC BladeLogic Console. the newly created object is granted a default set of permissions. 2 To limit the number of live browse results that can be displayed. false means that when you copy and paste an object. enter the following: set ACLCopy UseDefaultAclOnObjectCopy true In the command shown above. 2 To enable copying of objects so that the copied objects are assigned a default set of permissions. a * authorization). the newly created object has the same permissions that were defined for the object that was copied. 1 Start the Application Server Administration console. when users copy and paste an object. true means that when you copy and paste an object.000. users can set a preference that also establishes a limit for results displayed while browsing. and the newly created object has the permissions that are specified for that type of object in the object permissions template defined for the user’s role. 86 BMC BladeLogic Server Automation Administration Guide . as described in “Starting the Application Server Administration console” on page 45. By default this option is set to 50. enter the following: set AssetThresholds MaxAllowedLiveBrowseResults # where # is the maximum number of results that can be displayed for any node when browsing in the console. After you use blasadmin to perform this procedure. 3 Restart the Application Server. Normally. as described in “Starting the Application Server Administration console” on page 45. The limit set in the console cannot exceed the limit established with this procedure. Setting this number to 0 indicates no results are displayed. By default this option is set to false. users can copy and paste an object.Configuring user interface settings In the BMC BladeLogic Console. 3 Restart the Application Server. Also the user’s role is granted full permission to the object (that is. 1 Start the Application Server Administration console. the newly created object has the same permissions as those assigned to the object that was copied.

as described in “Starting the Application Server Administration console” on page 45.Configuring user interface settings Enabling export and import of property dictionaries and classes Use this procedure to enable or disable the export and import of the entire Property Dictionary or specific custom property classes. This temporary group is deleted at the end of the update operation. 2 To enable or disable the import and export of the Property Dictionary or custom property classes. Chapter 3 Configuring the Application Server 87 . Setting temporary group location for update When you run any of the BLCLI importAndUpdate commands in the Template or BlPackage name spaces. this option must be set to true on both the exporting and the importing Application Server. the temporary group is /importAndUpdate. 1 Start the Application Server Administration console. the import and update process creates a temporary group at the root of the relevant workspace and uses that group to store the imported object. true indicates that you can export and import the Property Dictionary or custom property classes. By default. as described in “Starting the Application Server Administration console” on page 45. By default this option is set to false. 2 To specify a new location for the temporary group. enter the following: set ConfigManagerUI PropertySync true|false In the command shown above. This procedure lets you change this group to another name or location. 3 Restart the Application Server. enter the following: set ConfigManagerUI DefaultImportAndUpdateFolder /path/to/some/folder 3 Restart the Application Server. false indicates import/export is disabled. To enable import/export. 1 Start the Application Server Administration console.

By default. For more information on RBAC see the BMC BladeLogic Server Automation User Guide. Maximum password age—By setting a maximum password age. you can specify how many failed logins cause a user to be locked out and how long that lockout lasts. there is no minimum length for passwords. ■ To specify how long a user is locked out when he or she has surpassed the lockout threshold. enter the following: set accountconfig AccountLockoutThreshold # where # is the number of failed logins that trigger a lockout. you can require users specifying passwords to provide a password of minimum length. Entering a 0 indicates there is no minimum length for passwords. Entering a 0 indicates that users cannot be locked out because of login failures. enter the following: set accountconfig MaxPasswordAge # where # is a period of time in days. Entering a 0 indicates passwords do not expire. as described in “Starting the Application Server Administration console” on page 45. ■ ■ 1 Start the Application Server Administration console. Account lockout—By setting a threshold and duration for account lockouts.Setting SRP login requirements Setting SRP login requirements Use this procedure to configure the Application Server so it forces users logging in via SRP to meet any of the following requirements: ■ Minimum password length—By setting a minimum password length. In RBAC you can specify that passwords never expire no matter what expiration period you specify. enter the following: 88 BMC BladeLogic Server Automation Administration Guide . ■ To specify how long it takes for a password to expire. you can require users to change passwords at specified intervals. ■ To specify how many times a user can fail to log in before being locked out. enter the following: set accountconfig MinPasswordLength # where # is the minimum length for passwords. 2 Do any of the following: ■ To specify a minimum password length.

255. such as eth0 or eth1.2.0. By default.1.Configuring the PXE Server set accountconfig AccountLockoutDuration # where # is the number of minutes the user is locked out. Chapter 3 Configuring the Application Server 89 . which provides instructions for downloading the bootstrap program needed to begin the provisioning process. 1 Start the Application Server Administration console and specify the PXE Server deployment (_pxe).0. you might enter the name of a network interface card. 3 Identify the address of the TFTP server by entering the following: set pxeserver default_address TFTP_address where TFTP_address is the IP address of the TFTP server. Entering a 0 indicates that users can only be unlocked by an administrator using RBAC.255. For example. 5 Identify the IP address of a multicast TFTP server by entering the following: set pxeserver mtftp_address MTFTP_address where MTFTP_address is the multicast address that the TFTP listens on.255. Configuring the PXE Server When provisioning some types of servers. Enter the following: blasadmin -s _pxe 2 Identify the type of Ethernet interface that the PXE server uses to listen by entering the following: set pxeserver interface_to_bind interfaceName where interfaceName is the type of Ethernet interface. Multicast addresses must fall in the range 224. you must set up a PXE Server. a BMC BladeLogic PXE Server listens on the multicast address of 224. 4 Identify the IP address of the multicast group that the PXE server listens on by entering the following: set pxeserver multicast_address address where address is an IP address.0. Servers being provisioned download bootstrap programs from a TFTP server.0 to 239. Use this procedure to provide various parameters needed to run a PXE Server.

By default BMC BladeLogic uses port 1759. By default BMC BladeLogic uses port 1758. 9 Specify whether the PXE Server uses a multicast by entering the following: set pxeserver is_use_multicast # where # can be one of the following: ■ ■ 0—The PXE Server cannot use a multicast. 10 Specify whether the PXE Server can use a broadcast by entering the following: set pxeserver is_use_broadcast # where # can be one of the following: ■ ■ 0—The PXE Server cannot use a broadcast. 7 Identify the port that the TFTP server should use to listen for traffic from PXE clients by entering the following: set pxeserver mtftp_server_port port where port is the multicast port. 1—The PXE Server can use a broadcast. the boot prompt does not display. 1—The PXE Server can use a multicast. 90 BMC BladeLogic Server Automation Administration Guide .Configuring the PXE Server 6 Identify the multicast port that PXE clients should use to communicate with the TFTP server by entering the following: set pxeserver mtftp_client_port port where port is the multicast port that servers being provisioned should use to communicate with the TFTP server. If you enter 0. 8 Identify the PXE Server’s listening port by entering the following: set pxeserver listen_port port where port is the port on which the PXE Server listens for connections from PXE clients. 11 Specify the amount of time the boot prompt displays before the boot process begins by entering the following: set pxeserver prompt_timeout # where # is the maximum amount of time the boot prompt can display.

bladelogic. Use the Licensing command to specify the information required to access the services of the Licensing Portal.com/ BMCBladelogicLicensingWS/services/BMCBladelogic LicenseService Chapter 3 Configuring the Application Server 91 .Configuring the Licensing Module 12 Identify the base directory on the TFTP server where operating system bootstrap programs are stored. 13 Identify the PXE Server’s domain by entering the following: set pxeserver domain domain_name where domain_name is the name of the PXE Server’s domain. 14 Restart the PXE Server. to display the user name the Application Server uses to connect to the Licensing Portal. Task Set the location of Licensing Portal for registering servers Set the location of Licensing Portal for deregistering servers Command set Licensing LicenseServiceURL http://www. Enter the following: set pxeserver tftpd_base_dir directory where directory is the base directory on the TFTP server for storing bootstrap programs. TIP To display the value of a parameter you have set previously.com/services/LicensingWS set Licensing DeregisterServiceURL https://webapps. enter: show Licensing ServiceUsername Connecting to the Licensing Portal Use the following parameters for the Licensing command to specify the location of the portal and the credentials the Application Server uses to communicate with the Licensing Portal. Configuring the Licensing Module The Application Server communicates with the BMC Software Licensing Portal to register or deregister managed servers. use the show parameter instead of the set parameter.bmc. For example.

When you use the show Licensing ServicePassword command. 2 To enable or disable asynchronous execution. Turning asynchronous execution on or off does not affect the Staging phase of a Deploy Job. enter the following: 92 BMC BladeLogic Server Automation Administration Guide . Notes Enter the fully-qualified name of the host machine. 1 Start the Application Server Administration console. it is stored in the database in encrypted form.Enabling asynchronous execution Task Set the user name and password Command set Licensing ServiceUsername userName set Licensing ServicePassword password Note: While the password is entered in clear text. Connecting to the Licensing Portal using a proxy These optional parameters for the Licensing command specify the system and credentials for the proxy host through which the Application Server communicates with the Licensing Portal. When you use the show Licensing ProxyPassword command. the password is displayed in encrypted form. it is stored in the database in encrypted form. Task Set the proxy host name Set the proxy port Set the proxy user name and password Command set Licensing ProxyHost hostName set Licensing ProxyPort portNumber set Licensing ProxyUsername userName set Licensing ProxyPassword password While the ProxyPassword is entered in clear text. Asynchronous execution can occur during the Simulate and Commit phases of a Deploy Job as well as during an undo. Enabling asynchronous execution Asynchronous execution lets Deploy Jobs run without blocking work item threads for extended periods of time. the password is displayed in encrypted form. as described in “Starting the Application Server Administration console” on page 45. This allow an Application Server to process a Deploy Job more efficiently and frees up valuable Application Server resources that can be used by other jobs.

the performance of one Application Server does not affect the behavior of another. Configuring multiple Application Servers on the same host BMC BladeLogic lets you run multiple Application Servers on a single host. Using separate Application Servers in this way. follow these steps: 1 If you have not done so already. in addition to the Application Server initially installed.Enabling web services set appserver EnableAsyncExecution true | false By default this value is set to true. The easiest way to achieve this result is to run the Post-Install configuration wizard as the last step of the Application Server installation. Enabling web services To enable web services. You can configure each additional Application Server so it performs one or more distinct functions. 3 Restart the Application Server.) Chapter 3 Configuring the Application Server 93 . (For information. To configure multiple application servers on the same host. Defining multiple Application Servers also lets you utilize more fixed memory on a host system because the JavaVM heap limit would otherwise restrict a single Application Server to a fixed amount of memory. install and configure the Application Server on the host machine. All Application Servers on the same host must use the same database connection. see “Using the Post-Install Configuration wizard to configure the default application server” on page 34. such as a Configuration Server or a Job Server. enter the following: set AppServer enableWebServices true For information about additional web services settings. see the BMC BladeLogic Server Automation Web Services Developer Guide.

About Application Server deployments and profiles The following sections provide an overview of Application Server deployment and the different types of Application Servers. use the Application Server Administration console (blasadmin) to further configure Application Servers. The table describes each deployment and the effect of configuration changes on it. you must use options to specify the Application Server you are configuring or to specify configuration of all Application Servers on the host. 94 BMC BladeLogic Server Automation Administration Guide . See “Creating additional Application Servers”. The creation process not only creates the additional Application Servers but also gives them an “out-of-the-box” configuration. based on their Application Server Type and other information you specify. 3 Optionally. Application Server deployments A deployment is a directory of services that an Application Server runs.About Application Server deployments and profiles 2 Use the Infrastructure Management window or the Application Server Administration console (blasadmin) to create and configure additional Application Servers on the host. See “Using the Application Server Administration console (blasadmin) to configure Application Servers” on page 44. NOTE When you start blasadmin.

This deployment is created when a single or initial Application Server is first started. See “Using the application server configuration wizard to change configuration settings” on page 39. default The deployment for a single Application Server or the initial Application Server when there are multiple Application Servers on the same host. ■ AppServerName The deployment for each Application Server created on the same host (in addition to the default Application Server).About Application Server deployments and profiles Deployment Name _template Description The “master” from which other Application Server deployments are created. The following configuration changes affect the default deployment: ■ Changes you make using the Application Server Administration console from the BMC BladeLogic menu or using blasadmin without the -a option or -s option. When there are multiple Application Servers configured on the same host. This deployment is created during BMC BladeLogic installation. See “Starting blasadmin to Configure the Default Application Server” on page 45. This deployment contains default (“out-of-the-box”) settings and initial configuration settings made with the Post-Install Configuration wizard. see “Using the application server configuration wizard to change configuration settings” on page 39. Changes you make using the Application Server Configuration Wizard or the blappconf command with no -s option. The following configuration changes affect the deployment: ■ Changes you make using blasadmin -s appServerName or blasadmin -a. See “Starting the Application Server Administration console” on page 45. ■ Chapter 3 Configuring the Application Server 95 . Changes to this deployment affect all new Application Servers created. Changes you make using blappconf -s appServerName For more information. Configuration changes you make using blasadmin -a affect this deployment. The start-up process copies the _template deployment to create the default deployment. each Application Server’s profile determines the number and type of services in its deployment.

Application Server Type CONFIGURATION Functional Description Handles all requests from the BMC BladeLogic Console and the BLCLI. You specify the Application Server types when you create the Application Server. A JOB server responds to local connection requests from the BMC BladeLogic Console or the BLCLI. See “The Application Server Launcher” on page 34. regardless of settings for the connection ports. A JOB server never responds to remote connection requests. See “Configuring the process spawner” on page 81.About Application Server deployments and profiles Deployment Name _spawner _pxe _launcher Description The deployment for the process spawner. provided that one or more of the connection ports (for example. Application Server types The Application Server Type defines the work that an Application Server performs and services that it runs. JOB 96 BMC BladeLogic Server Automation Administration Guide . and attributes. An Application Server profile can include attributes of one or more Application Server types. Each Application Server has a different profile. type. BMC BladeLogic uses the profile to create and update an Application Server’s deployment (the services that the Application Server runs). Application Server profiles A profile is a definition of an Application Server’s identity: its name. See “Configuring the PXE Server” on page 89. While a CONFIGURATION server can create jobs and start the execution of jobs. The attributes needed for each type are predefined in the profile for the type. The deployment for the Application Server Launcher. AppSvcPort) is open. Executes work items needed to process a job. The following table lists Application Server types and describes each. only a JOB server can run the work items needed to process a job. An Application Server’s profile is essentially a pre-packaged set of configuration options for an Application Server. The deployment for the PXE Server.

Choose one of the following options: ■ Click No to return to the new Application Server dialog. entering the following information for the new Application Server. NSH_PROXY) An Application Server with its type set to ALL performs the functions of all Application Server types. Creating additional Application Servers from the BMC BladeLogic Console Use this procedure to create Application Servers in addition to the Application Server installed on a host. If there are unmanaged deployments which match this new Application Server request. from the Configuration menu. Equivalent to (CONFIGURATION. Then select New Application Server. Click Yes to redeploy the unmanaged deployment with the base port and configuration type you specify.Creating additional Application Servers Application Server Type NSH_PROXY Functional Description Manages traffic between Network Shell clients and remote servers. ■ 3 In the New Application Server dialog. Chapter 3 Configuring the Application Server 97 . Note that you will not preserve the data that was in the previous unmanaged deployment. 2 Expand the Application Server Launchers node and right-click the Application Server Launcher that you want to control the new Application Server. select Infrastructure Management. you are presented with the option of using the unmanaged deployment or creating a new one. 1 In the BMC BladeLogic Console. JOB. An NSH_PROXY server cannot service requests from the BMC BladeLogic Console or the BLCLI. ALL Creating additional Application Servers You can create additional Application Servers from the BMC BladeLogic Console using the Infrastructure Management window or from the command line using the Application Server Administration console (blasadmin).

you can change the Display Name. However. BMC BladeLogic uses the base port with the last two digits of the default port. The creation process sets the Registry Port to 9936. To generate the numbers. Used internally within the BMC BladeLogic environment. see “Application Server types” on page 96. Specify a number that makes the new Application Server’s default ports unique on the host. Application (Required) Specifies the type of Application Server to create: Server Type(s) CONFIGURATION. The name can include letters. and so on). The system creates a profile for the new Application Server. The name can be no more than 200 characters in length. For example. use Ctrl-Click to select individual items). _template. asking if you want to edit the new Application Server’s profile. Follow these guidelines: ■ Specify a name that is unique on the host. NSH_PROXY. and so on. if the default port numbers have a base of 9800 (9836 for Registry Port. hyphens (-). _spawner. you could specify 9900 as the base port for the new Application Server. See “Viewing and editing an Application Server’s profile” on page 100. _launcher. 9829 for SRP Port. _pxe. 4 Click OK. and underscores (_). Do not use the following reserved names: default. the SRP Port to 9929. _postmig ■ ■ ■ You cannot change the Application Server Name after configuration. _util. (Use Shift + Click to select multiple contiguous types. as well as for the Display Name in the interface. Do not use the same name as the default Application Server.Creating additional Application Servers Field Application Server Name Description (Required) The name for the new Application Server. JOB. 98 BMC BladeLogic Server Automation Administration Guide . _old. Accept the default (All Server Types) or uncheck All Server Types and select one or more types. or ALL (a combination of all three types). 5 A prompt appears. The Application Server Type determines the attributes included in its Application Server profile. digits. For information on each type. The number must be between 1000 and 65536. _install. Base Port (Required) The number that BMC BladeLogic uses to automatically generate default port numbers for the new Application Server.

For example. For information. (You can always edit the profile later. The Edit Application Server Profile dialog appears. the offset for the authentication port is 40 by default. To add a new deployment 1 Start blasadmin for the _template deployment by entering the following: blasadmin -s _template 2 Create a new default deployment of a specific type by entering the following: create deployment_name base_port profile_types where deployment_name is the name of the new deployment you are creating. You can create deployments while executing from a shell or while reading in a file. profile_type is a comma separated list of the type of Application Server to create: Configuration. Job. You can either start the Application Server or deploy it and start it later. If the base_port is 9500. Chapter 3 Configuring the Application Server 99 . For guidelines for creating the name.) ■ BMC BladeLogic creates the Application Server. For information on each type. This command provides the ability to set up an environment from the command line. see the description of the Application Server Name field in “Creating additional Application Servers from the BMC BladeLogic Console” on page 97. or All (a combination of all three types). Creating additional Application Servers from the command line You can also add a new Application Server deployment using the blasadmin Create command. click Yes. see “Viewing and editing an Application Server’s profile” on page 100. the authentication port would be 9540. base_port is a number that is combined with offset values to determine Authentication and Application Server port numbers. To accept the profile. NSH_Proxy.Creating additional Application Servers ■ To add or change attributes for the server. see “Viewing and editing an Application Server’s profile” on page 100. click No.

clear the field. NOTE Always use the Edit Application Server Profile dialog to add or change the attributes (configuration parameters) in an Application Server’s profile. See “Starting Application Servers” on page 41. The Edit Application Server Profile dialog opens. To remove an attribute from the profile. from the Configuration menu. and attributes (configuration parameters). add or change values for attributes. ■ To add an attribute to the Application Server’s profile or to change a default value. To view an Application Server’s profile or change attribute values.Viewing and editing an Application Server’s profile NOTE For instructions on using blasadmin to create a stand-alone NSH Proxy. The fields in this dialog are effectively overrides to default values or to previouslyspecified configuration parameters. Do not use the blasadmin utility. see “Setting up a stand-alone Network Shell Proxy Server” on page 145. select Infrastructure Management. ■ ■ 100 BMC BladeLogic Server Automation Administration Guide . 3 Start the Application Server on the machine where you are setting up the deployment. clear the field and type the value you want. 1 In the BMC BladeLogic Console. 3 Right-click the Application Server you want to edit and select Edit. type a value in the blank field. type. use the Edit Application Server Profile dialog. Viewing and editing an Application Server’s profile An Application Server profile is a definition of an Application Server’s identity: its name. 4 In the Edit Application Server Profile dialog. 2 Expand the hierarchy of the Application Servers node. To change an existing value.

_launcher. see “Editing the list of roles with Application Server Launcher access” on page 113. the Display Name is the same as the Application Server name. _pxe. Do not use the same name as the default Application Server. the ServiceType is Automatic. You cannot edit this attribute. specified during configuration. The name can include letters. ■ By default. which means that the Application Server can only be started using the Infrastructure Dialog. If you leave this field blank. If you specify a name. _spawner.Viewing and editing an Application Server’s profile Attributes listed depend on the Server Profile Type (Application Server Type). JOB. and underscores (_). rather than the Application Server name. You cannot edit this attribute. You cannot edit this attribute. The name that appears in all user interfaces. Chapter 3 Configuring the Application Server 101 . For information. A ServiceType of Automatic means that the Application Server will be started automatically by the AppServerLauncher. Do not use the following reserved names: default. digits. See “Application Server types” on page 96. _install. follow these guidelines: ■ Specify a name that is unique on the host. ■ ■ True — The Application Server uses the default deployment. NSH. ServiceType Determines if the Application Server should be automatically started by the AppServerLauncher. The following table describes all attributes that a profile can include. as specified during configuration. _template. The type can be one or more of the following: CONFIGURATION. Attribute Application Server Name Display Name Description The name for the Application Server. hyphens (-). or ALL. _old. ■ A ServiceType of Manual. You do not have to specify a name. Server Profile Type(s) The Application Server’s type. _util ■ ■ Default Deployment Shows whether the Application Server uses the default deployment. False —The Application Server do not use the default deployment.

unless the server is also a configuration server (Application Server Type JOB and CONFIGURATION). that service accepts only connections from the local machine. 102 BMC BladeLogic Server Automation Administration Guide . the default is Base Port plus 40. However. For example: service:appsvc. the Application Server does not run an Authentication Service. CLRProxyPort The listening port for Network Shell (NSH) communication. you can direct these commands to run on a particular Application Server. If that Application Server is a JOB type Application Server.10:9841 Typically. This convention avoids conflicts when there are multiple Application Servers on the same host.bladelogic:blsess://10. Note: When you create a job server (Application Server type JOB). By default BLCLI commands run on the Application Server processing the job. In that case. To include this attribute in the profile. this port defaults to 0. AppSvcPort The listening port for the Application Service (the service that accepts client connections). it runs a ClientConnectionService. AuthSvcPort The listening port for the Authentication Service (the service that authenticates user identities). unless the server is also a configuration server (Application Server Type JOB and CONFIGURATION).Viewing and editing an Application Server’s profile Attribute AppServiceURLs Description The Application Service URLs distributed in the session credentials issued by the Authentication Service. When you create a new Application Server. If you set this value to 0. If you set this value to 0. the Application Server does not run an Application Service. it cannot process BLCLI commands used for import/export. if you want to run Network Shell Script Jobs that include BLCLI commands. specify one or more comma-separated values. you do not need to specify a value for this attribute. When you create a new Application Server.bladelogic:blsess://localhost:9841. Note: When you create a job server (Application Server Type JOB).10. BMC BladeLogic sets this value to the Base Port plus 41. the port is disabled. service:appsvc. BLCLI commands used for import or export must run on an Application Server with its type set to CONFIGURATION or ALL. If you set this value to 0. However.10. This convention avoids conflicts when there are multiple Application Servers on the same host. BMC BladeLogic sets this value to the Base Port plus 40.

When you create a new Application Server. You do not need to specify a value for this attribute. Specify any argument that can be specified to the Java command line If the MaxHeapSize attribute is set and you specify an -Xmx flag for JVMArgs. it is assumed to be valid and is used when the Application Server is started. for example: 1G or 225M. If you do not specify a value. This convention avoids conflicts when there are multiple Application Servers on the same host. When you create a new Application Server.log extension. To specify a value. Chapter 3 Configuring the Application Server 103 . the value for JVMArgs is used instead of MaxHeapSize. The maximum dynamic port number.Viewing and editing an Application Server’s profile Attribute ConsoleLogfileName Description The name of the console log file for the Application Server. MaxJobs MaxPort The maximum number of jobs the Application Server can execute simultaneously. use the standard Java notation. the Application Server does not start. This convention avoids conflicts when there are multiple Application Servers on the same host. This convention avoids conflicts when there are multiple Application Servers on the same host. By default. When you create a new Application Server. If you edit this attribute. MinPort The minimum dynamic port number. MaxWorkItemThreads The maximum size of the pool of threads that can be used to process BMC BladeLogic Console jobs. This convention avoids conflicts when there are multiple Application Servers on the same host. MaxHeapSize You can specify a value for MaxHeapSize but you are not required to do so. The default is 20. this value is set to Base Port + 99. see the hardware requirements for the Application Server in the BMC BladeLogic Server Automation Installation Guide. BMC BladeLogic sets the console log file’s name to the Application Server name plus “_console”. The default is 50. For information on recommended maximum Java heap size for Application Servers. JMXManagementPort The port used to access the BMC BladeLogic JConsole. specify a name that is unique on the host. If you specify a value. This value is usually adequate. If the value is not valid. When you create a new Application Server. BMC BladeLogic sets this value to the Base Port + 50. BMC BladeLogic sets this value to the Base Port plus 38. specify a name that is unique on the host. JVMArgs Arguments to pass to Java Virtual Machine for this Application Server. If you edit this attribute. LogfileName The name of the log file for the Application Server. Determines how many targets can be processed in parallel. BMC BladeLogic sets the log file’s name to the Application Server name plus the . plus any information logged to the console. The console log file contains all information logged to the Application Server log. the Application Server uses the heap size set in the Application Server start-up script or service definition.

ProxySvcPort is set to 9842 for the default Application Server.properties sql/reports-sql.bladelogic. When you deploy a new Application Server with its type set to NSH_PROXY or ALL. You can modify this value if necessary. However.com:9842. the ProxySvcPort is automatically set to the Base Port plus 42. When you create a new Application Server. type a comma-separated list in the field. this name is the same as the Application Server Name and its location is: installDirectory/tmp/temporaryDirectoryName When you create a new Application Server.com:9842 ProxySvcPort The listening port for a Network Shell Proxy Service. SqlFiles The list of SQL properties files used by the Database Service. This convention avoids conflicts when there are multiple Application Servers on the same host. When you create a new Application Server.properties sql/streamable_sqlmap.bladelogic.bladelogic:blsess://host2.properties In most cases.Viewing and editing an Application Server’s profile Attribute ProxyServiceURLs Description The Network Shell Proxy Service service URLs. For example: service:proxysvc. BMC BladeLogic sets this value to the Base Port plus 36. You must manually define a listening port for the default deployment of an Application Server. the system uses the default URLs. 104 BMC BladeLogic Server Automation Administration Guide . the list is: sql/sqlmap. BMC BladeLogic sets the temporaryDirectoryName to the Application Server Name. If you leave this field blank. service:proxysvc. If you leave this field blank. SSLPort The listening port for SSL communication. there is no need to change this list. TempDirectoryName The name of the directory that stores the Application Server’s tmp files. you can override the default list by typing a comma-separated list of properties in the field. Usually.properties sql/blas-sqlmap. specify a name that is unique on the host. To override the default URLs. the Application Server does not run a Network Shell Proxy Service. RegistryPort The listening port for traffic between Application Servers that cooperate by distributing jobs to each other. Typically. If you edit this attribute. This convention avoids conflicts when there are multiple Application Servers on the same host. If this value is blank. This convention avoids conflicts when there are multiple Application Servers on the same host. BMC BladeLogic sets this value to the Base Port plus 31.bladelogic:blsess://host1.

■ ■ Listing conflicting attributes When there are Application Servers on the same host.Listing conflicting attributes 5 When you are finished editing the profile. For the most part. All other attributes must be unique. Multiple Application Servers can have the same value for MaxJobs. select Infrastructure Management. 2 In the Infrastructure Management window. 1 In the BMC BladeLogic Console. its Application Server details shows State = CONFLICT. Chapter 3 Configuring the Application Server 105 . Failure to make them unique results in conflicts that can cause a start or restart failure in one or more Application Servers. regardless of what that value is. When an Application Server’s profile has a conflicting attributes. 6 Click OK on the warning that configuration changes do not take effect until you restart the Application Server. a conflict occurs because the same port number has been assigned to more than one Application Server. 7 Start or restart the Application Server to have changes take effect. Typically. expand the hierarchy of the Application Servers node. Rules for defining unique attributes Several rules apply when assigning unique values to attributes: ■ Multiple Application Servers can share any port that is set to 0 if that setting of 0 disables the port. MaxWorkItemThreads. For information on identifying conflicts in Application Servers’ attributes. These conflicts prevent an Application Server from starting or restarting if it has conflicts with one or more currently running Application Servers. each should have a unique profile. from the Configuration menu. You can also use the List Conflicts operation to identify attributes on an Application Server that conflict with attributes on other Application Servers. see “Listing conflicting attributes” on page 105. The Application Server Launcher automatically detects attribute conflicts among the Application Servers that it controls. or SqlFiles. click OK. attributes for these Application Servers cannot have the same values.

The right pane shows: ■ ■ ■ ■ ■ ■ Software version Number of jobs running Number of work item threads Database connections Host operating system JVM memory usage 106 BMC BladeLogic Server Automation Administration Guide . host (using the same database). The left pane lists each Application Server’s Display Name and Authorization Port. Getting information about Application Servers You can display information about an Application Server and the services that it runs. For each attribute. NOTE To display information about the Application Server. General information about an Application Server Click the Application Server’s name in the left pane. the panel shows the attribute name and the name of Application Server that has the same attribute value specified. This information can be useful for diagnostic purposes. 1 In the BMC BladeLogic Console.Read authorization. A Warning panel lists the attributes that conflict with those other Application Servers.. 2 Expand the hierarchy of the Application Servers node.. your role must be granted the BL_Administration.Getting information about Application Servers 3 Right-click an Application Server and select List Conflicts. select Infrastructure Management. from the Configuration menu. Do the following: A list of Application Servers on the Expand the Application Servers node. 4 Click OK. To display.

The right pane shows: ■ The Application Server Launcher that controls the Application Server Name — The name for the Application Server. ServiceType — (Manual | Automatic) Whether the Application Server is automatically started by the AppServerLauncher. Click the service name.) Expand the hierarchy of the Application Server. Status information from the Application Server Launcher. or starting up. (The number and type of services vary according to the Application Server’s type. stopped. Status — (Ready | Stopped | Starting) Whether the Application Server is ready to perform tasks. (For information. Elapsed Time — The uptime of the Application Server. ■ ■ ■ ■ ■ A list of the services that an Application Server provides Status information about an Application Server service Expand the hierarchy of an Application Server.The Application Server Launchers node To display.. specified during configuration. (This information is displayed if your role has authorization to access the Application Server Launcher. Needs Restart — (True | False) Whether the Application Server has been reconfigured and needs to be restarted. on the Application Server The Application Server Launchers node The Application Server Launchers node lists a node for each Application Server Launcher that is configured to use the database and is available. see “The Application Server Launcher” on page 34. State — (VALID | CONFLICTS) Whether the Application Server’s profile has conflicts that can keep the Application Server from starting. Start Date — The date when the Application Server was started. ■ ■ Server Type— Application Server Type. Display name— The name that appears in all BMC ■ ■ BladeLogic user interfaces.. scroll down.) Chapter 3 Configuring the Application Server 107 .) Do the following: Click the Application Server’s name in the left pane. A menu of actions you can perform Right-click the Application Server. In the right pane.

click Export Detail Report . 2 In the Infrastructure Management window. 108 BMC BladeLogic Server Automation Administration Guide . type a file name for the report.Reporting Application Server information The Application Server Launcher lists a node for each Application Server it controls. Information about the database to which the Application Server is connected. it is only through the Application Server Launcher that you can: ■ ■ ■ Obtain port information for the Application Server Launcher. General information for each PXE server connected to the database and detailed status information about each PXE Servers services. C For File Encoding. B For Object Type. such as UTF8 or Western (windows-1252). you can get the same information about Application Servers and perform the same operations as with the Application Servers node. Optionally. 5 Click Save. 4 On the dialog. Create new Application Servers. enter the information for the report file: A For Object Name. select Infrastructure Management. from the pull-down menu. select the type of character encoding that should be used for the exported data. 3 On the Export AppServer Details Report dialog. select a subdirectory by double-clicking its name in the panel. select a directory where the report should be stored. The report includes: ■ General information for each Application Server configured on the host machine (and using the same database) and detailed status information about each Application Server’s services. However. Through the Application Server Launchers node. Reporting Application Server information You can generate a report containing information about all of the Application Servers on the host. Edit the list of roles allowed access to the Application Server Launcher. select a file format. from the Configuration menu. ■ ■ 1 In the BMC BladeLogic Console.

2 Expand the Application Servers node. select Infrastructure Management. from the Configuration menu. 3 Right-click the Application Server and select Start. providing a controlled shutdown. if it has not been deployed. Chapter 3 Configuring the Application Server 109 . 1 In the BMC BladeLogic Console. NOTE You cannot use the stop operation on an Application Server to which a BMC BladeLogic Console is connected. You can perform any of the following management tasks: ■ ■ ■ ■ ■ ■ ■ Starting a specific Application Server Stopping a specific Application Server Redeploying a stopped Application Server Terminating a specific Application Server Restarting a specific Application Server Removing an Application Server Adding unmanaged deployments Starting a specific Application Server The start operation starts the Application Server and automatically deploys it.Managing multiple Application Servers on the same host Managing multiple Application Servers on the same host When there are multiple Application Servers configured on the same host. You can select options for handling the running jobs. Stopping a specific Application Server The stop operation ends running jobs and stops the Application Server. you manage the additional Application Servers through the Infrastructure Management window.

110 BMC BladeLogic Server Automation Administration Guide . If the base_port is 9500. Stop when all running jobs finish. 1 In the BMC BladeLogic Console. 4 On the Redeploy Application Server dialog. from the Configuration menu. NSH_PROXY. base_port is a number that is combined with offset values to determine Authentication and Application Server port numbers. select Infrastructure Management. the offset for the authentication port is 40 by default. 3 Right-click the Application Server and select Redeploy.Redeploying a stopped Application Server 1 In the BMC BladeLogic Console. see “Application Server types” on page 96. the authentication port would be 9540. For information on each type. or ALL (a combination of all three types). whichever comes first. NOTE This action is only available for stopped Application Servers. 2 Expand the Application Servers node. Application Server Type: select the profile type for this Application Server: ■ CONFIGURATION. 4 On the Stop Application Server dialog. select Infrastructure Management. 2 Expand the Application Servers node. from the Configuration menu. JOB. Stop when all running jobs finish OR after specified number of minutes. enter the following ■ Base port: enter a new base port. select the method for handling any running jobs: ■ ■ ■ Stop immediately without waiting for running jobs to finish. For example. 3 Right-click the Application Server and select Stop. 5 Click OK. Redeploying a stopped Application Server You can select a stopped Application Server and then redeploy it with a different profile type.

This selection is useful in cases where Stop does not work. This option automatically migrates any customizations from the existing deployment to the new deployment. Use this operation to have configuration changes take effect. NOTE You cannot use the restart operation on an Application Server to which BMC BladeLogic Console is connected. Restarting a specific Application Server The Restart operation first stops the Application Server and then starts it again. NOTE You cannot use the terminate operation on an Application Server to which BMC BladeLogic Console is connected. 1 In the BMC BladeLogic Console. those options are ignored. when the Application Server is hung. 3 Right-click the Application Server and select Terminate. Terminating a specific Application Server The terminate operation terminates the Application Server process immediately. You cannot enter a new Application Server name. from the Configuration menu. 5 Click OK to validate the information you entered and execute the action on the Application Server launcher.Terminating a specific Application Server ■ Preserve Existing Data: Check this box if you want to preserve deployment data from the existing deployment. Chapter 3 Configuring the Application Server 111 . for example. 2 Expand the Application Servers node. In the case where there are options in the customized deployment that do not exist in the new deployment type. select Infrastructure Management.

and removes references to the Application Server from routing rules. specify options for handling the Application Server’s deployment directory and the database registration. Option Preserve deployment Description Removes the Application Server but leaves its deployment directory unchanged. such as when a system has been decommissioned or repurposed. from the Configuration menu. select Infrastructure Management. 112 BMC BladeLogic Server Automation Administration Guide . this selection removes the Application Server from the BMC BladeLogic environment. 2 Expand the Application Servers node. Delete deployment Preserve server registration Delete server registration 5 Click OK. This selection ensures that the Application Server can still be referenced from routing rules. In effect. This operation can be useful in situations where an Application Server is “missing” and no longer in use. Removes the Application Server but does not delete the database entry for the Application Server. select Infrastructure Management. 2 Expand the Application Servers node. from the Configuration menu. In addition. it uses this deployment directory. the Application Server still appears under the Application Server Launchers node Removes the Application Server. deletes its database entry. The Application Server is removed from the Application Server Launcher. If you create a new Application Server with the same name. Removes the Application Server and deletes its deployment directory. 4 In the Remove Application Server dialog. 3 Right-click the Application Server and select Remove. 1 In the BMC BladeLogic Console. 3 Right-click the Application Server and select Restart. Removing an Application Server The remove operation removes an Application Server from the Application Server Launcher so the Application Server does not automatically restart when the Application Server Launcher starts.Removing an Application Server 1 In the BMC BladeLogic Console.

NOTE The option is displayed only if there are unmanaged deployments for this Application Server Launcher. 2 Expand the Application Server Launchers node. only the BLAdmins role is granted authorization to access to the Application Server Launcher. you can add the deployment back into the system without having to restart the launcher. To remove roles from the selected list. from the Configuration menu. Editing the list of roles with Application Server Launcher access At BMC BladeLogic installation time. 1 Right-click an Application Server Launcher node and select Add Unmanaged Deployments.Adding unmanaged deployments Adding unmanaged deployments If you have Application Servers which have been removed from the system. 2 On the Add Unmanaged Deployments dialog. Then click the right arrow to move the role to the Selected Roles list. 3 Click OK. but have had their deployments preserved (using the Preserve deployment option). Chapter 3 Configuring the Application Server 113 . 3 Right-click the Application Server Launcher and select Edit Role List. select one or more roles you want to have access to the Application Server Launcher. under Selected Roles. 4 Under Available Roles. The Application Server Launcher added the deployments you selected as managed Server Profiles. 1 In the BMC BladeLogic Console. select one or more roles. Users with this role can use the Edit Application Server Launcher Roles dialog to grant or deny authorization to other roles. select one or more unmanaged deployments you want to add to the Application Server Launcher. enabling you to manage these deployments as you would any other deployment in the system. select Infrastructure Management. Then click the left arrow.

conf_created_on'. update bluser set password = ''. click OK. use this procedure to update the password on the Application Server. 114 BMC BladeLogic Server Automation Administration Guide . commit.Resetting database passwords for the Application Server 5 When you have finished editing the list. 1 Execute the following command to set the passwords to a blank value. Resetting database passwords for the Application Server In the event that the database user password has been changed. 2 Run the application server configuration wizard and set the new password on the Database page of the wizard. delete from system_property where name = 'tpasswd. See “Using the application server configuration wizard to change configuration settings” on page 39.

Chapter 4 4 Administering security This chapter describes the approaches to security that are possible with BMC BladeLogic. including a discussion of some fundamental security concepts (see “Fundamentals of BMC BladeLogic security” on page 117). The following graphic illustrates the various communication legs possible within a BMC BladeLogic system. In BMC BladeLogic. the approaches to security vary. depending on which system components are communicating. Chapter 4 Administering security 115 .

116 BMC BladeLogic Server Automation Administration Guide . This chapter includes links to specialized terms that are defined in the Chapter 9. “Security Glossary”. A discussion of network security requires many technical terms.See “Security for different communication legs” on page 130 for a discussion of the security approaches that are possible with each leg and references to any implementation procedures required.

when an Application Server establishes an authenticated connection with an agent. For example. he or she must authenticate with the BMC BladeLogic Authentication Service (one of the services hosted by a BMC BladeLogic Application Server) prior to establishing a client/server session. depending on the communication leg. Chapter 4 Administering security 117 . For any entity that communicates directly with agents—including Network Shell clients that access agents without going through a Network Shell Proxy Server— authentication relies on the TLS protocol’s support for client authentication via clientside X. If the user’s session credential is cached and the credential has not expired. the user can then exit the console and start a BLCLI session without authenticating again. In this way a user’s context can easily be passed between BMC BladeLogic client applications. For example. or BLCLI) and middle tier applications (Application Server or Network Shell Proxy Server). For communication between most client tier applications (the BMC BladeLogic Console.509 certificates. which are the identities and addresses of the Application Services and Network Shell Proxy Services that can be accessed using the session credential. allowing client users to re-establish new application sessions without re-authenticating. For more information on single sign-on. client users authenticate with the Authentication Service and acquire a BMC BladeLogic single sign-on (SSO) session credential. BMC BladeLogic employs a twostep process. Then the client uses that session credential to establish an application session with middle tier services. BMC BladeLogic offers the following capabilities: ■ ■ ■ ■ Authentication Session layer security Impersonation and privilege mapping Authorization Authentication Authentication is the process of verifying the identity claimed by a system entity. Often that entity is a user. BMC BladeLogic client applications can cache SSO session credentials obtained from the Authentication Service. First. Written into the session credential are service URLs. see “Single sign-on” on page 121. On the other hand.Fundamentals of BMC BladeLogic security Fundamentals of BMC BladeLogic security To implement a secure data center automation system. the identity to be verified is the server hosting the Application Service. BMC BladeLogic uses different approaches for authentication. when a user starts the BMC BladeLogic Console. a user can launch the BMC BladeLogic Console and authenticate. Network Shell. but in some situations the entity is a service.

At installation. see “Securing communication with CA certificates” on page 224. ■ ■ ■ The BMC BladeLogic Application Server and all client applications use FIPS 140-2 certified modules for cryptographic operations on all transported data. the Authentication. For more information. the client establishes a TLS connection with the Application Server hosting the Authentication Service. this document refers only to TLS. SSL.Session layer security NOTE Be aware of the following documentation conventions: ■ BMC BladeLogic supports both TLS and its predecessor. you can provision middle tier entities with certificates issued by a CA. the session is terminated.) When a client first accesses a middle tier entity (by necessity. the Authentication Service) to authenticate and obtain an SSO credential. the client must validate a certificate from that entity. middle tier entities are provisioned with self-signed X. the certificate is added to the client’s list of trusted certificates and a secure session is established for the client. (Optionally. as well as its SHA1 and SHA256 fingerprints. If the user chooses not to trust the self-signed certificate. the client is presented with the Application Server’s self-signed X.509 certificates. The client application displays the certificate’s content. which includes the following capabilities: ■ RSA key negotiation 128-bit AES block encryption algorithm CBC (Cipher Block Chaining) block cipher mode SHA1 HMAC construction for integrity protection. In the course of the TLS handshake. When Network Shell connects to a Network Shell Proxy Server. BMC BladeLogic system components employ TLS_RSA_WITH_AES_128_CBC_SHA for the TLS cipher suite.509 certificate. Application. or Network Shell Proxy Services). In all contexts (excluding BMC BladeLogic Decision Support for Server Automation). The client cannot recognize the certificate as trusted so the client prompts the user to accept or reject the self-signed certificate. this document refers to that state as Network Shell operating in proxy mode. ■ Session layer security BMC BladeLogic uses TLS for session layer security across all communications legs. Communication with middle tier When a BMC BladeLogic client establishes a TLS connection with a middle tier entity (that is. For the sake of simplicity. If the user chooses to trust the self-signed certificate. 118 BMC BladeLogic Server Automation Administration Guide .

pem in the directory where the agent is installed. settings in the exports. If this file is not present. Communication with server tier Self-signed certificates are used to secure communication between entities that communicate directly with agents. These entities could be Application Servers.Impersonation and privilege mapping All client services running on a BMC BladeLogic Application Server (Authentication Service. Impersonation and privilege mapping Impersonation (on UNIX) and privilege mapping (on Windows) allow a user to assume an effective user identity and a set of user permissions on remote servers. The certificate is stored in a file called certificate. Once a client application has added the Authentication Service’s certificate to its list of trusted certificates. (For details on this process.local configuration files can specify the local user context under which the client’s commands should execute. repeater. see “How BMC BladeLogic grants access to RSCD agents” on page 237. When a client—that is an Application Server. Self-signed server-side certificates are used to secure the exchange of TLS session keys between agents and entities that communicate with agents. or Network Shell client—contacts an RSCD agent on a remote server. This file is known as a keystore. Network Shell Proxy Server. you must provision agents with the SHA1 fingerprints of trusted clients’ self-signed certificates. you can choose to use self-signed client-side certificates for TLS sessions with RSCD agents. If this file is present. and users. The keystore resides in a default location. Application Service. BMC BladeLogic generates self-signed certificates when an agent is installed on a server.) If entries in the configuration files map the client user to a local user. or Network Shell clients. repeaters. Client applications re-write the keystore file when a trusted X. Network Shell Proxy Servers. or Network Shell client establishes a connection with the agent. user.509 certificate is added to or removed from the trusted certificate store. but you can modify that location. and Network Shell Proxy Service) share the same certificate. Network Shell Proxy Server. BMC BladeLogic does not use client-side certificates. By default. In this way BMC BladeLogic takes advantage of the access control mechanisms provided by the remote server’s operating system. Chapter 4 Administering security 119 . However. it is read every time an Application Server. they too share the same certificate. the agent creates one. A client’s list of trusted certificates are stored in a file written in the Privacy Enhanced Mail (PEM) format. the agent temporarily acquires the privileges that the managed server’s operating system grants to this local user. To accomplish this. By default. the user is no longer prompted to trust that certificate when establishing future sessions with any of these other related entities. as described in “Setting override locations for client SSO files” on page 150. If your installation employs multiple Application Servers or stand-alone Network Shell Proxy Servers.

or users. a Network Shell user with a junior admin role can be permitted to perform read-only Network Shell commands such as ls. Every system object that you manage with the BMC BladeLogic Console has ACLs defined for it. On Windows systems the agent performs user privilege mapping. Or. if a user authenticates as “joe” and then begins to use Network Shell. This privilege mapping mechanism allows the agent to acquire the mapped local user’s group privileges without having to access that user’s Windows credentials (user name and password). BMC BladeLogic supports authorization via a role-based access control (RBAC) model and a set of very granular access control lists (ACLs). but that same junior administrator cannot make any changes on those servers. For more on RBAC and authorization in BMC BladeLogic. users are mapped to an underprivileged account (nobody on UNIX or Anonymous on Windows). You can also define authorizations for Network Shell users if they are configured to communicate through a Network Shell Proxy Server. If user equivalency is not possible (that is. see the BMC BladeLogic Server Automation User Guide.” Authorization Authorization refers to the process of giving someone access to resources or permissions to perform certain actions. For more on impersonation and privilege mapping. BMC BladeLogic uses a technique called user privilege mapping. (Network Shell users communicating directly with agents do not assume any particular role. the user will take on the privileges and permissions of the user “joe” on the target server. the BMC BladeLogic Console can allow users with an expert role to create component templates and other users with a junior admin role to check for compliance with these templates. If there is no user mapping defined in the exports. grep. on UNIX systems the agent fully impersonates the user through setuid. which allows the agent to temporarily grant the local user’s group privileges to an unprivileged user account called BladeLogicRSCD. the system attempts to match the user ID of the incoming user to a user ID defined on the managed server where the RSCD agent is installed. the user is assigned that user’s permissions in the same manner as if there was explicit mapping—that is.local configuration files. or ps on certain directories within a group of servers.) For example. If there is a match. If the managed server is a Windows machine.Authorization If the managed server is a UNIX-style system. see Chapter 5. joe does not exist on the target server as a user). the agent fully impersonates a user through a call to the setuid command. and those ACLs can grant a range of authorizations to users. “Setting up configuration files. For example. 120 BMC BladeLogic Server Automation Administration Guide . user.

the client application establishes a TLS session with a middle tier service—either an Application Service or Network Shell Proxy Service. To connect to a middle tier server. Single sign-on functionality supports the following authentication mechanisms: SRP LDAP RSA SecurID PKI Active Directory/Kerberos Domain Authentication Chapter 4 Administering security 121 . Then. The BMC BladeLogic Console has user authentication utilities built into it. client users authenticate with a BMC BladeLogic Authentication Service (one of the services hosted by a BMC BladeLogic Application Server) and acquire an SSO session credential. having acquired a credential. the client presents its SSO session credential to the service. First. The reports server uses these credentials to authenticate to the BMC BladeLogic Authentication Service. which validates the credential and uses it to establish the identity of the client user. All BMC BladeLogic client applications except BMC BladeLogic Decision Support for Server Automation can share the same session credential. Users can authenticate with blcred and acquire session credential for the command line applications. BMC BladeLogic provides a command linebased user authentication utility called blcred. A reports user logs in by providing the user credentials required for his or her authentication type. that credential can be used to establish a new client/server session without requiring the user to re-authenticate. the command line applications require access to a session credential that was acquired previously. The session credential cache file can only hold one session credential. BMC BladeLogic Console users can choose whether to cache newly acquired session credentials in a cache file. Once the TLS session is established. BMC BladeLogic Decision Support for Server Automation is a web-based application that uses BMC BladeLogic single sign-on functionality in a different manner than other BMC BladeLogic applications. The two client command line applications (BLCLI and Network Shell) do not. SSO session credentials have a finite lifetime and can be cached in the file system of the client host. Readers familiar with HTTP cookies may view SSO session credentials as analogous to cookies used to communicate an authenticated identity to a BMC BladeLogic service. This constraint will be relaxed in a future release. If a client application's credential cache contains an unexpired session credential.Single sign-on Single sign-on BMC BladeLogic employs a two-stage procedure for authenticating client application users to their respective middle-tier servers.

Client-tier users are correlated to identities maintained in directories on external LDAP servers. the Authentication Service issues the client a session credential. The Authentication Service authenticates users by contacting the first available LDAP server in the list. To take advantage of automatic failover. This type of protocol allows a client-tier user to prove to an Authentication Service that he or she has knowledge of a password without ever revealing that password to the middle-tier service. tree-like structure. Information in the user table is derived from the RBAC utility in the BMC BladeLogic Console. LDAP BMC BladeLogic authentication can be based on Lightweight Directory Access Protocol (LDAP). For SRP. the Authentication Service issues the client a session credential. Non-disclosing authentication protocols protect against man-in-the-middle attacks. that registry is a user table in the central Application Server’s database. the BMC BladeLogic Authentication Service connects to an LDAP server to authenticate the user. In BMC BladeLogic. After successfully authenticating the SRP user. the BMC BladeLogic Authentication Service authenticates client-tier users against a registry of authorized users. If the LDAP server successfully authenticates the user. a protocol for querying and modifying directory entries that are arranged in a hierarchical. 122 BMC BladeLogic Server Automation Administration Guide . When a BMC BladeLogic client-tier user logs in and provides an LDAP “distinguished name” and password. users can set up a list of multiple LDAP servers that provide the same directories of user information. At that point a BMC BladeLogic client application can use the session credential to establish an authenticated secure session with the Application Service or Network Shell Proxy Service identified by the service URLs in the session credential. At that point a BMC BladeLogic client application can use the session credential to establish a secure authenticated session with the Application Service or a Network Shell Proxy Service identified by the service URLs in the session credential.SRP SRP The secure remote password (SRP) protocol is a non-disclosing authentication protocol (also characterized as a zero-knowledge protocol). allowing password-based mutual authentication of a client and server.

RSA SecurID RSA SecurID BMC BladeLogic authentication can incorporate RSA’s Authentication Manager to utilize its two factor authentication mechanism. If authentication is successful. While logging into a BMC BladeLogic client. At that point a BMC BladeLogic client application can use the session credential to establish a secure authenticated session with the Application Service or Network Shell Proxy Service identified by the service URLs in the session credential. Active Directory/Kerberos Active Directory/Kerberos (AD/Kerberos) authentication integrates BMC BladeLogic with a key distribution center (KDC) to utilize the Kerberos v5 protocol for authenticating client-tier users. Kerberos mediates an authentication exchange between the client (the BMC BladeLogic Console or the blcred utility) and the domain controller as well as between the client and the BMC BladeLogic Authentication Service. At that point a BMC BladeLogic client application can use the session credential to establish a secure authenticated session with the Application Service or Network Shell Proxy Service identified by the service URLs in the session credential. The current status of a certificate can be verified by contacting an OCSP Responder. which is obtained from an RSA SecurID token. the user must insert a smart card into a card reader and enter a PIN. Through middleware. If the information the user enters is valid and the OCSP Responder verifies the validity of the user’s certificate. SecurID users authenticate by providing a user name and a passcode. After successfully Chapter 4 Administering security 123 . AD/Kerberos authentication correlates client-tier users to identities maintained within an Active Directory domain controller rather than the central Application Server’s RBAC-based database. a BMC BladeLogic client can access the appropriate certificate and private key on the smart card to authenticate the user. PKI BMC BladeLogic authentication can be based public key infrastructure (PKI) for users who present a type of smart card known as a common access card (CAC). The passcode consists of a PIN and the current token code. the Authentication Service issues the client a session credential. Client-tier users in BMC BladeLogic are correlated to identities maintained within RSA’s Authentication Manager rather than the central Application Server’s RBAC-based database. the Authentication Service issues the client a session credential. When an Active Directory domain user chooses to authenticate using AD/Kerberos.

the BMC BladeLogic Authentication Service issues the BMC BladeLogic client an SSO session credential. This information is passed to the Authentication Service. If the domain controller successfully authenticates the user. Domain Authentication The Domain Authentication solution integrates BMC BladeLogic with Active Directory without requiring users to obtain a Kerberos ticket—that is. AD/Kerberos takes advantage of the Windows single-sign on functionality. a BMC BladeLogic client application can use that session credential to establish an authenticated secure session with the Application Server or a Network Shell Proxy Service identified by the service URLs in the session credential. At that point. BMC BladeLogic clients (the BMC BladeLogic Console or the blcred utility) accept a user’s name. Domain Authentication provides greater flexibility than AD/Kerberos.COM. Although BMC BladeLogic Decision Support for Server Automation does not support AD/Kerberos authentication. a user can log into Windows as Sally@DOMAIN. it can authenticate AD/Kerberos users who provide a user name. a Windows user credential. domain. For example. and password (see Domain Authentication). BMC BladeLogic clients use authentication profiles. A user logging into the BMC BladeLogic Application Server can authenticate with a different user name than the user name used to log into the Windows system hosting the BMC BladeLogic client application. In Domain Authentication. domain.Domain Authentication authenticating the domain user. which are collections of information that a BMC BladeLogic client application needs to log into the BMC BladeLogic Authentication Service. A user logging into the BMC BladeLogic Authentication Service authenticates with the same user credential he or she acquires when the logging into the Windows domain. which delegates user authentication to the Active Directory domain controller.COM and then log into BMC BladeLogic as Administrator@DOMAIN. The BMC BladeLogic client application can then use the session credential to establish an authenticated secure session with the Application Server or a Network Shell Proxy Service identified by the service URLs in the session credential. and password. An authentication profile identifies the following: 124 BMC BladeLogic Server Automation Administration Guide . Authentication profiles To facilitate single sign-on. the Authentication Service issues the client a session credential.

SecurID. establishment of the client/server session is aborted if the session credential cache does not contain a session credential matching the requirements specified in the authentication profile. For BMC BladeLogic Decision Support for Server Automation. each pointing to a different instance of BMC BladeLogic. ■ ■ ■ A user can define multiple authentication profiles. LDAP. and one for Development. the port used to access the Authentication Service. such as the distinguished name template for LDAP. In Network Shell or BLCLI. so a user does not have to specify an Application Server or listening port. Chapter 4 Administering security 125 . Using authentication profiles When a user launches a BMC BladeLogic client application (except BMC BladeLogic Decision Support for Server Automation). when logging on. if a user plans to log into the Application Server using various authentication mechanisms. AD/Kerberos. If a user wants to connect to all three from the same client application. the client application establishes a connection to the service listed in the session credential. Instead. The BLCLI or Network Shell user can use the BMC BladeLogic Console or the blcred utility to obtain and cache the appropriate SSO session credential. users simply specify an authentication type. and an authentication mechanism. In another example. users do not define authentication profiles. Each authentication profile specifies an Application Server hosting an Authentication Service. or Domain Authentication Information specific to individual authentication protocols. PKI.Authentication profiles ■ Application Server host name Listening port for the Authentication Service hosted by the Application Server Authentication protocol: SRP. For example. The client application looks in its cache of session credentials to determine if it holds a current credential that was acquired under the conditions defined by the authentication profile. the BMC BladeLogic Console prompts the user to log into the Authentication Service identified by the specified authentication profile. If a cached session credential includes information matching these specifications. he or she would need three different authentication profiles. Each reports server always accesses the same Authentication Service. one for QA. If the client application does not possess an appropriate session credential. he or she would need an authentication profile for each mechanism. he or she must specify an authentication profile. an organization might employ three instances of BMC BladeLogic—one for Operations.

A session credential contains the following information: ■ BMC BladeLogic user name 126 BMC BladeLogic Server Automation Administration Guide . The BMC BladeLogic Console lets users choose to cache session credentials. Within that file each authentication profile must have a unique name. The XML file resides at a default location. see “Using the blcred utility” on page 226.Single sign-on session credentials The BMC BladeLogic Console provides a dialog that allows users to add or delete authentication profiles as well as select an authentication profile for the purpose of logging in. For more information on using blcred. as described in “Setting override locations for client SSO files” on page 150. The BMC BladeLogic command line applications provide various options for identifying an authentication profile by name. The blcred utility always caches any session credential it obtains from the Authentication Service. For more information on using environment variables. but you can modify that location. it issues a session credential to the client application. Note that BMC BladeLogic Decision Support for Server Automation does not require authentication profiles so it is not listed in the table below. Mechanisms to Identify Authentication Profile environment variable: BL_AUTH_PROFILE_NAME secure file setting: auth_profile BLCLI command line option: -v authenticationProfileName environment variable: BL_AUTH_PROFILE_NAME Takes precedence over environment variable Application Network Shell (in proxy mode) Precedence Takes precedence over secure file setting BMC BladeLogic Console login dialog For more information on setting up authentication profiles for the BMC BladeLogic Console. Authentication profiles are stored in a single XML file. Single sign-on session credentials When an Authentication Service authenticates a user. The blcred utility also can be used to add or delete authentication profiles. The following table summarizes these options. see the BMC BladeLogic Server Automation User Guide. see “Environment variables” on page 129. BMC BladeLogic clients use session credentials to establish secure sessions with Application Servers and Network Shell Proxy Servers.

The session credential cache file resides at a default location. the reports server does not cache the session credential on the client’s system. or Domain Authentication Service URL. the credential cache can hold a maximum of one session credential at any time. such as Application Services and Network Shell Proxy Services. its host address. AD/Kerberos. Each of these URLs specifies the type of service. BMC BladeLogic Decision Support for Server Automation can automatically renew the user’s session credential without requiring the user to re-authenticate. A BMC BladeLogic service. This allows users to schedule recurring report jobs. ■ ■ ■ ■ ■ ■ Session credentials are digitally signed by the issuing Authentication Service. as described in “Setting override locations for client SSO files” on page 150. LDAP. File system access controls only allow the user for whom the credential was issued to access the credential cache Unlike other BMC BladeLogic system components. Expiration time for session credential Maximum lifetime for session credential Client system’s IP address Authorized roles for user Service URLs of BMC BladeLogic services that the credential can be used to access. Each time a user logs into the reports server from a browser. The reports server can potentially hold the user’s session credential even after the user’s connection with the reports server terminates. upon being presented with a session credential. its host address. and its port. BMC BladeLogic relies on system access controls to restrict access to the session credential cache. and its port. the user provides data required for authentication. This restriction will be relaxed in a future release. On both Windows and UNIX. Chapter 4 Administering security 127 . SSO session credentials are cached in a file on the client host. verifies the digital signature to ensure the credential’s authenticity and integrity.Single sign-on session credentials ■ Protocol used to authenticate user: SRP. SecurID. The reports server relays this information to the Authentication Service and obtains a session credential for the user. which identifies the Authentication Service that issued the session credential. but you can modify that location.

the role may be specified through an environment variable.dat. BMC BladeLogic command line applications can specify a role using a command line option or an environment variable. When a user is authorized for multiple roles. if multiple roles are defined interactive prompts from command line dialog command line option: -r roleName environment variable: BL_RBAC_ROLE Network Shell (in proxy mode) interactive prompts from command line dialog environment variable: BL_RBAC_ROLE Takes precedence over environment variable 128 BMC BladeLogic Server Automation Administration Guide . Application BMC BladeLogic Console BLCLI Mechanisms to Specify a Role Precedence GUI dialog. The following table summarizes the options available to specifying a role. BMC BladeLogic only supports a keytab file for SRP authentication. When using Network Shell or BLCLI. In this release. Note that BMC BladeLogic also employs a keytab file for its AD/Kerberos implementation. If a user is authorized for only one role.Keytab files Keytab files If you are using SRP authentication. which lets you change roles after a Network Shell session is established. For instructions on setting up user_info. Keytab files provide the blcred utility with long-term user credentials that can be used to authenticate a user.dat. Network Shell also provides a command called chrole. The SRP keytab file is called user_info. Procedures for the AD/Kerberos implementation explain the use of a keytab file in that context. see “Generating a user information file” on page 230. for single sign-on. RBAC role selection When a session is established. keytab files are useful when running unattended automation scripts that make use of Network Shell proxy services or make calls to the BLCLI. Because of their sensitive nature. If a user is authorized for multiple roles. access to keytab files should be tightly controlled. a user must be assigned to an RBAC role. the user can interactively select a role while logging into a BMC BladeLogic client application. he or she is assigned to that role after logging into an application.

The command line options take precedence over environment variable settings. BLCLI and blcred also provide command line options for providing the same data. Environment Variable BL_SSO_TRUSTED_CERT_ KEYSTORE_FILE BL_RBAC_ROLE Description Specifies location of file storing trusted certificates Specifies RBAC role For More Information: “Trusted keystore” on page 151 “RBAC role selection” on page 128 BL_SSO_CRED_CACHE_FILE Specifies location of session “Session credential cache file” credential cache file on page 151 BL_AUTH_PROFILES_FILE Provides location of file containing authentication profile definitions Identifies authentication profile to use when authenticating “Authentication profile file” on page 151 “Using authentication profiles” on page 125 BL_AUTH_PROFILE_NAME Chapter 4 Administering security 129 . use a procedure like the following: % BL_SSO_CRED_CACHE_FILE=userHomeDirectory\bladelogic_alt\bl_sesscc % export BL_SSO_CRED_CACHE_FILE The following table details the environment variables that can be used with single sign-on functionality. To set an environment variable.Environment variables Environment variables BMC BladeLogic provides environment variables that can be used to pass configuration data to the command line client applications (BLCLI and Network Shell) and the blcred utility.

and authorization—are consistent throughout BMC BladeLogic. authentication can be configured differently for the various communication legs. BLCLI to Application Server For traffic between BLCLI and an Application Server. The BMC BladeLogic Authentication Service supports many authentication mechanisms. privilege mapping. see “Implementing single sign-on” on page 135. BMC BladeLogic relies on TLS to secure communication between client and server and single sign-on credentials to authenticate client users. For implementation details. Additional configuration is necessary if you want to customize the default behavior or use other authentication protocols. Implementation A default BMC BladeLogic installation sets up a single sign-on system using SRP authentication and TLS session layer security. SRP is the default user authentication mechanism. The following sections describe security for the following communication legs in BMC BladeLogic: ■ ■ ■ ■ ■ ■ ■ BMC BladeLogic Console to Application Server BLCLI to Application Server Network Shell to Network Shell Proxy Server Reports client to reports server Application Server to agent or repeater Network Shell to agent Repeater to agent BMC BladeLogic Console to Application Server For traffic between the BMC BladeLogic Console and an Application Server. BMC BladeLogic relies on TLS to secure communication between client and server and single sign-on credentials to authenticate client users.Security for different communication legs Security for different communication legs Although some aspects of security—session layer security. Client users obtain single sign-on credentials by authenticating themselves to the BMC BladeLogic Authentication Service. 130 BMC BladeLogic Server Automation Administration Guide .

SRP is the default user authentication mechanism. Network Shell does not have a built-in authentication utility. to authenticate themselves to an Authentication Service and acquire a SSO session credential. Users can acquire and cache a SSO session credential through the BMC BladeLogic Console and the BLCLI can use that credential. or customize SSO behavior. ■ Network Shell to Network Shell Proxy Server For traffic between a Network Shell client and a Network Shell Proxy Server. blcred. For implementation details. Additional configuration is necessary if you want to customize the default behavior or use other authentication protocols. see “Implementing single sign-on” on page 135. SRP is the default user authentication mechanism. Users can acquire and cache a SSO session credential through the BMC BladeLogic Console. Additional configuration is necessary to set up a Network Shell Proxy Service. see “Implementing single sign-on” on page 135. see “Using the blcred utility” on page 226. BLCLI users can use a separate user authentication command line utility. Implementation ■ A default BMC BladeLogic installation sets up a single sign-on system using SRP authentication and TLS session layer security. Chapter 4 Administering security 131 . The BLCLI does not have a built-in authentication utility. blcred. Network Shell can use that credential. BMC BladeLogic relies on TLS to secure communication between client and server and single sign-on credentials to authenticate client users. implement any authentication mechanism other than SRP. Implementation ■ A default BMC BladeLogic installation sets up a single sign-on system using SRP authentication and TLS session layer security. to authenticate themselves to an Authentication Service and acquire a SSO session credential. Network Shell users obtain single sign-on credentials by authenticating themselves to the BMC BladeLogic Authentication Service.Network Shell to Network Shell Proxy Server BLCLI users obtain single sign-on credentials by authenticating themselves to the BMC BladeLogic Authentication Service. Alternatively. The BMC BladeLogic Authentication Service supports many user authentication mechanisms. For implementation details. The BMC BladeLogic Authentication Service supports many user authentication mechanisms. Alternatively. For information on using the blcred utility to obtain session credentials. Network Shell users can use a separate user authentication command line utility.

Organizations that want Kerberos-based authentication for BMC BladeLogic Decision Support for Server Automation can use the Domain Authentication protocol. but you can replace it with a custom certificate. Users authenticate themselves to the reports server over the HTTPS session. The reports server accesses the BMC SARA Authentication Service to authenticate a user and acquire SSO credentials in the name of the authenticated user. By default 132 BMC BladeLogic Server Automation Administration Guide . For traffic between the reports client and the reports server. To generate a new certificate. they are granted session credentials. Authentication For BMC BladeLogic Decision Support for Server Automation.Reports client to reports server ■ For information on using the blcred utility to obtain session credentials. and password. Server-side certificates The TLS communication protocol automatically negotiates an encryption algorithm to secure data. Reports client to reports server A BMC BladeLogic Decision Support for Server Automation client is a web browser that connects to the reports server. the reports server obtains data for reports from the reports data warehouse. which can authenticate AD/Kerberos users when they provide their user name. Implementation A default installation of BMC BladeLogic Decision Support for Server Automation sets up a BMC BladeLogic Authentication Service called BMC SARA Authentication. BMC BladeLogic Decision Support for Server Automation supports all BMC BladeLogic authentication protocols except AD/Kerberos. BMC BladeLogic relies on the HTTPS protocol (HTTP over TLS) to secure communication between the browser and reports server. you can use a tool such as OpenSSL. see “Using the blcred utility” on page 226. BMC BladeLogic Decision Support for Server Automation data is packaged using Cognos Reports. user authentication functions much like authentication for other BMC BladeLogic applications. Once a user on the reports client is authenticated. domain. By default the reports server uses a self-signed certificate. After users are authenticated. Server-side certificates are used during the TLS handshake to establish session keys for encrypting traffic between the web browser and the reports server.

The procedure is identical. agents and repeaters are provisioned with the SHA1 fingerprints of the Application Servers’ self-signed certificates. For all implementation details. BMC BladeLogic relies on TLS to secure communication and the following options for authenticating the Application Server host to the repeater or agent: ■ Self-signed certificates—Enables agents or repeaters to authenticate Application Servers. Additional configuration is necessary if you want to use an Authentication Server that is not located on the same machine as the reports server. see the BMC BladeLogic Decision Support for Server Automation User Guide. ■ No authentication—By default. Implementation To implement this approach. use these procedures as well. To accomplish this.Application Server to agent or repeater only SRP authentication is enabled on the BMC SARA Authentication Service. modify the exports file on each agent or repeater. ■ IP address—Limits incoming traffic for an agent or repeater to IP addresses of specific Application Servers. BMC BladeLogic relies on TLS to secure communication and the following options for authenticating the Network Shell client to the agent: Chapter 4 Administering security 133 . see “Exports file” on page 240. see “TLS with client-side certs – Securing a Windows Application Server” on page 202 or “TLS with client-side certs – Securing a UNIXbased Application Server” on page 206. Application Server to agent or repeater For traffic between an Application Server and an agent or repeater. Implementation A default installation of BMC BladeLogic provides no authentication for this communication leg. Network Shell to agent For traffic between a Network Shell client and an agent. Implementation For implementation details. If you want to set up self-signed certificates for a Network Shell Proxy Server. no authentication occurs. For more information. when an Application Server connects to an agent or repeater.

BMC BladeLogic relies on TLS to secure communication and the following options for authenticating the repeater host to the agent: ■ Self signed. Implementation A default installation of BMC BladeLogic provides no authentication. this configuration relies on the host operating system of the Network Shell client to authenticate a user. To accomplish this. see “TLS with client-side certs – Securing a Network Shell client” on page 212. agents are provisioned with SHA1 fingerprints of repeaters’ selfsigned certificates. client-side certs—Enables agents to authenticate repeaters. ■ No authentication—By default. modify the exports file on each agent. 134 BMC BladeLogic Server Automation Administration Guide . To accomplish this. ■ IP address—Limits an agent’s incoming traffic to IP addresses of specific Network Shell clients. (If necessary. see “Implementing Security – Repeater to agent” on page 217. client-side certs—Enables agents to authenticate Network Shell clients. Implementation For implementation details. see “Exports file” on page 240.) Implementation To implement this approach. no authentication occurs other than the authentication provided by the underlying operating system of the host where Network Shell is running when a Network Shell user logs in. agents are provisioned with SHA1 fingerprints of Network Shell clients’ self-signed certificates. Application Servers can also be specified in the same way. For more information. Implementation For implementation details.Repeater to agent ■ Self-signed. Repeater to agent For traffic between a repeater and an agent. when a Network Shell client connects to an agent. Instead.

Implementing single sign-on ■ IP address—Limits an agent’s incoming traffic to IP addresses of specific repeaters. All communication with the Application Service occurs over TLS. Chapter 4 Administering security 135 ■ ■ . Network Shell Proxy Service—Used for accessing the functionality of a Network Shell Proxy Server. Implementation A default installation of BMC BladeLogic provides no authentication for this communication leg. Implementing single sign-on To implement the BMC BladeLogic single sign-on system. Application Servers and specific clients can be specified in the same way. ■ No authentication—By default. when a repeater connects to an agent. After a client user authenticates. Some configuration is necessary to set up a Network Shell Proxy Service. A client application (the BMC BladeLogic Console or the BLCLI) presents the session credential to the Application Service to establish a secure session with one of the targeted services listed within the session credential. After a client user authenticates. you need the following services: ■ Authentication Service—Used for authenticating user identities and issuing session credentials to authenticated users. All communication with the Authentication Service occurs over TLS. Application Service—Used for accessing the functionality of the BMC BladeLogic Application Server. all requests from the BMC BladeLogic Console or the blcred utility. A standard installation of BMC BladeLogic Decision Support for Server Automation sets up a stand-alone Authentication Server for reports users. All communication with the Network Shell Proxy Service occurs over TLS. no authentication occurs. For more information. modify the exports file on each agent. A Network Shell client presents the session credential to the Network Shell Proxy Service to establish a secure session with the Network Shell Proxy Server. see “Exports file” on page 240. SRP authentication is supported by default for all BMC BladeLogic applications. the client application is issued a session credential.) Implementation To implement this approach. the client application is issued a session credential. A standard installation of the Application Server includes an Authentication Service. The Authentication Service processes all user authentication requests—that is. A standard installation of the Application Server sets up the Application Service. (If necessary.

Each of the steps in this procedure references a section that describes another procedure. see “Setting up certificate verification using OCSP” on page 153. OCSP verification is only enabled by default for PKI authentication. If necessary. see “Configuring the Application Service” on page 140. A default installation of a BMC BladeLogic Application Server sets up an Application Service to support single sign-on. Currently. you can instruct a client application to use different files.Implementing single sign-on Use the following master procedure to implement the single sign-on system. The files used by the SSO system reside at default locations. see “Setting override locations for client SSO files” on page 150. see “Configuring the Authentication Service” on page 137. see any of the following: Implementing LDAP authentication Implementing RSA SecurID authentication Implementing PKI authentication Implementing Active Directory/Kerberos authentication Implementing Domain Authentication 136 BMC BladeLogic Server Automation Administration Guide . 1 If you want to modify the default behavior of an Authentication Service. 3 If you want to use a Network Shell Proxy Server. 4 If you want to modify the location of any SSO files used by any BMC BladeLogic client application. 5 If you want to set up OCSP verification of certificates. 6 If you want the SSO system to support any authentication protocol other than SRP. see “Configuring the Network Shell Proxy Service” on page 142. A default installation of a BMC BladeLogic Application Server sets up an Authentication Service to support single sign-on for BMC BladeLogic client applications. You can optionally use OCSP verification for Application Servers provisioned with custom certificates. 2 If you want to modify the default behavior of the Application Service.

Configuring the Authentication Service Configuring the Authentication Service A default installation of a BMC BladeLogic Application Server sets up an Authentication Service to support single sign-on and SRP authentication. Additional configuration is necessary to support other authentication protocols. enter the following: set AuthServer SessionCredentialLifetime # where # is the lifetime. By default. of issued session credentials. The Authentication Service runs on the same machine as the Application Server. 3 To specify the duration of session credentials that the Authentication Service issues. Use the following procedure to set any of those options. ■ To enable or disable SecurID authentication. as described in “Starting the Application Server Administration console” on page 45. 2 To specify a listening port other than 9840 for the Authentication Service. ■ To enable or disable LDAP authentication. There are various options for modifying the standard behavior of an Authentication Service. 1 Start the Application Server Administration console (that is. 4 To specify the types of authentication mechanisms that are enabled. the session credential lifetime is 600 minutes (10 hours). do any of the following: ■ To enable or disable SRP authentication. enter the following: set AuthServer AuthSvcPort # where # is the number of the port. in minutes. enter the following: set AuthServer IsSRPAuthEnabled true|false By default this value is set to true. the blasadmin utility). Setting AuthSvcPort to 0 turns off the Authentication Service. this value is set to false. enter the following: set AuthServer IsLdapAuthEnabled true|false By default. enter the following: set AuthServer IsSecurIdAuthEnabled true|false Chapter 4 Administering security 137 .

do any of the following: ■ To override the default Application Service URL. If that Application Server is a JOB type Application Server. it cannot process BLCLI commands used for import/export. ■ To enable or disable AD/Kerberos authentication.serviceURL where serviceURL.com:9841 Typically. enter the following: set PkiAuth IsEnabled true|false By default. this value is set to false.. BLCLI commands used for import or export must run on an Application Server with its type set to CONFIGURATION or ALL. this value is set to false.bladelogic. you do not need to change the default Application Server URL. if you want to run Network Shell Script Jobs that include BLCLI commands.service:appsvc. this value is set to false.bladelogic..com:9841. you can direct these commands to run on a particular Application Server. enter the following: set AuthServer AppServiceURLs " " Note the blank space between the quotation marks. ■ To enable or disable PKI authentication.serviceURL is a list of alternative Application Service’s service URLs. enter the following: set AuthServer IsDomainAuthEnabled true|false By default. enter the following: set AuthServer IsADKAuthEnabled true|false By default..Configuring the Authentication Service By default. bladelogic:blsess://host2. ■ To configure the Authentication Service so it does not write any Application Service service URLs into the session credential it issues. enter the following: set AuthServer AppServiceURLs serviceURL.. 5 To write non-default destination service URLs into a session credential. By default BLCLI commands run on the Application Server processing the job. However.. For example: set AuthServer AppServiceURLs service:appsvc.. this value is set to false..bladelogic: blsess://host1. ■ To enable or disable Domain Authentication. 138 BMC BladeLogic Server Automation Administration Guide ..

NOTE If you provide a value for ProxyServiceURLs on an Application Server that is defined as type ALL.bladelogic: blsess://host1. ■ To configure the Authentication Service so it reverts to its default behavior of writing the service URL of the local Network Shell Proxy Service into session credentials (assuming the local proxy service is enabled). Chapter 4 Administering security 139 . ■ To configure the Authentication Service so it does not write any Network Shell Proxy Service service URLs into the session credential it issues. see “Setting up a stand-alone Network Shell Proxy Server” on page 145. enter the following: set AuthServer AppServiceURLs "" Note that there is no blank space between the quotation marks. set AuthServer ProxyServiceURLs service:proxysvc.Configuring the Authentication Service ■ To configure the Authentication Service so it reverts to its default behavior of writing the service URL of the local Application Service into session credentials.serviceURL is a list of alternative Network Shell Proxy Service’s service URLs. enter the following: set AuthServer ProxyServiceURLs "" Note that there is no blank space between the quotation marks.bladelogic.serviceURL where serviceURL. you must identify the URL for the stand-alone server’s Network Shell Proxy Service service URL.com:9842. enter the following: set AuthServer ProxyServiceURLs " " Note the blank space between the quotation marks. For more information on setting up a stand-alone Network Shell Proxy Server.com:9842 If you are setting up a stand-alone Network Shell Proxy Server.bladelogic. enter the following: set AuthServer ProxyServiceURLs serviceURL. For example. ■ To override the default Network Shell Proxy Service service URL. then any Network Shell commands run by jobs on this Application Server are routed to the Network Shell Proxy Servers identified by ProxyServiceURLs.service:proxysvc. bladelogic:blsess://host2.

8 Restart the Application Server (see “Restarting a specific Application Server” on page 111). By default. enter the following: set AuthServer AuthSvcSocketTimeout # where # is the maximum number of minutes to wait for a response from a worker thread. There are various options for modifying the standard behavior of an Application Service.Configuring the Application Service Providing service URLs lets you specify alternative addresses (in the form of service URLs) for an Application Service or Network Shell Proxy Service. no additional configuration is necessary. 6 To specify the maximum number of worker threads used for authentication. Once the maximum is exceeded. the Authentication Service will. include its service URL in the session credential it issues. 140 BMC BladeLogic Server Automation Administration Guide . When a session credential has no destination service URL. Use the following procedure to set any of those options. This is particularly useful when your installation has a network configuration (for example. by default. a client cannot use it to access an Application Service or Network Shell Proxy Service. Overriding the defaults and specifying empty service URLs results in session credentials with no destination service URLs. 7 To specify a time-out for responses from Authentication Service worker threads. Typically. Configuring the Application Service A default installation of BMC BladeLogic sets up an Application Service to support single sign-on. By default the Authentication Service creates a session credential that only includes the service URL for the local Application Service. enter the following: set AuthServer MaxAuthSvcThreads # where # is the maximum number of threads that can process requests from clients. the maximum is 5. a firewall) that requires address translations. By default the maximum is 1. the connection times out. If the local Network Shell Proxy Service is enabled.

■ false means the IP address of the client does not have to match the client’s IP address included in the session credential. enter the following: set appserver ValidateClientIpAddress true|false In the command shown above: ■ true means the IP address of the client must match the client’s IP address included in the session credential. the client is denied access. enter the following: set appserver ValidateRequestURL true|false In the command shown above: ■ true means the service URL of the Application Service or Network Shell Proxy Service handling the request must match the service URL to which the request was addressed. you are not using a load balancer for the Authentication Service. Setting AppSvcPort to 0 turns off the Application Service. 2 To specify a listening port other than 9841 for the Application Service. 3 To specify whether the client’s IP address included in a session credential should be compared to the IP address of the client that is presenting the credential. ■ false means the receiving service’s URL does not have to match the service URL to which the request is addressed. By default. If the IP addresses do not match. enter the following: set appserver AppSvcPort # where # is the number of the port. Set this value to false only if you are using a network load balancer for your Application Servers or Network Shell Proxy Servers. By default. 4 To specify whether the service URL of the Application Service or Network Shell Proxy Service specified in a client’s service request should be compared to the actual service URL of that service. this option is set to true.Configuring the Application Service 1 Start the Application Server Administration console. and a client can access any one of many Application Servers when establishing a session connection. Chapter 4 Administering security 141 . this option is set to true. as described in “Starting the Application Server Administration console” on page 45.

Configuring the Network Shell Proxy Service Always set this value to false if you are using a network load balancer for your Application Servers or Network Shell Proxy Servers. See “Setting Up a Network Shell Proxy Server” on page 142. When setting up a Network Shell Proxy Server. you have the following options: ■ Setting up an Application Server that performs many functions including that of Network Shell Proxy Server. Setting up an Application Server that serves as a stand-alone Network Shell Proxy Server. Using this configuration. See “Setting Up a Network Shell Proxy Server” on page 142. If an Application Server experiences high traffic loads that include Network Shell activity. This procedure is only necessary if you want to use Windows user mapping to run jobs that act on Windows target servers. See “Setting up a stand-alone Network Shell Proxy Server” on page 145. A stand-alone Network Shell Proxy Server cannot access the BMC BladeLogic database. Configuring the Network Shell Proxy Service Use this procedure to set up a Network Shell Proxy Server that manages traffic from Network Shell clients. 142 BMC BladeLogic Server Automation Administration Guide . 5 Restart the Application Server (see “Restarting a specific Application Server” on page 111). It can relieve the overall workload by processing all Network Shell traffic. and a client can access any one of many Application Servers when establishing a session connection. Setting Up a Network Shell Proxy Server Use this procedure to configure an Application Server so that it either functions as an Application Server that also manages traffic from Network Shell clients or it only manages Network Shell traffic. Setting up an Application Server that functions exclusively as a Network Shell Proxy Server. you may want to reduce overall traffic loads by setting up an Application Server that functions exclusively as a Network Shell Proxy Server. which means it only manages Network Shell traffic and performs no other Application Server functionality. A default installation of a BMC BladeLogic Application Server does not set up a Network Shell Proxy Server. a Network Shell Proxy Server can accommodate all authentication protocols that BMC BladeLogic supports. ■ ■ This section also includes a description of how to set up Network Shell Proxy Services for Application Servers that process jobs (see “Setting up Network Shell Proxy Services for Windows user mapping” on page 149).

2 Start the Application Server Administration console. the Application Server does not run a Network Shell proxy service. see “Configuring multiple Application Servers on the same host” on page 93. To accomplish this. NSH_PROXY—The Application Server functions exclusively as a Network Shell Proxy Server. By default the Network Shell Proxy Server listens for traffic on port equal to Base Port plus 42. Each proxy thread can accommodate multiple Network Shell client connections by switching between connections when there is no traffic on a particular connection. By default this value is set to 5. Increasing the maximum number of proxy threads can improve performance for Network Shell users. enter the following: set appserver MaxNshProxyThreads # where # is the maximum number of threads.Configuring the Network Shell Proxy Service 1 Start the Network Shell Proxy Server using an application server profile with its Type set so it includes one of the following: ■ ALL—The Application Server performs many functions including Network Shell Proxy Server. However. 5 To adjust the performance of proxy threads processing Network Shell client connections. specify a maximum idle time for thread processing. using an excessive number of threads can potentially degrade the performance of a Network Shell Proxy Server. you do not have to set a value for ProxySvcPort. ■ For more information on application server profiles. enter the following: set appserver NshProxyMaxThreadIdleTime # where # can be any of the following: Chapter 4 Administering security 143 . If this value is acceptable. modify the listening port for the Network Shell Proxy Server by entering the following: set appserver ProxySvcPort # where # is the number of the port on the Application Server that listens for Network Shell traffic. 4 To specify the maximum number of threads that are available to process Network Shell client connections. If a value is not set for ProxySvcPort. 3 If necessary. as described in “Starting the Application Server Administration console” on page 45.

which means the connection is never closed. By default this value is set to 7200 seconds. This value specifies the number of seconds for obtaining a NSH proxy socket connection to the Application Server. the harder it is for that thread to process more than one connection. When there is no traffic over the connection between a Network Shell client and its proxy for this period of time. the connection is automatically closed. When the specified period expires. enter the following: set appserver IdleNshProxyPruneTime # where # is a value in minutes. While the thread is idle it continues to serve the current connection. 6 To specify the maximum idle time for a connection with a Network Shell client. The longer you instruct a thread to be idle. By default this value is set to 0. 144 BMC BladeLogic Server Automation Administration Guide . 7 To specify the timeout settings for obtaining a NSH proxy socket connection to the Application Server. A value greater than zero specifies a period. By default this value is set to 60 seconds. This value specifies the number of seconds for NSH proxy socket reads before the socket times out. >0 – Provides a compromise between the two settings described above. 8 To specify the timeout settings for NSH proxy socket reads. that a thread should remain idle. Each thread is dedicated to a single connection so the thread never switches connections. -1 – Provides the fastest performance for a particular connection. in milliseconds. 9 Restart the Application Server (see “Restarting a specific Application Server” on page 111). By default NshProxyMaxThreadIdleTime is set to 500 ms.Configuring the Network Shell Proxy Service 0 – Provides the best thread switching performance. A thread is always available to serve another connection after traffic ends on the current connection. enter the following: set appserver NshProxySocketConnectTimeout # where # is a value in seconds. enter the following: set appserver NshProxySocketOperationTimeout # where # is a value in seconds. the thread can switch to another connection.

provide the same password for the Application Server’s certificate that you entered when installing the central Application Server. 11 Assign the NSH_PROXY. A stand-alone Network Shell Proxy Server can perform no other Application Server functionality. 2 Copy the bladelogic. In this configuration. Setting up a stand-alone Network Shell Proxy Server Use this procedure to configure a stand-alone Network Shell Proxy Server. blasadmin) to create a new deployment of type NSH_PROXY and configure it as a stand-alone Network Shell Proxy Server. 1 Install an Application Server on the machine where you want to create a standalone Network Shell Proxy Server. NOTE You cannot use Windows user mapping to grant permissions to a user on a managed server when that user is running a Network Shell client to access a managed server through a standalone Network Shell Proxy Server. See “Setting up a Network Shell Client to run in proxy mode” on page 147. and you must perform some configuration on the central Application Server.keystore at installDirectory/br/deployments/_template/bladelogic. Do not run the Post-Install Configuration wizard. you must create a Network Shell Proxy Server deployment using the blasadmin utility. search for all instances of bladelogic. To perform this procedure. You must repeat this step for every Network Shell client that should communicate with the Network Shell Proxy Server. When installing.keystore file from the central Application Server. Using the copied bladelogic. you can find bladelogic. use the Application Server Administration console (that is. It cannot even access the BMC BladeLogic database. a deployment of an Application Server is configured to function only as a Network Shell Proxy Server. 3 On the Network Shell Proxy Server.keystore.keystore on the Application Server where you are setting up a Network Shell Proxy Server. perform the following steps: A Start blasadmin for the _template deployment by entering the following: blasadmin -s _template Chapter 4 Administering security 145 .Connect authorization to any role that should be used to connect to a Network Shell Proxy Server. replace all occurrences of bladelogic. such as the _template and _launcher directories.keystore that may exist within installDirectory/br/deployments or any of its subdirectories. To accomplish this.keystore file. On the central Application Server. On the Network Shell Proxy Server.Configuring the Network Shell Proxy Service 10 Set up a client for Network Shell users.

For new deployments of an Application Server. and select Edit. B Expand Application Servers. E Indicate that the Network Shell Proxy Server should not contact the BMC BladeLogic database by entering the following command: set appserver PwdStore file 4 Start the Application Server on the machine where you are setting up a stand-alone Network Shell Proxy Server. If the base_port is 9500. configure the central Application Server by doing the following: A Select Configuration => Infrastructure Management. for ProxyServiceURLs. modify the listening port for the Network Shell Proxy Server by entering the following: set appserver ProxySvcPort # where # is the number of the port on the Application Server that listens for Network Shell traffic. For example. If this value is acceptable.Configuring the Network Shell Proxy Service B Create a new default deployment of a Network Shell Proxy Server by entering the following: create new_proxy base_port NSH_PROXY new_proxy is the name of the new Network Shell Proxy Server you are creating. you do not have to set a value for ProxySvcPort. C On the Edit Application Server Profile. select the central Application Server. See “Starting Application Servers” on page 41. enter the following: 146 BMC BladeLogic Server Automation Administration Guide . right-click. base_port is a number that is combined with offset values to determine Authentication and Application Server port numbers. C Switch to the newly created deployment by entering the following: switch new_proxy D If necessary. If a value is not set for ProxySvcPort. 5 Using the BMC BladeLogic Console. the offset for the authentication port is 40 by default. the Application Server does not run a Network Shell Proxy Service. the Network Shell Proxy Server listens for traffic on a port equal to Base Port plus 42. the authentication port would be 9540.

you must have the BMC BladeLogic Console installed. 6 Restart the central Application Server (see “Restarting a specific Application Server” on page 111). if you plan to run Network Shell and BLCLI scripts unattended on this client machine.Connect authorization to any role that should be used to connect to a Network Shell Proxy Server. 1 Start Network Shell for a client installation and use the secadmin utility to create an entry in the secure file that specifies the following: ■ auth_profile=authProfile. You must repeat this step for every Network Shell client that communicates with the Network Shell Proxy Server. Setting up a Network Shell Client to run in proxy mode Use this procedure to configure a Network Shell client so it can run in proxy mode— that is. See “Setting up a Network Shell Client to run in proxy mode” on page 147. NOTE To use the blcred utility.Configuring the Network Shell Proxy Service service:proxysvc. For a complete description of blcred. 8 Assign the NSH_PROXY. where authProfile is the name of the authentication profile that holds a description of the Authentication Service from which the required session credential should be issued and the authentication mechanism that was used to authenticate the user when the session credential was acquired. this procedure includes steps to ensure that the scripts have access to valid SSO session credentials. You can use the blcred utility to authenticate a user and acquire a new session credential.bladelogic:blsess://NSH_proxy_server_host:proxy_svc_port In this entry NSH_proxy_server_host is the host where you have set up the Network Shell Proxy Server and proxy_svc_port is the port number you defined in step D above (under step 3). 7 Set up a client for Network Shell users. The value used for authProfile must match the name of an authentication profile included in that file. see the blcred man page. Additionally. Primarily this procedure consists of some settings you must add to the secure file for a client installation. Authentication profiles are defined in the authentication profiles file. Note that the BL_AUTH_PROFILE_NAME environment variable can override the value of this secure file setting. so it can communicate with servers via a Network Shell Proxy Server. Chapter 4 Administering security 147 .

you can use the BMC BladeLogic Console to generate authentication profiles on this client machine (see the BMC BladeLogic Server Automation User Guide for details). 148 BMC BladeLogic Server Automation Administration Guide . or you can copy authenticationProfiles.xml.xml from a machine where the console is installed and authentication profiles have already been created. For more information on secadmin. see “Secure file” on page 253.Configuring the Network Shell Proxy Service ■ auth_profiles_file=fileName. where fileName is the Network Shell-style path to the XML file containing authentication profile definitions. Note that the BL_AUTH_PROFILES_FILE environment variable can override the value of the auth_profiles_file setting in the secure file. 2 Assign the NSH_PROXY.xml file. 3 To run Network Shell and BLCLI scripts unattended from this client machine. See the BMC BladeLogic Server Automation User Guide for information on using the BMC BladeLogic Console to set up authentication profiles. ■ appserver_protocol=ssoproxy For example.xml" -appserver_protocol ssoproxy -T encryption_only -e tls For more information on the secure file. such as /c/Program Files/BMC Software/BladeLogic/version/NSH/br/authenticationProfiles. the following is a default entry in the secure file on a client machine running Network Shell: default:protocol=5:auth_profile=QAProfile: auth_profiles_file=/c/Program Files/BMC Software/BladeLogic/ version/NSH/br/ authenticationProfiles. You can create an authentication profile using blcred or you can create one beforehand using theBMC BladeLogic Console.Connect authorization to any role that should be used to connect to a Network Shell Proxy Server. To create the authenticationProfiles. enter the following from Network Shell: secadmin -m default -p 5 -auth_profile QAProfile -auth_profiles_file "/c/Program Files/BMC Software/BladeLogic/version/NSH/br /authenticationProfiles. You can provide an authentication profile name using a command line option for blcred or by defining the BL_AUTH_PROFILE_NAME environment variable.xml: appserver_protocol=ssoproxy:tls_mode=encryption_only:encryption= tls To use the secadmin utility to generate the default entry shown above. see “Using the secadmin utility” on page 258. do the following: A Provide an authentication profile name that can be used to generate an SSO session credential.

— Let the Network Shell client (operating in proxy mode) and the BLCLI prompt the user to make a role selection after establishing an SSO session. provide a value for ProxyServiceURLs. password. The following procedure configures an Application Server so that Network Shell traffic will be routed through a Network Shell Proxy Service for any Application Server that is processing jobs. or the job may not run at all.dat. and other information required for the authentication mechanism. make a role selection by doing one of the following: — Define the BL_RBAC_ROLE environment variable. which stores a user name.dat. see “Generating a user information file” on page 230. This procedure is only necessary for Application Servers that handle jobs and are defined as type ALL or JOB. select Configuration => Infrastructure Management. C If the user is authorized for multiple roles. and role. jobs acting on target servers may not use Windows user mapping and instead may operate using user privilege mapping. — Let the blcred utility prompt for a user name. password. For information on setting up user_info. Setting up Network Shell Proxy Services for Windows user mapping If you are using automation principals to implement Windows user mapping. password. This procedure also requires you to modify the secure file on the Application Server.Configuring the Network Shell Proxy Service B Provide user information required for the authentication mechanism specified in the authentication profile by doing any of the following: — Enter command line options to blcred that provide a user name. and other information required for the authentication mechanism. 1 Using the BMC BladeLogic Console. set up a keytab file called user_info. — For SRP authentication. 2 Expand the Application Servers node. your Application Server environment must meet certain criteria. 3 On the Edit Application Server Profile dialog. Chapter 4 Administering security 149 . If Application Servers are not correctly configured. Right-click the Application Server you want to modify and select Edit. — Provide a BLCLI command line option that specifies the user’s role.

4 If necessary. 7 Configure the secure file on the Application Server so the appserver_protocol option is set to ssoproxy. see “Viewing and editing an Application Server’s profile” on page 100. The value you provide should have the format service:proxysvc. Setting override locations for client SSO files The BMC BladeLogic system of single sign-on stores SSO user information in the following files: Authentication profile file Session credential cache file Trusted keystore Each of these SSO files resides at a default location.Setting override locations for client SSO files This value should identify a Network Shell Proxy Service running in the Application Server’s environment. provide values for other Application Server attributes. you can instruct a client application to use a file in a different location.bladelogic:blsess://nshProxyServerHost:portNumber In the value shown above. nshProxyServerHost is the fully qualified name of the host where a Network Shell Proxy Server is running. If necessary. 5 Click OK. By default. The following procedures let you define override locations for SSO files for the different BMC BladeLogic client applications: ■ ■ Setting SSO file locations for BLCLI Setting SSO file locations for Network Shell 150 BMC BladeLogic Server Automation Administration Guide . portNumber is the value provided for ProxySvcPort on that Network Shell Proxy Server. ProxySvcPort is set to Base Port plus 42. 6 Restart the Application Server (see “Restarting a specific Application Server” on page 111). see “Secure file” on page 253. For more information. For more information.

xml file. which is known as a keystore. Platform Solaris Linux AIX HP-UX Windows Default Location userHomeDirectory/. resides in a default location. it issues a session credential. When authenticating with the blcred utility. the client is presented with the Authentication Server’s self-signed X.xml. you can use the BMC BladeLogic Console to generate authentication profiles in their default location (see the BMC BladeLogic Server Automation User Guide for details). Within that file each authentication profile must have a unique name. the client establishes a TLS connection with that entity. BMC BladeLogic Console users can choose to cache session credentials.bladelogic/bl_sesscc where userHomeDirectory is the home directory of the user running the client application C:\Documents and Settings\WindowsUserName\ Application Data\BladeLogic\bl_sesscc Trusted keystore When a BMC BladeLogic client first accesses a middle tier entity (by necessity. BMC BladeLogic clients use session credentials to establish secure sessions with Application Servers and Network Shell Proxy Servers. the certificate is added to the client’s list of trusted certificates. By default. All authentication profiles are stored within a single XML file.509 certificate. A standard BMC BladeLogic installation uses a default location for caching session credentials. If the user does.Setting override locations for client SSO files Authentication profile file Authentication profiles are collections of information that a BMC BladeLogic client application needs to log into the BMC BladeLogic Authentication Service. as described below: Chapter 4 Administering security 151 . This list. or you can copy the authenticationProfiles. that XML file resides at installDirectory/br/authenticationProfiles. Session credential cache file When an Authentication Service authenticates a user.xml file from a client machine where the console is installed and authentication profiles have already been created. as described below. BMC BladeLogic Decision Support for Server Automation does not need an authentication profile to authenticate users. the Authentication Service) to authenticate and obtain an SSO credential. To create the authenticationProfiles. session credentials are automatically cached. In the course of the TLS handshake. The user is asked to trust the certificate.

The following table identifies SSO file locations you can specify for BLCLI and the mechanisms available to provide that information. you can define environment variables or make settings in the client’s secure file. A location provided in an environment variable takes precedence over a secure file setting.509 certificates command line option: -x certificateStore environment variable: BL_SSO_TRUSTED_CERT_KE YSTORE_FILE Takes precedence over environment variable Takes precedence over environment variable SSO File SSO session credentials Precedence Takes precedence over environment variable For more information on using command line options in BLCLI. you can either provide command line arguments or define environment variables. Mechanisms to Identify Location command line option: -f credentialCacheFileName environment variable: BL_SSO_CRED_CACHE_FILE Authentication profile definitions command line option: -w authenticationProfilesFile environment variable: BL_AUTH_PROFILES_FILE Keystore for trusted X.bladelogic/client_keystore.pem where userHomeDirectory is the home directory of the user running the client application C:\Documents and Settings\WindowsUserName\ Application Data\BladeLogic\client_keystore.pem Setting SSO file locations for BLCLI To specify alternative locations for SSO files used by the BLCLI. A location provided in a command line option takes precedence over a location provided with an environment variable. see the BLCLI Help. The following table identifies SSO file locations you can specify and the mechanisms available to provide that information. HP-UX Windows Default Location userHomeDirectory/. For more information on setting environment variables.pkcs12. Setting SSO file locations for Network Shell To specify alternative locations for SSO files used by Network Shell operating in proxy mode.pkcs12. see “Environment variables” on page 129. 152 BMC BladeLogic Server Automation Administration Guide .Setting override locations for client SSO files Platform Solaris Linux AIX.

an Authentication Server uses the information in a certificate to determine which OCSP Responder to access when verifying a certificate. it can also be used to further secure communication between components of the BMC BladeLogic system.Setting up certificate verification using OCSP SSO File SSO session credentials Authentication profile definitions Mechanisms to Identify Location environment variable: BL_SSO_CRED_CACHE_FILE environment variable: BL_AUTH_PROFILES_FILE secure file setting: auth_profiles_file Precedence Takes precedence over secure file setting Keystore for trusted X. it sends a message over HTTP to an OCSP Responder. see “Secure file” on page 253. You want to override the URL for the OCSP responder in the smart card certificate. You will need to perform additional configuration for OCSP if any of the following conditions are true: ■ In the smart card certificate. For almost all situations. When a BMC BladeLogic Authentication Server uses this type of verification. the OCSP Responder sends back a signed message indicating the certificate’s revocation status. OCSP checking can be used to improve the security of the overall BMC BladeLogic system. see “Environment variables” on page 129.509 certificates. this default approach is sufficient and users do not have to perform any additional configuration for OCSP checking. Chapter 4 Administering security 153 ■ ■ . BMC BladeLogic will contact that URL to verify the certificate. For more information on setting environment variables. If the certificate includes a valid URL for an OCSP Responder. Setting up certificate verification using OCSP The Online Certificate Status Protocol (OCSP) is an Internet standard used to verify the revocation status of X. In response. For example. OCSP can determine the revocation status of customer-provisioned certificates for Application Servers (see “Securing communication with CA certificates” on page 224). Typically. there is no URL for the OCSP Responder.509 certificates environment variable: BL_SSO_TRUSTED_CERT_KE YSTORE_FILE For more information on defining settings in the secure file. You want failover capability that tries a second OCSP Responder in situations when the first OCSP Responder fails. Not only is OCSP checking enabled by default for PKI authentication.

When nonce is enabled. For more information on this capability. Enabling or disabling nonce support Use this procedure to enable or disable nonce support when contacting OCSP Responders. No additional configuration is needed to validate responses sent by the OCSP Responder. In a typical configuration. Designating another OCSP responder In some circumstances an organization may want to designate an OSCP Responder. Using nonce helps to thwart replay attacks. The response BMC BladeLogic receives is signed either by the CA that issued the certificate or a responder designated by the CA. The response from that trusted responder may be using a certificate that was not issued by the CA that originally signed the certificate being verified. you can set up a failover capability (see “Configuring failover to an OCSP responder” on page 155). the Authentication Server may be contacting a trusted responder specified within the BMC BladeLogic system. To enhance the security of communication with an OCSP Responder. The Authentication Server can first attempt to contact the OCSP Responder identified within a certificate. either because a certificate does not include a URL for an OSCP Responder or conditions prevent users from contacting that responder. However. The Authentication Server expects that same value will be returned in the response message from the OCSP Responder.Setting up certificate verification using OCSP ■ Your OCSP Responder signs OCSP responses with a private key that is unrelated to the Certificate Authority that issued your smart card certificates. an organization can use the BMC BladeLogic system to designate another OCSP Responder (see “Configuring an additional OCSP responder” on page 155). 154 BMC BladeLogic Server Automation Administration Guide . In such a situation. identified within the BMC BladeLogic system. the Authentication Server encloses a unique value in an OCSP request message. you must create a trust store used specifically for validating communication with the trusted responder. you may need to set up a trust store so the OCSP responses can be validated (see “Setting up a trust store for an OCSP trusted responder” on page 156). Trusting the response from an OCSP responder If you have used the BMC BladeLogic system to designate an OCSP Responder. the Authentication Server can then contact a secondary responder. you may want to enable the OCSP “PKCS” extension. see “Enabling or disabling nonce support” on page 154. If that attempt fails. the Authentication Server contacts the OCSP Responder identified within a certificate. In this situation. When you use BMC BladeLogic to designate an OCSP Responder. in some situations.

start the Application Server Administration console (that is.Setting up certificate verification using OCSP 1 On the Authentication Server. enter the following command: set OCSP IsNonceEnabled true|false By default nonce support is disabled. 3 Restart the Application Server. start the Application Server Administration console (that is. the blasadmin utility). Configuring failover to an OCSP responder Use this procedure to set up failover capability between OCSP Responders. With failover. 2 To enable or disable nonce support. the only URL used to find an OCSP Responder is the URL obtained from the certificate. the blasadmin utility). a second OCSP Responder can be contacted in the event that the first fails for any reason. Once you perform this procedure to define an OCSP Responder. 2 Specify the additional responder by entering the following command: set OCSP ResponderUrl responderURL where responderURL is the URL of the additional responder. start the Application Server Administration console (that is. the Authentication Server only contacts the responder identified in this procedure unless you have defined a failover capability (see “Configuring failover to an OCSP responder” on page 155). the blasadmin utility). This procedure enables the Authentication Server to send the OCSP request to the specified URL. 3 Restart the Application Server. Configuring an additional OCSP responder Use this procedure to define an OCSP Responder other than the responder specified in a certificate. 2 To enable failover between OCSP Responders. If you set responderURL to an empty string (""). 1 On the Authentication Server. By default this value is set to an empty string. 1 On the Authentication Server. enter the following command: Chapter 4 Administering security 155 .

Setting this value to false means the Authentication Server first contacts the OCSP Responder defined in the certificate. a trust store may be necessary in some unusual circumstances. If you change the certificate trust store. No additional configuration is required. in some circumstances an OCSP trusted responder may sign its response with a key derived from some other entity. the response is signed with the private key that was also used to sign the certificate being verified. Typically. In this situation.Setting up certificate verification using OCSP set OCSP IsFailoverEnabled true By default this value is set to false and failover is not enabled. 2 Import the certificates into a trust store file on the Authentication Server. when the Authentication Server contacts an OCSP Responder. However. be sure to restart the Application Server. NOTE The Application Server only reads its certificate store when it starts up. The certificate to be added to the OCSP trust store must be the same certificate that the OCSP Responder inserted into OCSP response messages or the certificate used to issue the certificate that was inserted into OCSP response messages. To establish secure communication with an OCSP trusted responder. 3 To specify which OCSP Responder the Authentication Server should contact first. 156 BMC BladeLogic Server Automation Administration Guide . 4 Restart the Application Server. The trust store must contain a certificate that allows the Authentication Server to trust messages from the OCSP Responder. true means the Authentication Server first contacts the additional responder you have defined using the BMC BladeLogic system (see “Configuring an additional OCSP responder” on page 155). 1 Obtain certificates for all OCSP trusted responders from a certificate authority. enter the following command: set OCSP UseCustomResponder true|false In this command. Setting up a trust store for an OCSP trusted responder Use this procedure to import a certificate and set up a trust store that is used to verify messages from an OCSP trusted responder. you must set up a trust store used exclusively for validating communication with the OCSP trusted responder.

OCSP verification is enabled by default for PKI authentication only. -storepass provides the password for accessing the trust store. -file identifies the certificate you are importing. Chapter 4 Administering security 157 . if you are importing certificates with the Authentication Server’s version of keytool.Setting up certificate verification using OCSP There are many methods for importing a certificate. the blasadmin utility). which is available on any machine where the Authentication Server is installed. Enabling or disabling OCSP Use this procedure to enable or disable OCSP support. 4 Make the OCSP trust store available to the Authentication Server by entering the following command: set OCSP TruststorePathname certificateStore where certificateStore is the local path to the OCSP trust store. 3 On the Authentication Server. One approach is to use Java’s keytool utility. start the Application Server Administration console (that is. Currently. it displays in encoded text.cer -alias ocspt where -keystore identifies the trust store you are setting up.jks -storepass ****** -file DODOcspCert. and -alias is the name you are assigning to the certificate you are adding to the trust store. you might enter a command like the following: installDirectory/jre/bin/keytool -import -keystore PkiOcspTruststore. If you attempt to view this password later using the show command. 5 Provide the password needed to decrypt the certificate by entering the following command: set OCSP TruststorePassword ****** When you enter the password. it is displayed in clear text. 6 Specify the type of OCSP trust store by entering the following command: set OCSP TruststoreType trustStoreType In this command trustStoreType can be either of the following: ■ jks—Trust store uses the “JKS” format. For example. ■ 7 Restart the Application Server. pkcs12—Trust store uses the PKCS12 format.

1 Specify the LDAP servers. Overview of LDAP configuration tasks This section provides an overview of the concepts you should understand and the tasks you must perform to set up LDAP-based authentication. To accomplish this. see step 2 on page 161 in “Configuring LDAP authentication” on page 161. Implementing LDAP authentication The BMC BladeLogic Authentication Service can authenticate users defined in an LDAP registry. 3 Define a distinguished name template. 158 BMC BladeLogic Server Automation Administration Guide . see “Certificate trust store” on page 159. to connect to an LDAP server and authenticate a user. the service uses that information to bind to an external LDAP server—that is. the Authentication Service uses the LDAP Service. 2 Provision the Authentication Server with trusted certificates for all LDAP servers. including any servers used for high availability purposes. enter the following command: set OCSP IsEnabled true|false By default OCSP is enabled. For more information on high availability. see step 3 on page 161 in “Configuring LDAP authentication” on page 161. the Authentication Service issues a session credential with the user’s distinguished name. see “High availability configurations” on page 159. start the Application Server Administration console (that is. the blasadmin utility). When a user logs in and provides an LDAP distinguished name and password. For details on how to specify LDAP servers to the Authentication Server. 2 To enable or disable OCSP support. For more information.Implementing LDAP authentication 1 On the Authentication Server. If the bind is successful. 3 Restart the Application Server. For details on how to configure the Authentication Server to use a trust store for certificates. See “Configuring LDAP authentication” on page 161 for a step-by-step procedure describing how to set up LDAP authentication.

LDAP servers are authenticated via X. you must identify a file that contains trusted X. Certificate trust store The Authentication Service uses TLS to encrypt its connection to the LDAP Server. When provisioning X. This file is the trust store. For more information. you can use one of the following approaches: ■ Install certificates for all LDAP servers. Chapter 4 Administering security 159 . The Authentication Service sends the user’s credential to the LDAP Server only if it can validate the LDAP server’s certificate. 5 Cross-register LDAP users with the users in the RBAC user database. see “Distinguished names” on page 160 and the BMC BladeLogic Server Automation User Guide. For details on how to set up a distinguished name template for the Authentication Server.509 certificates that LDAP servers provide during the TLS handshake. see “Distinguished names” on page 160.509 certificates for the Authentication Server’s trust store. 4 On the BMC BladeLogic client: A Set up a distinguished name template. see “Cross-registering users in the BMC BladeLogic database” on page 160. LDAP connects to the first functional LDAP server in the list. see “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide. For more information. High availability configurations When the Authentication Service needs to authenticate a user by connecting to an LDAP server.509 certificates. Listing multiple servers helps to ensure high availability and failover capability. B Set up an authentication profile for LDAP authentication. When configuring LDAP. see step 4 on page 162 in “Configuring LDAP authentication” on page 161. For more information. When a list of multiple LDAP servers is available. if necessary.High availability configurations For more information. you may want to provide a list of LDAP servers that it can potentially contact. You must repeat this procedure each time an LDAP server’s certificate is updated.

be sure to enter the users full distinguished name in both RBAC and the LDAP registry. CN=sub1 before sending it to the Authentication Service. CN=Users. When cross-registering users. the authentication profile DN template might be CN={0}. DC=sub1. If the common names (CN) specified in the issued certificates are set to the directory server’s fully qualified domain names. Cross-registering users in the BMC BladeLogic database Users must be registered in both LDAP registries and BMC BladeLogic’s RBAC-based user database. DC=com before it is used to contact the LDAP server. For example. be sure to also set IsHostValidationEnabled to True. Distinguished names LDAP users are uniquely identified by distinguished names (DN). Since all CA-issued certificates are trusted. ou=dev. If the user enters “admin” as a user name when logging in. 160 BMC BladeLogic Server Automation Administration Guide . ou=dev. To add X. DN templates can be defined in two places: the Authentication Service and LDAP authentication profiles (described in the BMC BladeLogic Server Automation User Guide). all current and future LDAP certificates are automatically trusted. Only users authorized to use BMC BladeLogic should be entered into the BMC BladeLogic database. o=bladelogic. see the BMC BladeLogic Server Automation User Guide. and the Authentication Service DN template might be {0}. with a DN template of CN={0}. Use RBAC to add users to the BMC BladeLogic database.509 certificates to the Authentication Server’s trust store. For example. see the blcred man page.Distinguished names ■ Install the certificate of the trusted Certificate Authority that issued certificates to the LDAP servers. Cross-registration allows users to be authorized for RBAC roles. CN=Users. which is replaced with the name the user provides when logging in. DC=bladelogic. ou=dev. To authenticate a user. Consequently. For information on adding users to RBAC. The name the user provides is transformed to a full DN by the use of a distinguished name template. CN=Users. which replaces the {0} substring. DC=sub1. DC=bladelogic. There it is transformed into CN=admin. the Authentication Service requires a full DN and a corresponding password. the user’s DN becomes CN=qatest3. o=bladelogic. A DN template is a static string containing a {0} substring. For more information. users only have to enter the part of a DN that is unique to their accounts. Rather than entering a full DN. the user only enters a string such as “qatest3”. such as CN=admin. o=bladelogic. use the blcred utility. however. the profile template transforms the name to CN=admin. DC=com. The two templates can be used together or by themselves.

including any servers used for high availability configurations. 1 On the Authentication Server. the blasadmin utility). this is the amount of time the service waits for a response from one URL before trying the next URL in the list you provided in step A. start the Application Server Administration console (that is. B To specify the amount of time to wait for an LDAP server to respond before terminating the connection.509 certificates. use the blcred utility. C To check that the certificate’s common name matches the LDAP server’s fully qualified name.509 certificates. 3 To set up a trust store for X. enter the following: set Ldap TrustStore certificateStore where certificateStore is the local path to a trust store. 2 To identify LDAP servers. see “High availability configurations” on page 159.Configuring LDAP authentication Configuring LDAP authentication Use this procedure to configure the Authentication Service so it can perform LDAP authentication. In a high availability configuration. enter the following: set Ldap LdapServerURLs serverList where serverList is a list of one or more URLs. enter the following: set Ldap IsHostValidationEnabled true Chapter 4 Administering security 161 . URLs must point to LDAPv3 servers that support the StartTLS extension. enter the following: set Ldap ConnectionTimeoutMs # where # is the number of milliseconds to wait. Separate URLs with commas or other delimiters (see “Specifying multiple values for a parameter” on page 50). To provision a trust store. do the following: A Provision a trust store with X. do the following: A To specify URLs of LDAP servers. For more information on high availability configurations in LDAP. either by adding certificates from individual LDAP servers or by importing a certificate from a PEM file. B To identify the trust store containing trusted certificates.

see “Certificate trust store” on page 159. For more information on X. 162 BMC BladeLogic Server Automation Administration Guide . See “Distinguished names” on page 160 for more information on using a distinguished name template. See “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide. enter the following: set AuthServer LdapUserDnTemplate "text {0} text" where text represents any distinguished name objects that should be included in the template. See “Certificate trust store” on page 159 for more information on using this option. NOTE The Application Server only reads its certificate store when it starts up. enter the following: set AuthServer IsLdapAuthEnabled true By default LDAP authentication is not turned on.Configuring LDAP authentication Setting this value to true causes the Authentication Server to reject X. 4 To define an LDAP distinguished name template. If you change the certificate trust store. be sure to restart the Application Server. 8 Set up authentication profiles using LDAP authentication on the BMC BladeLogic client. 5 To enable LDAP authentication. NOTE The blasadmin utility provides two additional commands for the Ldap component that are not documented here: DefaultUser and DefaultPassword.509 certificates and setting up trust stores. 7 Cross-register LDAP users with the users in the RBAC user database. These commands are only used by BMC BladeLogic Decision Support for Server Automation. 6 Restart the Application Server (see “Restarting a specific Application Server” on page 111).509 certificates if the LDAP server’s fully qualified domain name (FQDN) is not contained in one of the alternative names or the common name (CN). See “Crossregistering users in the BMC BladeLogic database” on page 166.

Configuring RSA Authentication Manager BMC BladeLogic assumes you have installed RSA Authentication Manager and are familiar with its functionality. you must configure a client to use an authentication profile set up for SecurID authentication.Implementing RSA SecurID authentication Implementing RSA SecurID authentication The BMC BladeLogic Application Server can authenticate users by means of RSA SecurID. BMC BladeLogic does not require one to be installed on the Application Server. Configuring SecurID authentication Use this procedure to configure the Authentication Server so it can perform SecurID authentication. the Authentication Service issues a session credential to the user.rec) for the newly created agent. BMC BladeLogic’s integration with SecurID requires the presence of a host configuration file called sdconf. Then generate a configuration file (sdconf. RSA Authentication Agents are used to protect computers and other resources. If an RSA Authentication Agent is installed. which consists of a PIN and the current token code displayed on an RSA SecurID Token. Users might choose to install an RSA Authentication Agent to help troubleshoot SecurID. In that situation you do not have to perform the following procedure. 2 Copy the sdconf. If a user is registered in the RBAC system. the BMC BladeLogic Authentication Service can share that agent’s configuration file.rec. that user can authenticate by providing his or her user name and passcode. In addition. If the information the user enters is valid.rec file to the BMC BladeLogic Authentication Server. See “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide for more information on authentication profiles. This file provides the address of the RSA Authentication Manager Server and other parameters needed to contact it. In some situations the user may be prompted for a new PIN before authentication can occur. Chapter 4 Administering security 163 . The following sections describe those requirements. Configuring a BMC BladeLogic system to support SecurID authentication requires configuration beyond the default setup. 1 Log in to RSA Authentication Manager and define an Authentication Agent Host using the Application Server’s name or IP address.

enter the following: set AuthServer IsSecurIDAuthEnabled true By default SecurID authentication is not turned on. enter the following: set SecurID StatusFilePath filePath where filePath is a local path to that file. The valid range is 0-86400 (24 hours). The default is 600 seconds. enter the following: set SecurID ReadConfigInterval interval where interval is the interval in seconds for reloading the configuration file. 1 On the Authentication Server. enter the following: 164 BMC BladeLogic Server Automation Administration Guide .1. ■ To specify the path to the RSA Authentication Manager’s optional configuration file (sdopts. start the Application Server Administration console (that is. 3 Restart the Authentication Server. When set to false.rec). 4 Provide the path to the RSA Authentication Manager’s configuration file (sdconf. However. If you do not provide a path.rec file. if you change the SecurID configuration. a new file is created in BMC BladeLogic’s /br directory. all SecurID login attempts are rejected. ■ To specify the path to the RSA Authentication Manager’s server status file. The default file name is JAStatus.Configuring SecurID authentication When you perform this procedure. 2 To enable SecurID authentication. 5 Do any of the following to set additional configuration options for SecurID: ■ To instruct the RSA Authentication Agent which IP address to use if the Authentication Server has multiple IP addresses.rec) by entering the following: set SecurID ConfigFilePath filePath where filePath provides a local path to the sdconf. the blasadmin utility). enter the following: set SecurID AgentHost iPAddress ■ To specify the interval at which SecurID settings are read. you do not have to restart the Authentication Server if you are making changes to SecurID configuration. you must wait the amount of time specified by ReadConfigInterval (described below) until the new configuration values are read.

they should all use the same node secret file. The default file name is securid. Chapter 4 Administering security 165 . enter the following: set SecurID LogLevel OFF | DEBUG | INFO | WARN | ERROR | FATAL By default this option is set to OFF. the file is automatically created in BMC BladeLogic’s /br directory. you must grant permission to the bladmin user. This configuration file is used to configure a manual authentication load balancing policy. enter the following: set SecurID LogToFile true | false If set to true. ■ To specify the path to the RSA Authentication Manager’s node secret file. If you are running other applications that also use RSA authentication. By default this option is set to false. the RSA SecurID module creates log entries in the file specified by the LogFilePath option. ■ To specify the path to the SecurID log file. enter the following: set SecurID NodeSecretFilePath filePath where filePath is a local path to that file. ■ To set the logging level. you must ensure that the Application Server can access the node secret file by granting the appropriate operating system-level permissions to the file. When multiple applications share a node secret file.Configuring SecurID authentication set SecurID OptionsFilePath filePath> where filePath is a local path to that file. ■ To turn on logging. Other applications may have similar access requirements. If multiple Application Servers are running on the same host. they may need to share the same node secret file that the Application Server is using. enter the following: set SecurID LogFilePath filePath where filePathis local path to the log file. This file is created automatically the first time the Authentication Service successfully connects to the RSA Authentication Manager. If you do not define a path. on Windows you must grant permission to SYSTEM. On UNIX.

See “Cross-registering users in the BMC BladeLogic database” on page 166. Cross-registering users in the BMC BladeLogic database Users must be registered in both the SecurID user registry and the BMC BladeLogic RBAC-based user database. the Authentication Server can access an OCSP Responder. BMC BladeLogic documentation assumes you know how to add users to the SecurID user registry. 7 Set up authentication profiles using SecurID authentication on the BMC BladeLogic client. See “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide.Cross-registering users in the BMC BladeLogic database NOTE SecurID configuration settings are stored in installDirectory/br/deployments/ deploymentName/options/securid-options. see the BMC BladeLogic Server Automation User Guide. Only users authorized to use BMC BladeLogic should be entered into the BMC BladeLogic database.properties. the Authentication Service issues the client a session credential. By default. 6 Cross-register users in both the SecurID user registry and the RBAC user data base. You can manually edit this file to specify additional debug options. a BMC BladeLogic client can access the appropriate certificate and private key on the smart card to authenticate the user. If the information the user enters is valid and the OCSP Responder verifies the validity of the user’s certificate. Use RBAC to add users to the database. For information on adding users to RBAC. Through ActiveClient middleware. While logging into a BMC BladeLogic client. Cross-registration allows users to be authorized for RBAC roles. the user must insert a smart card into a card reader and enter a PIN. 166 BMC BladeLogic Server Automation Administration Guide . such as RSA_ENABLE_DEBUG=YES. For more information on setting up OCSP. see “Setting up certificate verification using OCSP” on page 153. Refer to RSA’s product documentation for a more complete description of supported settings. OCSP verification is enabled for PKI authentication. To verify whether a certificate is currently valid. Implementing PKI authentication The BMC BladeLogic Authentication Server can use public key infrastructure (PKI) to authenticate users who present a type of smart card known as a common access card (CAC).

you cannot also crossregister users by their distinguished name. 3 To register users by the common name portion of the subject name within a user’s certificate. enter the following: set PkiAuth useCommonName true By default cross-registration by common name is not turned on. 2 To enable PKI authentication. 1 On the Authentication Server. When set to false. NOTE In this release. Note that many steps in this procedure reference a sub-section that describes another procedure. all PKI-based login attempts are rejected. the blasadmin utility).Configuring PKI authentication BMC BladeLogic does not provide a default set of trusted CA certificates for use with PKI authentication. PKI authentication is not supported for Windows 64-bit platforms. You must choose between the common name or the distinguished name approach. start the Application Server Administration console (that is. If you choose to cross-register users by their common name. If you are implementing PKI. For more information on registering users. See “Setting up a trust store for PKI authentication”. see “Cross-registering users in the BMC BladeLogic database” on page 166. Chapter 4 Administering security 167 . 4 Set up a trust store for a PKI certificate. Configuring PKI authentication Use this procedure to configure the Authentication Server so it can perform PKIbased authentication. you must obtain certificates yourself from a CA. users must be cross-registered according their full distinguished name (DN). enter the following: set PkiAuth IsEnabled true By default PKI authentication is not turned on.

see “Setting up certificate verification using OCSP” on page 153. which is available on any machine where the Authentication Server is installed. See “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide.cer where -keystore identifies the trust store you are setting up. NOTE The Application Server only reads its certificate store when it starts up. you might enter a command like the following: installDirectory/jre/bin/keytool -import -keystore PkiTruststore. If you change the certificate trust store. One approach is to use Java’s keytool utility. if you are importing a certificate with the Authentication Server’s version of keytool. start the Application Server Administration console (that is. OCSP verification is enabled for PKI authentication and no additional configuration is necessary. 4 Make the trust store available to the Authentication Server by entering the following command: set PkiAuth TruststorePathname certificateStore 168 BMC BladeLogic Server Automation Administration Guide . 7 Set up authentication profiles using PKI authentication on the BMC BladeLogic client. the blasadmin utility). be sure to restart the Application Server. obtain the certificate for the certificate authority that issued the certificates on the smart card. For example.jks -storepass ****** -file DODJITCCA_19. -storepass provides the password for accessing the trust store (needed later in step 5). 6 Cross-register users in both the user registry maintained for smart card holders and the RBAC user data base. In most situations. and -file identifies the certificate you are importing. 3 On the Authentication Server. There are many methods for importing a certificate. Setting up a trust store for PKI authentication Use this procedure to import a certificate into a trust store and then make that trust store available to the Authentication Server. 2 Import the certificate into a trust store file on the Authentication Server.Configuring PKI authentication 5 To configure certificate verification using an OCSP Responder. See “Cross-registering users in the BMC BladeLogic database” on page 169. 1 If you haven’t already done so.

The Application Server Administration console encodes the password that is displayed. Optionally. users are registered by their full distinguished name. Chapter 4 Administering security 169 . 6 Specify the type of trust store by entering the following command: set PkiAuth TruststoreType trustStoreType In this command trustStoreType can be either of the following: ■ jks—Trust store uses the “JKS” format. see “Configuring PKI authentication” on page 167. BMC BladeLogic documentation assumes you know how to add users to the registry of smart card holders. Only users authorized to use BMC BladeLogic should be entered into the BMC BladeLogic database. 5 Provide the password needed to decrypt the certificate by entering the following command: set PkiAuth TruststorePassword ****** Enter the password using clear text. For information on adding users to RBAC. see the BMC BladeLogic Server Automation User Guide. Cross-registering users in the BMC BladeLogic database Users must be registered in both the registry maintained for smart card holders and the BMC BladeLogic RBAC-based user database.Cross-registering users in the BMC BladeLogic database where certificateStore is the local path to the trust store. ■ 7 Restart the Application Server. By default. users can be registered by just the common name portion of the subject name within their certificate. For details on this option. Cross-registration allows users to be authorized for RBAC roles. Use RBAC to add users to the database. pkcs12—Trust store uses the PKCS12 format.

170 BMC BladeLogic Server Automation Administration Guide . use your existing Kerberos configuration files and modify as necessary based on the descriptions in this section. which relies on the Active Directory registry to store the names and passwords of registered users within its Kerberos realm. you must configure a client to use an authentication profile set up for Domain Authentication. After you configure BMC BladeLogic for Domain Authentication. The Authentication Service uses that information to authenticate the user to the Active Directory KDC. Users provide a user name. a Kerberos realm is an Active Directory domain. see “Configuring BMC BladeLogic for Domain Authentication” on page 171. Configuring a BMC BladeLogic system to support Domain Authentication requires configuration beyond the default setup. If you have already set up AD/Kerberos authentication for BMC BladeLogic. For details on this process. The following sections provide instructions for setting up Domain Authentication at installations where AD/Kerberos authentication is not already being used for BMC BladeLogic.Implementing Domain Authentication Implementing Domain Authentication The BMC BladeLogic Authentication Service can authenticate users via Windows Active Directory user credentials. and password. See “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide for more information on authentication profiles. domain. In Windows.

domain. you must use UPPER CASE LETTERS. Your domain structure may be simpler or more complex. The following is a master procedure. Chapter 4 Administering security 171 .Sample domain structure Sample domain structure The following diagram shows a sample domain structure containing a parent domain and two child sub-domains. Each of the steps in this procedure references a sub-section that describes another procedure. Configuring BMC BladeLogic for Domain Authentication Use this procedure to configure BMC BladeLogic so users can authenticate to the Authentication Service by providing an AD/Kerberos user name. You may want to review the diagram in “Sample domain structure” on page 171 for an overview of the domain names and host names used in the examples in this section. NOTE When you specify a domain name in any of the following steps. and password. This is an example. The sample names shown in this example are used in many procedures that relate to the Domain Authentication and AD/Kerberos solutions.

MYCOMPANY. If multiple realms are used.COM).MYCOMPANY. For example: nslookup -type=srv _kerberos. Locating Active Directory KDCs Use this procedure to obtain the host names for Active Directory KDCs. See “Creating the blappserv_login. which defines Active Directory domains and servers.COM nslookup -type=srv _kerberos.com 172 BMC BladeLogic Server Automation Administration Guide .DEV. See “Cross-registering users in the BMC BladeLogic database” on page 176.conf file” on page 173.MYCOMPANY.MYCOMPANY. From a command line. also look up the KDC for the parent realm (DEV._tcp.DEV. 7 Set up authentication profiles using Domain Authentication on the BMC BladeLogic client. 2 Create the blappserv_krb5. 5 Add user names based on Kerberos naming conventions to the RBAC user database. For example: service = 0 100 88 kdc.dev. See “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide.REALM where REALM is a Windows domain name.Configuring BMC BladeLogic for Domain Authentication 1 Obtain the host names for Active Directory KDCs.conf file” on page 174.SUB1.DEV. See “Locating Active Directory KDCs”.SUB2.sub2._tcp.COM The Active Directory KDC’s host name is reported as the value of service (UNIX) or svr hostname (Windows)._tcp. you will need these host names.conf file.COM. Look up the KDCs for each realm against which users authenticate. such as SUB1. 4 Configure the Authentication Service to support Domain Authentication. which provides necessary authentication information.conf file. enter the following: nslookup -type=srv _kerberos.DEV. 6 Add users to built-in roles. 3 Create the blappserv_login.MYCOMPANY._tcp. See “Defining Authentication Service settings for Domain Authentication” on page 175.mycompany. Later in the configuration process.COM nslookup -type=srv _kerberos. See “Logging on using default users and roles” on page 177. See “Creating the blappserv_krb5.DEV.MYCOMPANY.COM and SUB2.

use the nslookup command.MYCOMPANY. A period before a DNS name indicates you are mapping every system with a DNS name ending with that value to a corresponding Kerberos realm.dev.conf file Use this procedure to create a blappserv_krb5.sub1.USERS_DOMAIN = USERS_REALM USERS_REALM is the realm where users are defined.MYCOMPANY. list all of those KDCs. If multiple KDCs are running. they are authenticated as members of the default realm.dev. For example: . USERS_DOMAIN provides DNS names.sub2.dev.conf file. When Domain Authentication users log in and they do not provide a fully qualified user name.COM . Creating the blappserv_krb5. This file configures Kerberos so it can communicate with the Active Directory server or servers.MYCOMPANY.COM .com = DEV.mycompany.com = SUB2.mycompany. do not use IP addresses.COM To obtain host names for any of the KDCs listed in this file. USERS_REALM_KDC is the host name for the KDC servicing that realm. The Application Server must be able to resolve DNS names of Active Directory servers. NOTE When identifying servers in the blappserv_krb5.Configuring BMC BladeLogic for Domain Authentication Ignore the numbers before the host name. 1 Create a text file and add the following content to it: [libdefaults] ticket_lifetime = 6000 default_realm = USERS_REALM [realms] USERS_REALM = { kdc = USERS_REALM_KDC:88 } [domain_realm] .com = SUB1. In the “domain_realm” section.conf file. as described in “Locating Active Directory KDCs” on page 172.DEV. If users are defined in multiple realms. you must define a default realm. Chapter 4 Administering security 173 .DEV.mycompany.conf. create a separate stanza for each realm. When you create a blappserv_krb5.

conf ■ On Windows. the file should be located as follows: /opt/bmc/BladeLogic/version/NSH/br/blappserv_login. the file should be located as follows: /opt/bmc/BladeLogic/version/NSH/br/blappserv_krb5. if the Authentication Server is installed in the default location. }. 2 Do one of the following: ■ On a UNIX-style system. the file should be located as follows: C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ blappserv_krb5.conf file.bladelogic. com.sun.conf.conf file You must create a blappserv_login. save the file to the InstallDirectory\NSH\br directory with the name blappserv_login.conf For example. save the file to the InstallDirectory\NSH\br directory with the name: blappserv_krb5.Krb5LoginModule required doNotPrompt=false useTicketCache=false debug=false. if BMC BladeLogic is installed in the default location.auth.conf ■ On Windows. For example. if BMC BladeLogic is installed in the default location.conf.conf For example. save the file to the InstallDirectory/NSH/br directory with the name: blappserv_krb5.ADKerberosPasswordLogin { com. if the Authentication Server is installed in the default location. This files provides necessary Kerberos authentication information. 1 Create a text file and add the text shown below to this file. the file should be located as follows: 174 BMC BladeLogic Server Automation Administration Guide .module.Configuring BMC BladeLogic for Domain Authentication 2 Do one of the following: ■ On a UNIX-style system. save the file to the InstallDirectory/NSH/br directory with the name blappserv_login.security. For example.service.conf Creating the blappserv_login.auth.

Configuring BMC BladeLogic for Domain Authentication C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ blappserv_login. select Programs => BMC Software => BladeLogic Server Automation Suite => Utilities => Application Server Administration. enter the following: set AuthServer AuthSvcKrb5LoginConfig fileName Chapter 4 Administering security 175 . 1 Start the Application Server Administration console by doing one of the following: ■ On a UNIX-style system.conf file. — From the directory where BMC BladeLogic is installed. To perform this procedure. enter the following: . 2 To allow users to log in using Domain Authentication. This file is essential for supporting Kerberos. from the directory where BMC BladeLogic is installed.conf file. enter the following: \bin\blasadmin.conf file. 4 To enable the blappserv_login. You can skip this step unless you choose to use a different file name. 3 To enable the blappserv_krb5./bin/blasadmin ■ On Windows.conf. enter the following: set AuthServer isDomainAuthEnabled true By default this value is set to false. do one of the following: — From the Start menu. you must use the Application Server Administration console. enter the following: set AuthServer AuthSvcKrb5Config fileName where fileName is the name of the blappserv_krb5. By default AuthSvcKrb5Config is set to a value of blappserv_krb5.bat Both options run the same command.conf Defining Authentication Service settings for Domain Authentication Use this procedure to define settings for the BMC BladeLogic Authentication Service so it can use the Kerberos configurations you set up in previous procedures.

This file is essential for supporting Kerberos. you must ensure that domain user names stored in RBAC are fully qualified and that those names match the user names stored in the Active Directory.MYCOMPANY.conf file. you would fill in the name field with a value such as: mary@SUB1.COM is a different user name than than mary or mary@SUB3.DEV.COM rather than filling in the name field with a value such as: mary Note that the user name mary@SUB1. Cross-registration allows users to be authorized for RBAC roles.DEV.MYCOMPANY. Only users authorized to use BMC BladeLogic should be entered into the BMC BladeLogic database. For example. Use RBAC to add users to the BMC BladeLogic database.COM.conf. 5 Restart the Application Server. BMC BladeLogic documentation assumes you know how to add users to Active Directory. Cross-registering users in the BMC BladeLogic database Users must be registered in both Active Directory and BMC BladeLogic’s RBACbased user database.MYCOMPANY. if you are using RBAC or the bladduser utility to add a new BMC BladeLogic user. For information on adding users to RBAC. 176 BMC BladeLogic Server Automation Administration Guide .DEV. see the BMC BladeLogic Server Automation User Guide. Requirements for User Names When using AD/Kerberos to authenticate end users. The user’s BMC BladeLogic user name must match the user’s fully qualified Active Directory user name. By default AuthSvcKrb5LoginConfig is set to a value of blappserv_login. You can skip this step unless you choose to use a different file name.Configuring BMC BladeLogic for Domain Authentication where fileName is the name of the blappserv_login. Each BMC BladeLogic user name must be in the form: USER@DOMAIN where DOMAIN is the domain the user is registered in.

and the GlobalReportViewers role.COM. equivalently. These default users are assigned to the default roles RBACAdmins and BLAdmins. which has built-in authorizations to change permissions for all system objects in BMC BladeLogic. the administrator should log in as a user authorized for the RBACAdmins role and ensure that each of the four built-in roles—RBACAdmins. respectively. no user will be able to access the built-in roles. If the BMC BladeLogic administrator intends to support AD/Kerberos authentication exclusively and disable SRP user authentication.Implementing Active Directory/Kerberos authentication BMC BladeLogic provides a BLCLI command. and GlobalReportAdmins—has at least one registered domain user assigned to that role. which has read access to all reports at all sites in a BMC BladeLogic installation. you can simply assign a fully qualified domain user name (for example. RBACAdmin_ADK@SUB2. GlobalReportViewers. In this example. the RBACAdmins role has the authorizations necessary to manage users and roles. Implementing Active Directory/Kerberos authentication The BMC BladeLogic Authentication Service can authenticate users via Windows Active Directory single sign-on credentials or. Otherwise. If you are using that default setup. the GlobalReportAdmins role. which has built-in authorizations to see data for all BMC Service Automation Reporting and Analytics sites. To allow a user to log into the GlobalReportViewers role. Logging on using default users and roles The BMC BladeLogic user database comes pre-provisioned with two default SRP users: RBACAdmin and BLAdmin. when SRP authentication is disabled. then. you must use RBAC to add a fully qualified user name to the GlobalReportAdmins role. Windows single sign-on is based on the Kerberos authentication protocol. prior to disabling SRP. see the BLCLI help. BLAdmins. the user would also have to be registered in the Active Directory user registry for the domain SUB2. RBACRole:syncUsers. For more information on this command. you must use RBAC to add a fully qualified name to the GlobalReportViewers role. that you can use to synchronize group information in Active Directory with role information in RBAC. a Kerberos user’s ticket granting ticket (TGT).MYCOMPANY. In a default installation. you must use RBAC to add a fully qualified user name to the BLAdmins role. To allow a user to log into the GlobalReportAdmins role.COM) to the RBACAdmins role.DEV. The same issue applies to the BLAdmins role.MYCOMPANY. Windows Server 2003/2008 implements a Kerberos Key Chapter 4 Administering security 177 .DEV. To allow a user to log into the BLAdmins role.

When a BMC BladeLogic authentication user interface (either the authentication user interface built into the BMC BladeLogic Console or the blcred utility) selects an AD/Kerberos authentication profile. This credential consists of a service ticket to the ticket granting service (the Ticket Granting Ticket) and an associated ticket granting service session key. In Windows single sign-on. the Active Directory KDC responds by sending the client a limited-lifetime (typically 10 hours) user credential. The request carries encrypted material that allows the KDC to authenticate the request. Upon successful Kerberos authentication of the end user. referred to as the Active Directory KDC. When a registered domain user logs into a client platform (Windows or UNIX). In the context of Active Directory. The following sections describe those configuration tasks. BMC BladeLogic end users can use their AD/Kerberos credentials to authenticate themselves to the BMC BladeLogic Authentication Service. which BMC BladeLogic clients can use to establish secure sessions with the BMC BladeLogic Application Service or Network Shell Proxy Service.keytab file. the Authentication Service issues the authentication user interface a single sign-on credential. This Windows Server KDC. relies on the Active Directory registry to store the names and passwords of registered users within its Kerberos realm. it employs the end user's AD/Kerberos credentials to conduct a Kerberos protocol exchange with the Authentication Service. In this exchange.Overview of AD/Kerberos configuration tasks Distribution Center (KDC) as one of its default domain services. a Kerberos realm is an Active Directory domain. 178 BMC BladeLogic Server Automation Administration Guide . the login client sends a request to the Active Directory KDC for a Kerberos Ticket Granting Ticket (TGT). Give this file and the SPN to the administrator of the Application Server hosting the BMC BladeLogic Authentication Service. B Export the blauthsvc. Configuring BMC BladeLogic authentication user interfaces and the Authentication Service to support AD/Kerberos authentication requires additional configuration beyond the default configuration of clients and servers. Overview of AD/Kerberos configuration tasks This section provides a quick overview of the tasks you must perform to set up a BMC BladeLogic environment that supports user authentication via AD/Kerberos user credentials: 1 On the Active Directory KDC: A Create a user account for the BMC BladeLogic Authentication Service. the Active Directory domain controller or Kerberos KDC mediates the authentication of the end user to the BMC BladeLogic Authentication Service. which the client stores in a local credential cache. After validating the request. The keying material used to generate and verify the request is derived from the user’s password. the Kerberos TGT is also referred to as the domain user credential.

keytab file in the correct directory.conf file.COM). E Define Authentication Service settings to support AD/Kerberos. G If you are using Network Shell to communicate directly with agents. F UNIX only: Obtain a ticket granting ticket (TGT) for the client.Overview of AD/Kerberos configuration tasks These tasks are described in detail in “Registering an Authentication Service in an Active Directory Domain” on page 180. making sure each user name includes the user’s Active Directory domain (user@DOMAIN. D Create a blclient_krb5. D Create the blappserv_login. set up a Network Shell Proxy Server. B Locate the Active Directory KDC for the service principal’s realm. These tasks are described in detail in “Configuring an Authentication Service for AD/Kerberos authentication” on page 184. E Update the config.properties file. F Add users to the BMC BladeLogic RBAC user database.conf file. These tasks are described in detail in “Configuring a BMC BladeLogic Client for AD/Kerberos authentication” on page 194. 3 On the BMC BladeLogic client: A Windows only: Update the Kerberos Registry Settings. Chapter 4 Administering security 179 . G Create an authentication profile using AD/Kerberos authentication. B Create the blclient_login. 2 On the BMC BladeLogic Application Server: A Put the blauthsvc.conf file. C Locate the Active Directory KDC for the client’s realm.conf file. C Create the blappserv_krb5.

Registering an Authentication Service in an Active Directory Domain

Registering an Authentication Service in an Active Directory Domain
This section provides procedures that an administrator of an Active Directory KDC can use to register the Authentication Service associated with a BMC BladeLogic Application Server in an Active Directory domain. Refer to this section only if you want to employ AD/Kerberos user credentials to authenticate BMC BladeLogic end users to the BMC BladeLogic Authentication Service. The following is a master procedure. Each of the steps in this procedure references a sub-section that describes another procedure.

NOTE
When you specify a domain name in any of the following steps, you must use UPPER CASE LETTERS. You may want to review the diagram in “Sample domain structure” on page 171 for an overview of the domain names and host names used in the examples in this section.

1 Review the required utilities that must be installed on the Active Directory server.
For more information, see “Requirements for the Active Directory server” on page 180.

2 Create an Active Directory user account for the Authentication Service associated
with an Application Server. For more information, see “Creating a user account in the domain of the Application Server” on page 181.

3 Export the user account and SPN information into a keytab file. After you create
the keytab file, you must give this file and the SPN to the administrator of the Application Server. For more information, see “Exporting the keytab file” on page 181.

Requirements for the Active Directory server
The following utilities must be installed on the Active Directory server:
■ ■

ktpass.exe (BMC BladeLogic recommends using version 5.2.3790.2732) setspn.exe

For Windows 2003, both of these utilities are provided as part of the Support Tools Service Pack 1. For Windows 2008 these utilities are provided as part of the core operating system.

180

BMC BladeLogic Server Automation Administration Guide

Registering an Authentication Service in an Active Directory Domain

Creating a user account in the domain of the Application Server
Use this procedure to create a user account for the Authentication Service in the domain (that is, the Kerberos realm) where the BMC BladeLogic Application Server is running.

1 On a Windows 2003 or 2008 Server, from the Start menu, select Programs =>
Administrative Tools => Active Directory Users and Computers. The Active Directory Users and Computers window displays.

2 In the left column, expand the domain name for the BMC BladeLogic Application
Server so that it displays the Users folder.

3 Right click the Users folder and select New => User. The New Object – User wizard
displays.

4 For First name, enter a name, such as blauthsvc. For User logon name, enter the name
again. In this example, you would enter blauthsvc again.

5 Click Next. The second screen of the wizard displays, requesting password
information.

6 For Password, set the password to whatever you want. Be sure to use a password
that conforms to the Active Directory password policy. Then check Password never
expires.

7 Click Next. The final summary page of the wizard displays. 8 Click Finish to dismiss the wizard.

Exporting the keytab file
Use this procedure to export a keytab file from the Active Directory server. You must give the keytab file to the administrator of the BMC BladeLogic Application Server. The Application Server needs a keytab file because it holds keying material used for decrypting and validating the service ticket that the domain controller (that is, the KDC) issues to the client. When requesting a service ticket from the KDC, the client identifies the targeted server (that is, the Application Server) by the SPN. Because Kerberos employs mediated authentication for the mutual authentication of both the client and server, both the client and server must be registered with the KDC. The user is registered under a domain user name. The server is registered under an SPN.

Chapter 4

Administering security

181

Registering an Authentication Service in an Active Directory Domain

The procedure varies depending on what version of Windows and what service pack you are using. If you are using a Windows 2008 without Service Pack 2, you must work around a Microsoft defect by using a different setup. This defect is corrected in Service Pack 2 for Windows 2008, and it does not affect Windows 2003.

Windows 2003 and Windows 2008 with Service Pack 2 1 Use the ktpass command-line utility to export the keytab file using the command
shown below. Run this utility in a directory suitable for writing a file with sensitive data.
ktpass -out blauthsvc.keytab -princ blauthsvc/instance@DOMAIN -mapuser blauthsvc@DOMAIN +rndPass -minPass 33

In this command, instance is the instance of this Application Server (typically a host name) and DOMAIN is the realm where the Application Server is running. (This is the realm/domain that appeared next to the User logon name when you created the blauthsvc user.) For example, if you used the example names shown in “Sample domain structure” on page 171, you would enter:
ktpass -out blauthsvc.keytab -princ blauthsvc/app4@SUB2.DEV.MYCOMPANY.COM -mapuser blauthsvc@SUB2.DEV.MYCOMPANY.COM +rndPass -minPass 33

2 Give the following to the administrator of the Application Server:

The newly created blauthsvc.keytab file. The blauthsvc.keytab file contains key material, so transfer it between systems with care. The Authentication Service needs this keytab to allow users to authenticate. The service principal name used in the keytab file. For example:
blauthsvc/app4

The name of the domain (that is, the Kerberos realm) for the Application Server. For example:
SUB2.DEV.MYCOMPANY.COM

182

BMC BladeLogic Server Automation Administration Guide

Registering an Authentication Service in an Active Directory Domain

Windows 2008 without Service Pack 2 1 On the command line, use the setspn utility to create a service principal name for
the BMC BladeLogic Authentication Service by entering the following command:
setspn -A blauthsvc/instance blauthsvc

In this command, instance is the instance of this Application Server (typically a host name). For example, you can enter the following command:
setspn -A blauthsvc/app4 blauthsvc

2 Use the ktpass command-line utility to export the keytab file using the command
shown below. Run this utility in a directory suitable for writing a file with sensitive data.
ktpass -out blauthsvc.keytab -princ blauthsvc@DOMAIN -mapuser blauthsvc@DOMAIN +rndPass -minPass 33

For example, if you used the example names shown in “Sample domain structure” on page 171, you would enter:
ktpass -out blauthsvc.keytab -princ blauthsvc@SUB2.DEV.MYCOMPANY.COM -mapuser blauthsvc@SUB2.DEV.MYCOMPANY.COM +rndPass -minPass 33

Note that the -princ parameter identifies a user principal (blauthsvc) rather than a service principal name.

3 Give the following to the administrator of the Application Server:

The newly created blauthsvc.keytab file. The blauthsvc.keytab file contains key material, so transfer it between systems with care. The Authentication Service needs this keytab to allow users to authenticate. The user principal name used in the keytab file. For example:
blauthsvc

NOTE
The remainder of this guide assumes you are using a service principal name when setting up AD/Kerberos authentication. When this guide provides examples of a service principal name, it uses blauthsvc/app4. However, if you are using Windows 2008 without Service Pack 2, you must work around the Microsoft defect by using a user principal name instead of a service principal name. In that case, you should use blauthsvc instead of blauthsvc/app4.

Chapter 4

Administering security

183

Configuring an Authentication Service for AD/Kerberos authentication

The name of the domain (that is, the Kerberos realm) for the Application Server. For example:
SUB2.DEV.MYCOMPANY.COM

Configuring an Authentication Service for AD/Kerberos authentication
Use this procedure to configure a BMC BladeLogic Authentication Service so BMC BladeLogic users can authenticate using the AD/Kerberos user credentials. The following is a master procedure. Each of the steps in this procedure references a sub-section that describes another procedure.

NOTE
When you specify a domain name in any of the following steps, you must use UPPER CASE LETTERS. You may want to review the diagram in “Sample domain structure” on page 171 for an overview of the domain names and host names used in the examples in this section.

1 If you have not done so already, perform the following prerequisite procedure:
“Registering an Authentication Service in an Active Directory Domain” on page 180.

2 Review the information that is needed to perform subsequent steps. See “Required
information” on page 185.

3 Copy the keytab file to the Application Server. See “Copying the keytab file” on
page 185.

4 Obtain the host name of an Active Directory KDC for the service principal’s realm.
See “Locating the Active Directory KDC for the service principal’s domain” on page 186.

5 Create the blappserv_krb5.conf file, which provides essential configuration
information. See “Creating the blappserv_krb5.conf file” on page 186.

6 Create the blappserv_login.conf file, which provides the location of the keytab file.
See “Creating the blappserv_login.conf file” on page 188.

7 Configure the Authentication Service to support Kerberos. See “Defining
Authentication Service settings for AD/Kerberos” on page 191.

184

BMC BladeLogic Server Automation Administration Guide

Configuring an Authentication Service for AD/Kerberos authentication

8 Add user names based on Kerberos naming conventions to the RBAC user
database. See “Cross-registering users in the BMC BladeLogic database” on page 192.

9 If you are using Network Shell to communicate directly with agents, set up a
Network Shell Proxy Server to manage that traffic. See “Setting up a Network Shell Proxy Server” on page 193.

10 Add users to built-in roles. See “Logging on using default users and roles” on
page 194.

Required information
Before you start configuring an Authentication Service, you must obtain the following from the administrator of the Active Directory KDC:

The blauthsvc.keytab file. The service principal name used for the keytab file. For example:
blauthsvc/app4

The name of the service principal’s domain (Kerberos realm). For example:
SUB2.DEV.MYCOMPANY.COM

For information about creating a user account, service principal name, and keytab file on the Active Directory KDC, see “Registering an Authentication Service in an Active Directory Domain” on page 180.

Copying the keytab file
Use this procedure to copy the blauthsvc.keytab file you obtained from the Active Directory administrator to the correct location on the Application Server hosting the Authentication Service. For the Authentication Service to authenticate users through the AD/Kerberos user credentials, the Authentication Service must be able to accept KDC service tickets. To accept service tickets, the Authentication Service needs the service key in the blauthsvc.keytab file.

1 Locate the blauthsvc.keytab file that was exported from the Active Directory KDC. 2 Do one of the following:

On a UNIX-style system, copy the file to the /NSH/br directory.

Chapter 4

Administering security

185

Configuring an Authentication Service for AD/Kerberos authentication

For example, if BMC BladeLogic is installed in the default location, the file should be located here:
/opt/bmc/BladeLogic/version/NSH/br/blauthsvc.keytab

On Windows, copy the file to the \NSH\br directory. For example, if BMC BladeLogic is installed in the default location, the file should be located here:
C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ blauthsvc.keytab

Locating the Active Directory KDC for the service principal’s domain
Use this procedure to obtain the host name for the Active Directory KDC that is running in the realm where the keytab file for the service principal was created. Later in the configuration process, you will need this host name. From a command line, enter the following:
nslookup -type=srv _kerberos._tcp.SERVICE_PRINCIPAL_DOMAIN

In this command, SERVICE_PRINCIPAL_DOMAIN is the domain of the service principal. For example:
nslookup -type=srv _kerberos._tcp.SUB2.DEV.MYCOMPANY.COM

The Active Directory KDC’s host name is reported as the value of service (UNIX) or svr hostname (Windows). For example:
service = 0 100 88 kdc.sub2.dev.mycompany.com

Ignore the numbers before the host name.

Creating the blappserv_krb5.conf file
Use this procedure to create a blappserv_krb5.conf file. This file provides necessary Kerberos configuration information.

NOTE
When identifying servers in the blappserv_krb5.conf file, do not use IP addresses. The Application Server must be able to resolve DNS names of Active Directory servers.

186

BMC BladeLogic Server Automation Administration Guide

MYCOMPANY.MYCOMPANY.DEV.mycompany.MYCOMPANY. For example: SUB2.DEV.COM .SUB2. save the file to the /NSH/br directory with the name: blappserv_krb5. as described in “Locating the Active Directory KDC for the service principal’s domain” on page 186.dev.dev.MYCOMPANY. SERVICE_PRINCIPAL_DOMAIN provides DNS names.conf Chapter 4 Administering security 187 .COM This is the value you got when you ran the nslookup command.SERVICE_PRINCIPAL_DOMAIN = SERVICE_PRINCIPAL_REALM In this text file: SERVICE_PRINCIPAL_REALM is the realm where the keytab file was created.sub2. For example: kdc.MYCOMPANY.dev. In the “domain_realm” section.com = DEV.Configuring an Authentication Service for AD/Kerberos authentication 1 Create a text file like the following: [libdefaults] ticket_lifetime = 6000 default_realm = SERVICE_PRINCIPAL_REALM [realms] SERVICE_PRINCIPAL_REALM = { kdc = SERVICE_PRINCIPAL_REALM_KDC:88 } [domain_realm] .DEV.COM .mycompany.com = SUB2. A period before a DNS name indicates you are mapping every system with a DNS name ending with that value to a corresponding Kerberos realm.COM SERVICE_PRINCIPAL_REALM_KDC is the host name for the Active Directory KDC for the realm where the keytab file was created. For example: .com = SUB1.sub1.mycompany.DEV.COM 2 Do one of the following: ■ On a UNIX-style system.

keytab" Be sure to use the double backslash syntax shown above.sun.conf file to find the location of the keytab file. ■ On a UNIX-style system.security.conf file You must create a blappserv_login.conf ■ On Windows.Krb5LoginModule required useKeyTab=true keyTab="keytabFileLocation" storeKey=true principal="blauthsvc/instance@DOMAIN" doNotPrompt=true debug=false. In this text file. 188 BMC BladeLogic Server Automation Administration Guide .accept { com. the file should be located as follows: C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ blappserv_krb5. }. the file should be located as follows: /opt/bmc/BladeLogic/version/NSH/br/blappserv_krb5.keytab file on your system.jgss. if BMC BladeLogic is installed in the default location. assuming BMC BladeLogic is installed in the default location. The Application Server looks in the blappserv_login. if BMC BladeLogic is installed in the default location.conf For example. assuming BMC BladeLogic is installed in the default location. keyTab is the location of the blauthsvc. the keyTab line would look like this: keyTab="/opt/bmc/BladeLogic/version/NSH/br/blauthsvc.keytab" ■ On Windows.auth.module.security. 1 Create a text file and add the following content to it: com.conf Creating the blappserv_login.Configuring an Authentication Service for AD/Kerberos authentication For example. save the file to the \NSH\br directory with the name: blappserv_krb5. the keyTab line would look like this: keyTab="C:\\Program Files\\BMC Software\\BladeLogic\\version\\NSH\\br\\ blauthsvc.conf file.sun.

save the file to the \NSH\br directory with the name blappserv_login. 1 Do one of the following: ■ On a UNIX-style system.DEV. For example. For example: principal="blauthsvc/app4@SUB2. the file should be located as follows: /opt/bmc/BladeLogic/version/NSH/br/blappserv_login.conf. principal is the service principal name for the Authentication Service. For example.MYCOMPANY. In other words. 2 Do one of the following: ■ On a UNIX-style system.conf ■ On Windows.DEV. if BMC BladeLogic is installed in the default location.COM" If you do not have the service principal name and the Application Server’s realm.COM" If you are using Windows 2008 without Service Pack 2.Configuring an Authentication Service for AD/Kerberos authentication In the text file. followed by the Application Server’s domain.MYCOMPANY. use blauthsvc instead of blauthsvc/app4. the file should be located as follows: C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ blappserv_login. you should enter a user principal name rather than a service principal name.conf. enter the following: Chapter 4 Administering security 189 . save the file to the /NSH/br directory with the name: blappserv_login. See “Using klist to read the keytab file” on page 189. if BMC BladeLogic is installed in the default location. you can use the klist utility to display them. followed by the @ sign. You obtained the service principal name from the Active Directory administrator. For example: principal="blauthsvc4@SUB2.conf Using klist to read the keytab file You can use the klist utility to read the keytab file and display the name and realm of the service principal.

2 Identify the service account name from the keytab file by entering one of the following: ■ Windows: installDirectory\jre\bin\klist -k -t keytabFile UNIX: utilityPath/klist -k -t keytabFile ■ 190 BMC BladeLogic Server Automation Administration Guide . If you do not have klist installed on a UNIX system.keytab" 2 The klist utility displays output similar to the following: Service principal: blauthsvc/app4@SUB2. assuming that BMC BladeLogic is installed in the default location.DEV. 1 Copy the blappserv_krb5. utilityPath provides the path to the klist utility. This procedure is not essential.conf All UNIX platforms except Solaris: /etc/krb5.DEV. enter the following: "C:\Program Files\BMC Software\BladeLogic\version\NSH\jre\bin\klist" -t -k "C:\\Program Files\BMC Software\BladeLogic\version\NSH\br\ blauthsvc. ■ On Windows.conf file you set up for the Authentication Server to one of the following locations: ■ Windows: %WINDIR%\krb5.keytab In this command.conf ■ ■ For more information on the blappserv_krb5.MYCOMPANY.ini Solaris: /etc/krb5/krb5. Verifying a keytab file Use this procedure to verify that the keytab file you have generated can be used to authenticate.MYCOMPANY.COM The service principal name is blauthsvc/app4@SUB2. but BMC BladeLogic recommends performing this step to confirm that you have successfully set up authentication based on AD/Kerberos.conf file.Configuring an Authentication Service for AD/Kerberos authentication utilityPath/klist -t -k /opt/bmc/BladeLogic/version/NSH/br/blauthsvc.conf file” on page 186. you must first obtain it. There are many online sources for Kerberos utilities such as klist.COM. see “Creating the blappserv_krb5.

Configuring an Authentication Service for AD/Kerberos authentication In this command. Typically. If the command does not succeed.COM. the keytab file for Windows would be C:\Program Files\BMC Software\BladeLogic\version\NSH\br\blauthsvc.conf is correct. verify that the default_realm you have set up in blappserv_krb5. 1 Start the Application Server Administration console by doing one of the following: ■ On a UNIX-style system. The variable keytabFile identifies the location of the keytab file you are generating. enter the following: . For example. from the directory where BMC BladeLogic is installed.DEV. If you do not have klist installed on a UNIX system. authenticate to Active Directory by entering one of the following: ■ Windows: installDirectory\jre\bin\kinit -k -t keytabFile servicePrincipal UNIX: utilityPath/kinit -k -t keytabFile servicePrincipal ■ In this command. keytabFile is set to installDirectory/br.keytab Running the klist command generates output that identifies the service principal. If you do not have kinit installed on a UNIX system. For example. Defining Authentication Service settings for AD/Kerberos Use this procedure to define settings for the BMC BladeLogic Authentication Service so it can use the Kerberos configurations you set up in previous procedures. you must use the Application Server Administration console. If this command runs successfully. There are many online sources for Kerberos utilities such as klist. you should be able to authenticate with AD/ Kerberos. you must first obtain it./bin/blasadmin Chapter 4 Administering security 191 . To perform this procedure. utilityPath provides the path to the kinit utility. The variable keytabFile identifies the location of the keytab file and servicePrincipal is the entity identified in the previous step. if BMC BladeLogic is installed in the default location.MYCOMPANY. you must first obtain it. if you used the example names shown in “Sample domain structure” on page 171. this command might identify a service principal called blauthsvc/ app4@SUB2. utilityPath provides the path to the klist utility. 3 Using the results of the previous step.

Configuring an Authentication Service for AD/Kerberos authentication ■ On Windows.conf file. 3 To enable the blappserv_krb5. do one of the following: — From the Start menu.exe Both options run the same command. enter the following: set AuthServer AuthSvcKrb5Config fileName where fileName is the name of the blappserv_krb5. You can skip this step unless you choose to use a different file name. — From the directory where BMC BladeLogic is installed.conf. You can skip this step unless you choose to use a different file name. By default AuthSvcKrb5Config is set to a value of blappserv_krb5. 4 To enable the blappserv_login. 5 Restart the Application Server (see “Restarting a specific Application Server” on page 111). Cross-registering users in the BMC BladeLogic database Users must be registered in both Active Directory and BMC BladeLogic’s RBACbased user database. enter the following: set AuthServer IsADKAuthEnabled true By default Active Directory/Kerberos authentication is not turned on. 192 BMC BladeLogic Server Automation Administration Guide .conf file. Cross-registration allows users to be authorized for RBAC roles. By default AuthSvcKrb5LoginConfig is set to a value of blappserv_login. This file is essential for supporting Kerberos.conf. enter the following: set AuthServer AuthSvcKrb5LoginConfig fileName where fileName is the name of the blappserv_login. 2 To enable Active Directory/Kerberos authentication. enter the following: \bin\blasadmin. This file is essential for supporting Kerberos.conf file.conf file. select Programs => BMC Software => BladeLogic Server Automation Suite => Utilities => Application Server Administration.

DEV.Configuring an Authentication Service for AD/Kerberos authentication Only users authorized to use BMC BladeLogic should be entered into the BMC BladeLogic database. you would fill in the name field with a value such as: mary@SUB1. Chapter 4 Administering security 193 .DEV.MYCOMPANY. that you can use to synchronize group information in Active Directory with role information in RBAC. Network Shell user names do not include domain information. RBACRole:syncUsers.COM. Use RBAC to add users to the BMC BladeLogic database. BMC BladeLogic documentation assumes you know how to add users to Active Directory. Network Shell users may not be able to communicate directly with the agent on that server because the agent will expect user names to include domain information (such as mary@SUB1. if you are using RBAC or the bladduser utility to add a new BMC BladeLogic user.MYCOMPANY.DEV. you must ensure that domain user names stored in RBAC are fully qualified and that those names match the user names stored in the Active Directory.COM). The user’s BMC BladeLogic user name must match the user’s fully qualified Active Directory user name. Each BMC BladeLogic user name must be in the form: USER@DOMAIN where DOMAIN is the domain the user is registered in. For information on adding users to RBAC. Requirements for User Names When using AD/Kerberos to authenticate end users.MYCOMPANY. BMC BladeLogic provides a BLCLI command. Setting up a Network Shell Proxy Server If you cross-register users in Active Directory and RBAC and then you run an ACL Push Job on a server. For example. see the BMC BladeLogic Server Automation User Guide.MYCOMPANY. see the BLCLI help.COM is a different user name than than mary or mary@SUB3. For more information on this command.COM rather than filling in the name field with a value such as: mary Note that the user name mary@SUB1.DEV.

Logging on using default users and roles The BMC BladeLogic user database comes pre-provisioned with two default SRP users: RBACAdmin and BLAdmin. To allow a user to log into the BLAdmins role. when SRP authentication is disabled. To allow a user to log into the GlobalReportAdmins role. see “Configuring the Network Shell Proxy Service” on page 142. Otherwise. In this example. the user would also have to be registered in the Active Directory user registry for the domain SUB2. To allow a user to log into the GlobalReportViewers role. then.Configuring a BMC BladeLogic Client for AD/Kerberos authentication To avoid this problem and maintain communication with agents via Network Shell. which has built-in authorizations to see data for all BMC Service Automation Reporting and Analytics sites.COM. respectively. GlobalReportViewers. BLAdmins. If you are using that default setup. you must use RBAC to add a fully qualified user name to the GlobalReportAdmins role. and GlobalReportAdmins—has at least one registered domain user assigned to that role. you must use RBAC to add a fully qualified name to the GlobalReportViewers role.COM) to the RBACAdmins role. prior to disabling SRP. and the GlobalReportViewers role. set up a Network Shell Proxy Server. In a default installation. If the BMC BladeLogic administrator intends to support AD/Kerberos authentication exclusively and disable SRP user authentication. you must use RBAC to add a fully qualified user name to the BLAdmins role. the RBACAdmins role has the authorizations necessary to manage users and roles.MYCOMPANY. RBACAdmin_ADK@SUB2. which has read access to all reports at all sites in a BMC BladeLogic installation. which has built-in authorizations to change permissions for all system objects in BMC BladeLogic. These default users are assigned to the default roles RBACAdmins and BLAdmins. The same issue applies to the BLAdmins role.DEV. Configuring a BMC BladeLogic Client for AD/Kerberos authentication This section describes how to configure a BMC BladeLogic client (the BMC BladeLogic Console or the blcred utility) to authenticate with a BMC BladeLogic Authentication Service using AD/Kerberos user credentials. the GlobalReportAdmins role.MYCOMPANY. 194 BMC BladeLogic Server Automation Administration Guide .DEV. you can simply assign a fully qualified domain user name (for example. For more information. the administrator should log in as a user authorized for the RBACAdmins role and ensure that each of the four built-in roles—RBACAdmins. no user will be able to access the built-in roles.

See “Creating the blclient_krb5.conf file.conf file” on page 196. a user must also define an authentication profile that calls for AD/Kerberos authentication. See “Creating the blclient_login. the equivalent of a “kinit” is performed automatically. each user must manually perform a kinit to obtain a ticketgranting ticket (TGT). which provides essential configuration data. 3 Create the blclient_login. When a Windows user logs into the Active Directory. You may want to review the diagram in “Sample domain structure” on page 171 for an overview of the domain names and host names used in the examples in this section.Configuring a BMC BladeLogic Client for AD/Kerberos authentication In addition to the procedures described here. Each of the steps in this procedure references a sub-section that describes another procedure.conf file” on page 198. update registry settings and perform other configuration tasks. 1 If you have not done so already. NOTE When you specify a domain name in any of the following steps. The following is a master procedure.properties file” on page 200. perform the following prerequisite procedures: ■ “Registering an Authentication Service in an Active Directory Domain” on page 180 “Configuring an Authentication Service for AD/Kerberos authentication” on page 184 ■ 2 For Windows clients. This step provides information that is needed for subsequent steps in this procedure. For more information on defining authentication profiles. For UNIX environments. See “Updating the config. skip this step. 5 Create a blclient_krb5. See “Obtaining a TGT for a BMC BladeLogic client (UNIX only)” on page 201. 4 Locate the Active Directory KDC for the client’s realm. See “Locating the Active Directory KDC for the client’s domain” on page 197. 6 Update the BMC BladeLogic config. you must use UPPER CASE LETTERS. which provides essential Kerberos configuration information. See “Authentication profiles” on page 124 and the BMC BladeLogic Server Automation User Guide.properties file. See “Performing Windows-only client configuration tasks” on page 196. Chapter 4 Administering security 195 . 7 For UNIX clients.conf file. 8 Set up authentication profiles using AD/Kerberos authentication on the BMC BladeLogic client. see the BMC BladeLogic Server Automation User Guide.

2.conf file. 5. 2. If you are configuring a UNIX-style system. Reboot the server.conf file Use this procedure to create the blclient_login. It should be named allowtgtsessionkey and it should have a value of 1. Open the Windows Registry Editor. 4. This file provides necessary configuration information. 196 BMC BladeLogic Server Automation Administration Guide . Do one of the following: Platform Windows 2003 and 2008 Actions 1. Create a new registry value of type REG_DWORD. 3. 3.Configuring a BMC BladeLogic Client for AD/Kerberos authentication Performing Windows-only client configuration tasks Use this procedure to modify registry settings and perform other configuration tasks on Windows client machines. Open the Windows Registry Editor. It should be named allowtgtsessionkey and it should have a value of 1. Navigate to \HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\ Parameters. Open the Windows Registry Editor. Navigate to \HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\ Parameters. 2. skip this section. Navigate to \HKLM\System\CurrentControlSet\Control\Lsa\Kerberos. Create a new registry value of type REG_DWORD. 4. Create a new registry value of type REG_DWORD. Reboot the workstation. Disable User Account Control (UAC). 3. Windows XP 1. Windows Vista 1. Creating the blclient_login. This procedure is only necessary in Windows environments. It should be named allowtgtsessionkey and it should have a value of 1.

if BMC BladeLogic is installed in the default location. For example: nslookup -type=srv _kerberos.security. From a command line.conf. 2 Do one of the following: ■ On a UNIX-style system.security. save the file to the \NSH\br directory with the name: blclient_login.module. save the file to the /NSH/br directory with the name: blclient_login.MYCOMPANY. enter the following: nslookup -type=srv _kerberos.sun. For example._tcp._tcp. }.conf. You will need this host name later in the configuration process. For example.conf Locating the Active Directory KDC for the client’s domain Use this procedure to obtain the host name for the Active Directory KDC that is running in the domain that includes the client machine. if BMC BladeLogic is installed in the default location.sun.conf ■ On Windows. the file should be located as follows: C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ blclient_login.auth.Configuring a BMC BladeLogic Client for AD/Kerberos authentication 1 Create a text file and add the following content to it: com.jgss.SUB1.initiate { com.DEV.CLIENT_DOMAIN where CLIENT_DOMAIN is the domain containing the user’s workstation where the client is running.COM Chapter 4 Administering security 197 .Krb5LoginModule required doNotPrompt=true Debug=false useTicketCache=true. the file should be located as follows: /opt/bmc/BladeLogic/version/NSH/br/blclient_login.

For example: service = 0 100 88 kdc.MYCOMPANY. Creating the blclient_krb5.MYCOMPANY. For example: SUB1. 1 Create a text file like the following: [libdefaults] ticket_lifetime = 6000 default_realm = CLIENT_DOMAIN [realms] CLIENT_DOMAIN = { kdc = CLIENT_DOMAIN_KDC:88 } SERVICE_PRINCIPAL_DOMAIN = { kdc = SERVICE_PRINCIPAL_DOMAIN_KDC:88 } PARENT_DOMAIN = { kdc = PARENT_DOMAIN_KDC:88 } [domain_realm] .DEV. For example: kdc.conf file Use this procedure to create the blclient_krb5.PARENT_DOMAIN = PARENT_REALM In this text file: CLIENT_DOMAIN is the realm containing the user’s workstation.mycompany. This file provides necessary Kerberos configuration information.conf file. where the BMC BladeLogic client is running.COM 198 BMC BladeLogic Server Automation Administration Guide .DEV.com Ignore the numbers before the host name.SERVICE_PRINCIPAL_DOMAIN = SERVICE_PRINCIPAL_REALM .Configuring a BMC BladeLogic Client for AD/Kerberos authentication The Active Directory KDC’s host name is reported as the value of svr host name (Windows) or service (UNIX).dev.SUB1.sub1.CLIENT_DOMAIN = CLIENT_REALM .COM CLIENT_DOMAIN_KDC is the host name where the Active Directory server is running in your client’s realm.

In the “domain_realm” section.MYCOMPANY. For example. save the file to the /NSH/br directory with the name: blclient_krb5.MYCOMPANY.DEV.dev.com = DEV.MYCOMPANY.COM 2 Do one of the following: ■ On a UNIX-style system. save the file to the \NSH\br directory with the name blclient_krb5. SERVICE_PRINCIPAL_DOMAIN is the realm where the keytab file was created.conf ■ On Windows. For example.mycompany.MYCOMPANY.com = SUB1.conf.COM .com = SUB2. the file should be located as follows: /opt/bmc/BladeLogic/version/NSH/br/blclient_krb5.MYCOMPANY.dev. For example: .mycompany.COM This is the value you obtained when you ran the nslookup command. SERVICE_PRINCIPAL_DOMAIN provides DNS names.conf.conf Chapter 4 Administering security 199 .COM SERVICE_PRINCIPAL_DOMAIN_KDC is the host name where the Active Directory server is running in the realm where the keytab file was created.sub1. For example: SUB2.Configuring a BMC BladeLogic Client for AD/Kerberos authentication This is the value you obtained when you ran the nslookup command. as described in “Locating the Active Directory KDC for the client’s domain” on page 197.dev. For example: kdc. the file should be located as follows: C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ blclient_krb5. A period before a DNS name indicates you are mapping every system with a DNS name ending with that value to a corresponding Kerberos realm.mycompany.COM . as described in “Locating the Active Directory KDC for the service principal’s domain” on page 186.SUB2. if BMC BladeLogic is installed in the default location.DEV.sub2. if BMC BladeLogic is installed in the default location.DEV.DEV.

conf file.COM:88 } DEV.properties is placed in the following user-specific location: ■ UNIX-style systems: userHomeDirectory /.MYCOMPANY. you must add additional DOMAINS to the [realms] section of the blclient_krb5.bladelogic/config.COM = { kdc = kdc.DEV.MYCOMPANY.COM and SUB2.properties When a user runs the console for the first time.COM = { kdc = kdc. assume that there is no direct trust between the child domains SUB1.MYCOMPANY.COM:88 } Updating the config. In this case. the [realms] section would look something like this: [realms] SUB1.properties 200 BMC BladeLogic Server Automation Administration Guide .COM.properties file.MYCOMPANY.MYCOMPANY. By default.MYCOMPANY.DEV.MYCOMPANY.Configuring a BMC BladeLogic Client for AD/Kerberos authentication NOTE If there is no direct trust between the two child domains. For example.DEV. These additional DOMAINS specify the explicit path you need to traverse from the first child domain.properties file Use this procedure to modify the config.properties ■ Windows systems: C:\Program Files\BMC Software\BladeLogic\version\NSH\br\ config. this file is initially stored in the following location: ■ UNIX-style systems: /opt/bmc/BladeLogic/version/NSH/br/config.properties file on the BMC BladeLogic client.DEV. 1 Open the config. a copy of config.DEV. using the examples in “Sample domain structure” on page 171. up the tree to the root domain and back down to the other child domain.COM:88 } SUB2.MYCOMPANY.DEV.SUB1.DEV.SUB2.COM = { kdc = kdc.

config= Value path/blclient_login. you can use a backslash as a path separator but you must escape it with another backslash (such as.conf In this entry. This procedure must be performed every time a user needs a TGT on a UNIX client. path is the full path to the blclient_krb5.conf). For Windows paths. The TGT is the AD/Kerberos user credential that domain users need to authenticate with the BMC BladeLogic Authentication Service.properties file. Chapter 4 Administering security 201 .useSubjectCredsOnly= false Obtaining a TGT for a BMC BladeLogic client (UNIX only) Users of the BMC BladeLogic Console and the blcred utility running on a UNIX-style host must manually run a kinit to obtain a ticket-gathering ticket (TGT).properties If you are setting up an AD/Kerberos environment that many users are sharing (for example. Entry java. path is the full path to the blclient_login.conf file. Although the life span of a TGT is configurable. If a user already has a valid TGT. you should modify config. 2 Set the following entries to the values shown below. C\:\\Program Files/BMC Software/BladeLogic/ version/NSH/br/blclient_krb5. C\:\\Program Files\\BMC Software\\BladeLogic\\version\\NSH\\br\\ blclient_login. use forward slashes as path delimiters (such as. a terminal server) and you have already run the BMC BladeLogic Console.auth. add it at the end of the file.conf= javax. you can use a backslash as a path separator but you must escape it with another backslash (such as.properties in both locations—its initial location and in your own user-specific location.krb5. C\:\\Program Files/BMC Software/BladeLogic/ version/NSH/br/blclient_login. Note that in either case you must use a backslash to escape the colon and backslash after the drive letter.security. For Windows paths. If an entry does not already exist in the config. this procedure is not necessary. typically a TGT is valid for 10 hours.conf).security. Alternatively. use forward slashes as path delimiters (such as.auth.conf). C\:\\Program Files\\BMC Software\\BladeLogic\\version\\NSH\\br\\ blclient_krb5.conf file.conf).Configuring a BMC BladeLogic Client for AD/Kerberos authentication ■ Windows systems: userHomeDirectory\Application Data\BladeLogic\config. java. path/blclient_krb5.conf In this entry.security.login. Note that in either case you must use a backslash to escape the colon and backslash after the drive letter. Alternatively.

If you already use krb5.conf.conf. If you are using a Windows client. Implementing security – Application Server to agents or repeaters This section provides the following procedures to secure access between the BMC BladeLogic Application Server and RSCD agents or repeaters by employing TLS client authentication: ■ ■ TLS with client-side certs – Securing a Windows Application Server TLS with client-side certs – Securing a UNIX-based Application Server TLS with client-side certs – Securing a Windows Application Server Use this procedure to generate a self-signed. you should repeat this procedure for each Application Server. If you are not already using krb5.Implementing security – Application Server to agents or repeaters This procedure is only necessary in UNIX-style environments.conf. 1 Copy blclient_krb5. The name you provide is associated with the client’s realm. If your environment includes multiple Application Servers.conf by renaming the copy of blclient_krb5. 2 To obtain a TGT. run the following command: utilityPath/kinit userName In this command.conf with the contents of krb5. The user name you provide for the kinit command does not have to be fully qualified. skip this procedure. you can replace the existing version of krb5. utilityPath provides the path to the kinit utility. then you must integrate the contents of blclient_krb5. provision all targeted agents or repeaters with an SHA1 fingerprint of the Application Server’s self-signed certificate.conf. If you do not have kinit installed.conf to /etc/krb5. client-side certificate for a Windows Application Server. you must first obtain it.conf.conf file. 202 BMC BladeLogic Server Automation Administration Guide . There are many online sources for Kerberos utilities such as kinit. and configure those agents or repeaters to authenticate incoming requests using client-side certificates. identified when you created the client’s blclient_krb5.

Each of the steps in this procedure references a sub-section that describes another procedure. The procedure for a Network Shell Proxy Server is identical to the procedure for an Application Server. which contains the self-signed certificate for the Application Server and the private key associated with the certificate. See “Provisioning agents and repeaters with a SHA1 fingerprint of the Application Server’s self-signed certificate” on page 204. 2 Provision all targeted agents or repeaters with an SHA1 fingerprint of the Application Server’s self-signed certificate. In the path shown above. Generally.pem. client-side certificate on the Windows Application Server. See “Creating a self-signed client-side certificate on the Application Server” on page 203. WINDIR is typically winnt (on a Windows 2000 server) or windows. The following is a master procedure. 1 Create a self-signed. See “Configuring agents or repeaters to authenticate incoming requests with client-side certificates” on page 206. in BMC BladeLogic documentation a “client” refers to a host running the BMC BladeLogic Console or Network Shell. Creating a self-signed client-side certificate on the Application Server Use this procedure to create a file called id.TLS with client-side certs – Securing a Windows Application Server Note that in the context of this section. 1 Log into a Windows Application Server as Administrator. 3 Using a command line. If you want to stop using self-signed. Then add the passphrase for that certificate to the securecert file. client-side certificates. You can use this procedure to use TLS with client-side certificates to secure communication between a Windows-based Network Shell Proxy Server and agents or repeaters. 3 Configure all targeted agents or repeaters to authenticate incoming requests using client-side certificates. see “TLS with client-side certs – Discontinuing use of client-side certificates” on page 210. a “client” refers to an Application Server that is attempting to establish contact with the server hosting an agent. generate a self-signed Application Server certificate by entering the following: Chapter 4 Administering security 203 . 2 Create a directory called C:\WINDIR\rsc\certs\SYSTEM. Then add the passphrase used to encrypt the private key to the securecert file on the Application Server.

This file contains the SHA1 fingerprint of the Application Server’s self-signed certificate.pem file. If you prematurely set the rscd entry in a secure file so that tls_mode=encrytion_and_auth. 1 Ensure that the secure file on all managed servers is configured so that tls_mode=encryption_only. you must ensure that the secure file on the agent or repeater is configured correctly. the default location for the second instance of BMC BladeLogic would be C:\Program Files\BMC Software\BladeLogic2\version\NSH. you are prompted to provide and then confirm a passphrase.pem file is created in the C:\WINDIR\rsc\certs\SYSTEM directory. use the command line to enter the following: secadmin -m default -cu SYSTEM -cp passPhrase After issuing this command. If necessary. you can find securecert in installDirectoryN\version\NSH\conf\securecert. For example. 4 Update the securecert file to include an encoded copy of the passphrase. The encoded passphrase will vary. the agent or repeater will refuse the incoming connection because it will not have the SHA1 fingerprint of the Application Server’s self-signed cert. generate this setting by running the following secadmin command on each agent: secadmin -m rscd -p 5 -T encryption_only -e tls Before you can provision a managed server with the fingerprint of the Application Server’s certificate.TLS with client-side certs – Securing a Windows Application Server bl_gen_ssl -appcert After you enter the command. To accomplish this. or update. The secure file (located in the C:\WINDIR\rsc directory on a Windows server and in /usr/lib/rsc on a UNIX-style server) must have the rscd entry set to the following when deploying the certificate fingerprint: 204 BMC BladeLogic Server Automation Administration Guide . [default] SYSTEM=FCUVOMLNGLVRZNOO For the initial installation of BMC BladeLogic. The id. you can find the securecert file in the C:\WINDIR\rsc directory. the contents of the securecert file are updated to something like the following. This passphrase is used to encrypt the private key in the id. on each managed server and repeater a file named SYSTEM. If additional instances of BMC BladeLogic are installed. An agent or repeater uses this fingerprint to validate the selfsigned certificate received from the Application Server in the course of the TLS handshake. Provisioning agents and repeaters with a SHA1 fingerprint of the Application Server’s self-signed certificate Use this procedure to create.

cd to C:\WINDIR\rsc\certs\ SYSTEM. so in most situations there is no need to perform this step.. update the exports file on a Windows server by creating the following entry: * rw. To grant this privilege. such as the IP address or host name of the Application Server. on a UNIX machine.agentN is a space-delimited list of the host names or IP addresses of the managed servers hosting agents or repeaters. Chapter 4 Administering security 205 .agentN where agent1. To provision an agent or repeater with the SHA1 fingerprint of an Application Server’s certificate. you should provision each Application Server with its own self-signed certificate.. the directory containing the id.pem file.TLS with client-side certs – Securing a Windows Application Server rscd:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls This is the default setting after a fresh installation of an agent. On a Windows machine. you must have root or Administrator privileges on the server hosting the agent.. 2 Set up root or Administrator privileges on each managed server hosting an agent. This command creates or updates a fingerprint file on each targeted agent or repeater. Performing this procedure for each of those Application Servers generates multiple fingerprints in the SYSTEM file. the fingerprint file for a Window Application Server is C:\Program Files\BMC Software\BladeLogic\version\RSCD\certs\ SYSTEM. Otherwise.pem agent1.user=Administrator On a UNIX server. the fingerprint file for a Windows Application Server is /opt/bmc/BladeLogic/version/NSH/certs/SYSTEM. 3 Using a command line on the Application Server. update the exports file by creating the following entry: * rw. 4 Push the SHA1 fingerprint to managed servers by entering the following command: putcert SYSTEM id. all users accessing those agents will be mapped to root or Administrator. In environments where multiple Application Servers communicate with agents. 5 Revert the setting in the exports file on managed servers back to a more restrictive user mapping. you should replace the host wildcard (“*”) with a more restrictive setting.user=root To be safe..

provision all targeted agents or repeaters with an SHA1 fingerprint of the Application Server’s self-signed certificate. The procedure for a Network Shell Proxy Server is identical to the procedure for an Application Server. use Network Shell to enter the following secadmin command: secadmin -m rscd -p 5 -T encryption_and_auth -e tls This procedure is also necessary if you are configuring a repeater to authenticate incoming requests from an Application Server. 206 BMC BladeLogic Server Automation Administration Guide . TLS with client-side certs – Securing a UNIX-based Application Server Use this procedure to generate a self-signed. Generally. Each of the steps in this procedure references a sub-section that describes another procedure. see “TLS with client-side certs – Discontinuing use of client-side certificates” on page 210. If you want to stop using self-signed. To modify the rscd entry in the secure file on each targeted agent. in BMC BladeLogic documentation a “client” refers to a host running the BMC BladeLogic Console or Network Shell. client-side certificates. The following is a master procedure. Note that in the context of this section. and configure those agents or repeaters to authenticate incoming requests using client-side certificates.TLS with client-side certs – Securing a UNIX-based Application Server Configuring agents or repeaters to authenticate incoming requests with client-side certificates Use this procedure to update the rscd entry in each agent's secure file so it reads as follows: rscd:port=4750:protocol=5:tls_mode=encryption_and_auth:encryption=tls After agents are provisioned with the SHA1 fingerprint of an Application Server’s self-signed certificate. This section is intended for administrators of BMC BladeLogic Application Servers. This setting requires client authentication via clientside certificates. You can use this procedure to use TLS with client-side certificates to secure communication between a UNIX-based Network Shell Proxy Server and agents or repeaters. the secure files on those agents must be updated so tls_mode=encryption_and_auth. client-side certificate for a UNIX-based Application Server. a “client” refers to an Application Server that is attempting to establish contact with the server hosting an agent.

The id.pem. 2 Provision all targeted agents or repeaters with an SHA1 fingerprint of the Application Server’s self-signed certificate. See “Creating a selfsigned client-side certificate on the Application Server” on page 207. 3 Configure all targeted agents or repeaters to authenticate incoming requests using client-side certificates. Creating a self-signed client-side certificate on the Application Server Use this procedure to create a file called id.pem file.bladelogic directory. Then add the passphrase used to encrypt the private key to the securecert file on the Application Server. See “Provisioning agents and repeaters with a SHA1 fingerprint of the Application Server’s self-signed certificate” on page 208. where the id. To accomplish this. 2 Enter the following command: /opt/bmc/BladeLogic/version/NSH/bin/bl_gen_ssl After entering the command.bladmin This command logs you in as the bladmin user.bladelogic directory. 1 Log into the UNIX system on the Application Server as root. 4 Update the securecert file (contained in the /usr/lib/rsc directory) to contain an encoded copy of the passphrase. and then enter the following command: su .TLS with client-side certs – Securing a UNIX-based Application Server 1 Create a self-signed client-side certificate on the UNIX Application Server. which contains the self-signed certificate for the Application Server and the private key associated with the certificate. Then add the passphrase for that certificate to the securecert file. BMC BladeLogic will not load the certificate if group or world permissions are set for the id. This passphrase is used to encrypt the private key in the id. 3 Enter exit to revert back to the root user.pem file or the . use Network Shell to enter the following: secadmin -m default -cu bladmin -cp passPhrase Chapter 4 Administering security 207 . In UNIX the Application Server runs as the bladmin user.pem file is created in the bladminUserHome/.pem file is generated. you are prompted to provide and then confirm a passphrase. See “Configuring agents or repeaters to authenticate incoming requests with client-side certificates” on page 209.

on each managed server or repeater a file named bladmin. the contents of the securecert file are updated to something like the following. If you prematurely set the rscd entry in a secure file so that tls_mode=encrytion_and_auth.TLS with client-side certs – Securing a UNIX-based Application Server After issuing this command. 208 BMC BladeLogic Server Automation Administration Guide .bladelogic directory by running the following commands: chmod 700 /opt/bmc/BladeLogic/version/NSH/br/. you must ensure that the secure file on the agent or repeater is configured correctly.bladelogic/id.bladelogic chmod 600 /opt/bmc/BladeLogic/version/NSH/br/. [default] bladmin=FCUVOMLNGLVRZNOO 5 Ensure that access is restricted to the id. If necessary. This file contains the SHA1 fingerprint of the Application Server’s self-signed certificate. the agent or repeater will refuse the incoming connection because it will not have the SHA1 fingerprint of the Application Server’s self-signed cert. 2 Set up root or Administrator privileges on each managed server hosting an agent. The secure file (located in the C:\WINDIR\rsc directory on a Windows server and in /usr/lib/rsc on a UNIX-style server) must have the rscd entry set to the following when deploying the certificate fingerprint: rscd:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls This is the default setting after a fresh installation of an agent. The encoded passphrase will vary. 1 Ensure that the secure file on all managed servers is configured so that tls_mode=encryption_only. generate this setting by running the following secadmin command on each agent: secadmin -m rscd -p 5 -T encryption_only -e tls Before you can provision a managed server with the fingerprint of the Application Server’s certificate. so in most situations there is no need to perform this step.pem Provisioning agents and repeaters with a SHA1 fingerprint of the Application Server’s self-signed certificate Use this procedure to create. or update. An agent or repeater uses this fingerprint to validate the selfsigned certificate received from the Application Server in the course of the TLS handshake.pem file and the .

TLS with client-side certs – Securing a UNIX-based Application Server To provision an agent or repeater with the SHA1 fingerprint of an Application Server’s certificate. This command creates or updates a fingerprint file on each targeted agent or repeater.user=root To be safe. Configuring agents or repeaters to authenticate incoming requests with client-side certificates Use this procedure to update the rscd entry in each agent's secure file so it reads as follows: rscd:port=4750:protocol=5:tls_mode=encryption_and_auth:encryption=tls Chapter 4 Administering security 209 .pem file. update the exports file by creating the following entry: * rw. all users accessing those agents will be mapped to root or Administrator.bladelogic. Otherwise.agentN is a space-separated list of the host names or IP addresses of the managed servers hosting agents or repeaters. 4 Push the SHA1 fingerprint to managed servers by entering the following command: /opt/bmc/BladeLogic/version/NSH/sbin/putcert bladmin id.. you should provision each Application Server with its own self-signed certificate. 3 Using a command line on the Application Server. update the exports file on a Windows server by creating the following entry: * rw. the fingerprint file for a Window Application Server is C:\Program Files\BMC Software\BladeLogic\version\RSCD\certs\ bladmin.. To grant this privilege. such as the IP address or host name of the Application Server. On a Windows machine. the fingerprint file for a Windows Application Server is /opt/bmc/BladeLogic/version/NSH/certs/bladmin.. In environments where multiple Application Servers communicate with agents. on a UNIX machine. cd to /opt/bmc/BladeLogic/version/ NSH/br/. Performing this procedure for each of those Application Servers generates multiple fingerprints in the bladmin file. you should replace the host wildcard (“*”) with a more restrictive setting. 5 Revert the setting in the exports file on managed servers back to a more restrictive user mapping.user=Administrator On a UNIX server.pem agent1. you must have root or Administrator privileges on the server hosting the agent. the directory containing the id..agentN where agent1.

you may want to replace the host wildcard (“*”) with the IP address or host name of the Network Shell client.agentN where SYSTEM|bladmin is SYSTEM for a Windows Application Server or bladmin for a UNIX Application Server and agent1.user=Administrator On a UNIX server. To perform this procedure.. This setting requires client authentication via clientside certificates. To grant this privilege. 1 Set up root or Administrator privileges on each managed server hosting an agent or repeater. update the exports file on a Windows server by creating the following entry: * rw.. 210 BMC BladeLogic Server Automation Administration Guide . To modify the rscd entry in the secure file on each targeted agent. TLS with client-side certs – Discontinuing use of client-side certificates Use this procedure to stop using client-side certificates that secure access between Application Servers and agents or repeaters.agentN is a space-delimited list of the names or IP addresses of the servers where you want to stop using the Application Server’s self-signed certificate.TLS with client-side certs – Discontinuing use of client-side certificates After agents are provisioned with the SHA1 fingerprint of an Application Server’s self-signed certificate..user=root To be safe. the secure files on those agents must be updated so tls_mode=encryption_and_auth.. you must have root or Administrator privileges on any servers hosting agents or repeaters where you want to discontinue use of clientside certificates. use Network Shell to enter the following secadmin command: secadmin -m rscd -p 5 -T encryption_and_auth -e tls This procedure is also necessary if you are configuring a repeater to authenticate incoming requests from an Application Server. 2 Remove the SHA1 fingerprint of the Application Server’s self-signed certificate from managed servers by entering the following command: nukecert SYSTEM|bladmin agent1. update the exports file by creating the following entry: * rw.

For UNIX Application Servers. For Windows Application Servers. Typically administrators use the exports file to limit Network Shell client access to agents by restricting access to certain client IP addresses. The following options are available: ■ ■ No authentication – Using a default installation TLS with client-side certs – Securing a Network Shell client No authentication – Using a default installation A standard installation of BMC BladeLogic requires no user authentication between Network Shell clients and servers hosting agents. see “Exports file” on page 240. the SYSTEM directory can be found at C:\ WINDIR\rsc\certs\SYSTEM. Implementing security – Network Shell to agent This section provides procedures to secure access between Network Shell clients and servers hosting RSCD agents. Chapter 4 Administering security 211 .Implementing security – Network Shell to agent 3 Configure the secure file on all agents or repeaters where you want to stop using certificates by using Network Shell to run the following secadmin command: secadmin -m rscd -p 5 -T encryption_only -e tls Running this command generates an rscd entry in the secure file like the following: rscd:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls 4 Revert the setting in the exports file on managed servers back to a more restrictive user mapping.bladelogic. Otherwise.bladelogic directory for UNIX Application Servers. the bladmin directory can be found at /opt/bmc/ BladeLogic/version/NSH/br/. For more information on using the exports file. 5 Remove certificates from Application Servers by deleting the SYSTEM directory for Windows Application Servers or the . all users accessing those agents will be mapped to root or Administrator.

pem file (certificate and corresponding private key) and the agents uses the SHA1 fingerprint. generate this setting by running the following secadmin command on each agent: secadmin -m rscd -p 5 -T encryption_only -e tls This is the default setting after a fresh installation of an agent. At this point in the procedure the rscd entry in the secure file should be set to tls_mode=encryption_only. On UNIX machines running Network Shell clients. provision all targeted agents with an SHA1 fingerprint of the self-signed certificate.pem file or the . Then this procedure calculates the SHA1 fingerprint of the client certificate and pushes it to targeted agents using the putcert utility. where the id. That file contains the client’s digital certificate and the corresponding private key. During the TLS handshake. For more information. so in many situations there is no need to perform this step. 2 Set up root or Administrator privileges on each managed server hosting an agent. BMC BladeLogic will not load the certificate if group or world permissions are set for the id. 1 Ensure that the secure file is configured correctly on all agents where you want to set up secure access. which is encrypted using a password supplied when the self-signed certificate is created.bladelogic directory. see the BMC BladeLogic Server Automation User Guide.pem file is generated. NOTE The machine where you are creating a certificate must have the capability to generate random numbers. The BMC BladeLogic installation program for the Application Server tests whether a machine has the capability to generate random numbers.pem. client-side certificate for a Windows Network Shell client. This procedure creates a file on the client called id. the client uses the contents of the id. and configure those agents to authenticate incoming requests using client-side certificates. The installation program also allows you to install a daemon or create a random number seed that BMC BladeLogic uses for generating random numbers. see “Discontinuing use of client-side certificates” on page 216.TLS with client-side certs – Securing a Network Shell client TLS with client-side certs – Securing a Network Shell client Use this procedure to generate a self-signed. 212 BMC BladeLogic Server Automation Administration Guide . Later in this procedure you will change the tls_mode setting. client-side certificates. The SHA1 fingerprint is written into fingerprint files on the agents. If you want to stop using self-signed. If necessary.

where userProfileDirectory specifies a path such as /Documents and Settings/userName. In Windows. BMC BladeLogic generates a self-signed certificate in a file named id.pem file. update the exports file on a Windows server by creating the following entry: * rw.pem file and the .pem 7 Push the SHA1 fingerprint of the self-signed certificate to managed servers by entering the following command: putcert userName id. 3 Using a command line on the Network Shell client.pem.TLS with client-side certs – Securing a Network Shell client To provision an agent with the SHA1 fingerprint of a client’s certificate. where userHomeDirectory is the user’s home directory.pem is stored in /userHomeDirectory /.. Chapter 4 Administering security 213 .pem agent1 . agentN where userName is the name of the user who created the certificate and agent1 .user=Administrator On a UNIX server.bladelogic.. ensure that access is restricted to the id. you must have root or Administrator privileges on the server hosting the agent.bladelogic/id.. In UNIX.user=root To be safe. generate a self-signed certificate by entering the following: bl_gen_ssl 4 Enter a passphrase. you should replace the host wildcard (“*”) with the IP address or host name of the Network Shell client. such as /home/userName.. id.bladelogic chmod 600 /home/userName/.bladelogic directory by running the following commands: chmod 700 /home/userName/.pem is stored in /userProfileDirectory/Application Data /BladeLogic.pem is stored. 5 Cd to the directory where id. id. Then confirm the passphrase by entering it again. The passphrase is used to encrypt the private key in the id. To grant this privilege. 6 For UNIX machines running Network Shell clients. agentN is a space-delimited list of the names or IP addresses of the servers to which you want to push the certificate. update the exports file by creating the following entry: * rw.

pem file is not password-protected. see “TLS with client-side certs – Securing a Windows Application Server” on page 202 or “TLS with client-side certs – Securing a UNIX-based Application Server” on page 206. C:\Program Files\BMC Software\BladeLogic\version\RSCD\certs \userName is the fingerprint file. On a UNIX agent. the contents of the id. You can also use these procedures to set up client-side certificates on Network Shell Proxy Servers. Caching private keys A client certificate and its associated private key (that is. Otherwise. To keep private keys safe. all users accessing those agents will be mapped to root or Administrator. The procedure for activating the private key cache varies for Windows and UNIX-style systems. For more information.TLS with client-side certs – Securing a Network Shell client This command creates or updates a fingerprint file on each targeted agent. BMC BladeLogic provides a private key cache so users do not have to retype their passwords every time they start a new Network Shell session. the system prompts you for your private key password. On a Windows agent. making it available to any command running under the shell. For information on setting up client-side certificates on these entities. When you start Network Shell.pem file is generated. see “Caching private keys” on page 214. Network Shell decrypts and caches your private key. /opt/bmc/BladeLogic/version/ NSH/certs/userName is the fingerprint file. which means these agents will require Application Servers or Network Shell Proxy Servers to also use client-side certificates. 8 Modify the rscd entry in the secure file on each targeted agent by entering the following secadmin command: secadmin -m rscd -p 5 -T encryption_and_auth -e tls NOTE Performing this step could have implications for Application Servers or Network Shell Proxy Servers when they communicate with the same targeted agents. When an id. Once you provide the password. This step sets tls_mode=encryption_and_auth on the targeted agents. If the private key in the id. BMC BladeLogic provides a password mechanism. 10 If you plan to use Network Shell to run non-interactive tools such as the BLCLI. The procedure is the same as the procedure for Application Servers. 9 Revert the setting in the exports file on managed servers back to a more restrictive user mapping. Because each Network Shell session requires knowledge of the private key password. you should cache your private key for your client-side certificate.pem file) constitute a user credential that the holder of the credential can use to assume the identity of the user named within the credential. anyone gaining access to the file can assume the identity of the user named in the certificate. 214 BMC BladeLogic Server Automation Administration Guide . the private key is encrypted using the password you provide when you run the bl_gen_ssl utility.

Network Shell only prompts for the password when you start the new session. bl_ssl_agent --background The system prompts for your private key password. enter the following command. right-click the BMC BladeLogic icon in the system tray and select Exit from the pop-up menu. 2 Enter the password. Activating the private key cache in UNIX 1 On the Network Shell client. 2 Enter the password and click OK. Network Shell prompts you for a password every time you issue a command during that session.TLS with client-side certs – Securing a Network Shell client TIP If you are already running Network Shell and you create a certificate. NOTE This command must be run in the foreground because it prompts for a password. To avoid this. create the certificate. Activating the private key cache in Windows 1 From a Windows command line. exit Network Shell. The system generates a message like the following: set BL_X509_KEY to xy to reuse this private key where xy is the hexadecimal value of the location of the shared memory segment. and then start Network Shell again. Chapter 4 Administering security 215 . 3 To stop sharing the password. enter the following command: bltray -blkey A dialog prompts for your private key password. The BMC BladeLogic icon displays in the system tray on the task bar. indicating the private key password is shared. The command will spawn a new process that will remain in the background to cache the password in a shared memory segment.

user=root To be safe. 3 To reuse this shared memory segment with Network Shell. To perform this procedure. To grant this privilege.TLS with client-side certs – Securing a Network Shell client After entering your password... update the exports file on a Windows server by creating the following entry: * rw. you must have root or Administrator privileges on any servers hosting agents where you want to discontinue use of client-side certificates.. self-signed certificate from managed servers by entering the following command: nukecert userName agent1.user=Administrator On a UNIX server. 1 Set up root or Administrator privileges on each managed server hosting an agent. set the BL_X509_KEY environment variable by entering the following command: BL_X509_KEY=xy 4 Export the BL_X509_KEY environment variable by issuing the following command: export BL_X509_KEY The bl_ssl_agent program remains in the background holding the private key password cached in a shared memory segment until you kill it. you may want to replace the host wildcard (“*”) with the IP address or host name of the Network Shell client. 3 Configure the secure file on all agents where you want to stop using certificates by using Network Shell to run the following secadmin command: 216 BMC BladeLogic Server Automation Administration Guide . 2 Remove the SHA1 fingerprint of a client-side.agentN is a space-delimited list of the names or IP addresses of the servers where you want to stop using certificates. This shared memory segment is only usable by the person who ran bl_ssl_agent. bl_ssl_agent runs in the background with the password cached in a shared memory segment.. update the exports file by creating the following entry: * rw.agentN where userName is the name of the user who created the certificate and agent1. Discontinuing use of client-side certificates Use this procedure to stop using client-side certificates that secure access between Network Shell clients and agents.

pem is stored in /userHomeDirectory /. id. Otherwise. Each of the steps in this procedure references a sub-section that describes another procedure. you must perform this procedure for the BladeLogicRSCD user. On UNIX repeaters. such as /home/userName. In Windows. If you want to stop using self-signed. The following is a master procedure. On Windows. where userHomeDirectory> is the user’s home directory. users are mapped to root but mapping to other user names is possible. id. all users accessing those agents will be mapped to root or Administrator. see “Discontinuing use of client-side certificates” on page 222. client-side certificates. In UNIX. where userProfileDirectory specifies a path such as /Documents and Settings/userName. and configure those agents to authenticate incoming requests using clientside certificates. This step sets tls_mode=encryption_only on the targeted agents.Implementing Security – Repeater to agent secadmin -m rscd -p 5 -T encryption_only -e tls Running this command generates an rscd entry in the secure file like the following: rscd:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls NOTE Performing this step could have implications for Application Servers or Network Shell Proxy Servers when they communicate with the same targeted agents. Chapter 4 Administering security 217 . provision all targeted agents with an SHA1 fingerprint of the repeater’s self-signed certificate. you must perform this procedure for every user to whom connecting users are mapped. client-side certificate for a repeater. Implementing Security – Repeater to agent Use this procedure to generate a self-signed. Typically.pem is stored in /userProfileDirectory/Application Data /BladeLogic.pem file. which means these agents will not require Application Servers or Network Shell Proxy Servers to also use client-side certificates. 5 Remove certificates from clients by deleting the id.bladelogic. 4 Revert the setting in the exports file on managed servers back to a more restrictive user mapping.

and then add the passphrase for that certificate to the securecert file. C. Then confirm the passphrase by entering it again. BMC BladeLogic will not load the certificate if group or world permissions are set for the id. generate a self-signed certificate by doing one of the following: ■ On UNIX-style systems. See “Provisioning agents with an SHA1 fingerprint of the repeater’s self-signed certificate” on page 219. issue the following command for generating a certificate: bl_gen_ssl ■ On Windows. 2 Provision all targeted agents with an SHA1 fingerprint of the repeater’s self-signed certificate. log into the repeater as a user to whom connecting users are mapped (typically root).pem file or the . See “Configuring agents to authenticate incoming requests with clientside certificates” on page 221. See “Creating a self-signed client-side certificate on the repeater” on page 218. Enter the following command for generating a certificate: bl_gen_ssl -repeatcert 5 Enter a passphrase for the private key to the certificate. In the path shown above. where the id. WINDIR is typically winnt (on a Windows 2000 server) or windows. Create a directory called C:\WINDIR\rsc\certs\BladeLogicRSCD.bladelogic directory. 218 BMC BladeLogic Server Automation Administration Guide . Then. Creating a self-signed client-side certificate on the repeater Use this procedure to create a self-signed certificate for the repeater and then add the passphrase for that certificate to the securecert file on the repeater.pem file is generated. client-side certificate on the repeater. 3 Configure all targeted agents to authenticate incoming requests using client-side certificates. 4 Using a command line. B.Creating a self-signed client-side certificate on the repeater 1 Create a self-signed. On UNIX repeaters. Log into the Application Server as Administrator. do the following: A.

if you are logged in as root.pem file and the . ensure that access is restricted to the id.bladelogic directory by running the following commands: chmod 700 /opt/bmc/BladeLogic/version/NSH/br/. For example.bladelogic chmod 600 /opt/bmc/BladeLogic/version/NSH/br/.pem is created in /root/. Using Network Shell. the file is created in userHomeDirectory /. this command might create an entry like the following. Chapter 4 Administering security 219 .. the file is created in WINDIR\rsc\certs\BladeLogicRSCD. (The encoded passphrase will vary. enter the following: secadmin -m default -cu user -cp password where user is BladeLogicRSCD for Windows repeaters and the user who created the certificate (such as root) for UNIX-style repeaters. where userHomeDirectory is the user’s home directory. 6 Update the securecert file to contain an encoded copy of the passphrase. the contents of the securecert file are updated to include an entry for your current user name. Enter the password in clear text. The secadmin utility encrypts the password.pem Provisioning agents with an SHA1 fingerprint of the repeater’s self-signed certificate Use this procedure to provision managed servers with the SHA1 fingerprint of the repeater’s self-signed certificate. id. On UNIX.pem.pem. An agent uses this fingerprint to validate the selfsigned certificate received from the repeater in the course of the TLS handshake. such as root or BladeLogicRSCD. For example.bladelogic/id.) [default] BladeLogicRSCD=FCUVOMLNGLVRZNOO 7 For UNIX repeaters. After issuing this command. where WINDIR is typically windows or winnt.bladelogic.Provisioning agents with an SHA1 fingerprint of the repeater’s self-signed certificate BMC BladeLogic generates a certificate in a file named id. On Windows.bladelogic/id.

On UNIX-style servers.pem is stored. 2 Set up root or Administrator privileges on each managed server hosting an agent. you may want to replace the host wildcard (“*”) with the IP address or host name of the Application Server.pem resides in WINDIR\rsc\certs\BladeLogicRSCD.pem resides in userHomeDirectory/. id. the agent will refuse the incoming connection because it will not have the SHA1 fingerprint of the repeater’s self-signed cert.user=Administrator On a UNIX server. On Windows. you must have root or Administrator privileges on the server hosting the agent. generate this setting by running the following secadmin command on each agent: secadmin -m rscd -p 5 -T encryption_only -e tls Before you can provision an agent with the fingerprint of the repeater’s certificate.bladelogic. 220 BMC BladeLogic Server Automation Administration Guide . so in most situations there is no need to perform this step.pem is created at /root/. id. update the exports file on a Windows server by creating the following entry: * rw. id. If necessary. To provision an agent with the SHA1 fingerprint of an Application Server’s certificate. update the exports file by creating the following entry: * rw. To grant this privilege. The secure file (located in the C:\WINDIR\rsc directory on a Windows server and in / usr/lib/rsc on a UNIX-style server) must have the rscd entry set to the following when deploying the certificate fingerprint: rscd:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls This is the default setting after a fresh installation of an agent. where WINDIR is typically windows or winnt. If you prematurely set the rscd entry in an agent's secure file so that tls_mode=encrytion_and_auth.user=root To be safe. if you are logged in as root. you must ensure the secure file on the agent is configured correctly. 3 Cd to the directory on the repeater where id. where userHomeDirectory is the user’s home directory. For example.Provisioning agents with an SHA1 fingerprint of the repeater’s self-signed certificate 1 Ensure that the secure file on all managed servers is configured so that tls_mode=encryption_only.bladelogic/id..pem.

agentN is a space-separated list of the host names or IP addresses of the managed servers hosting agents. all users accessing those agents will be mapped to root or Administrator. To accomplish this. user is either the name of the UNIX user you were logged in as when you created the certificate or BladeLogicRSCD if the repeater is on a Windows platform. This setting requires client authentication via clientside certificates. To modify the rscd entry in the secure file on each targeted agent. agent1.Configuring agents to authenticate incoming requests with client-side certificates 4 Push the SHA1 fingerprint for the repeater’s certificate to managed servers that communicate with the repeater. the secure files on those agents must be updated so tls_mode=encryption_and_auth. Otherwise. Configuring agents to authenticate incoming requests with client-side certificates Use this procedure to update the rscd entry in each agent's secure file so it reads as follows: rscd:port=4750:protocol=5:tls_mode=encryption_and_auth:encryption=tls After agents are provisioned with the SHA1 fingerprint of an Application Server’s self-signed certificate. use Network Shell to enter the following secadmin command: secadmin -m rscd -p 5 -T encryption_and_auth -e tls Chapter 4 Administering security 221 .... 5 Revert the setting in the exports file on managed servers back to a more restrictive user mapping. When you issue the putcert command.. The file resides in the /nsh/certs directory on UNIX-style servers and in \rsc\certs on Windows. BMC BladeLogic places the SHA1 fingerprint of the id.pem agent1. It places the SHA1 fingerprint of the id.pem file for BladeLogicRSCD in a file called BladeLogicRSCD.pem file for root in a file called root. use Network Shell to enter the following: putcert user id.agentN where.

you must remove those user names as well. you must have root or Administrator privileges on any servers hosting agents where you want to discontinue use of client-side certificates. 2 Remove the SHA1 fingerprint of the repeater’s self-signed certificate from managed servers. 3 Configure the secure file on all agents where you want to stop using certificates by using Network Shell to run the following secadmin command: secadmin -m rscd -p 5 -T encryption_only -e tls Running this command generates an rscd entry in the secure file like the following: rscd:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls NOTE Performing this step could have implications for Application Servers or Network Shell Proxy Servers when they communicate with the same targeted agents.. To grant this privilege. such as the IP address or host name of the Network Shell client.user=root To be safe. This step sets tls_mode=encryption_only on the targeted agents. update the exports file by creating the following entry: * rw. you should replace the host wildcard (“*”) with a more restrictive setting. In the command shown above agent1. To perform this procedure. To accomplish this. update the exports file on a Windows server by creating the following entry: * rw.user=Administrator On a UNIX server.Discontinuing use of client-side certificates Discontinuing use of client-side certificates Use this procedure to stop using client-side certificates that secure access between repeaters and agents.. 1 Set up root or Administrator privileges on each managed server hosting an agent.agentN where user is BladeLogicRSCD for a Windows repeater and typically root for a UNIX repeater.agentN is a space-delimited list of the names or IP addresses of the servers where you want to stop using the repeater’s self-signed certificate. which means these agents will not require Application Servers or Network Shell Proxy Servers to also use client-side certificates. use Network Shell to enter the following: nukecert user agent1. If other UNIX users have fingerprints on the agent... 222 BMC BladeLogic Server Automation Administration Guide .

On UNIX-style servers. the id. enter the following command: blmkcert CN=hostname jksFileName password The command shown above has the following parameters: ■ hostname—Typically set to the host name where you are generating the certificate. see “Generating a selfsigned certificate for an Application Server” on page 223. Chapter 4 Administering security 223 .pem file storing the certificate. In some situations. For more information on that procedure.bladelogic. For more information on that procedure. you may need to manually generate a self signed certificate for an Application Server. where WINDIR is typically windows or winnt.pem resides in /root/. id.Using certificates to secure communication between clients and Application Servers 4 Revert the setting in the exports file on managed servers back to a more restrictive user mapping. Generating a self-signed certificate for an Application Server Performing this procedure generates a 2048-bit RSA key and a self-signed certificate for an Application Server. However.. 5 Remove certificates from repeaters by deleting the id. if you are logged in as root. all users accessing those agents will be mapped to root or Administrator.pem. you may choose to provision Application Servers with a CA-issued certificate or certificate chain.pem file resides in WINDIR\rsc\certs\BladeLogicRSCD. 1 From installDirectory/bin. and it will be stored under the “blade” alias.pem file resides in userHomeDirectory/. The certificate will be valid for three years. where userHomeDirectory is the user’s home directory. see “Securing communication with CA certificates” on page 224.bladelogic/id. the id. For example. Using certificates to secure communication between clients and Application Servers Typically BMC BladeLogic uses self-signed certificates to secure communication between clients and Application Servers. Otherwise. On Windows.

224 BMC BladeLogic Server Automation Administration Guide . When you perform this procedure. However. the installation procedure provisions the Application Server with a self-signed certificate. some organizations may choose to use a CA-issued certificate or certificate chain rather than the default selfsigned certificate. 1 Obtain a certificate chain from a certificate authority. see “Synchronizing keystore files of multiple Application Servers” on page 58. This file should be stored in the /deployments directory for the Application Server that is being updated. you might enter a command like the following: blmkcert CN=winappserver1 "C:\Program Files\BMC Software\BladeLogic\version\ NSH\br\deployments\_template\bladelogic. After you provision Application Servers with CA-issued certificates. update the password for each cooperating Application Server. do not provision the Application Server with a certificate that includes an OCSP URL.) If the certificate you are importing includes a URL for an OCSP Responder. copy the JKS file you generated in step 1 from this Application Server to all cooperating Application Servers. Securing communication with CA certificates When you install an Application Server. you set up a keystore that takes the place of the bladelogic. see “Importing CA-issued certificates into clients” on page 226. such as installDirectory/br/deployments/_template. If a new password is needed. if you are generating a self-signed certificate on a Windows server called winappserver1. 2 Import the certificate and its corresponding private key into a keystore file on the Application Server. password—A password used to encrypt the generated keystore file. For more information on that procedure. the client will attempt to verify the revocation status of the Application Server’s certificate. (A keystore contains certificates and a private key. A trust store only contains certificates. If you do not want clients to verify a certificate’s revocation status. you should import those certificates into client trust stores.Securing communication with CA certificates ■ jksFileName—The path to the keystore you are generating.keystore created automatically when you install the Application Server. For information on this process. ■ For example.keystore" ******** 2 If you are using a multi-Application Server environment.

This is the password used to encrypt the keystore. the alias you use to identify the certificate must be blade and the format of the keystore must be jks. your certificate authority should create a certificates and private keys and output them using the JKS format. you can use Java’s keytool utility. see “Synchronizing keystore files of multiple Application Servers” on page 58. bladelogic. copy the JKS file you generated in step 2 from this Application Server to all cooperating Application Servers. which is available on any machine where the Authentication Server is installed.Securing communication with CA certificates Ideally. you might enter a command like the following: installDirectory/jre/bin/keytool -importkeystore -srckeystore bladelogic. you must convert your certificates and private keys into JKS. pkcs12Alias is the alias under which the certificate and private key are stored. There are various tools for performing this type of conversion. which is the password originally used to create the PCKS12 file. When you enter the command shown above. If a new password is needed. 3 If you are using a multi-Application Server environment.keystore -srcstoretype pkcs12 -deststoretype jks -srcalias pkcs12Alias -destalias blade In this command bladelogic.keystore is the name of the keystore file you are creating. NOTE No matter what method you use to import the certificate. For example. Chapter 4 Administering security 225 . If you are importing a certificate with the Authentication Server’s version of keytool. When you use the blasadmin utility to set up keystores for cooperating Application Servers (described in the next step) you must provide this password. For information on this process. If your CA cannot create a JKS file and instead provides you with a PKCS12 file. This file should be stored in the /deployments directory for the Application Server that is being updated.p12 is the file being imported. you are prompted for a destination keystore password. such as installDirectory/br/deployments/_template. update the password for each cooperating Application Server.p12 -destkeystore bladelogic. The command shown above also prompts you for the source keystore password.

but performing it configures the client so it communicates more securely with the Application Server. This file must use the PEM or DER format. session credentials. On UNIX. To log into a BMC BladeLogic system.PEM. Once the Authentication Service validates a user.pkcs12. which uses self-signed certificates.PEM. If you do not perform this procedure. a user must provide an authentication profile. the Authentication Service issues a session credential. This procedure is not essential. you must install the BMC BladeLogic Console. you should import a related certificate into the client’s trust store. This file could be the Application Server’s certificate file. The related certificate should be the issuing certificate for the Application Server’s certificate. Use the blcred utility to import the certificate into the client trust store by entering the following command: blcred cert -import certificateFile In this command certificateFile provides the path to the certificate you are adding to the trust store. OCSP verification on the client side will only happen if the CA certificate was imported and the Application Server’s certificate contains an OCSP URL. you are prompted to trust the certificate. and trusted certificates. 226 BMC BladeLogic Server Automation Administration Guide .pkcs12. On Windows. user name. If the Application Server is provisioned with a certificate chain. To use blcred. and password. when you establish a connection to the Application Server. Using the blcred utility The blcred utility manages authentication profiles. or it could be a CA’s certificate that can be used to verify the validity of the Application Server’s certificate. This functionality is equivalent to the default approach for BMC BladeLogic. The authentication profile specifies a BMC BladeLogic Authentication Service and the mechanism that should be employed to authenticate the user. this command imports the certificate to userHomeDirectory/.Using the blcred utility Importing CA-issued certificates into clients If you have provisioned an Application Server to use a certificate or certificate chain obtained from a Certificate Authority (see “Securing communication with CA certificates” on page 224). the certificate that you import into the client’s trust store should be the issuing certificate for the top of the certificate chain. This session credential can be stored in a credential cache file.bladelogic/ client_keystore. this command imports the certificate to C:\Documents and Settings\ user\Application Data\BladeLogic\client_keystore.

BMC BladeLogic client applications can use a cached session credential when the owner of the credential cache file invokes the client application. When operating in a command line environment. — Domain Authentication—User name (in the form user@KRBDOMAIN.509 certificates are used when establishing a TLS connection to an LDAP server. as described below: — SRP—user name and password. the blcred utility lets you: ■ Create an authentication profile Acquire a session credential by providing an authentication profile and the appropriate user credentials for each authentication protocol. — SecurID—user name and passcode (PIN plus token code). an established client/ server session can continue even though the session credential used to establish that session has expired.COMPANY. Application Server.509 certificates are used when establishing a TLS connection to an Authentication Service. and delete authentication profiles. and delete trusted X. — PKI—Insert a smart card into a smart card reader and provide the appropriate PIN for that smart card. Review. or Network Shell Proxy Server. Review. add. BMC BladeLogic users can log on and acquire session credentials using the BMC BladeLogic Console or blcred command line utility. Session credentials have a finite lifetime. ■ ■ Chapter 4 Administering security 227 . However. After a session credential has expired. X. — AD/Kerberos—The blcred utility retrieves the AD/Kerberos user credential from the host system's AD/Kerberos credential store. add. import. users do not explicitly use the command line interface to provide AD/Kerberos credentials. On clients.509 certificates. X. — LDAP—distinguished name and password.COM) and password. You must insert the smart card before you can use blcred to run the acquire command to obtain a session credential. it cannot be used to establish a client/server session.Using the blcred utility BMC BladeLogic client applications use session credentials to establish secure sessions with a middle tier service—either the Application Service or the Network Shell Proxy Service. On Application Servers. ■ ■ Test whether a valid session credential already exists and determine the lifetime remaining for that credential.

If this command is successful. which means a valid session credential does exist for MyProfile. refer to the man page for blcred. which means the MyProfile session credential is valid for at least 500 minutes. enter a command like the following: blcred cred -test -profile MyProfile -time 500 where 500 is a remaining lifetime in minutes.Options Options For a complete description of all available command line options. it generates a return code of 0. run the following command: blcred cred -acquire 228 BMC BladeLogic Server Automation Administration Guide . Typical scenarios The following sections describe some typical scenarios for using blcred. If this command is successful. it generates a return code of 0. To determine whether a credential's remaining lifetime exceeds a specified number of minutes. run the following command: blcred cred -test -profile MyProfile where MyProfile is the name of the authentication profile for which a session credential has been issued. Interactively obtaining a session credential If you are interactively running Network Shell (in proxy mode) or the BLCLI and you need to obtain a session credential but cannot use the console. Testing for valid session credentials If you are using a command line (BLCLI or Network Shell in proxy mode) and you want to determine whether you have a valid session credential.

blcred does not prompt the user for a name or password. you can direct blcred to retrieve an SRP user name and password from an SRP keytab file. but when prompted for an authentication profile name. as described in “Obtaining a TGT for a BMC BladeLogic client (UNIX only)” on page 201. Instead. user name and password if the named profile specifies SRP authentication. $ blcred cred -acquire profile name: adkProfile Authentication succeeded: acquired session credential Obtaining a session credential by referencing a keytab file If you are running Network Shell or the BLCLI in batch mode and you need to obtain a session credential non-interactively. you can specify the profile name. (Alternatively. and you are using SRP authentication. you must enter a profile name that calls for AD/Kerberos authentication. blcred cred -acquire -profile srpProfile -username BLAdmin -password ****** Chapter 4 Administering security 229 .Typical scenarios The blcred utility will prompt for an authentication profile name. you can enter the same command. The example below shows an authentication session that prompts the user for credential information. you can specify the profile name as a command line option. user name and password as command line options. using a command like the following blcred cred -acquire -profile srpProfile -i /home/user/user_info.dat Obtaining a session credential using SRP authentication profile If you are running Network Shell or the BLCLI in batch mode.) When employing AD/Kerberos authentication. Alternatively. $ blcred cred -acquire profile name: srpProfile username: BLAdmin password ****** Authentication succeeded: acquired session credential If you are using AD/Kerberos authentication. you can direct blcred to obtain a session credential. you need to obtain a session credential non-interactively. it retrieves the user’s Kerberos credential from the host operating system’s AD/Kerberos credential cache. Note that UNIX users must first manually run a kinit before attempting to authenticate.

0.Generating a user information file Obtaining a session credential using an LDAP authentication profile If you are running Network Shell or the BLCLI in batch mode. If you are using a distinguished name template.1 Destination URLs: service:appsvc. you must provide a full distinguished name and a password. run the command bl_gen_blcli_user_info. 2 Name the file user_info.0.exe.bladelogic:blsess://localhost:9842 Generating a user information file Use this procedure to generate a user information file. Username: Authentication: Issuing Service: Expiration Time: Maximum Lifetime: Client address: Authorized Roles: RBACAdmins RBACAdmin SRP service:authsvc. ■ The utility prompts you to create a file name. 230 BMC BladeLogic Server Automation Administration Guide . you need to obtain a session credential non-interactively. and role. password. do one of the following: ■ On Windows.bladelogic:blsess://localhost:9841 service:proxysvc. you can display the contents of your current session credential. On UNIX.bladelogic:blauth://localhost:9840 Fri Aug 17 20:57:29 EDT 2007 Sat Aug 18 06:57:29 EDT 2007 127. Displaying the contents of a session credential Using a blcred command like the following. blcred cred -acquire -profile ldapProfile -username admin -password ****** If you are not using distinguished name templates. you can direct blcred to obtain a session credential. which caches your user ID. you only have to provide a partial distinguished name (in this case admin) and an LDAP password.dat. run the command bl_gen_blcli_user_info. 1 From installDirectory/bin. and you are using LDAP authentication.

dat 5 Make sure that only you have permission to access the directory where you have stored the user_info.Generating a user information file 3 When prompted. To determine the userHomeDirectory for LocalSystem.bladelogic/. run Network Shell on the Application Server and enter the following command: echo $USERPROFILE To determine the userHomeDirectory for bladmin. run the following command as root or a user with root privileges: sudo -u bladmin echo $HOME Chapter 4 Administering security 231 . NOTE When running a Network Shell Script Job based on a Network Shell script that contains CLI commands. password.user/user_info.dat file. and role.dat ■ UNIX: userHomeDirectory/. 4 Move the file created in step 2 to one of the locations shown below: ■ Windows: userHomeDirectory\Application Data\BladeLogic \user\user_info. the user_info. enter your user name.dat file must be saved in the userHomeDirectory for the LocalSystem account on Windows or the bladmin user on UNIX.

Generating a user information file 232 BMC BladeLogic Server Automation Administration Guide .

txt files are also installed for each client installation. secure.txt. securecert. each machine where an RSCD agent is installed). users. which clients and users have access to RSCD agents. The exports. When a client connects to a server. The secure files on both the client and server configure how clients communicate with servers. Chapter 5 Setting up configuration files 233 . and log4crc.local.local secure securecert log4crc. The secure. securecert. users. and log4crc.txt files reside on each server (that is. The configuration files control how communication occurs between RSCD agents and their clients. The chapter also provides an overview of logging in BMC BladeLogic. even if there are multiple client installations on the same machine. and discusses how logging is performed. Introduction to the configuration files BMC BladeLogic provides the following configuration files: exports users users. the client user can be granted permissions on the server using two approaches: through configuration files on the agent (a process called user privilege mapping) or through Windows user mapping.Chapter 5 5 Setting up configuration files This chapter describes how to modify BMC BladeLogic configuration files.

you must still create entries for the users. It uses a combination of the exports. you can grant permissions to roles that are mapped to local or domain users who are authorized for a Windows server. the standard approach to granting user permission on managed servers is user privilege mapping. users. see the man page for the chapw command. Any user mapping information in these entries is ignored for roles that employ Windows user mapping through automation principals. NOTE Only Windows servers running BMC BladeLogic 8. The information in these entries defines whether users can access a server. or exports files. Using this technique. Together.local configuration files. Consequently. users. 234 BMC BladeLogic Server Automation Administration Guide . see the BMC BladeLogic Server Automation User Guide.Introduction to the configuration files In BMC BladeLogic. see “Setting up a Network Shell Client to run in proxy mode” on page 147. This approach should always be used in the following situations: ■ ■ ■ ■ ■ When a user is accessing any UNIX server. you should still push agent ACLs to servers when you add or modify user or role information in the BMC BladeLogic Console. even if you are using Windows user mapping. For more information on configuring clients to use a Network Shell Proxy Server. and users.local. these files define what permissions apply during the connection. Disabling user privilege mapping BMC BladeLogic provides a mechanism for disabling user privilege mapping on Windows servers. When a user is using a Network Shell client to connect to servers via a stand-alone Network Shell Proxy Server. When a user is running a Network Shell script defined to use the first and second script types and the appserver_protocol setting in the secure file is not set to ssoproxy. When a user runs a Network Shell client to connect directly to a server.0 or later can recognize automation principals. The alternative approach to user privilege mapping is to implement Windows user mapping. When a user is accessing a Windows server and the user’s role is not mapped to a Windows user through an automation principal. For information on implementing Windows user mapping. When you are using Windows user mapping to grant permissions to roles. For more information.

) A client’s secure file specifies how the client communicates with agents. RSCD agents. A utility called secadmin allows you to configure the secure file on a particular machine. An Application Server’s secure file specifies how the Application Server communicates with agents and how the file server (typically created on the same host as the Application Server) communicates with clients. users and users. With the exports file you can also establish global user permissions. BMC BladeLogic recommends that you always use secadmin. (For more information on RBAC. Storing passphrases lets BMC BladeLogic access private keys without any need for user interaction. ■ secure—Sets communication parameters that define how client and server machines communicate. With log4crc. so that a single log file cannot get excessively large.txt. Application Servers. (On Windows. A server’s secure file specifies how an agent communicates with clients. Permissions set in either the users and users.txt—Controls logging in BMC BladeLogic so that all events are logged using consistent formats.Configuration file functions Configuration file functions The configuration files function as follows: ■ exports—Sets access permissions for client machines that communicate with a server. the values specified in the users file are ■ automatically generated to implement decisions made in RBAC.509 certificates.local files override any global user permissions defined in the exports file. Strong security for communication requires X.509 certificates. ■ securecert—Stores passphrases used to encrypt the private keys for X. a single machine can have multiple client installations. Although you can edit the secure file by hand. and client installations each have their own secure file. Chapter 5 Setting up configuration files 235 .local—Set access permissions for individual users that communicate with a server.) You can use the users. see the BMC BladeLogic Server Automation User Guide. you can also control the rolling of log files. Typically. The secure file also determines whether a Network Shell client communicates with servers via a Network Shell Proxy Server. ■ log4crc.local file to override any permissions defined in the users file.

000 @192.Subnet designations The following graphic illustrates how the secure.10. provide the number of bits in the mask.0/24 236 BMC BladeLogic Server Automation Administration Guide . and users configuration files work together to control access to a server.0/24 The following are sample subnet mask definitions: 255. an IP address. or a subnet.168.100. For example.255.0 might look like the following: @192. A subnet represents a range of IP addresses. a subnet designation uses the following format: @<IP address or hostname>/mask The @ symbol indicates that a subnet is being defined. exports.255.255. After the IP address or host name. you can use a resolvable host name. In the configuration files.168.255. Subnet designations When designating a host in the configuration files. a subnet with a subnet mask of 255.

193/26 255.255.255.255.168.168. the client uses the information in the entry to establish a connection with the server. BMC BladeLogic uses the following algorithm to determine whether a user has permissions for accessing the agent: 1 Every client installation (on Windows there can be multiple clients) and the RSCD agent each have their own secure file. the client reads its secure file to determine whether it includes an entry for a particular server. Depending on the type of authentication and encryption specified in the secure file. see “Secure file” on page 253.248 @192. access to the agent is denied.241/28 255.249/29 How BMC BladeLogic grants access to RSCD agents When a client contacts an RSCD agent.240 @192.225/27 255.168.100. For a complete description of how to set up communication security for a BMC BladeLogic system. the RSCD agent on the server reads its secure file to determine if it has an entry for the incoming client.255. see Chapter 4.100.255. “Administering security. additional measures may be required before a connection can be successfully established between clients and servers. Then. If there is an entry and the communication parameters in the secure file on the server match those in the secure file on the client.255. First.100.224 @192.100.168.255.255.129/25 255.128 @192. If an entry for that server exists.192 @192.How BMC BladeLogic grants access to RSCD agents 255. a connection is established.100.255. Chapter 5 Setting up configuration files 237 . If there is no entry for that client in the secure file of the server.” For more information on using on the secure file.255.168.

238 BMC BladeLogic Server Automation Administration Guide . you can map a user on a client to a user on a server. the system checks the exports configuration file. For example.local and users configuration files to determine if these files include any map= entries that supersede definitions set in the exports file. where the user= field can map users connecting from specified machines to a particular user on the server. If any of the following conditions are not satisfied.How BMC BladeLogic grants access to RSCD agents 2 Assuming the conditions described below are satisfied. Note that on Windows. — The secure file on the Application Server must be defined so the appserver_protocol option is set to ssoproxy. If the same users have entries in both users.local and users files produce no user mapping.local and users. all users are domain users. the exports file produces no user mapping. The users. you can map users to root on UNIX-style systems or Administrator on Windows. Using the map= field.0.00 or later. Typically.local file take precedence. 4 The system checks the users. if you are using Windows user mapping. incoming users can only be mapped to local users.local file is used for granting user permissions on a per-agent basis rather than granting system-wide user privileges. entries in the users. Any job acting on a target server must be running in an Application Server environment that meets the following criteria: — The Application Server must also be running a Network Shell Proxy Service or the ProxyServiceURLs value in the Application Server profile must point to a valid Network Shell Proxy Server. you can map a user to a domain user. the algorithm continues to step 3 ■ ■ ■ ■ ■ The agent being contacted must be running on a Windows server. with the user= field. To take advantage of Windows user mapping. On domain controllers. the users. The agent must be running BMC BladeLogic 8. On Windows domain controllers. For more on the exports file. 3 Once a connection is established between the client and server. The agent being contacted must be running on a server that has already been added to the BMC BladeLogic system. the users file is used to implement the permissions that are defined and granted to users on a system-wide basis through RBAC Management. Network Shell cannot contact an agent directly or communicate through a stand-alone Network Shell Proxy Server. see “Exports file” on page 240. If a role is mapped to a Windows user through an automation principal. the incoming role is granted the permissions of a local or domain user on the server and the process if complete. If a role is mapped to a Windows user through an automation principal. A Network Shell client must be communicating through a Network Shell Proxy Server. however.

users. then that user is. users are granted the permissions of user “Anonymous. you can use the anon= field to specify how to deal with anonymous users. be aware that the validusers= option is treated the same as the allowed= option.” Note that on UNIX. any client user found to be a member of the Administrators group cannot be mapped by default to an equivalent user on the server.local. The anon= field is not supported for Windows. by default. on Windows. Similarly. If a root= field is found. On Windows. if the role is not mapped to an automation principal.local files” on page 247. user “root” on a UNIX-style client is not allowed to map to its equivalent user “root” on a UNIX-style server. Similarly. In UNIX-style systems. the system maps the incoming user to a default user. on Windows.How BMC BladeLogic grants access to RSCD agents For more on the users and users. mapped to nobody unless a corresponding entry for the root= field is found. by default. if an incoming user is not mapped to an automation principal and that user is a member of the Administrators group. access is denied. the user is assigned that user’s permissions.” On Windows systems. mapped to Anonymous unless a corresponding entry for the root= field is found. For example. Chapter 5 Setting up configuration files 239 . If there is no user named WindowsUser. a mapping exists in the exports or users file. see “Users and users. and the user that is being mapped to does not exist. if an entry in the users file says betty map=WindowsUser then any user named betty that tries to make a connection to this machine is mapped to the local user named WindowsUser. access to the agent is denied. users are granted the permissions of user “nobody. Also. if you are not using Windows user mapping. 5 If there is no user mapping defined in the exports. If there is a match. then root equivalence is allowed. 6 If none of the previous steps succeed. including rejecting them with anon=-1. on Windows. On UNIX-style systems. the system attempts to match the user ID of the incoming user to a user ID defined on the server where the RSCD agent is installed.local files. users coming in as root are. or users files. Note that. by default.

HP-UX Windows Location /usr/lib/rsc/exports WINDIR\rsc\exports (For example. AIX. the daemon automatically re-reads it. If you are using Windows user mapping to grant permissions to roles. Access permissions are defined for each individual RSCD agent and must be configured separately on each host where the RSCD agent is running. use the users or users. you cannot establish a connection with an agent. All subsequent client connections have the access permissions defined in the modified version of the exports file. Linux. as described in the following table. Often the exports file is used to set global permission that apply to users on all client machines.) The exports file does not grant permissions on Windows servers to roles that are set up for Windows user mapping. Platform Solaris. you can use the exports file to limit all clients to readonly permission on the server. If the exports file does not exist or it does not contain any configuration information. Only the user mapping information in the exports file is ignored.Exports file Exports file The exports file determines which BMC BladeLogic clients have access to a server. When an rscd daemon starts on a server. Updating the exports file on the host where you are running Network Shell or other BMC BladeLogic applications does not set access permissions for managed servers. WINDIR can be \windows or \winnt. You do not have to restart the agent or otherwise instruct it to read the new exports file. For information on Windows user mapping. With the exports file you can set permissions on a per-client basis and. The exports file resides in different locations in Windows and UNIX-style systems. When changes are made to the exports file. Then you can use the users or users. see the BMC BladeLogic Server Automation User Guide. For example. Existing client connections are not affected by the changes. 240 BMC BladeLogic Server Automation Administration Guide .local files to override those permissions for particular users.local files to specify individual users who are granted read/write permission on that server. the exports file may still include entries that apply to Windows servers. it automatically reads the exports file. when necessary.

Using an asterisk (*) instead of a list of host names defines default options that apply to any host not specifically named in the exports file.. enter options in a comma-separated list.optionN hostNnames is a list of comma-separated IP addresses. Each option defines a type of access permission that applies to the hosts you have named in that entry. with each entry identifying client hosts and the access permissions granted to those hosts. Chapter 5 Setting up configuration files 241 .. To configure the exports file. separate each value with a colon. Option allowed=username[:username] Description This option can be used to restrict access to specific users who do not have a local account. use the validusers option instead of the allowed= option. The user names entered here should be the login names of the users on the client machines. Use the following format for each entry: hostNnames option1. If possible. as in the following: validusers=user1:user2 Lines in the exports file that begin with # are considered to be comments. resolvable host names.Configuring the exports file Configuring the exports file The exports file consists of multiple entries.optionN is a list of comma-separated fields. see “Options for exports file” on page 241. you can apply any of the options listed below. Options for exports file For each of the entries in the exports file.. Subnet designations are used to define a range of addresses (see “Subnet designations” on page 236). For a complete list of available options. If a single option sets multiple values. This option is similar to the validusers option except that the users named here are not required to have an account on the local system.. create entries that correlate the host names of clients with the permissions that should be granted to those clients. When defining multiple options. The allowed= option is read before the validusers= option. option1. or subnet designations.

If both the ro= and rw= options are defined. (UNIX only. If the user nobody does not exist. Hosts not specified have read-only permissions if ro is defined or they are listed in the ro= option. See “Restricting commands” on page 244 for more details on how to use this option.) This option specifies how unknown users should be treated. If both the ro= and rw= options are defined. Setting anon=-1 disables anonymous access. rw=hostname[:hostname] Hosts listed in this option are granted read/write permissions. If a user name is entered.) By default.) By default. If rw is not set or the host is not listed in the rw= option. 242 BMC BladeLogic Server Automation Administration Guide . If ro is not set or the host is not listed in the ro= option. If you specify the nosuid option. nomknod nosuid ro rw All clients have read-write access except those listed in the ro= option. ro=hostname[:hostname] Hosts listed in this option are granted read-only permissions. Hosts not specified have read/write permissions if rw is defined or they are listed in the rw= option. The default is for no hosts to be granted root access. All clients have read-only access except those listed in the rw= option. the client is denied access. The ro option takes precedence over the rw option if both are defined. (UNIX only. The default value for anon= is the UID of the user nobody. the ro and rw options are ignored. The ro option takes precedence over the rw option if both are defined. described below. root=hostname[:hostname] This option gives root access to root users from specified hosts. the client is denied access.Options for exports file Option anon=uid Description (UNIX only. the ro and rw options are ignored. the value 65534 is used. The commands= option allows you to limit the commands a client can execute against an agent. the RSCD agent silently ignores any attempt to enable the setuid or setgid bits when creating a file or changing a file’s permissions. Root users (uid 0) are always considered “unknown” by the RSCD agent unless they are included in the root= option. the GID is set to the GID for the user nobody. If the GID is not found. If a request comes from an unknown user. If a UID is entered. a corresponding GID is searched for. the corresponding UID and GID are determined and set accordingly. commands=cmd1[:cmd2] By default. The value entered can be numeric or a user name. BMC BladeLogic clients are allowed to execute any command against an agent. clients are allowed to create special files (character special and block special). Specifying the nomknod option instructs the RSCD agent to prevent the client from making a mknod(2) call generating an EACCES (Permission denied) error. clients are allowed to create files with the setuid or setgid bits enabled and to set setuid and setgid permission via chown(2). the user is treated as an anonymous user and the effective user ID is uid.

no password challenge) and then tries to switch to a user not in the list. the rscd server allows the client to “see” the complete directory tree from / on down. you can enter Windows user account SIDs rather than user names. then its corresponding GID is also set. If the client tries to use the rsu command with the -p option (that is. By specifying the rootdir= option. When setting rootdir= on Windows systems. The single entry you provide for username can be a user name or a numeric UID (UNIX only). rsu=user[:user] user=username validgroups=groupname[:groupname] This option allows you to specify user groups that are allowed access. For Windows systems.Options for exports file Option rootdir=dirname Description By default. The comparison is done as a numeric equivalency and as such group names must be known on the local system to determine their corresponding GID. if a user name or user account SID is entered. The user name you enter is validated against the domain users on the domain controller. If the GID is not in the list. If the user name entered is not known. but with the -p option no password is requested. This option takes precedence over the root= and anon= options if they exist. The client command rsu allows a client to get alternate remote permissions on the agent. See “How BMC BladeLogic grants access to RSCD agents” on page 237 for more details. access is denied. The rsu= entry defines which users the client is allowed to rsu without challenging them for a password. Enter user groups in a colon (:) separated list. If the user name that is entered is not known. Use /etc/groups to define group names. Numeric GIDs do not have to correspond to a local group name. you can map a user to a domain user. Note that on Windows domain controllers. the connection is refused. If an account is associated with a UID. then the corresponding UID on the server is used even if no known user account is associated with that UID. access to the machine is denied. it is validated against a list of local users on the machine. On UNIX. On Windows. Group information can be provided in the form of group names or numeric GIDs. This option forces all incoming client connections to run with the permissions of username. For each group name and/or GID entered. the rscd server sets the “root” directory to dirname by making a call to or emulating chroot(2). the UID and GID for the user are determined and set accordingly. if a user name is entered. Chapter 5 Setting up configuration files 243 . default user mapping applies.) If a numeric UID is entered. By default the client is challenged for the user’s password. you can use the native file naming convention rather than a Network Shellstyle path. (For more details on user privilege mapping. Clients can only see files and directories from dirname on down. the RSCD agent looks at the effective GID of the calling user (as reported by the calling host) and only allows it access if the GID is in the specified list. see “How BMC BladeLogic grants access to RSCD agents” on page 237.

hostname $ mkdir //athens/tmp/foo //rome/tmp/bar Besides launching external applications. BMC BladeLogic clients can run two types of commands. These commands do not have distributed capabilities and run remotely on the server host. and more. The first are Network Shell utilities. and by the commands a user can run. Given that these commands are internal to nsh. remote commands include ps. The other type of command that a client can run is called a remote command (remote. For each user name and/or UID that is entered. In some circumstances you may want to restrict the commands a user can execute. The RSCD agent then matches the user name/UID combination to each attempted client connection. echo. Access can be limited by host or subnet. you cannot use the commands= option to explicitly restrict their use. from the client’s perspective). the entry is ignored. such as nsh.Restricting commands Option validusers=username[:username] Description This option allows you to specify users who are allowed access. df. false. kill. Enter users in a colon (:) separated list. If the user name and UID of the client connection does not exactly match one of the user name/UID combinations generated by the daemon. each distributed utility contains an encrypted string that is used to hard code the name of the utility into the executable. set. the connection is refused. the nsh utility provides access to many internal commands. pwd. The user information you provide for validusers= can be in the form of user names or numeric UIDs. you must 244 BMC BladeLogic Server Automation Administration Guide . which each have distributed capabilities.) For example. (The process is conceptually similar to doing an rsh. true. This can be done using the commands= option in the exports or users files. To allow remote commands. and netstat. Remote commands do not include this safeguard. by user name. Restricting commands The RSCD agent reads entries in the exports file to determine what access permissions a calling client should have. and midair. the RSCD agent looks up the corresponding UID and user name to create a user name/UID combination. You must first define the allowable distributed commands and then define the allowable remote commands. that is. To prevent individuals from renaming executables to trick the RSCD agent. User names and UIDs must correspond to a locally known user account. For example. you also inherently authorize the use of all nsh internal commands against the server. If no corresponding user account can be found. The order in which commands are entered and the format of the commands= field affect the way permissions are determined. including cd. A distinction exists between distributed commands and remote commands. ls. Once you use the commands= option to authorize the nsh command to run against a server.

For example. The entry commands=ls:nexec:ps:df allows a user to execute the remote commands ps and df but does not allow a user to cd to the host because cd is not a remote command and the nsh command has not been authorized. Then you define the remote commands. This command does allow the user to do things like: rome $ ls //athens/foo/ If you only want to limit the remote commands that can be executed. In order to ensure that only the desired remote commands are executed. commands=nexec:df:ps:netstat allows the user to execute all distributed commands but only allows the user to execute three remote commands on this host. In other words. the last of which should be the nexec command. For example. first you define the distributed commands. you can specify the full pathname of the remote executable. For example.Restricting commands also allow the distributed command nexec. This prevents users from trying to execute a different executable than the intended one. The decision to allow or disallow execution of a remote command is based on comparison of the effective (basename) of the command. if you enter commands=nsh:nexec:/bin/ps the following commands work as expected (executing from /bin/ps): rome $ nexec athens ps -ef rome $ cd //rome/etc athens $ ps -ef Chapter 5 Setting up configuration files 245 . Once the nexec entry is found. commands=nsh:mkdir:rmdir allows users to execute Network Shell’s internal commands as well as to create and remove directories. you can leave out the list of distributed commands. all subsequent commands in the list are assumed to be remote commands. No remote commands such as ps or df are allowed.

The asterisk means permissions apply to all clients unless there are other entries that define different permissions for specific hosts. and it also maps their user privileges to root. need to manage remote UNIX servers. on Windows Domain Controllers.rootdir=/reports The following example is a configuration that could be assigned when administrators.rootdir=/pubs. * rw.admin2 rw.root=host1 host4. However.host2. It grants two users (sysadmin1 and sysadmin2) read/write permission for all servers.user=root 246 BMC BladeLogic Server Automation Administration Guide . granting them root access from only one host and changing the root directory to /reports: host1. * rw. The following example allows both read/write and read-only access for selected hosts. the user name entered is validated against a list of local users on the machine. Because Windows machines have no inherent concept of root. A configuration like this is typically necessary if you are deploying BLPackages to Windows machines because you need Administrator privileges to deploy packages. This example grants read-only access to all clients and maps all incoming connections so that users have “guest” privileges.host5 ro. admin1.rootdir=/reports.user=Administrator NOTE On Windows.Examples Examples The following example allows customers access to software updates from servers.nosuid. * ro.user=guest The following example grants read/write access to all users but turns off the setting of setuid/setgid bits and denies unknown users access. who typically work on Windows clients. This entry would be added to the exports file on every remote server being managed by the two administrators.allowed=sysadmin1:sysadmin2. When using the exports file to set up user privilege mapping on Domain Controllers. map users to Administrator or the administrator account for the domain.anon=-1 The following example maps incoming connections from machines called admin1 and admin2 to the local user called Administrator.host3 rw. a configuration entry something like this example is important if administrators working on Windows clients want to modify the configuration of UNIX servers. all users are domain users. The root directory for these users is set to /pubs.

In other words. a user cannot connect to a server unless a matching user name has been defined on a server.local files grant access permissions to specific users connecting to a server.foo. Running an ACL Push Job automatically converts your role definitions and role assignments into entries in the users file on that server. You can apply RBAC decisions to a server by running an ACL Push Job in the BMC BladeLogic Console.255.foo.foo. @192. Together these entries are called an access control list (ACL). If the same users have entries in both users. Typically the users.local file take precedence.com/26 The following is an example where an address range of 192. entries in the users.10. when user betty attempts to connect to a server.168. The permissions in the users and user.10.192) has read-only privileges.local and users.local files override any permissions defined on a per-client basis in the exports file.168. see the BMC BladeLogic Server Automation User Guide.local file is scanned before the users file. Both the users and users. The agent accomplishes this by doing the following: ■ Incoming users are matched to a user name on the server.129/25 Users and users.10.255.) With RBAC you define the characteristics of a role and assign users to that role. Administrators may want to modify the users.ro=@192. The users file is primarily used to implement user permissions that are defined through RBAC. Chapter 5 Setting up configuration files 247 .Users and users. The permissions granted in the users and user. but the users.1/24 rw=@192.10.168. you should first define the exception hosts and then define the default value for the remaining subnet.1-255 is split up so that the range from 1-127 has read/write privileges while the range 128-255 has readonly privileges.com rw. If you want to have different access (ro/rw) permissions for various hosts within a subnet. (For more on RBAC.local files The users and user.com ro @host1. The agent on a server enforces user permissions defined in an ACL by mapping incoming users to users defined on the server. In the example below the host host1. In this scenario.local file is used for granting permissions on a per-server basis rather than granting system-wide user privileges.local files are defined on a per-user basis.local files The following example demonstrates subnets.local files have the same format. she must operate with the privileges already assigned to user betty on that server.root=host1.1/25.foo. host1.168.com has read/write privileges while everybody else in the subnet (subnet mask 255.local file to override RBAC policy on a particular server.

This means the role has full authorization to use any Network Shell and nexec commands on that server.local files. UNIX users are mapped to user nobody and Windows users are mapped to Anonymous. This means the role has full authorization to use any Network Shell and nexec commands on that server.local WINDIR\rsc\users WINDIR\rsc\users. ■ ■ ■ When you make changes to the users or users. For example.local (For example. no command authorizations for that role are pushed to the agent. the RSCD agent automatically detects your new settings and uses them for all subsequent client connections. If command authorizations are specified on the server in BMC BladeLogic Console and command authorizations are specified for the role. no command authorizations for that role are pushed to the agent. incoming users are automatically mapped to a user with downgraded permissions. those command authorizations are pushed to the agent. If neither of the two previous techniques are possible. including permissions for commands.Users and users. The job uses the following algorithm to create users file entries relating to command authorizations: ■ If no command authorizations are specified on the server in the BMC BladeLogic Console and no command authorizations are specified for a role. HP-UX Windows Location /usr/lib/rsc/users /usr/lib/rsc/users.local files reside in different locations in Windows and UNIX-style systems. Platform Solaris. while users connecting to a Windows system can be mapped to Administrator. as described in the following table. You do not have to restart the agent or otherwise instruct it to read the new users or users. If no command authorizations are specified on the server in BMC BladeLogic Console but command authorizations are specified for a role. Linux. all users connecting to a UNIX system can be mapped to root. This means the role is authorized to perform those commands on the agent. This means the role is authorized to perform only those commands on the agent.local files ■ Incoming users are mapped to a specified user name. ■ An ACL Push Job generates users file entries that grant a variety of permissions.local files.) 248 BMC BladeLogic Server Automation Administration Guide . If command authorizations are specified on the server in BMC BladeLogic Console but no command authorizations are specified for a role. The users and users. AIX. WINDIR can be \windows or \winnt. the command authorizations common to both are pushed to the agent.

The name of a Network Shell user should match the name of the user on the client host who is attempting to make a connection to this server. the users or users. For a complete list of available permissions. For a complete list of available permissions. The second field is a comma-separated list of permissions that apply to the user defined in the first field.Configuring the users or users. The format of each entry consists of two fields. The second field is a commaseparated list of permissions that apply to the user defined in the first field. The first field provides a role and a user name. However. Configuring the users or users. For example. If an option sets multiple values.local files are a list of entries. separate each value with a colon. Chapter 5 Setting up configuration files 249 .local files is ignored for roles that employ Windows user mapping through automation principals. even if you are using Windows user mapping.local files” on page 251. the first field in a users file entry provides only a user name. No role is necessary because Network Shell does not recognize roles.local files Both the users and users. hosts=host1:host2.local files” on page 251. For information on Windows user mapping. For example. such as BLAdmins:BLAdmin. Consequently. see “Options for users and users. If an option sets multiple values. see “Options for users and users. For Network Shell users that are not communicating with servers through a Network Shell Proxy Server. see the BMC BladeLogic Server Automation User Guide. separated by a colon.local files The users and users.local files do not grant permissions on Windows servers to roles that are set up for Windows user mapping. you should still push agent ACLs to servers when you add or modify user or role information in the BMC BladeLogic Console. All other settings still apply. Only the user mapping information in the users and users. Each entry grants permissions to a user.local files should still include an entry for each role so that role can be granted access to a Windows server. separate each value with a colon. hosts=host1:host2.

When you use an ACL Push Job to push a users file to a server. Using wild cards in the users. Below these entries.map=root rw.map=root An entry like this grants read/write access to all users who have assumed the role of SecOpcs. Including this entry instructs a server to allow a connection from a user only when that user has been explicitly defined in the users configuration file. the Network Shell entries shown above would not be necessary.local files Below is a sample users file with entries for DBAdmins:george and DBAdmins:betty. The entries for DBAdmins:george and DBAdmins:betty would grant george and betty access to this server. For example. 250 BMC BladeLogic Server Automation Administration Guide .local file.local files that begin with # are considered to be comments.map=root rw.local file allows you to use a wild card in place of user names when defining role:user combinations. The users file can also include a nouser entry.map=root # NSH-only ACLs entries for Network Shell users george betty rw.map=root nouser If george and betty communicate with the server by means of a Network Shell Proxy Server. two more entries grant george and betty access to this server using Network Shell. All users in the role are mapped to root. This capability is unique to the users. In these entries george and betty are not paired with any role # DBAdmins ACLs entries for DBAdmins role DBAdmins:george DBAdmins:betty rw. DBAdmins is the role and george and betty are users. Lines in the users and user.Configuring the users or users. BMC BladeLogic places a nouser entry in the users file if that server has a property called PUSH_ACL_NO_USERS_FLAG set to true. you could create a users file entry such as: SecOps:* rw.local file The users. In this example.

By performing a modification like this. If no hosts field is provided. you can temporarily allow all users in a role to access a server without first running an ACL Push Job to change the users file on that server. Because these roles cannot be deleted. If no commands= option is given. If you choose to rename the RBACAdmins or BLAdmins roles. You do not have to update entries in the users. TIP BMC BladeLogic recommends adding an entry for RBACAdmins:RBACAdmin and BLAdmins:BLAdmin to the users.. the entries you make in the users.local file is a capability that should be used sparingly..local files Identifying users with a wild card provides some benefits.] This is a list of colon (:) separated commands that the user is allowed to execute on the local host.. Options for users and users. exists hosts=hosts1[:host2 . Using wild cards for user names in the users.) This entry tells the RSCD agent that an account with the same user name must exist on this host. the corresponding entry in the exports file determines what commands the user can run. This entry tells the RSCD agent that permissions should only apply if the user named in the first field is connecting from one of the hosts in this list of colon (:) separated host names and/or addresses.Options for users and users. they provide a way to access a server in case you accidentally revoke everyone else’s permissions for that server. running an ACL Push Job may first require a lengthy change control process. Thus an entry like the one shown above overrides any more restrictive settings defined for the role using RBAC.local files provide the following options that you can use to assign access permissions to users: Option Description commands=cmd1[:cmd2 .] (Unix only.. the entry applies to the user named in the first field regardless of what host that user is connecting from. Entries in the users.local file override entries in the users file. See “Restricting commands” on page 244 for more details on the use of this field.local file when users are added to or removed from a group.local files The users and users. Using a wild card like this also lets you authorize all members of a role to perform certain types of actions. In some organizations.local file should reflect those naming decisions. Chapter 5 Setting up configuration files 251 .local file for every server.

When the nouser name is included in the users or users. see “How BMC BladeLogic grants access to RSCD agents” on page 237. which are for user1 and user2. the first and second entries in the users file grant read/ write access to user1 and user2. Both users are mapped to Administrator on this server. server access is limited to users specifically included in the users or users. generating an EACCES (Permission denied) error. For more information. no password challenge) and then tries to switch to a user not in the list. the RSCD agent silently ignores any attempt to enable the setuid or setgid bits when creating a file or changing a file’s permissions.) By default. the RSCD agent allows the client to “see” the complete directory tree from / on down.local file.. Clients can then see files and directories from dirname on down.] rw validuser Examples In the following example.Examples Option map=username Description This entry forces incoming client connections to run with the permissions of username. By default.local files. do not associate those users with a role but do 252 BMC BladeLogic Server Automation Administration Guide . user1 and user2 can access this server from any other server. The third and fourth entries. For Windows systems. access is denied. The client command rsu allows a client to get alternate remote permissions on the agent.local files. By specifying the rootdir entry. clients are allowed to create files with the setuid or setgid bits enabled and to set setuid and setgid permission via chown(2). clients are allowed to create special files (character special and block special). If you specify the nosuid option. (Unix only. who are associated with the role of SrAdmin.) By default. By default the client is challenged for the respective user’s password but with the -p option no password is requested. or emulating. This entry tells the daemon that the user name/UID/GID combination of the remote (incoming) user must match a user name/UID/GID combination on the local host. The named user has read/write access. (Unix only. you can enter a Windows user account SID rather than a user name. chroot(2). Because no hosts field is provided. The rsu= entry defines which users the client is allowed to rsu without challenging them for a password. Specifying the nomknod option instructs the RSCD agent to prevent the client from making an mknod(2) call. nomknod nosuid nouser ro rootdir=dirname rsu=user1[:user2 . The named user has read-only access. If the client tries to use the rsu command with the -p option (that is. the RSCD agent sets the “root” directory to dirname by making a call to.. This is a special user name that denies user access to the server unless the user has an entry specifically configured in the users or users.

who is associated with the role of JrAdmin and is mapped to Anonymous on this server. If user2 is not connecting from host1 or host2.Secure file map them to user Administrator. In this discussion.rw. user1 user2 rw rw nouser Secure file The secure file defines how BMC BladeLogic applications for a client installation and the RSCD agent on a server communicate with each other. These entries are used for granting permissions to Network Shell users. The exports. or Network Shell Proxy Server that communicates directly with an RSCD agent or repeater. a client application can be a Network Shell client. If user1 is not connecting from host1 or host2. then user1 is only given access to the /data directory and granted the permissions of user3.validuser hosts=host1:host2. users.map=Administrator SrAdmin:user2 rw. user2 is granted read-only permission.rootdir=/data. The last entry forbids access to all users who are not specified in the users file. user1 user2 user1 user2 hosts=host1:host2.rw.local files control user access to servers (see “Exports file” on page 240 and “Users and users. Chapter 5 Setting up configuration files 253 .local file grants read/write access to user1 and user2 if they are connecting from either host1 or host2 and they have a local account with the same user name and user ID as they do on the host from which they are connecting.map=Anonymous nouser The following example in the users. and users.map=Administrator user2 rw.local file grants read/write access to user1 and user2 and forbids access to all other users.local files” on page 247).map=user3 ro The following example in the users. BMC BladeLogic Application Server.map=Administrator user1 rw.validuser rw. The secure file for a client application defines parameters that BMC BladeLogic applications use to communicate with the RSCD agent on a server. The fifth entry grants read-only access to user3. SrAdmin:user1 rw. The secure file on the server defines parameters that the RSCD agent uses to communicate with BMC BladeLogic applications on clients.map=Administrator JrAdmin:user3 ro.

servers. Always use the secadmin utility to modify the secure file. WINDIR can be For example. The secure file resides in different locations in Windows and UNIX-style systems. see “Using the secadmin utility” on page 258. For more information.Clients. you need only modify the secure file to establish how data is communicated between clients and servers. Clients. the application checks the secure file to see if and how the connection should be redirected and whether data should be encoded. the application searches for an entry 254 BMC BladeLogic Server Automation Administration Guide . “Administering security” for a full description of all the procedures needed to implement security in a BMC BladeLogic system. and the secure file By default. encrypted. each with their own secure file. the application first checks the secure file for a client to see how the connection should be established. If an entry for the remote host is not found. The port number can be set with an entry in the Internet services databases (for example. Stronger security requires additional modifications to a system. If an entry for the target server exists in the secure file. the default location for the second instance of BMC BladeLogic would be \windows or \winnt. and the secure file When a BMC BladeLogic application on a client attempts to connect to an RSCD daemon on a server. or sent as clear text. /etc/services). C:\Program Files\BMC Software\ BladeLogic2\version\NSH. as described in the following table. servers. On Windows. For simpler security installations. See Chapter 4. client and server processes communicate via TCP/IP port 4750 with the server process listening on all configured NIC (Network Interface Card) addresses. Name and location of secure file for first instance of BMC BladeLogic /usr/lib/rsc/secure Platform Solaris Linux AIX HP-UX Windows Name and location of secure file for additional instances Not applicable WINDIR\rsc\secure installDirectoryN\version\NSH\conf\secure For example. The following table shows how the location of the secure file on Windows varies between the first instance and all subsequent instances. you can have multiple instances of BMC BladeLogic client applications. Using the secadmin utility ensures that the secure file is formatted correctly.

If such an entry exists. Configuring the secure file When configuring the secure file. To determine where to listen for connection requests. see “Session layer security” on page 118.) The RSCD daemon can listen on a specified port on all available NICs or a particular NIC (specified using the host= field. the BMC BladeLogic default communication protocol. it can only listen on one NIC or all NICs. that connection is used to both send and receive data. see “Configuring the secure file” on page 255. For a more detailed description of the capabilities of this suite. establishes rules for communication between BMC BladeLogic clients and Application Servers and the RSCD agent. (For more on configuring entries in the secure file.Communication protocol called default to determine how the connection to the remote host should be made. as described in “Options for secure file” on page 258). Communication protocol Protocol 5. By default. see “Configuring the secure file” on page 255. the RSCD daemon consults the secure file on the server. when a client establishes a connection to an RSCD daemon on a server. The RSCD first checks for an entry for the connecting host. The RSCD daemon cannot listen to a port on a list of specified NICs. the daemon listens by default to port 4750 (or as otherwise defined in the Internet services databases). the successor to SSL. the daemon uses the default values from the rscd entry. The rscd entry can specify which port and address to listen to for connection requests and it can specify default communication parameters. protocol 5 uses Transport Layer Security (TLS). If an rscd entry is found. BMC BladeLogic clients and RSCD agents use the TLS_RSA_WITH_AES_256_CBC_SHA cipher suite. If no entry for the connecting host is found. the software treats it as a special entry used by the RSCD daemon. which automatically negotiates the strongest form of encryption that clients and servers can support. the agent uses the connection parameters defined in that entry. In other words. When a client establishes a connection. (For more on configuring the rscd entry. the attempt to establish a connection is aborted. the RSCD daemon again refers to the secure file to determine what data encoding/encryption it should expect from the client host.) If the secure file does not include an entry for the remote host or a default entry. If an entry is not found. As such. It looks for an entry for a host named rscd. TCP is a bi-directional virtual circuit protocol. you can make three types of entries: ■ ■ default rscd Chapter 5 Setting up configuration files 255 .

An rscd entry in the secure file uses the following format: rscd:option1:option2:option3. The default entry also designates the default port as 4750.. see “Options for secure file” on page 258.. 256 BMC BladeLogic Server Automation Administration Guide . It defines connection parameters for servers that otherwise do not have an entry in the secure file. A default entry in the secure file uses the following format: default:option1:option2:option3. a default entry is automatically created in the secure file. Creating an rscd entry is an easy way to define the same communication parameters for all of the servers in your system that are not otherwise configured in the secure file. Default entry The secure file allows for a special host name called default. Each option in the list defines a parameter for communicating with all servers that do not have a host entry specifically defined for them... For more information. The secadmin utility encrypts any keys needed for data encryption and guarantees that the secure file is formatted correctly. see “Using the secadmin utility” on page 258. When you initially install Network Shell. The default entry specifies that the client use protocol 5 and instructs clients and servers to communicate using the TLS protocol for secure communication. For a complete list of available options. Creating a default entry is an easy way to define the same communication parameters for multiple servers without having to configure entries for each of those servers. or the RSCD agent. The default entry that is automatically generated in a client’s secure file reads as follows: default:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls rscd entry The secure file allows for another special host name called rscd. It defines standard connection parameters that are used for an RSCD agent on a server communicating with clients when those clients are not included in the list of host entries on the server’s secure file. where optionN is a list of colon-separated fields.Configuring the secure file ■ host Always use the secadmin utility to configure the secure file. the BMC BladeLogic consoles.

For a complete list of available options. When you initially install an RSCD agent on a server. Chapter 5 Setting up configuration files 257 . For a complete list of available options. Subnet designations are used to define a range of addresses (see “Subnet designations” on page 236). where. NOTE If you change the RSCD agent port number in the secure file. you must restart both the Application Server as well as the RSCD agent on the system(s) where you changed the secure file for the change to take effect. create entries that define parameters for a connection with a particular host. Use the following format for each entry: hostName:option1:option2:option3. or subnet designation. Each option defines a parameter for communicating with the host (or subnet) named in hostName. an rscd entry is automatically created in the secure file. Each option in the list defines a parameter for communicating with all agents that do not have a host entry specifically defined for them. see “Options for secure file” on page 258. hostName can be a resolvable host name. IP address. optionN is a list of colon-separated fields. You must make corresponding entries in the secure file on both the client and server to establish a connection between client and server.. The rscd entry specifies that the RSCD agent use protocol 5 and instructs clients and servers to communicate using the TLS protocol for secure communication. The rscd entry that is automatically generated in the secure file on a server reads as follows: rscd:port=4750:protocol=5:tls_mode=encryption_only:encryption=tls Host entries Host entries in the secure file on a server set connection parameters that define how that server communicates with individual clients. see “Options for secure file” on page 258.. The rscd entry also designates the default port as 4750. Host entries in the secure file on a client set connection parameters that define how that client communicates with individual servers. To configure host entries in the secure file. hostName is the host with which the client or server is communicating.Configuring the secure file where optionN is a list of colon-separated fields.

By default. Additionally. you must include the full path to the secadmin utility when running a secadmin command. or delete entries in a secure file. host3. you can find secadmin in the following locations: ■ UNIX: /opt/bmc/BladeLogic/version/NSH/secadmin Windows: C:\Program Files\BMC Software\BladeLogic\version\RSCD\secadmin ■ For a complete description of the secadmin utility. Example If you are using protocol 5 and you want to specify TLS-style encryption between a client called host1 and three servers called host2. host3. and host4 by entering the following command on each of those servers: secadmin -m host1 -p 5 -T encryption_only -e tls If you are using secadmin on a server where Network Shell is not installed. You can also create.Options for secure file Using the secadmin utility With the secadmin utility. modify. and host4. see the man page for secadmin. modify. you must use secadmin to modify the secure file on host2. or delete default or rscd entries in the secure file. Options for secure file An entry in the secure file can include the following fields: 258 BMC BladeLogic Server Automation Administration Guide . the secadmin utility lets you modify entries in the securecert file. you would use secadmin to make the following additions to the secure file on host1: secadmin -a host2 -p 5 -T encryption_only -e tls secadmin -a host3 -p 5 -T encryption_only -e tls secadmin -a host4 -p 5 -T encryption_only -e tls Next. you can create.

is yes. This is the default value for appserver_protocol. however. data is not compressed. If the remote daemon to which the data is being sent is not another RSCD daemon. then it will be the responsibility of the of the remote daemon to forward the data to an RSCD daemon and also return any data it may return. For more on Network Shell Proxy Servers. depending on whether a secure file entry defines the special host name rscd: ■ When applied to an rscd entry. where a higher number calls for better compression. If TCP keep-alives are not sent. If you want to use data compression. the host= field can be used to redirect data between hosts. You can set protocol to the following: ssoproxy Use the single sign-on functionality when communicating with the Network Shell Proxy Server. the host= field determines the address to which the agent should listen for client connections. Set this field to tls. This field specifies whether the agent should send TCP keepalive messages to the other side of a connection. ■ When applied to a non-rscd entry. This field determines the type of data encryption that should be used. By default.Options for secure file Option Description appserver_protocol=protocol This field specifies the authentication protocol used when communicating with a Network Shell Proxy Server. If a system has a single NIC card. Possible values for this field are yes or no. The host= field should only be used for systems with multiple NIC cards (real or virtual) so you can select the NIC (address) to which the RSCD agent should listen. you do not have to set this field because the agent automatically listens on the default system NIC card (address). that better compression is more CPU intensive. if unset. see “Configuring the Network Shell Proxy Service” on page 142. the connecting system will notice the death of a connection or a machine crash. sessions may hang indefinitely leaving hung processes or threads on the agent. compression=value This field sets a data compression level. In a LAN environment the overhead required for compressing and uncompressing data is usually greater than the time saved transferring compressed data. encryption=type host=value keepalive=value Chapter 5 Setting up configuration files 259 . Typically you should use compression when communicating through a thin pipe. which specifies that BMC BladeLogic should automatically negotiate an encryption method (usually AES). set value to a number between 1 and 9. The default value. If keep-alive messages are sent. This field is used differently. Be aware.

Options for secure file

Option lock=value

Description When set to a non-zero positive value, this field determines the maximum number of times a bad connection is allowed from a source address before the address is locked. A bad connection can happen if encryption is not set up properly or a particular host is not granted access. The address is locked for a period of time as defined by the unlock= field (see below). This field can be used to redirect data to a port other than the default port of 4750. On most UNIX systems, access to port numbers under 1024 requires root permissions. When selecting an alternate port number, make sure it does not conflict with some other existing service. Also, when using this field, make sure that both the client and server machines are configured to use the same port number. This field determines the transport protocol used for communication between BMC BladeLogic applications and the RSCD agent. Protocol 5, the default protocol, uses the TLS protocol (TLS is the successor to SSL) for communication between client and server. This field identifies the authentication profile that should be used to provide session credentials to Network Shell when communicating with a Network Shell Proxy Server. If you need to use multiple Network Shell Proxy Servers, you can set up a different secure file entry for each profile. Using the BL_AUTH_PROFILE_NAME environment variable, you can override the value defined with this field. For more on Network Shell Proxy Servers, see “Configuring the Network Shell Proxy Service” on page 142. This field provides the Network Shell-style path to the file containing authentication profile definitions, which are necessary when Network Shell communicates with a Network Shell Proxy Server. Using the BL_AUTH_PROFILES_FILE, you can override the value defined with this option. For more on Network Shell Proxy Server, see “Configuring the Network Shell Proxy Service” on page 142. When first contacting a remote server, the TCP protocol may continue to contact an offline or unavailable server for several minutes before finally giving up and reporting that a server is unavailable. This option lets you set the maximum number of seconds that a client will wait before giving up. The default value is 30 seconds. This timeout mechanism is implemented within the BMC BladeLogic code and does not in any way alter any system wide TCP parameters. If the operating system has an effective TCP timeout less than the value defined here, the OS value will take precedence.

port=value

protocol=value

auth_profile=profile

auth_profiles_file=filename

timeout=secs

260

BMC BladeLogic Server Automation Administration Guide

Examples

Option tls_mode=value

Description When using protocol 5, this field specifies one of the following values: encryption_only Use the TLS protocol to autonegotiate an encryption type (that is, a cipher) and then use that cipher to communicate. Client-side authentication or certificates are not required. Use TLS for encryption and clientside authentication. This option requires a certificate. For more on certificates, see “Implementing security – Application Server to agents or repeaters” on page 202.

encryption_and_auth

unlock=value

This field is used in conjunction with the lock= field, which allows you to lock out IP addresses that repeatedly fail to connect to the (RSCD agent) server. These failures are limited to encryption misconfigurations and host authorization errors. With the unlock= field, you can specify how many minutes the IP address should be locked before allowing connection attempts to resume. If value is a negative number, the IP address is locked until the RSCD agent is restarted. The default value for unlock= is 1 minute. This field turns off X11 forwarding. By default this field is set to on and X11 forwarding is enabled for this agent. This field defines an offset from 6000, and together these values specify the port that the agent binds to for X11 forwarding. By default X11 forwarding starts at port 6010 (6000 plus an offset of 10). Any new connections afterwards increments the offset by one (that is, 6011, 6012, and so forth).

x11_fwd=on |off x11_port_offset=value

Examples
The following examples are meant to serve as sample uses of the fields available in a secure file. To generate entries in a secure file like those shown below, use the secadmin utility. Using the secadmin utility ensures that the secure file is formatted correctly. For more information, see “Using the secadmin utility” on page 258. The following example shows a typical default entry for BMC BladeLogic clients.
default:port=4750:protocol=5:encryption=tls

The following example shows a subnet in an entry:
@192.168.12.13/24:protocol=5:encryption=tls

Chapter 5 Setting up configuration files

261

Securecert file

The following example instructs a Network Shell client to communicate with a Network Shell Proxy Server using an authentication profile called QAProfile. The authentication profile is stored in the default location for the authentication profile file: default:protocol=5:encryption=tls:appserver_protocol=ssoproxy: auth_profile=QAProfile:auth_profiles_file=/opt/bmc/BladeLogic/version/NSH/br/ authenticationProfiles.xml The following example shows how to use a port other than the default port of 4750. If you use host1 as the client host and host2 as the remote host, the following entry should be in the secure file of host1
host2:port=987

while the following entry should be in the secure file of host2:
host1:port=987

The following example shows how to instruct the RSCD agent to listen on a specific address for client connections: rscd:host=192.168.10.20

Securecert file
The securecert file stores passphrases used to encrypt the private keys for X.509 certificates. By storing passphrases in the securecert file, BMC BladeLogic can access those passphrases without any user interaction. Accessing passwords noninteractively is essential for setting up secure, certificate-based communication with an Application Server. It is also necessary when using secure communication to deploy assets via repeaters (that is, with an indirect deployment). When setting up a securecert file for an Application Server, you must provide an entry for the owner of the process that communicates securely with repeaters and servers. The owner of the process is bladmin on UNIX-style systems and SYSTEM on Windows. When setting up a securecert file for a repeater, you must provide an entry for all users that communicate with servers. On UNIX-style systems, you must provide an entry for any users to whom other users are mapped (typically root). On Windows, you must provide an entry for the user named BMC BladeLogicRSCD. For more information on using the securecert file while setting up security for a BMC BladeLogic system, see Chapter 4, “Administering security.”.

262

BMC BladeLogic Server Automation Administration Guide

Configuring the securecert file

The securecert file resides in different locations on Windows and UNIX-style systems, as described in the following table. On Windows, you can have multiple instances of BMC BladeLogic client applications, each with their own securecert file. The following table shows how the location of the securecert file on Windows varies between the first instance and all subsequent instances.
Name and location of securecert file for first Name and location of securecert file for instance of BMC BladeLogic additional instances /usr/lib/rsc/securecert Not applicable

Platform Solaris Linux AIX HP-UX Windows

WINDIR\rsc\securecert For example, WINDIR can be \windows or \winnt.

installDirectoryN\version\NSH\conf\ securecert For example, the default location for the second instance of BMC BladeLogic would be C:\Program Files\BMC Software\ BladeLogic2\version\NSH.

Configuring the securecert file
When configuring a securecert file, you can make entries for the Application Server and repeaters. On the Application Server, create an entry like the following for the owner of the process that communicates securely with repeaters and servers:
[Default] processOwner=********

where processOwner is bladmin for UNIX-style systems and SYSTEM for Windows. You must use the secadmin utility to modify a securecert file. (For more on secadmin, see “Using the secadmin utility” on page 258 or the man page for secadmin). To create an entry like the one shown above using the secadmin utility, enter the following command:
secadmin -m default -cu bladmin -cp password

Enter the password in clear text. The secadmin utility encrypts the password. On repeaters, create an entry like the following for the administrative user that communicates with servers:

Chapter 5 Setting up configuration files

263

BMC BladeLogic log file reference

[Default] adminUser=********

where adminUser is typically root for UNIX-style systems and BladeLogicRSCD for Windows. Using the secadmin utility to create the entry like the one shown above, enter the following command:
secadmin -m default -cu root -cp password

BMC BladeLogic log file reference
About logging configuration for BMC BladeLogic
BMC BladeLogic uses log4j to capture log messages from the console and the BMC BladeLogic Application Server. Log4j is an open source logging framework used to control logging output from Java applications. For more information on log4j, see http://jakarta.apache.org/log4j/docs/. Unless instructed otherwise by BladeLogic Support, the default logging configuration is recommended for normal operation. BladeLogic Support may ask the Application Server Administrator to enable DEBUG logging for a single logger when debugging a particular issue. This change will typically be backed out once the requested DEBUG information has been gathered.

Overview of BMC BladeLogic log files
A standard BMC BladeLogic installation provides default logging behavior that satisfies the needs of many organizations. Defaults vary for Windows and UNIX-style systems. The default behavior for Windows is:

The RSCD agent logs to rscdInstallDirectory\rscd.log as a rollfile at the info1 level. The RSCD agent service logs to rscdInstallDirectory\rscdsvc.log as a rollfile at the info level. BLPackage Deploy Jobs log at the debug level to locations based on the name and location of the jobs.

264

BMC BladeLogic Server Automation Administration Guide

Overview of BMC BladeLogic log files

BLPackage Deploy Jobs on the console log to stdout as a stream at the debug level. The priority level can be overridden using Transaction Options when defining the BLPackage Deploy Job. For more information, see the BMC BladeLogic Server Automation User Guide. The Application Server logs to installDirectory\br\appserver.log as a stream at the info level.

The default behavior for UNIX is:

The RSCD agent logs to rscdInstallDirectory/log/rscd.log as a rollfile at the info1 level. BLPackage Deploy Jobs log at the debug level to locations based on the name and location of the jobs. BLPackage Deploy Jobs on the console log to stdout as a stream at the debug level. The priority level can be overridden using Transaction Options when defining the BLPackage Deploy Job. For more information, see the BMC BladeLogic Server Automation User Guide. The Application Server logs to installDirectory/br/appserver.log as a stream at the info level.

Table 1 lists the various log files that are used by BMC BladeLogic which may be of interest to you. Table 1 Overview of BMC BladeLogic log files (part 1 of 3)
Description and default location Application Server appserver.log Application Server log installDirectory/br/appserver.log Infrastructure Management => AppServer Launcher => Edit AppServer LogfileName attribute installDirectory/br/deployments/ deploymentName/log4j.properties AppServerLauncher.log AppServer Launcher log installDirectory/br/ AppServerLauncher.log post_install.log Application Server configuration log installDirectory/br/post_install.log installDirectory/br/deployments/ deploymentName/log4j.properties installDirectory/br/deployments/ _template/log4j.properties Where to configure

Log file name

Chapter 5 Setting up configuration files

265

Overview of BMC BladeLogic log files

Table 1

Overview of BMC BladeLogic log files (part 2 of 3)
Description and default location Application Server Console log installDirectory/br/Console.log Where to configure Infrastructure Management => AppServer Launcher => Edit AppServer ConsoleLogfileName attribute installDirectory/deployments/ deploymentName/log4j.properties RSCD Agent (Windows)

Log file name Console.log

rscd.log*

Windows RSCD Agent log rscdInstallDirectory\rscd.log

rscdInstallDirectory\log4crc.txt

keystroke.log*

nexec session log rscdInstallDirectory\keystroke.log*

rscdInstallDirectory\log4crc.txt

rscdsvc.log*

RSCD agent service rscdInstallDirectory\rscdsvc.log

rscdInstallDirectory\log4crc.txt

*.log

Deploy Job log rscdInstallDirectory\Transactions\log\*.log RSCD Agent (UNIX)

rscdInstallDirectory\log4crc.txt

rscd.log*

UNIX RSCD Agent log rscdInstallDirectory/log/rscd.log

rscdInstallDirectory/log4crc.txt

keystroke.log*

nexec session log rscdInstallDirectory/log/keystroke.log*

rscdInstallDirectory/log4crc.txt

*.log

Deploy Job log rscdInstallDirectory/Transaction/log/*.log RCP Client (Windows)

rscdInstallDirectory/log4crc.txt

.log

BMC BladeLogic Console log WindowsHomeDirectory\BladeLogic\ 1_1_2\Workspacen\.metadata\.log

installDirectory\br\rcp.cf

BLWorkbenchPlugin.log BLWorkbenchPlugin log WindowsHomeDirectory\BladeLogic\ 1_1_2\Workspacen\.metadata\.plugins\ com.bladelogic.client.ui\ BLWorkbenchPlugin.log RCP Client (UNIX) .log BMC BladeLogic Console log /root/.bladelogic/1_1_2/Workspacen/ .metadata/.log 266 BMC BladeLogic Server Automation Administration Guide

installDirectory\br\rcp.cf

installDirectory/br/rcp.cf

which is located in the Application Server installation directory for that deployment. Chapter 5 Setting up configuration files 267 .properties file.bladelogic/blcli.cf Application Server logging Logging is controlled at the Application Server instance level.bladelogic/1_1_2/Workspacen/ . logging is controlled by the log4j.log* TFTP Server log installDirectory/br/tftpsvr.bladelogic/blcli-log.log* BLCLI (Windows) blcli. Within the configuration files for each specific deployment.metadata/.log installDirectory/br/deployments/ _pxe/log4j. By default.log* tftpsvr.plugins/ com.properties installDirectory/br/tftpsvr.log file.properties By default.properties configuration file.log* PXE Server log installDirectory/br/pxesrvr. Application Server logging output is written to the appserver.log BLCLI Windows log C:\Documents and Settings\Administrator\Application Data\BladeLogic\blcli. The following sections provide information on the log4j.bladelogic. the file is located in installDirectory/br/deployments/deploymentName/log4j.cf /.ui/ BLWorkbenchPlugin.cf Log file name BLWorkbenchPlugin.log PXE server pxesrvr.log BLCLI UNIX log /.log BLWorkbenchPlugin log /root/.Application Server logging Table 1 Overview of BMC BladeLogic log files (part 3 of 3) Description and default location Where to configure installDirectory/br/rcp. also located in the Application Server installation directory for the specific deployment.client.cf C:\Documents and Settings\Administrator\Application Data\BladeLogic\blcli-log.log BLCLI (UNIX) blcli.

Modifying basic logging attributes Table 2 on page 268 describes some of the basic log attributes that can be controlled by modifying options in the log4j. This value controls how many backup files will be retained. To do so. This section describes how to manipulate some of the basic properties of the configuration file. specifying the relative or full path of the log file.R. locate the BlDeploy appserver performance logging section in the file and uncomment the lines in that section.appender.properties file can also control where the logging information is stored and how the log files are managed. a backup file will be made and a new log file will be created. To do so. the maximum number of roll-over files is 5. By default.properties In addition to controlling the logging information.File option. Maximum file size Number of roll-over files Performance logging Timing for Deploy Jobs Content Authoring Log configuration Additional debug logging The log4j. you can modify one or more of the specified loggers in the file to set the log level to DEBUG.Application Server logging Modifying logging configuration using log4j. Table 2 Attribute Log Files Location Modifying basic Application Server logging attributes Description You can set the log file location using the log4j. 268 BMC BladeLogic Server Automation Administration Guide . By default.R.appender. locate the Content Authoring related debug logs section in the file and uncomment the lines in that section.MaxBackupIndex option. When debugging specific issues with the system. You can enable logging of Content Authoring debug information. You can set the number of roll-over files using the log4j. To do so. There are comments within the file describing other options not defined here. You can enable logging of timing information pertaining to the Deploy Jobs. the maximum log file size is 5000KB.appender. the log4j. You can enable logging of performance-related information pertaining to the Application Server. These loggers are initially configured with the log level INFO to prevent the log files from containing too much information.properties file.MaxFileSize option. This option instructs the log4j system to use the specified path for logging.properties file contains a large list of loggers that can be configured to add useful debug information. locate the timing for deploy jobs section in the file and uncomment the lines in that section. You can set the maximum file size for the log file using the log4j.R. When a log file reaches its maximum size.

bladelogic.Demux – This logger controls messages generated by the networking layer. 1 In the BMC BladeLogic Console. See the comment lines in the log4j. from the Configuration menu.logger. the following options in the log4j. There are many logger options that give you the ability to enable debug logging for very specific tasks. ■ log4j.logger.DBServiceImpl – This logger controls messages generated by the database service.bladelogic. To enable basic debug logging 1 Open the log4j. 3 Right-click the Application Server you want to edit and select Edit.rootLogger=DEBUG.com. R. Modifying log file names from the BMC BladeLogic Console You can also modify basic logging options for the Application Server from the BMC BladeLogic Console. C 3 Modify the line to read: log4j. 2 Locate the following line: log4j.properties file for additional information on these logger options. C Once saved.properties file control loggers that are useful for debugging: ■ log4j.Application Server logging NOTE Debugging issues with the Application Server often require assistance by BMC BladeLogic Customer Support.db.com.app. select Infrastructure Management. R.properties file.demux. For example. 2 Expand the hierarchy of the Application Servers node.rootLogger=INFO.mfw. Chapter 5 Setting up configuration files 269 . The Edit Application Server Profile dialog opens. the application server will automatically detect the logging level modification after a short period of time and being logging data in debug mode.

5 When you are finished editing the profile. When you create a new Application Server.Application Server logging 4 In the Edit Application Server Profile dialog. click OK. information such as the java thread dump and any messages generated by third party code used by the Application Server that logs messages to standard out/err. This convention avoids conflicts when there are multiple Application Servers on the same host.log extension. Attribute ConsoleLogfileName Description The name of the console log file for the Application Server.log file is useful for debugging when certain output is not captured by the regular log files.properties).log file contains the same information as the appserver. When you create a new Application Server. specify a name that is unique on the host. If you edit this attribute. Enabling more detailed logging In addition to the appserver.properties file accessed from the _template deployment directory (/br/ deployments/_template/log4j. The console log file contains all information logged to the Application Server log. add or change values for the following attributes. the console log files are configured to rollover. As with the Application Server log files. BMC BladeLogic sets the console log file’s name to the Application Server name plus “_console”. For example. set the ConsoleLogfileName to be empty. but in addition it also captures any output that does not go through the log4j logging system. This convention avoids conflicts when there are multiple Application Servers on the same host. 6 Click OK on the warning that configuration changes do not take effect until you restart the Application Server.log file. You can set the number of roll-over files for the console log file in the log4j. Console logging is enabled by default. 270 BMC BladeLogic Server Automation Administration Guide .log. LogfileName The name of the log file for the Application Server. To disable console logging. 7 Start or restart the Application Server to have changes take effect.log file. an Application Server running on Linux or Solaris can be configured to write all the standard output and standard error information into a file called console. specify a name that is unique on the host. If you edit this attribute. The console. BMC BladeLogic sets the log file’s name to the Application Server name plus the . plus any information logged to the console. The console.

Chapter 5 Setting up configuration files 271 . how often logs are rotated.log. Collecting log data You can use the Support Data Generation tool to capture log data that you can then send to BMC Software Customer Support. ■ For more information on log4j.txt file” on page 272.cf—Configures ui. see “Generating data for support” on page 19.log. For detailed information. For specific instructions. By modifying XML tags in log4crc. how much information is included in each file. PXE Server logging The log file for the PXE Server is controlled with the log4j.apache. BMC BladeLogic uses the following configuration files (all found in installDirectory/br) to control logging with log4j: ■ ui.properties file located in the PXE server deployment (_pxe directory). see http://jakarta.org/log4j/docs/.Agent logging Agent logging The log4crc. This data can be useful for diagnostic purposes when you contact Customer Support. tftpsvr. see “About the Log4crc.txt file is XML-based. Additional log files of interest Additionally. The log4crc. You access the tool from the BMC BladeLogic Console by selecting Configuration => Generate Support Data. where each log file is generated. you can control which log files BMC BladeLogic generates.txt file allows you to control Agent logging in BMC BladeLogic so that all Agent events are logged using consistent formats.txt. which logs messages from the TFTP server.cf—Configures tftpsvr. The Generate Support Data tool generates data about the Application Servers and other components in the BMC BladeLogic environment and packages that data into a zip file. which logs messages from the BMC BladeLogic Console. and what sort of layout the contents of each log should use.

The following table shows how the location of the log4crc. installDirectoryN\version\NSH\conf \log4crc.txt file for additional instances Not applicable WINDIR\rsc\log4crc. The log4crc. the default location for the second instance of BMC BladeLogic would be C:\Program Files\BMC Software\ BladeLogic2\version\NSH.About the Log4crc. NOTE The log4crc.txt file allows you to control Agent logging in BMC BladeLogic so that all Agent events are logged using consistent formats. you can control which log files BMC BladeLogic generates.txt. By modifying XML tags in log4crc. For Application Server logging. WINDIR can be \windows or \winnt. see “Application Server logging” on page 267.txt For example.txt file The log4crc.properties file.txt file. how often logs are rotated. as described in the following table.txt file resides in different locations on Windows and UNIX-style systems. you control logging attributes using the Infrastructure Management window on the BMC BladeLogic Console and in the Application Server profiles of each default and custom profiles. The log appender. Syntax The syntax of the log4crc.txt file is used to control Agent logging.txt file About the Log4crc. The log4crc.txt file for first instance of BMC BladeLogic /usr/lib/rsc/log4crc.txt file is XML-based.txt file consists of three tags: <category> <appender> <layout> 272 BMC BladeLogic Server Automation Administration Guide . On Windows.txt file on Windows varies between the first instance and all subsequent instances. each with their own log4crc. you can have multiple instances of BMC BladeLogic client applications. where each log file is generated. how much information is included in each file. logging level.txt Platform Solaris Linux AIX HP-UX Windows Name and location of log4crc. Name and location of log4crc.txt For example. and logging format for Application Server logs are controlled using the log4j. For more information. and what sort of layout the contents of each log should use.

txt file in a Windows installation. rscdsvc bldeploy bldeployConsole bldeployAppserver The priority= option specifies the amount of information included in a log. Logs all errors. priority. Logs only connection information. Uncomment it to enable keystroke logging.log" debugappender="stderr"/> <category name="bldeploy" priority="debug"/> <category name="bldeployConsole" priority="debug" appender="stdout"/> <categoryname="bldeployAppserver"priority="error"appender="blbasic"/> The name= option identifies the type of log file BMC BladeLogic generates. see “Enabling keystroke logging” on page 283. Default values vary somewhat for UNIX-style installations. <category name="root" priority="info"/> <category name="rscd" priority="info1" appender="C:/Program Files/BMC Software/ BladeLogic/version/RSCD/rscd. The following table identifies the possible priority levels: Priority fatal error warn info Description Logs only fatal errors. For more information.log" debugappender="stderr"/> <!-category name="keystroke" priority="info1" appender="C:/Program Files/BMC Software/BladeLogic/version/RSCD/keystroke. By default. this is disabled (commented out). Logs all warnings and errors. which monitors the RSCD agent and restarts the agent if necessary. The <category> tag can include three options: name. Do not modify this <category> tag. Agitator managed internally by Deploy Job executables. Do not modify this <category> tag. Generates a log for the RSCD agent server.log"/--> <category name="rscdsvc" priority="info" appender="C:/Program Files/BMC Software/ BladeLogic/version/RSCD/rscdsvc. and appender. Chapter 5 Setting up configuration files 273 . The following list shows the <category> tags included by default in the log4crc. Do not modify this <category> tag. Agitator managed internally by Deploy Job executables.About the Log4crc. The following table identifies all possible names: Name rscd keystroke Description Generates a log for the RSCD agent. including fatal errors. Generates a keystroke log that records nexec sessions.txt file category The <category> tag identifies the types of logging that BMC BladeLogic generates. A category managed internally by Deploy Job executables. This option only applies to Windows installations.

usually to prevent log files from getting excessively large. the <category> tag named rscd). The <appender> tag also lets you specify secure agent logging and keystroke logging. The appender= tag provides a name and path for a log file. This priority is only valid for the RSCD agent log (that is.log is renamed to rscd.About the Log4crc. the <category> tag named rscd). Logs connection information and user actions. This priority corresponds to logging level 1 in older releases of BMC BladeLogic.txt file Priority info1 Description Logs connection information and user actions. appender The <appender> tag specifies whether logging information is stored as a stream in a file or periodically rolled over into a new file. as well as all the system calls that an RSCD agent performs to execute user actions. rscd. Logs the STDIN and STDERR streams of the command being run by nexec.log2. You can specify that log files are rolled at specified intervals or when log files reach a particular size.log1.log file. All new information is then recorded in the rscd. When the log file is rolled again.log1 is renamed to rscd. 274 BMC BladeLogic Server Automation Administration Guide . This priority corresponds to logging level 2 in older releases of BMC BladeLogic. Do not use a Network Shell-style path. For example.log. the file is renamed with a number appended to its name. and STDOUT streams of the command being run by nexec. and all new information is recorded in rscd. rscd. the current log file is renamed to rscd. When a log file is rolled.log1. Enter the path using a UNIX or Windows format. Logs all messages. Logs the STDIN. info2 debug Note that keystroke logs (where name is set to keystroke) support only the following options: Priority info info1 info2 Description Logs only the STDIN stream of the command being run by nexec. This priority is only valid for the RSCD agent log (that is. STDERR.

you must set type=stream.log" type="encrypt" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="rawtime" certfile="C:/WINDOWS/rsc/certificate.log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated"/> <!-appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/ rscd. see “Using secure agent logging” on page 277 and “Using keystroke log files” on page 281. Instead. The type= option specifies what type of log file to generate. you must configure the UNIX syslog daemon (see “Configuring the UNIX syslog” on page 284). In other words. you cannot use type=rollfile to roll log files.pem"/--> <!-appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/ keystroke. Type stream syslog Description Logging information is output in a continuous stream to a file. NOTE The two commented out entries (where type is set to digisign or encrypt) are used in secure logging. Chapter 5 Setting up configuration files 275 . For information about secure logging. If you are using this option for UNIX systems.log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated"/> The name= option must match the name (including its full path) assigned to an appender option in a <category> tag. If multiple sources are output to the same log.pem"/--> <appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/rscdsvc. and layout. type. a feature that is disabled by default.pem" privatekeyfile="C:/WINDOWS/rsc/certificate.log" type="digisign" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated" certfile="C:/WINDOWS/rsc/certificate. The following list shows the <appender> tags that are included by default in the log4crc. Logging information is output to the UNIX syslog.txt file.About the Log4crc. The following table identifies the possible types: NOTE You can only roll log files when one source of logging data is being used to create a log file.txt file The <appender> tag can include three options: name. only one category can be output to a single log.pem" privatekeyfile="C:/WINDOWS/rsc/certificate. <appender name="stdout" type="stream" layout="basic"/> <appender name="stderr" type="stream" layout="basic"/> <appender name="syslog" type="syslog" layout="basic"/> <appender name="/tmp/bllog" type="stream" layout="dated"/> <appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/rscd.

1 to log. In this case. For example. Specifies the maximum number of files used for logging. Specifies an interval in seconds for rolling log files. if you have already generated ten log files. In addition. As with rollfile.10 is lost.10. and rollmaxfiles mean the same as they do for rollfile. rolltimeinsec rollmaxfiles digisign As with rollfile. In addition to these parameters.About the Log4crc. you can specify how log files are rotated by including one or more of the following options in the <appender> tag: rollsize Specifies a maximum number of characters for the log file. In addition to these parameters. if you set rollmaxfiles=10. the information in file log. you can store log files named log. log entries and rolled log files are encrypted and protected using the security mechanisms described in “Using keystroke log files” on page 281. If you set type=rollfile.txt file Type rollfile Description Logging information is output to a file that is periodically rolled over into another file. The parameters rollsize. encrypt needs the following additional parameters: certfile privatekeyfile Specifies the file containing the agent’s certificate. encrypt Used for keystroke log files. In addition. log files are rolled. rolltimeinsec and rollmaxfiles mean the same as they do for rollfile. logging information is output to a file that is periodically rolled over into another file. Specifies the file containing the agent’s private key. log entries and rolled log files are protected using the security mechanisms described in “Using secure agent logging” on page 277. 276 BMC BladeLogic Server Automation Administration Guide . Specifies the file containing the agent’s private key. When the file reaches that maximum. logging information is output to a file that is periodically rolled over into another file. The parameters rollsize. the next time the log files roll over. rolltimeinsec. digisign needs the following additional parameters: certfile privatekeyfile Specifies the file containing the agent’s certificate.

Using secure agent logging Secure agent logging is a rolling log mechanism that protects your RSCD agent log files by: ■ Securing each entry in the current log file with a Message Authentication Code (MAC) and sequence number. Except for the time stamp.txt file The layout= option specifies the type of layout used for logging information. It does not output the category name and log level that the basic and dated layouts do. contact BMC Software support. ■ ■ For additional information about secure agent logging.About the Log4crc. see: ■ ■ ■ ■ Overview of the security processes Verifying the integrity of log files Enabling secure agent logging Disabling secure agent logging Overview of the security processes Here is an overview of the security processes that take place as an agent writes and rolls a log file. Users should not modify the syntax of the <layout> tag. To develop additional logging formats. You can later check log file integrity by using the bllogman command. Used only when type is set to encrypt. log entries use the same format as the data that is generated for the log message. and recording the status of each verification. Chapter 5 Setting up configuration files 277 . Verifying the integrity of log files. The following table identifies all possible layouts: Type basic dated Description Log entries use the same format of the data that is generated for the log message. rawtime <layout> The <layout> tag defines the format of logging entries. A time stamp precedes all log entries. Protecting rolled log files with digital signatures. This layout outputs minimal information in the log file—just the timestamp and the actual message.

The agent verifies the integrity of each log entry in the rolled log file.log. It also associates a sequence number with each entry. ■ Digital signature file. rscd. the agent raises an event (in EventLog on Windows and syslog on UNIX-style systems) indicating that the file has been tampered with. against each entry’s MAC. the corresponding signature file would be called rscd.sig1. it uses the session key to calculate a MAC and associate this MAC with each log entry. the RSCD agent generates a random session key.About the Log4crc. When it is time for a rollover. Note that this session key will be used only for the writing of this one log file. The agent creates a corresponding digital signature file for the rolled log file rscd.log1.269 INFO rscd . If the rolled log file failed the MAC test or the sequencing test.log1. When this log file is rolled and it is time to start a new log file.log is rolled to rscd.txt file 1. As it writes each log entry. the status field is set to Consistent. the status field is set to Inconsistent. 2. Before beginning to write its first log file. In this case. the agent will generate a new session key. — The signature file has a status field. MAC Sequence number 3d8591f27a805b0edac5 0000000012 07/28/07 02:45:16. 278 BMC BladeLogic Server Automation Administration Guide .222 23694 99/99 (Administrator): nexec: nexec engrhes40vm10 ifconfig -a 3. the order) of each log entry. rscd.20. The agent will use this key to calculate a Message Authentication Code (MAC) for each entry in the log file. If the rolled log file passed the MAC test and the sequencing test.log1.log. It also verifies the sequence number (or in other words.21. The following events take place at rollover: ■ MAC verification test and sequencing test.10. If either the MAC test or the sequencing test fails. The RSCD agent starts writing its first log file—rscd.

log1 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/rscd. One file (rscd. Verifying the integrity of log files You can verify the integrity of all agent log files by using the NSH command. as described in “Verifying the integrity of log files” on page 279. see the bllogman man page. Example: engw2k3agt1% bllogman list --verify engrhes40vm10 Logfile(s) for host engrhes40vm10 with status: /opt/bmc/BladeLogic/version/NSH/log/rscd. For additional information about bllogman.log. NOTE If an agent is restarted. the previous log file is automatically rolled and signed at agent startup. The cycle begins again. — The MAC and sequence number fields are stripped as part of the process of signing the rolled log file. The agent also does the MAC verification test and sequencing test on the rolled log file. bllogman. as described the procedure below.log () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/rscd. which indicates that it has been tampered with. Chapter 5 Setting up configuration files 279 .txt file You can use the information stored in the status field to verify the integrity of a rolled log file. Enabling secure agent logging You can enable secure agent logs as part of your initial installation (see the BMC BladeLogic Server Automation User Guide) or later on. engrhes40vm10.About the Log4crc.log3) is reported as Inconsistent. with the creation of a new random session key for use in creating MACs for the next version of rscd.log2 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/rscd.log3 () --> Inconsistent /opt/bmc/BladeLogic/version/NSH/log/rscd. the signature file will be rolled along with its associated log file. — At the next roll. 4.log4 () --> Consistent engw2k3agt1% In the above example. there are five log files on the agent machine.

remove or comment out the rscd. secure agent logs are only enabled (even if you have followed these steps) if the server on which the agent is running has either a working random number generator or PRNGD installed.log2.txt configuration file: In the <appender> section. 2 Back up all your existing agent log files (if any). These files have names like rscd. Otherwise. rscd.log. See the BMC BladeLogic Server Automation Installation Guide for more information. rscd. These files have names like rscd.txt configuration file: 280 BMC BladeLogic Server Automation Administration Guide .log" type="digisign" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated" certfile="C:/WINDOWS/rsc/certificate. rscd.pem"/> 5 Start the RSCD agent.pem" privatekeyfile="C:/ WINDOWS/rsc/certificate. and so on. 5 Make the following changes to the log4crc.txt file 1 Back up all your existing agent log files (if any). 3 Stop the RSCD agent. Disabling secure agent logging If you have enabled secure agent logging and you now want to disable it: 1 Back up the certificate.About the Log4crc. usual rolling logs will be generated. 4 Make the following changes to the log4crc. NOTE On UNIX agents. 2 Stop the RSCD agent.log2.pem file and the signature files.log appender entry that has type set to rollfile: <!-appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/ rscd. rscd.log.log1. 3 Delete all the agent log files. and so on.log1. 4 Delete all the agent log files.log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated"/--> Uncomment or add the following entry where type is set to digisign: <appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/rscd.

txt file In the <appender> section.pem" privatekeyfile="C:/WINDOWS/rsc/certificate.log" type="digisign" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated" certfile="C:/WINDOWS/rsc/certificate. or a particular keystroke log file on an agent machine. Keystroke logs are similar to the secure agent logs described in “Using secure agent logging” on page 277: keystroke logs are rolled periodically and are digitally signed after they are rolled. you can verify the integrity of all the keystroke logs on an agent machine. add or uncomment the rscd. which lets you verify the integrity of a keystroke log file.About the Log4crc. Chapter 5 Setting up configuration files 281 . the keystroke log captures and stores the command’s STDIN. Whenever a remote user uses the NSH command nexec to execute a command on an agent machine. STDOUT. By using the NSH command blkeylogman.log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated" Comment out or delete the following entry where type is set to digisign: <!--<appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/ rscd. keystroke logs are encrypted and so are not readable. and STDERR streams. Using keystroke log files You can configure the BMC BladeLogic RSCD agent to generate keystroke logs that record nexec sessions. each keystroke log file is accompanied by a digital signature file. Similar to the secure agent logs.log appender entry that has type set to rollfile: appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/rscd. Additionally.pem"/>--> ■ Start the RSCD agent.

One file (keystroke.log3 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke.log6 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke. 282 BMC BladeLogic Server Automation Administration Guide .About the Log4crc.log10 () --> Consistent engw2k3agt1% In the above example.log in the above example) is also protected by MAC codes and sequence numbers. View a list of various nexec sessions that have been recorded in the keystroke logs.log5) is reported as Inconsistent. ■ ■ For more details. which indicates that it has been tampered with. These two are then stripped off from the file and a digital signature is computed for it.log9 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke.log2 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke. there are ten keystroke log files on the agent machine. the agent tests it for consistency using the MACs and the sequence numbers. The active keystroke log file (/opt/bmc/BladeLogic/version/NSH/log/keystroke.txt file Example: engw2k3agt1% blkeylogman list --verify engrhes40vm10 Keystroke Logfile(s) for host engrhes40vm10 with status: \ /opt/bmc/BladeLogic/version/NSH/log/keystroke.log5 () --> Inconsistent /opt/bmc/BladeLogic/version/NSH/log/keystroke. Copy a (decrypted) keystroke log file from an agent to the client host. If the log file was detected Inconsistent during this process. an event is raised (In the Eventlog on Windows and syslog on UNIXstyle systems).log8 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke. The blkeylogman utility also lets you: ■ View the decrypted contents of keystroke log files.log7 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke.log () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke. see the blkeylogman man page.log4 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke.log1 () --> Consistent /opt/bmc/BladeLogic/version/NSH/log/keystroke. MAC Sequence number 967ff34b84f754c0774a 0000000011 Zl8abih3bvmLNHwTnE4iK5UqeYXWMk2ZQ4 2xdR3nNo8lE2/xUoVxPOd8CSlg7hAygMQgO7D6VmbB2QZVAG6ucg== When the active keystroke log file is rolled.

keystroke logging is only enabled (even if you have followed these steps).pem file. uncomment or add the following entry. Enabling keystroke logging You can enable keystroke logging as part of your initial installation (see the BMC BladeLogic Server Automation Installation Guide) or later on. as described in the procedure below. if the server on which the agent is running has either a working random number generator or PRNGD installed. Disabling keystroke logging If you have enabled keystroke logging and you now want to disable it: 1 Back up the certificate.txt configuration file: In the <category> section. 2 Stop the RSCD agent. See the BMC BladeLogic Server Automation Installation Guide for more information. as described in “Enabling keystroke logging” on page 283.txt configuration file: Chapter 5 Setting up configuration files 283 . see “Disabling keystroke logging” on page 283. 2 Make the following changes to the log4crc.pem" privatekeyfile="C:/WINDOWS/rsc/certificate. To disable keystroke logging.txt file You can enable keystroke logs as part of your initial installation (see the BMC BladeLogic Server Automation Installation Guide) or later on.About the Log4crc. where type is set to encrypt: <appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/ keystroke. 1 Stop the RSCD agent.pem"/> 3 Start the RSCD agent. 3 Make the following changes to the log4crc. uncomment or add the following entry.log" type="encrypt" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="rawtime" certfile="C:/WINDOWS/rsc/certificate.log"/> In the <appender> section. NOTE On UNIX agents. where name is set to keystroke: <categoryname="keystroke"priority="info1"appender="C:/ProgramFiles/BMC Software/BladeLogic/version/RSCD/keystroke.

pem"/>--> ■ Start the RSCD agent.debug /var/log/rscd-syslog BMC BladeLogic uses the local6 facility.conf. comment out or delete the following entry. Configuring the UNIX syslog If you are logging output to the UNIX syslog. comment out or delete the following entry. 284 BMC BladeLogic Server Automation Administration Guide . where name is set to keystroke: <!--<category name="keystroke" priority="info1" appender="C:/Program Files/BMC Software/BladeLogic/version/RSCD/keystroke. configure a facility.txt file In the <category> section.log"/>--> In the <appender> section. where type is set to encrypt: <!--<appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/ keystroke.About the Log4crc. Within /etc/syslog. you must configure the syslog daemon to accept output from BMC BladeLogic.pem" privatekeyfile="C:/WINDOWS/rsc/certificate. a priority level. and a location for the syslog by creating an entry like the following: local6.log" type="encrypt" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="rawtime" certfile="C:/WINDOWS/rsc/certificate.

0" encoding="ISO-8859-1"?> <!DOCTYPE log4c SYSTEM ""> <log4c version="1.log" type="digisign" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated" certfile="C:/WINDOWS/rsc/certificate.default layouts ======================================= --> <layout name="basic" type="basic"/> <layout name="dated" type="dated"/> <layout name="rawtime" type="rawtime"/> </log4c> Chapter 5 Setting up configuration files 285 .log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated"/> <!-.log"/--> <category name="rscdsvc" priority="info" appender="C:/Program Files/BMC Software/BladeLogic/ version/RSCD/rscdsvc.appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/rscd.log" type="encrypt" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="rawtime" certfile="C:/WINDOWS/rsc/certificate.txt file examples The following is an example of a default log4crc.txt file Default default log4crc.pem" privatekeyfile="C:/WINDOWS/rsc/certificate.About the Log4crc.root category ========================================= --> <category name="root" priority="info"/> <category name="rscd" priority="info1" appender="C:/Program Files/BMC Software/BladeLogic/ version/RSCD/rscd.pem" privatekeyfile="C:/WINDOWS/rsc/certificate.pem"/--> <appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/rscdsvc.default appenders ===================================== --> <appender name="stdout" type="stream" layout="basic"/> <appender name="stderr" type="stream" layout="basic"/> <appender name="syslog" type="syslog" layout="basic"/> <appender name="/tmp/bllog" type="stream" layout="dated"/> <appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/rscd.0"> <!-.1.log" debugappender="stderr"/> <category name="bldeploy" priority="debug"/> <category name="bldeployConsole" priority="debug" appender="stdout"/> <category name="bldeployAppserver" priority="error" appender="blbasic"/> <!-.pem"/--> <!-appender name="C:/Program Files/BMC Software/BladeLogic/version/RSCD/keystroke. <?xml version="1.log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated"/> <!-.txt file for a Windows installation.log" debugappender="stderr"/> <!--categoryname="keystroke"priority="info1"appender="C:/ProgramFiles/BMCSoftware/ BladeLogic/version/RSCD/keystroke.

log" debugappender="stderr"/> <!--categoryname="keystroke"priority="info1"appender="/opt/bmc/BladeLogic/version/ NSH/log/keystroke.0" encoding="ISO-8859-1"?> <!DOCTYPE log4c SYSTEM ""> <log4c version="1.default layouts ======================================= --> <layout name="basic" type="basic"/> <layout name="dated" type="dated"/> <layout name="rawtime" type="rawtime"/> </log4c> 286 BMC BladeLogic Server Automation Administration Guide .appender name="/opt/bmc/BladeLogic/version/NSH/log/rscd.txt file The following is an example of a default log4crc.pem" privatekeyfile="/usr/lib/rsc/certificate.txt file for a UNIX-style installation.pem" privatekeyfile="/usr/lib/rsc/certificate.root category ========================================= --> <category name="root" priority="info"/> <categoryname="rscd"priority="info1"appender="/opt/bmc/BladeLogic/version/NSH/log/ rscd.log"/--> <category name="rscdsvc" priority="info" appender="/tmp/rscdsvc.pem"/--> <!--appendername="/opt/bmc/BladeLogic/version/NSH/log/keystroke.1.log"type="encrypt" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="rawtime" certfile="/usr/ lib/rsc/certificate. <?xml version="1.log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated"/> <!-.0"> <!-.log" type="rollfile" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated"/> <!-.About the Log4crc.pem"/--> <appender name="/tmp/rscdsvc.log" type="digisign" rollsize="10000000" rolltimeinsec="2419200" rollmaxfiles="10" layout="dated" certfile="/usr/lib/ rsc/certificate.default appenders ===================================== --> <appender name="stdout" type="stream" layout="basic"/> <appender name="stderr" type="stream" layout="basic"/> <appender name="syslog" type="syslog" layout="basic"/> <appender name="/tmp/bllog" type="stream" layout="dated"/> <appender name="/opt/bmc/BladeLogic/version/NSH/log/rscd.log" debugappender="stderr"/> <category name="bldeploy" priority="debug"/> <category name="bldeployConsole" priority="debug" appender="stdout"/> <category name="bldeployAppserver" priority="error" appender="blbasic"/> <!-.

you can use the target server clean-up utility to delete these files. For information. You can mark these objects for deletion. and compliance results. You can delete these files by using the repeater clean-up utility. Data from Deploy Jobs can also accumulate in the staging directory on repeater servers. For information. patch analysis. ■ ■ ■ ■ Chapter 6 Managing BMC BladeLogic data 287 . the objects are deleted from the database the next time the database clean-up utility is run. The BMC BladeLogic Database. snapshot results. and auto-remediation. the Application Server to which you are connected. These tools let you delete unused data or data no longer needed for BMC BladeLogic operations. You can reduce the number of temporary files in the Application Server cache (directory) by using the Application Server clean-up utility. see “Cleaning the Application Server cache” on page 293. For information. or all accessible Application Servers. Repeater Servers. see “Cleaning up the BMC BladeLogic database” on page 288. The database clean-up utility also deletes old audit trail entries. This utility lets you delete old temporary files from a specific Application Server.Chapter 6 6 Managing BMC BladeLogic data BMC BladeLogic provides a suite of tools for managing data in the BMC BladeLogic system and controlling its growth where necessary. You can reduce clutter in your workspace from objects created by job runs. see “Cleaning up repeater servers” on page 294. audit results. You can delete data that has accumulated on target servers (BMC BladeLogic agents) from Deploy Jobs. For information. This utility deletes from the database objects users have deleted in the BMC BladeLogic Console and objects marked for deletion with the retention policy utility. You can reduce the amount of space taken up by unused data in the database by executing the database clean-up utility. You can manage data in these areas: ■ The BMC BladeLogic Console. This data consists of old files that are no longer accessed. see “Marking data for deletion” on page 289. see “Cleaning up target servers (Agents)” on page 293. For information. The Application Server Cache. Target Servers (Agents).

These objects include old job runs and job and depot objects automatically created during patching and auto-remediation. you must first start the Network Shell and then start the BMC BladeLogic command line interface (CLI). ■ About the clean-up utility The database clean-up utility works in conjunction with the retention policy utility. To execute the retention policy utility using the CLI or to run the database clean-up utility. see the BLCLI Help. This data includes: ■ Objects users have already deleted in the BMC BladeLogic Console. if you query again. to avoid longrunning clean-up runs. This utility lets you mark for deletion from the BMC BladeLogic database old job runs and objects automatically generated by operations such as auto-remediation and patch analysis. For more information on the CLI. You can delete unused files from the file server. TIP BMC Software recommends that you run the clean-up utility once per week. To run the database clean-up utility.Cleaning up the BMC BladeLogic database ■ The BMC BladeLogic File Server. Cleaning up the BMC BladeLogic database BMC BladeLogic provides a database clean-up utility (cleanupDatabase) to minimize the amount of space taken up by unused data. While the database clean-up utility is running. see “Executing the database clean-up utility” on page 292. 288 BMC BladeLogic Server Automation Administration Guide . For information on the retention policy utility. see “Marking data for deletion” on page 289. see “Cleaning up the file server” on page 295. This clean-up utility deletes any data from the database that has been previously marked for deletion. Objects marked as deleted with the retention policy utility. the initial result displays until the cleanup completes. Before using the database clean-up utility. For information. The result drops to 0 when the cleanup completes. you can run the following database query to determine how many depot objects the database clean-up utility will delete: select count (*) from depot_object where is_deleted = ‘1’.

For more information on this command see the BLCLI Help. ■ 3 Execute the retention policy utility.Marking data for deletion If you want to remove historical data. See “Executing the retention policy utility” on page 291. files associated with the objects are deleted from the File Server the next time the file server clean-up utility is run. These objects include old job runs and job and depot objects automatically created during patching and auto-remediation. such as audit trail information and job run events. Marking data for deletion BMC BladeLogic includes a retention policy utility that allows you to mark objects for deletion from the BMC BladeLogic database. the objects are deleted from the database the next time the database clean-up utility is run. (In addition.) Using the retention policy utility in this way lets you manage the amount of physical space the database requires and avoid potential performance issues resulting from your database getting too large. Enabling/disabling the retention policy utility The following procedure lets you enable or disable the retention policy. Once they are marked for deletion. 2 Set the retention period for objects you want to mark for deletion. For information on setting the retention period for automatically-generated objects. See “Enabling/disabling the retention policy utility” on page 289. ■ For information on setting the retention period for job runs. you can use the CLI to run the Delete:cleanupHistoricalData command. The following master procedure summarizes the steps for marking job runs for deletion: 1 Enable the retention policy utility. see “Setting the retention period for job runs” on page 290. see “Setting the retention period for automatically-generated objects” on page 291. By enabling the utility and setting the retention period. Once they are marked for deletion. Chapter 6 Managing BMC BladeLogic data 289 . the retention policy utility is not enabled to avoid the possibility of deleting data unknowingly. the objects that are candidates for deletion (because they are older than the specified retention period) are marked for deletion when the retention policy is executed. the objects are deleted from the database the next time the database clean-up utility is run. By default.

For details on setting a property using the Property Dictionary. For details on setting a property using the Property Dictionary.Marking data for deletion 1 Start the Application Server Administration console. do any of the following: ■ To set the default retention period for all jobs. which lets you mark objects for deletion from the BMC BladeLogic database. To set the number of days to retain job runs before marking them for deletion. In addition.) false — Disables the retention policy utility. the SnapshotJob property class). You cannot mark objects for deletion during database cleanup. 3 Restart the Application Server to have this change take effect. set the RESULTS_RETENTION_TIME property for the Job property class in the Property Dictionary. (See “Starting the Application Server Administration console” on page 45. ■ ■ 290 BMC BladeLogic Server Automation Administration Guide . see the BMC BladeLogic Server Automation User Guide. as described in “Starting the Application Server Administration console” on page 45. (Objects are deleted from the database the next time the database clean-up utility is run. To set the default retention period for job runs of a specific job. To set the default retention period for all jobs of a specific type. set the RESULTS_RETENTION_TIME property for the specific job property class in the Property Dictionary (for example.) Setting the retention period for job runs You can set the number of days to retain job runs before marking them for deletion. For information on setting property values using the Properties tab for a system object (such as a job). see the BMC BladeLogic Server Automation User Guide. set the RESULTS_RETENTION_TIME property using the Properties tab for a specific job. 2 To enable or disable the retention policy utility. files associated with the objects are deleted from the file server the next time the file server clean-up utility is run. see the BMC BladeLogic Server Automation User Guide. enter the following: set Cleanup EnableRetentionPolicy true|false Where: true — Enables the retention policy utility.

as described in “Starting the Application Server Administration console” on page 45. a specific job value overrides any value defined for the specific job type or for all job types. see “Starting the Application Server Administration console” on page 45. For example. Setting the retention period for automatically-generated objects To set the number of days to retain automatically-generated objects before marking them for deletion. do the following: 1 Start the Application Server Administration console. Executing the retention policy utility To execute the retention policy utility. Chapter 6 Managing BMC BladeLogic data 291 . 3 Restart the Application Server to have this change take effect. do the following: 1 Start the Network Shell and then issue the CLI command that executes the retention policy utility by entering the following: #nsh Server1% blcli Delete executeRetentionPolicy For more information about this command. the CLI prompts you for a user name and password. 2 If you have not cached your session credentials. see the Delete name space of BLCLI Help.Marking data for deletion NOTE The most specific retention value will be used when executing a retention policy. Enter a user name and password that you use for accessing BMC BladeLogic. 2 Specify the retention period (in days) with the set command: set Cleanup AutoGeneratedRetentionTime #days Where: # days — is the number of days that job and depot objects are retained before being marked for deletion (when you execute the retention policy utility). For information.

see “Single sign-on” on page 121. For information. For information on using the retention policy utility.System_Cleanup authorization. storing this information in the credentials cache. your role must be granted the BL_Administration. 2 If you have not cached your session credentials. see “Marking data for deletion” on page 289. you can cache your authentication information for repeated use over a given time period. see the Delete name space of BLCLI Help. 1 Start the Network Shell and then issue the CLI command that executes the database clean-up utility by entering the following: #nsh Server1% blcli Delete cleanupDatabase For more information about this command. Enter a user name and password that you use for accessing BMC BladeLogic. Executing the database clean-up utility Use this procedure to remove superfluous BMC BladeLogic data from Oracle and SQL Server databases.Executing the database clean-up utility NOTE If you are authenticating with SRP. see the Delete name space of BLCLI Help. to avoid longrunning clean-up runs. For information. 292 BMC BladeLogic Server Automation Administration Guide . TIP BMC Software recommends that you run the clean-up utility once per week. the CLI prompts you for a user name and password. see “Single sign-on” on page 121. NOTE BMC BladeLogic also provides the performFullCleanupJob CLI command for database cleanup. To execute a database clean-up operation. For information. storing this information in the credentials cache. NOTE If you are authenticating with SRP. you can cache your authentication information for repeated use over a given time period.

see “Single sign-on” on page 121. These files are temporary and will probably no longer be accessed. your role must be granted the BL_Administration. For information. These files are temporary files no longer needed after the operation. To execute a clean-up operation. 2 If you have not cached your session credentials. you can use the Application Server cache clean-up utility to delete them from the cache.Cleaning the Application Server cache Cleaning the Application Server cache Each Application Server has a file cache (directory) containing files that it uses for operations it performs. The utility lets you specify parameters for the cleanup. objects such as BL packages. you can cache your authentication information for repeated use over a given time period. 1 Start the Network Shell and then issue the CLI command that executes the Application Server cache clean-up utility by entering the following: #nsh Server1% blcli Delete cleanupAppServerCache <retention time> For more information about this command. transaction information and log files are created on the target servers and in certain cases are not deleted. Enter a user name and password that you use for accessing BMC BladeLogic. see the BMC BladeLogic Server Automation User Guide.System_Cleanup authorization. To delete these objects from a target server. use the target server clean-up utility To clean up transactions. such as Application Server name and the minimum elapsed time before files can be considered for deletion. the target server clean-up utility uses the value of the server’s TRANSACTIONS_DIR property to locate the transactions directory. You can also use the utility to clean up caches of all accessible Application Servers. see the Delete name space of BLCLI Help. Cleaning up target servers (Agents) During Deploy Jobs. storing this information in the credentials cache. For information on configuring this property. Chapter 6 Managing BMC BladeLogic data 293 . NOTE If you are authenticating with SRP. the CLI prompts you for a user name and password.

storing this information in the credentials cache. For information. such as maximum size for the staging directory and the minimum elapsed time before files can be considered for deletion. you can cache your authentication information for repeated use over a given time period. see “Single sign-on” on page 121. use the command in a Network Shell Script Job. 1 Start the Network Shell and then issue the CLI command that executes the repeater server clean-up utility by entering the following: #nsh Server1% blcli Delete cleanupRepeater For more information about this command. Enter a user name and password that you use for accessing BMC BladeLogic. see the Delete name space of BLCLI Help. see the Delete name space of BLCLI Help. See “Scheduling the target server (Agent) cleanup” on page 300. your role must be granted the BL_Administration. Cleaning up repeater servers Old temporary files from Deploy Jobs can accumulate in the staging directory on repeater servers. The utility lets you specify parameters for the cleanup. You can use the repeater clean-up utility to delete these files.System_Cleanup authorization.Cleaning up repeater servers To execute a clean-up operation. 2 If you have not cached your session credentials. NOTE If you are authenticating with SRP. To execute a clean-up operation. To clean up a set of target servers. 294 BMC BladeLogic Server Automation Administration Guide .System_Cleanup authorization. the CLI prompts you for a user name and password. your role must be granted the BL_Administration. 1 Start the Network Shell and then issue the CLI command that executes the target server clean-up utility by entering the following: #nsh Server1% blcli Delete cleanupAgent For more information about this command.

Before you begin When a Custom Package Deploy Job runs. Neither the file server clean-up utility or database clean-up utility removes these directories. 2 If you have not cached your session credentials. the CLI prompts you for a user name and password. storing this information in the credentials cache. NOTE If you are authenticating with SRP. see “Single sign-on” on page 121. Chapter 6 Managing BMC BladeLogic data 295 . these directories still exist. For information. Even after the job run history is removed by the retention policy. Prior to running the Delete cleanupFileServer command. you must run the Delete updateDeleteDependencies to remove these directories. Cleaning up the file server When users delete objects from the BMC BladeLogic Console.Cleaning up the file server 2 If you have not cached your session credentials. Enter a user name and password that you use for accessing BMC BladeLogic. To clean up the file server 1 Start the Network Shell and then issue the CLI command that executes the file server clean-up utility by entering the following: #nsh Server1% blcli Delete cleanupFileServer For more information about this command. you can cache your authentication information for repeated use over a given time period. it creates a subdirectory under the BLPackage directory for every iteration. Enter a user name and password that you use for accessing BMC BladeLogic. the CLI prompts you for a user name and password. the system marks for deletion from the file server all files associated with the objects. see the Delete name space of BLCLI Help. You can use the file server clean-up utility to delete these unused files from the file server and from the temporary file storage on the Application Server.

To execute a clean-up operation. 296 BMC BladeLogic Server Automation Administration Guide . However. Cleaning up historical data As part of its operation. The utility deletes the following objects: ■ ■ ■ ■ ■ ■ Old audit trail entries Audit results Job run events Compliance results Snapshot results Job schedules Using this utility. you can also clean up historical data by using the historical data clean-up utility. Enter a user name and password that you use for accessing BMC BladeLogic.System_Cleanup authorization. see the Delete name space of BLCLI Help.Cleaning up historical data NOTE If you are authenticating with SRP. For more information about this command. for example. the CLI prompts you for a user name and password. you can delete all historical data or only one specific type of object. your role must be granted the BL_Administration. 2 If you have not cached your session credentials. For information. storing this information in the credentials cache. you can cache your authentication information for repeated use over a given time period. 1 Start the Network Shell and then issue the CLI command that executes the historical data clean-up utility by entering the following: #nsh Server1% blcli Delete cleanupHistoricalData This command deletes all historical data. To clean up one specific type of object. see “Single sign-on” on page 121. snapshot results. the database clean-up utility (cleanupDatabase) cleans up historical data from the database. enter the command and specify a value for the objectName variable.

) ■ ■ ■ ■ ■ NOTE BMC BladeLogic recommends that you create all Network Shell Script Jobs for cleanup in a single directory.Scheduling the cleanup NOTE If you are authenticating with SRP. storing this information in the credentials cache. For information. Scheduling the cleanup The clean-up utilities can be run as Network Shell Script Jobs. Running a utility as a script job lets you schedule the job so it executes on a regular basis rather than running it interactively. you can cache your authentication information for repeated use over a given time period. see “Single sign-on” on page 121. The script should consist of the CLI command that invokes the utility: blcli Delete executeRetentionPolicy Chapter 6 Managing BMC BladeLogic data 297 . create a Network Shell script to run the retention policy utility.) Target server (agent) cleanup (See “Scheduling the target server (Agent) cleanup” on page 300. You can set up Network Shell Script Jobs for performing these clean-up tasks: ■ Marking data for deletion (See “Scheduling the retention policy utility to mark data for deletion”. 1 In a text editor.) Database cleanup (See “Scheduling the database cleanup” on page 298.) File Server cleanup (See “Scheduling the file server cleanup” on page 299.) Repeater cleanup (See “Scheduling the repeater server cleanup” on page 300.) Application Server cache cleanup (See “Scheduling the Application Server cache cleanup” on page 299. for example: /Jobs/BMC BladeLogic Administration/Cleanup Scheduling the retention policy utility to mark data for deletion Use this procedure to run the retention policy utility as a Network Shell Script Job.

B Schedule the job to run at a frequency you prefer. For information. TIP BMC Software recommends that you run the clean-up utility once per week. B Schedule the job to run at a frequency you prefer. choose the first option. see the BMC BladeLogic Server Automation User Guide. to avoid longrunning clean-up runs. see the BMC BladeLogic Server Automation User Guide. A Assign any name to the script. see the BMC BladeLogic Server Automation User Guide. For information. add the Network Shell script to the Depot. specify the server functioning as the Application Server. B When you specify the Script Type. 1 In a text editor. A For the target server. A For the target server. For information. The script should consist of the CLI command that invokes the utility: blcli Delete cleanupDatabase 2 Using BMC BladeLogic Console. 3 Create a Network Shell Script Job based on the script you added to the Depot in the previous step. 298 BMC BladeLogic Server Automation Administration Guide . see the BMC BladeLogic Server Automation User Guide. Scheduling the database cleanup Use this procedure to run the database clean-up utility as a Network Shell Script Job. create a Network Shell script to run the database clean-up utility. B When you specify the Script Type. choose the first option.Scheduling the database cleanup 2 Using the BMC BladeLogic Console. 3 Create a Network Shell Script Job based on the script you added to the Depot in the previous step. A Assign any name to the script. add the Network Shell script to the Depot. specify the server functioning as the Application Server. For information.

The script should consist of the CLI command that invokes the utility: blcli Delete cleanupFileServer 2 Using BMC BladeLogic Console.Scheduling the file server cleanup Scheduling the file server cleanup Use this procedure to run the file server clean-up utility as a Network Shell Script Job. For information. A Assign any name to the script. Scheduling the Application Server cache cleanup Use this procedure to run the Application Server cache clean-up utility as a Network Shell Script Job. add the Network Shell script to the Depot. B When you specify the Script Type. 1 In a text editor. For information. For information. B When you specify the Script Type. choose the first option. see the BMC BladeLogic Server Automation User Guide. specify the server functioning as the Application Server. The script should consist of the CLI command that invokes the utility: blcli Delete cleanupAppServerCache <retention time> 2 Using the BMC BladeLogic Console. create a Network Shell script to run the file server clean-up utility. 1 In a text editor. A For the target server. See “Cleaning up the file server” on page 295 for notes on pre-requisites for running the utility. Chapter 6 Managing BMC BladeLogic data 299 . choose the first option. create a Network Shell script to run the Application Server cache clean-up utility. see the BMC BladeLogic Server Automation User Guide. see the BMC BladeLogic Server Automation User Guide. add the Network Shell script to the Depot. A Assign any name to the script. 3 Create a Network Shell Script Job based on the script you added to the Depot in the previous step. B Schedule the job to run at a frequency you prefer.

A For the target server. For information. B When you specify the Script Type. B Schedule the job to run at a frequency you prefer. B Schedule the job to run at a frequency you prefer. specify the repeater servers you want to clean up. add the Network Shell script to the Depot. 1 In a text editor. The script should consist of the CLI command that invokes the utility: blcli Delete cleanupAgent 300 BMC BladeLogic Server Automation Administration Guide . choose the first option. 1 In a text editor. A Assign any name to the script. create a Network Shell script to run the target server (agent) cleanup utility. Scheduling the target server (Agent) cleanup Use this procedure to run the target server clean-up utility as a Network Shell Script Job.Scheduling the repeater server cleanup 3 Create a Network Shell Script Job based on the script you added to the Depot in the previous step. For information. The script should consist of the CLI command that invokes the utility: blcli Delete cleanupRepeater 2 Using the BMC BladeLogic Console. see the BMC BladeLogic Server Automation User Guide. create a Network Shell script to run the repeater server clean-up utility. see the BMC BladeLogic Server Automation User Guide. For information. specify the server functioning as the Application Server. Scheduling the repeater server cleanup Use this procedure to run the repeater server clean-up utility as a Network Shell Script Job. A For the target server. 3 Create a Network Shell Script Job based on the script you added to the Depot in the previous step. see the BMC BladeLogic Server Automation User Guide.

Chapter 6 Managing BMC BladeLogic data 301 . see the BMC BladeLogic Server Automation User Guide. B Schedule the job to run at a frequency you prefer. A For the target server. 3 Create a Network Shell Script Job based on the script you added to the Depot in the previous step. see the BMC BladeLogic Server Automation User Guide. For information.Scheduling the target server (Agent) cleanup 2 Using the BMC BladeLogic Console. B When you specify the Script Type. add the Network Shell script to the Depot. choose the first option. A Assign any name to the script. specify the target servers (agents) you want to clean up. For information.

Scheduling the target server (Agent) cleanup 302 BMC BladeLogic Server Automation Administration Guide .

Figure 1 shows a sample configuration. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 303 .Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 7 An advanced file server or Advanced Repeater server uses BMC BladeLogic Advanced Repeater technology with deploy jobs to enable file servers and repeater servers to store and share deploy data more efficiently. You can also configure bandwidth throttling on links between the Advanced File Server and the Advanced Repeater. Using an Advanced File Server on the existing File Server with one or more Advanced Repeaters uses a more efficient protocol to ensure that only changes to the content are downloaded across the network. With the standard BMC BladeLogic Server Automation file server and repeater. the Depot objects are sent to the repeater in their entirety whenever they are required for a deployment. Overview Using advanced file servers and Advanced Repeater servers can help you improve the bandwidth utilization between the central file server and the repeaters.

Key terms Figure 1 Sample configuration Key terms The BMC BladeLogic Advanced Repeater is the combination of Advanced File Server and Advanced Repeater server. It uses the BMC BladeLogic Server Automation Client Automation master transmitter component to hold a second copy of the depot content in a compressed. 304 BMC BladeLogic Server Automation Administration Guide .an enhanced Java application server running on an existing File Server. and the BMC BladeLogic Server Automation Client Automation Proxy (used by the Advanced Repeater server). proprietary format that is well suited to providing bandwidth efficient transfer of data. the Transmitter (used by the Advanced File Server). ■ Advanced File Server . The three key components are the Content Replicator. The following list defines some of these key terms. Both the Advanced Repeater and Advanced File Server are built on BMC BladeLogic Server Automation Client Automation technology.

What is the BMC BladeLogic Advanced Repeater? ■ Advanced Repeater . Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 305 . When a Deploy Job is run and is set for indirect staging. If you are using deploy jobs in a large-scale environment. NOTE For instructions on installing the BMC BladeLogic Advanced Repeater.a Java application that runs instead of the traditional BMC BladeLogic Server Automation repeater and uses the BMC BladeLogic Server Automation Client Automation Proxy component to efficiently download data from the Advanced File Server. using the BMC BladeLogic Server Automation Client Automation proxy. Any targets which have been configured to use a standard repeater continue to do so. It is also used to pull the content down to the file system on the Advanced Repeater.the Advanced Repeater and Advanced File Server are both installed from the same installation file.used to publish the content from the existing file server to the Transmitter on the Advanced File Server. you can configure an Advanced File Server and one or more Advanced Repeaters. See “Best practice information” on page 306. which use the BMC BladeLogic Advanced Repeater. see “Installing the BMC BladeLogic Server Automation Advanced Repeater” on page 307. An RSCD agent must be installed on the servers hosting both the Advanced Repeater and Advanced File Server components. Using BMC BladeLogic Advanced Repeater technology enables file servers and repeater servers to store and share deploy data efficiently. consider setting up Advanced File Servers and using Advanced Repeater servers. ■ ■ What is the BMC BladeLogic Advanced Repeater? The BMC BladeLogic Advanced Repeater provides scalable transport of data over wide-area networks. Ability to manage the use of network resources by the Advanced File Server and Advanced Repeater server. Advanced Repeater installer . Any targets which are not configured to use a repeater stage the data directly on the target. any targets which have been configured through Routing Rules to use an Advanced Repeater will make use of the BMC BladeLogic Advanced Repeater. Using the BMC BladeLogic Advanced Repeater technology for deploying data offers several key benefits: ■ Improved performance of staging data for deploy jobs. Content Replicator . and is an alternate option when configuring file servers or repeater servers. ■ If the BMC BladeLogic Advanced Repeater components have been installed.

it maintains three times the size of the data as cache. This setting means that about 1GB RAM should be allowed to run the advanced file server. it runs in limited disk space mode. and starts maintaining free disk space instead. The Advanced Repeater transmitter component uses the additional space for optimizations that improve the efficiency of data replication. Memory utilization The default Java heap size is configured for a maximum of 512MB in the advanced file server. the transmitter stops maintaining storage size ratio. and compressing. If the transmitter does not have enough disk space to maintain the optimal storage size ratio. but the CPU usage will spike when new content is published as this needs to be compressed. caching. CPU utilization The advanced file server does not make intensive usage of the CPU. non-redundant. 306 BMC BladeLogic Server Automation Administration Guide . An Advanced File Server cannot be disabled if there are existing Advanced Repeater servers. In limited disk space mode.Best practice information NOTE Note the following requirements when configuring Advanced File Servers and repeater servers: ■ ■ An Advanced Repeater server cannot be enabled unless an Advanced File Server is enabled. using SSL also increases the CPU usage by about 40% due to the encryption and decryption of the content. but efficiency degrades. Best practice information Disk space If you are implementing an Advanced File Server. It is possible to run the transmitter with less than optimal disk space. BMC BladeLogic recommends that the file server have 200 GB or more of available RAID 5 disk space. When the BMC BladeLogic Advanced Repeater has enough disk space. the file server must have a minimum of 72 GB of available. and attempts to maintain at least 10% free disk space. disk space. In addition. such as diffing. by removing cache files to reduce the amount of storage.

The installer files applicable to the Advanced Repeater are labeled BMC BladeLogic Advanced Repeater for hostPlatform on the EPD site. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 307 . click Next. 4 On the BMC BladeLogic Server Automation Advanced Repeater Installation screen. upload the installer bin to the file server or repeater server. 2 Do one of the following: ■ In Microsoft Windows environments. copy the installation file to a directory on the server you want to configure as an Advanced File Server or Advanced Repeater Server. 5 On the Welcome screen. 6 Accept the license agreement and click Next. Installing using the installation program To install the BMC BladeLogic Advanced Repeater 1 Download the BMC BladeLogic Advanced Repeater installation file according to the download instructions in provided in the “Before you begin” chapter of the BMC BladeLogic Server Automation Installation Guide. ■ 3 Start the BMC BladeLogic installation program for your platform.Installing the BMC BladeLogic Server Automation Advanced Repeater Installing the BMC BladeLogic Server Automation Advanced Repeater You can install the BMC BladeLogic Server Automation Advanced Repeater using the installation program or by performing an unattended (silent) installation. The download instructions in the BMC BladeLogic Server Automation Installation Guide provide a standard method for downloading the product files from the BMC Software Electronic Product Download (EPD) website. Different installers are provided for 32-bit and 64-bit Windows. In Linux Environments. click OK.

click Finish. and then click Install. Click Next to upgrade the installation. Specify this TCP port if you are installing the BMC BladeLogic Advanced Repeater behind a firewall. 8 Specify the workspace directory (where the Advanced Repeater stores its channels). — Proxy Listener Port: Specify the TCP port for the Proxy Service listener. Click Next. — Transmitter Listener Port: Specify the TCP port for the Transmitter service listener. or accept the default.Installing using the installation program 7 Specify the destination directory. Click Next. The Advanced Repeater Credentials window opens. A notification panel window appears if the installation program detects an existing installation. as long as the port number is not already in use. enter the port number used to establish a new connection for each RPC client connecting to the RPC server. NOTE You must use the RPC port number that was set during installation. 12 When the installation completes. The Advanced Repeater Service Port window opens. You can use any port. The default port is 7717. — Click Next. The Workspace Directory window opens. Specify an integer between 0 and 65535. NOTE The default installation folder (AdvancedRepeater) is the same for both Advanced File Server and Advanced Repeater Server. 9 Specify the credentials for the Advanced Repeater administrator. 10 Specify the following: — Transmitter RPC Port: If the server is using remote procedure calls (RPC). or accept the default credentials by selecting Use default tuner credential settings.port number to be used by the BMC BladeLogic Advanced Repeater. Specify an integer between 0 and 65535. or accept the default. The default port is 5282. 308 BMC BladeLogic Server Automation Administration Guide . Click Next. 11 Review the current settings to confirm that you have specified the correct installation configuration. The default port is 8081.

Performing an unattended (silent) installation To uninstall the BMC BladeLogic Advanced Repeater Do one of the following: ■ On Microsoft Windows. Before you begin Certain Terminal Server configuration options that pertain to temporary folders must be turned off./uninstall where version is the version number for BMC BladeLogic Server Automation (for example. to enable running the installation wizard through a Terminal Services connection or a remote desktop session.1). Performing an unattended (silent) installation Install the Advanced Repeater using silent mode You can perform an unattended (silent) installation of the BMC BladeLogic Server Automation Advanced Repeater. For example: -A -P -J -J -J -J -J -J featureAdvancedRepeater installLocation=installationDirectory WORKSPACE_DIRECTORY=pathToWorkspace TUNER_ADMINISTRATION_USER_NAME=admin TUNER_ADMINISTRATION_PASSWORD=password TUNER_ADMINISTRATION_PORT_NUMBER=7177 PROXY_PORT_NUMBER=8081 XMITTER_PORT_NUMBER=5282 Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 309 . To install the Advanced Repeater in silent mode 1 In a text editor. 8. create an options file and add the options for the installation that you want to run. On Linux. select Start => All Programs => BMC BladeLogic Server Automation Suite => Uninstall Advanced Repeater and follow the prompts on the uninstall wizard. enter the following command and follow the prompts on the uninstall wizard: ■ :/opt/adv/rptr/version/AdvancedRepeater/UninstallAdvancedRepeater # .

■ 310 BMC BladeLogic Server Automation Administration Guide . Specify an integer between 0 and 65535. Specify an integer between 0 and 65535. -J PROXY_PORT_NUMBER= The TCP port for the Proxy Service listener. You can use any port.Performing an unattended (silent) installation Where: Option -P installLocation= installationDirectory Description Sets the installation directory for the product. Values for options may contain spaces.0\AdvancedRepeater\tuner On UNIX: -J WORKSPACE_DIRECTORY=/opt/bmc/BladeLogic/8. The default is 8081. The TCP port for the Transmitter service listener.0/AdvancedRepeater -A featureAdvancedRepeater Specifies installation of the Advanced Repeater. Specify this TCP port if you are installing the BMC BladeLogic Server Automation Advanced Repeater behind a firewall. on Windows: -J WORKSPACE_DIRECTORY=C:\Program Files\BMC Software\BladeLogic\8. For example.0\AdvancedRepeater On UNIX: -P installLocation= opt/bmc/BladeLogic/8. The default is 5282. The NUMBER= default is 7717. as long as the port number is not already in use. Specify an integer between 0 and 65535. on Windows: -P installLocation=C:\Program Files\BMC Software\BladeLogic\8. -J XMITTER_PORT_NUMBER= Guidelines ■ Each option must be on a single line.0/AdvancedR epeater/tuner The user name and password for Advanced Repeater administrator. -J WORKSPACE_DIRECTORY= pathToWorkspace Specifies the workspace directory (where the Advanced Repeater stores its channels). -J TUNER_ADMINISTRATION_USER_ NAME= -J TUNER_ADMINISTRATION_ PASSWORD= -J The TCP port to be used by the BMC BladeLogic Server Automation TUNER_ADMINISTRATION_PORT_ Advanced Repeater. For example.

bin -i silent DOPTIONS_FILE=/opt/bmc/BladeLogic/8. AdvancedRepeaterInstallerName -i silent DOPTIONS_FILE=silentOptionsFilePath You must use an absolute path to the options file. However. you should specify TUNER_ADMINISTRATION_USER_NAME and PASSWORD.txt Upgrade the Advanced Repeater using silent mode You can perform an unattended (silent) upgrade of the BMC BladeLogic Server Automation Advanced Repeater. 1 In a text editor. AdvancedRepeaterInstallerName -i silent -DOPTIONS_FILE=silentOptionsFilePath You must use an absolute path to the options file.txt Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 311 . Windows example AdvancedRepeater_8_1_win32.0/silent_install. 3 Run the installation program with the -i silent option.0/silent_install. create an options file that contains this option: -A featureAdvancedRepeater 2 Change directory to the location where the installer resides.exe -i silent DOPTIONS_FILE=/opt/bmc/BladeLogic/8.exe -i silent -DOPTIONS_FILE=C:\Program Files\BMC Software\BladeLogic\8.Performing an unattended (silent) installation ■ All Java properties have default values if not specified in the options file. 3 Run the installation program with the -i silent option. Windows: AdvancedRepeater_8_1_win32.txt UNIX example sh AdvancedRepeater_8_1_win32.0\silent_upgrade. 2 Change directory to the location where the installer resides.

txt Configuring Advanced File Servers and Advanced Repeater servers To adjust the configuration settings for the an Advanced File Server or Advanced Repeater server. See the BMC BladeLogic Server Automation User Guide for information on creating automation principals.Configuring Advanced File Servers and Advanced Repeater servers UNIX: sh AdvancedRepeater_8_1_win32. see the following: ■ Configuring Advanced File Servers Configuring Advanced Repeater servers Changing the administrator user and password for Advanced Repeater Servers ■ ■ Before you begin NOTE Configuring an Advanced Repeater server behind a SOCKS proxy server is not supported. create an automation principal which contains the user-defined Administrator credential used to configure the Advanced File Server. Set up credentials If you have not already done so.bin -i silent DOPTIONS_FILE=/opt/bmc/BladeLogic/8. An automation principal defines a user credential that can be used for accessing external systems.0/silent_upgrade. 312 BMC BladeLogic Server Automation Administration Guide .

change the Advanced File Server root directory path to point to the BMC BladeLogic Advanced Repeater installation directory. click Enable Advanced File Server.Configuring Advanced File Servers Configuring Advanced File Servers Use this procedure to modify a file server to be used as an Advanced File Server. select Configuration => Infrastructure Management. 5 On the General tab. If you do not specify the install directory. the Transmitter and Performance tabs are not accessible. which uses the BMC BladeLogic Advanced Repeater. as described in “Installing the BMC BladeLogic Server Automation Advanced Repeater” on page 307. If necessary. 2 Install the BMC BladeLogic Advanced Repeater on the file server. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 313 . 4 Right-click the file server and select Properties to open the Modify File Server dialog. 1 Create a file server as described in “Setting up the file server” on page 75. while the File Server Root Path points to the directory on the file server where data is stored. 3 On the BMC BladeLogic Server Automation Console. The Advanced File Server Root Directory points to the BMC BladeLogic Advanced Repeater installation directory. NOTE The Advanced File Server Root Directory path is different than the File Server Root Path.

This credential is needed by BMC BladeLogic Server Automation to access and configure the Advanced File Server. This default automation principal matches the built-in administrator credential. If you specified a custom user/password combination during installation or in the post-install procedure. you can use SSL if your environment requires encryption. Advanced File Server Administrator Select an Automation Principal from the drop-down list. ■ 314 BMC BladeLogic Server Automation Administration Guide . See “Securing communication between Advanced File Servers and Advanced Repeater servers (optional)” on page 319. ■ If you have not changed any credential during the installation or post-installation procedures.Configuring Advanced File Servers 6 On the Security tab. If you have configured secure communication for the file server. The automation principal is used to access and configure the Advanced File Server. select the automation principal that was created for that user/password combination. However. select "Default". check SSL Enabled. specify the following: Option SSL Settings Description By default the traffic between the advanced file server and advanced repeater is not encrypted.

Install Copy B on a separate transmitter host. you only need to install one copy of the Advanced Repeater on the file server host. In this case. The value Advanced File Server Root Directory on the General tab reflects the installation directory for Copy A. if there is not sufficient disk space on the file server host.Configuring Advanced File Servers 7 On the Transmitter tab. however. In some cases. Enter the RPC port number that was set during installation. The RPC port is used to administer the Advanced Repeater components. you must install two copies of the Advanced Repeater. The Host field on the General tab will be the same as the Transmitter Host Name field on the Transmitter tab. The Advanced File Server Root Directory field on the General tab will be the same as the value specified here. By default. ■ Install Copy A on an existing file server host. Select the BMC BladeLogic Advanced Repeater installation directory. For example. You can use any port as the listener port. the transmitter is located on the same host as the File Server. you may want the transmitter to be on a different host than file server. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 315 . specify the following: Option Transmitter Host Name Transmitter Root Directory Description By default. the value for the Transmitter Root Directory field reflects the installation directory for Copy B. as long as the port number is not already in use. the transmitter (in the Advanced File Server) is located on the same host as the existing file server. In this case. ■ In this case. Transmitter Listener Port RPC Port Enter the port on which the Advanced Repeater listens for requests.

you can specify options that help you control the amount of network resources used during deployment.enter the maximum amount of available bandwidth (as a percentage) that the transmitter can use. — high . 316 BMC BladeLogic Server Automation Administration Guide . the transmitter automatically deletes optional files. If you select the Enable bandwidth management option. specify the following: Option Disk resources Description Enter the minimum amount of disk space (as a percentage) that the transmitter should keep free. — medium . Specify the following: Option Network connections Network bandwidth Description Enter the number of clients (Advanced Repeaters) allowed to connect to the Advanced File Server at one time. Instead of transferring entire files when updating payloads.balances time and size. 10 Click OK.the file is compressed as much as possible.specify the number of kilobits per second that the Advanced File Server can use as throughput. Specify the following: ■ ■ File transfer efficiency ■ Compression enabled . Compression level . such as files in the index cache. This setting limits the total traffic leaving the transmitter. Maximum throughput . Differencing enabled . specify the following: ■ ■ Percentage of bandwidth . Set the amount of memory to allocate for differencing. — low . To keep the specified amount of disk space free.specifies the level of compression the transmitter should use for the files it sends. 9 On the Network tab.Configuring Advanced File Servers 8 On the Performance tab.specifies whether the Advanced File Server should compress the files it sends. A bandwidth setting of “0” (zero) sets specifies maximum bandwidth speed (unlimited). across all parallel connections. which allows the transmitter to send faster payload updates and to use less bandwidth. but for large files the process can take a long time and can use many CPU resources.the compression is fast but the file size isn't reduced as much as on high (however the byte-savings difference is minimal).specifies whether the transmitter should use byte-level differencing. the transmitter uses byte-level differencing to send only the changed bytes.

see the Exports File section in the BMC BladeLogic Server Automation Administration Guide. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 317 . 3 Do one of the following: — Right-click Repeater Servers and select New Repeater Server to start the New Repeater Wizard. as described in “Installing the BMC BladeLogic Server Automation Advanced Repeater” on page 307. 2 On the BMC BladeLogic Server Automation Console. 1 Install the BMC BladeLogic Advanced Repeater on the system that you will use as an Advanced Repeater server. which uses the BMC BladeLogic Advanced Repeater.Configuring Advanced Repeater servers Configuring Advanced Repeater servers Use this procedure to create or modify a server to be used as an Advanced Repeater server. NOTE The Advanced Repeater server must be able to access the Advanced File Server directly using the user name defined in the exports file on the file server. If necessary. select Configuration => Infrastructure Management. change the Advanced Repeater root directory path. For more information. See “Configuring Advanced File Servers and Advanced Repeater servers” on page 312. click Enable Advanced Repeater. NOTE You must have first configured an Advanced File Server before you can configure an Advanced Repeater server. — Right-click an existing repeater server select Properties to open the Modify Repeater Server dialog. 4 On the General panel.

Enter a percentage that represents the lower limit (cache low watermark) for the Advanced Repeater cache size. The cache does not exceed this disk-space limit. Once the cache reaches the maximum cache size. If you have configured secure communication. This credential is needed by BMC BladeLogic Server Automation to access and configure the Advanced Repeater. the Advanced Repeater starts garbage collection to delete older channel files from the cache. ■ 6 On the Cache and Port panel. check SSL Enabled. select "Default". Cache low watermark 318 BMC BladeLogic Server Automation Administration Guide . select the automation principal that was created for that user/password combination. specify the following: Option SSL Settings Description By default the traffic between the advanced file server and advanced repeater is not encrypted. See “Securing communication between Advanced File Servers and Advanced Repeater servers (optional)” on page 319.Configuring Advanced Repeater servers 5 On the Security tab. you can use SSL if your environment requires encryption. This default automation principal matches the built-in administrator credential. When the Advanced Repeater starts cache garbage collection. Advanced Repeater Server Administrator Select an Automation Principal from the drop-down list. The automation principal is used to access and configure the Advanced File Server. specify the following: Option Cache maximum size Description Cache management options Enter the total size (in MB) for the Advanced Repeater cache. ■ If you have not changed any credential during the installation or post-installation procedures. it takes a snapshot of the cache and then determines the number of files it must delete to reach the low watermark. However. If you specified a custom user/password combination during installation or in the post-install procedure. BMC Software recommends that you set the cache low watermark to a value between 75 and 80 (indicating that it is 75% to 80% of the maximum cache size).

as long as the port number is not already in use. you can specify options that help you control the amount of network resources used during deployment.specify the number of kilobits per second that the Advanced Repeater can use as throughput. Enter the RPC port number that was set during installation. Changing the administrator user and password for Advanced Repeater Servers You can change the administrator user and password for Advanced Repeater Servers in any of the following ways: ■ In the installation wizard. you can change it using a Runchannel command. Maximum throughput . specify the following: ■ ■ Percentage of bandwidth . You can use any port as the listener port. (On Windows.enter the maximum amount of available bandwidth (as a percentage) that the Advanced Repeater can use. — From a command prompt. If you know the administrator user/password combination. The RPC port is used to administer the Advanced Repeater components. If enabled. This setting applies for each repeater to file server connection. execute the following command: ■ Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 319 .0\AdvancedRepeater\tuner\). — Navigate to the Advanced Repeater Server installation directory. A bandwidth setting of “0” (zero) sets specifies maximum bandwidth speed (unlimited). the default directory is C:\Program Files\BMC Software\Bladelogic\8.Changing the administrator user and password for Advanced Repeater Servers Option Listener port Description Port management options Enter the port on which the Advanced Repeater listens for requests. when running the installation program. RPC port 7 On the Network panel. 8 Click OK. Specify the following: Option Network connections Network bandwidth Description Enter the number of concurrent connections to the Advanced Repeater.

0\AdvancedRepeater\tuner\). all communication between the Advanced File Server and Advanced Repeater servers using the BMC BladeLogic Advanced Repeater can be encrypted using SSL. — From a command prompt.exe -admin "newAdminUser.d/advancedrepeater start 320 BMC BladeLogic Server Automation Administration Guide . (Note that the Tuner program can only be run locally. for example) that is able to issue credentials used for PKI authentication. execute the following command: tuner. NOTE The following instructions assume you have a valid certificate authority (using OpenSSL.plain:newAdminPwd" ■ If you do not know the administrator user/password combination (for example. All other traffic is all local and does not require encryption.plain:newAdminPwd" Securing communication between Advanced File Servers and Advanced Repeater servers (optional) Optionally. using one of the following methods: ■ On UNIX and Linux.Securing communication between Advanced File Servers and Advanced Repeater servers (optional) runchannel http://localhost:5282/Marimba/Current/TunerAdministrator -tuner localhost:7717 -username oldAdminUser -password oldAdminPwd set -property "marimba. the default directory is C:\Program Files\BMC Software\Bladelogic\8. if you are using the built-in default user/password). Set up the Advanced File Server for secure communication 1 Start the Advanced Repeater.tuner.) — Navigate to the Advanced Repeater Server installation directory. You can secure the link between the Advanced Repeater server and the transmitter located on the Advanced File Server. use the following command: /etc/init. (On Windows.admin" -value "newAdminUser. you can use the Tuner program to override the current user/password combination.

3 In the left pane. TIP When specifying Host name. 2 Right-click the Certificate Manager option and select Start. select Channel => Show internal channels to populate the list. complete the fields and click Next. select Root. from the Start menu.Generate the SSL certificate ■ On Windows. select SSL in the left pane. leave the entry field blank. 2 Click Request. 5 Browse to the location of the root certificate and select it. Do not enter localhost. 7 On the Root Certificates dialog. The SSL Certificate Request dialog is displayed. The root certificate is now configured on the Advanced File Server. select the root certificate you just imported and select SSL from the Trust Type group box. 4 On the Class 3 Digital ID Information panel. 6 When prompted for a password or nickname. use the actual name of the Advanced File Server host system. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 321 . 5 Specify a password. TIP If you do not see any channels listed in the Channels list. The Certificate Manager dialog is displayed. Generate the SSL certificate 1 In the Certificate Manager dialog. 4 Click Import to display the Import Certificate dialog. and click Next. click Programs => BMC Software => BladeLogic Server Automation Suite => Advanced Repeater. 3 Click Next.

secure true where ■ uniqueID is the ID you obtained in step 3. Enable SSL on Advanced File Servers and Advanced Repeaters To configure the BMC BladeLogic Advanced Repeater for secure communication. complete the following steps on the Advanced File Server. 8 Copy the certificate request and paste it into a text file. select SSL in the left pane. copy the contents of the file. 2 Select the certificate you just created.savepw true hostname property -setProperty transmitter. 322 BMC BladeLogic Server Automation Administration Guide .http. click Install.http. enter the following commands to configure the transmitter to use the certificate and only accept https traffic: runchannel transmitterURL runchannel transmitterURL runchannel transmitterURL plain:password runchannel transmitterURL hostname property -setProperty transmitter. 1 In the Certificate Manager dialog. The certificate request is generated.Enable SSL on Advanced File Servers and Advanced Repeaters 6 Click inside the text box and enter characters until the counter reaches zero. 9 Forward the file to your Certificate Authority.http.pw hostname property -setProperty transmitter. 7 Click Copy CSR to paste buffer. 11 On the SSL Certificates dialog. 12 On the Install SSL Certificate dialog. 13 Click Done to complete the SSL certificate. 10 Once you have received the signed certificate.http. The Unique ID is displayed on the Certificate Information dialog. 3 Click View.certID uniqueID hostname property -setProperty transmitter. paste the contents of the signed certificate and click Next. 4 Using the Unique ID displayed in the certificate.

d/advancedrepeater start ■ On Windows. 6 Restart the BMC BladeLogic Advanced Repeater on the Advanced File Server. select Root. 2 Right-click the Certificate Manager option and select Start. 5 Validate that the communication type is enabled. For example. Configure the Advanced Repeater server for secure communication 1 Copy the root certificate you created to the Advanced Repeater server. 3 In the left pane. The Certificate Manager dialog is displayed. 5 Browse to the location of the root certificate and select it. by entering the following string in any browser address field: https://transmitterURL/?status transmitterURL is the URL to the Transmitter Administrator of the BMC BladeLogic Advanced Repeater. start the Advanced Repeater using one of the following methods: ■ On UNIX and Linux. click Programs => BMC Software => BladeLogic Server Automation Suite => Advanced Repeater. 1 On the Advanced Repeater server. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 323 . http://localhost:5282/Marimba/Current/TransmitterAdministrator.Configure the Advanced Repeater server for secure communication ■ transmitterURL is the URL to the Transmitter Administrator of the BMC BladeLogic Advanced Repeater installed on the Advanced File Server. The browser should display the status information for the Advanced Repeater. https://localhost:5282/Marimba/Current/TransmitterAdministrator. For example. from the Start menu. 4 Click Import to display the Import Certificate dialog. use the following command: /etc/init.

see BMC Configuration Automation CMS and Tuner Guide. Configure the Advanced File Server to use secure communication You must configure the Advanced File Server to use SSL when communicating with the Advanced Repeater. For more information on using the Certificate Manager. clear the Enable SSL check box. Disabling SSL communication 1 Enter the following command to disable secure communication between the Advanced File Server and the Advanced Repeater server: runchannel transmitterURL hostName property –setProperty transmitter. 7 On the Root Certificates dialog. 3 Validate that the secure communication type has been disabled. 4 Click OK. 3 Select Enable SSL. 1 Select Configuration => Infrastructure Management. select the root certificate you just imported and select SSL from the Trust Type group box. by entering the following string in any browser address field: 324 BMC BladeLogic Server Automation Administration Guide .Configure the Advanced File Server to use secure communication 6 Click OK to bypass the Enter Password and Enter Nickname dialogs.http.secure false 2 Restart the BMC BladeLogic Server Automation Advanced Repeater. 2 Right-click the Advanced File Server and choose Properties. Do not enter a password or a nickname. NOTE To disable SSL communication.

http://localhost:5282/Marimba/Current/TransmitterAdministrator. Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 325 . The options are particularly useful in large scale environments. The options are ■ ■ Network connections Network bandwidth (Percentage of bandwidth and Maximum throughput) These options enable you to enter a maximum amount of available bandwidth that the Advanced File Server or repeater can use. as well as the number of kilobits per second that the Advanced File Server or repeater can use as throughput. ■ Configuring bandwidth throttling between Advanced File Servers and Advanced Repeater servers Location of log files Location of configuration files Starting and stopping the Advanced Repeater ■ ■ ■ Configuring bandwidth throttling between Advanced File Servers and Advanced Repeater servers Both the Advanced File Server and Advanced Repeater server include options that you can use to control the use of network resources during file staging and deployment. For example. The Network tab on the Advanced File Server or Advanced Repeater server Properties include options for controlling the number of network connections and the amount of network bandwidth. Troubleshooting advanced file servers and advanced repeaters The following topics may be useful if you are experiencing issues with advanced file servers and advanced repeaters. where data is being pushed out to a large number of servers.Troubleshooting advanced file servers and advanced repeaters http://transmitterURL:portNumber/?status transmitterURL is the URL to the Transmitter Administrator of the BMC BladeLogic Advanced Repeater. The browser displays the status information for the Advanced Repeater.

marimba\proxyroot\lo gs\ UNIX /opt/bmc/BladeLogic/8.marimba/ws3/ Proxy log files access-y<yyyy>-w<w>. These options are described in detail in the procedures for Configuring Advanced File Servers and Advanced Repeater servers and Configuring Advanced Repeater servers.marimba\BCAC\ UNIX /opt/bmc/BladeLogic/8. Location of log files Log files specific to the Advanced Repeater are listed in Table 3 on page 325. while the bandwidth setting in Advanced Repeater server is a per connection setting (for each repeater to file server link). across all parallel connections.0/AdvancedRepeater/tuner/.log Log files for Advanced Repeater Default location Tuner log files The tuner log file is located in: Windows C:\Program Files\BMC Software\BladeLogic\8.Location of log files NOTE The bandwidth setting on an Advanced File Server is different from the bandwidth setting on an Advanced Repeater server.log The proxy access log is located in: Windows C:\Program Files\BMC Software\Bladelogic\8.0/AdvancedRepeater/tuner/.marimba/proxyroot/logs/ 326 BMC BladeLogic Server Automation Administration Guide .0\AdvancedRepeater\tuner\. Table 3 Log file history-<n>. The bandwidth setting on Advanced File Server limits the total traffic leaving the transmitter.0\AdvancedRepeater\tuner\.

tuner.txt UNIX /opt/bmc/BladeLogic/8.0\AdvancedRepeater\tuner\.txt The main configuration file for the tuner is located in: Windows C:\Program Files\BMC Software\BladeLogic\8.display.marimba/proxyroot/logs/ Location of configuration files Configuration files specific to the Advanced Repeater are listed in Table 4.0\AdvancedRepeater\tuner\lib\tuner\properties.0/AdvancedRepeater/tuner/.marimba\proxyroot\lo gs\ UNIX /opt/bmc/BladeLogic/8.Location of configuration files Table 3 Log file Log files for Advanced Repeater Default location admin-y<yyyy>-w<w>. However. perform the following steps: 1 Add the following property to the properties.log The proxy admin log is located in: Windows C:\Program Files\BMC Software\Bladelogic\8.nodisplay=true 2 Restart the advanced file server.txt file (see Table 4 for location of file): marimba. Table 4 Configuration files for Advanced Repeater Default location Properties file properties.txt Configuration file Chapter 7 Configuring Advanced File Servers and Advanced Repeaters 327 .0/AdvancedRepeater/tuner/lib/tuner/properties. if you are experiencing problems on Linux or UNIX systems that are not running X-Windows. In general these configuration files should not be modified.

— From the Services dialog. use one of the following procedures: — From the Start menu.txt Starting and stopping the Advanced Repeater Use the following procedures to start and stop the BMC BladeLogic Advanced Repeater: ■ On UNIX. click Programs => BMC Software => BladeLogic Server Automation Suite => Advanced Repeater.0/AdvancedRepeater/tuner/.d/advancedrepeater {start|stop} ■ On Windows.txt UNIX /opt/bmc/BladeLogic/8.txt Configuration file prefs. start or stop the BMC BladeLogic Advanced Repeater Service.0\AdvancedRepeater\tuner\.marimba/ws3/prefs. 328 BMC BladeLogic Server Automation Administration Guide .marimba\BCAC\prefs. use the following command: /etc/init.Starting and stopping the Advanced Repeater Table 4 Configuration files for Advanced Repeater Default location Preferences file The preferences file is located in: Windows C:\Program Files\BMC Software\BladeLogic\8.

Once configured and enabled. Levels of integration The following sections provide an overview of the integration points. you can track infrastructure changes when a change is initiated by the BMC BladeLogic operator or when a remediation job is required due to the results of audit and compliance jobs. enabling you to track infrastructure change actions.Chapter 8 Integrating BMC BladeLogic and Change Management 8 You can integrate BMC BladeLogic with your Change Management processes. NOTE BMC BladeLogic supports integration with BMC Remedy ITSM Change Management. ■ The BMC Continuous Compliance for Servers solution Requirements for integration ■ Chapter 8 Integrating BMC BladeLogic and Change Management 329 . The following topics provide an overview of integrating BMC BladeLogic with the BMC Remedy ITSM change management solution. and describe the configuration tasks in BMC BladeLogic that are required to communicate with BMC Remedy ITSM. and describe how to enable that integration within BMC BladeLogic.

The integration of BMC BladeLogic with BMC Remedy ITSM is accomplished through standard application interfaces (APIs). see BMC Continuous Compliance for Server Automation Solution Getting Started Guide. For more information on the BMC Continuous Compliance for Servers solution. See “Ensuring continuous compliance for servers” on page 331. and remediation processes with IT management systems such as BMC Remedy ITSM. For complete details on installing and configuring BMC Atrium Orchestrator and setting up the BMC Remedy ITSM templates and filters. such as incident management and change management. These tasks are described in “Enabling BMC Remedy ITSM integration for job approval” on page 333. you can ■ ■ ■ facilitate the tracking of infrastructure change actions initiated by a BMC BladeLogic operator. See “Facilitating BMC BladeLogic operator-initiated change” on page 331. There are several configuration tasks you need to perform to enable the integration of BMC BladeLogic and BMC Remedy ITSM. There are also a number of installation and configuration tasks for other BMC Software tasks to enable the solution. see “Requirements for integration” on page 332.The BMC Continuous Compliance for Servers solution The BMC Continuous Compliance for Servers solution The BMC Continuous Compliance for Servers solution increases the value of BMC BladeLogic by providing an out-of-the-box integration with BMC Remedy ITSM applications. The solution reduces the risk of unauthorized and unplanned changes through enforced change tracking and automated documentation of all changes. Benefits of the integration Implementing the BMC Continuous Compliance for Servers solution enables compliance to the change process without requiring IT personnel to manually create change tickets. See “Enriching BMC Remedy ITSM incidents with server configuration information” on page 331. The BMC Continuous Compliance for Servers solution automates the integration of BMC BladeLogic monitoring. contact your BMC Software sales representative. For an overview of these tasks. ensure continuous compliance for servers. but also reduces errors commonly associated with the manual coordination of change and configuration management. This automation not only saves organizations time. enabling an automated coordination of configuration management processes with other ITIL® processes. If you implement the solution. enrich BMC Remedy ITSM incidents with server configuration information. auditing. compliance. 330 BMC BladeLogic Server Automation Administration Guide .

a change request is automatically created in BMC Remedy ITSM when a BMC BladeLogic operator submits a job that requires BMC Remedy ITSM tracking and approval. or if deviations from a master server configuration are detected. After the job has run. To automate this change tracking process. and governance ■ BMC BladeLogic integrates the remediation of discrepancies and compliance violations in BMC BladeLogic to the change management processes facilitated by BMC Remedy ITSM management system. The server auditing and server compliance capabilities in BMC BladeLogic involve: ■ detecting discrepancies between specific servers or component configurations against a baseline server or configuration monitoring and detecting compliance violations between specific servers or component configurations against specific rules related to operations.The BMC Continuous Compliance for Servers solution Facilitating BMC BladeLogic operator-initiated change When operations changes are implemented. The integration reduces the risk of unauthorized and unplanned changes through enforced change tracking. operators need to document these changes in BMC Remedy ITSM Change Management. Ensuring continuous compliance for servers This integration involves automatically creating incidents and change requests if noncompliant servers are detected. the BMC Remedy ITSM change task is closed with an associated completion status and any changed configuration items (CIs). security. The main benefit of this integration is to enforce continuous compliance to the change process without introducing labor intensive activities. Once the change is approved in BMC Remedy ITSM. the job is scheduled for execution in BMC BladeLogic. The BMC Remedy ITSM user can launch the job details report from the task to verify the change actions. These details added to the workinfo note of incident include things such as: ■ ■ ■ ■ audit trails basic server configuration information historical deployments in the past 24 hours links to BMC BladeLogic Decision Support for Server Automation reports Chapter 8 Integrating BMC BladeLogic and Change Management 331 . Enriching BMC Remedy ITSM incidents with server configuration information This integration involves automating the addition of information from various relevant sources (such as BMC Atrium Configuration Management Database (CMDB) and BMC BladeLogic servers) to the incident ticket when a server-related incident is detected in BMC Remedy ITSM.

and tasks using BMC Remedy ITSM templates.The BMC Atrium Orchestrator workflows create incidents. To implement the solution. you must have several BMC Software products installed and configured: ■ ■ ■ ■ BMC Atrium Orchestrator BMC Remedy ITSM BMC BladeLogic Server Automation BMC BladeLogic Integration for Atrium The BMC BladeLogic solution integrates the BMC Remedy ITSM and the BMC BladeLogic systems. you must complete the following configuration tasks in BMC Atrium Orchestrator and BMC Remedy ITSM: ■ Tasks for integration with BMC Remedy IT Service Management — Create the user ID which is used for monitoring the BMC Remedy alerts. see “Enabling BMC Remedy ITSM integration for job approval”. — Review default BMC Remedy templates . ■ Tasks for integration with BMC Atrium Orchestrator — Configure and deploy the required Operations Actions (OA) management modules — Configure BMC Atrium Orchestrator Run Book modules For details on installing and configuring BMC Atrium Orchestrator and setting up the BMC Remedy ITSM templates and filters. see BMC Continuous Compliance for Server Automation Solution Getting Started Guide. using BMC Atrium Orchestrator as the enabling technology. To complete the integration tasks associated with BMC BladeLogic. 332 BMC BladeLogic Server Automation Administration Guide .Requirements for integration Requirements for integration To integrate BMC BladeLogic with BMC Remedy ITSM. change tickets.

see the BMC BladeLogic Server Automation User Guide. select Configuration => Approval Configuration. By default. you can track these infrastructure changes when the change is initiated by the BMC BladeLogic operator. Chapter 8 Integrating BMC BladeLogic and Change Management 333 . Use this procedure to enable or disable the BMC Remedy ITSM job approval capability at the job type level.Enabling BMC Remedy ITSM integration for job approval Enabling BMC Remedy ITSM integration for job approval If your environment has been configured to integrate BMC BladeLogic with BMC Remedy ITSM Change Management (as described in BMC Continuous Compliance for Server Automation Solution Getting Started Guide). the approval for each supported job type is turned off. For more information about Workflow Jobs. if integration with BMC Remedy ITSM for job approval is desired. Configuring job approval for job types The Approval Configuration option enables you to configure whether or not jobs of a given type require BMC Remedy ITSM approval. To configure job approval for job types 1 From the BMC BladeLogic Console. complete the following configuration tasks in BMC BladeLogic: ■ Configuring job approval for job types Assigning job approval permissions Setting up the connection to BMC Atrium Orchestrator Enabling HTTPS support for the BMC Atrium Orchestrator connection ■ ■ ■ NOTE Two of these tasks—setting up the connection to BMC Atrium Orchestrator and (optionally) enabling HTTPS support—are necessary also for integrating with BMC Atrium Orchestrator for the creation of Workflow Jobs through the BMC BladeLogic Console. 3 Click OK. 2 On the Job Approval Required Configuration dialog. To fully enable the integration. set the Approval Required option for each available job type.

2 Right-click a role and select Open. 4 Add any of the following RBAC controls to enable specific BMC Remedy ITSM job approval permissions ■ ■ ■ ■ Automatic Manual Emergency NoApproval For example. select Roles. 3 Click the Systems tab. only the job approval type assigned for the user role is listed when running the job wizard. the BLAdmins Role has permissions to all approval permissions. Assign the appropriate approval type to each user role. When that user logs on. Assigning job approval permissions Use this procedure to assign permissions to different BMC BladeLogic users for integrating job execution with BMC Remedy ITSM. 6 Click OK to exit the Update Permissions panel.Assigning job approval permissions All job types with Yes specified for the Approval Required option will require the completion of the Approval tab information in the job wizard. NOTE By default. To assign job approval permissions 1 In the RBAC Manager workspace of the BMC BladeLogic Console. 5 Click OK to save the updates. you may create a role for junior operators that has only Manual permission. ensuring that any jobs they initiate would be reviewed and approved by a BMC Remedy ITSM prior to execution. 334 BMC BladeLogic Server Automation Administration Guide .

For any additional CDP connection (see step 4). The amount of time. The name defined for the BMC Atrium Orchestrator grid. and then click OK. Before you begin From the BMC BladeLogic Console. in seconds. To configure the connection with BMC Atrium Orchestrator 1 Select Configuration => AO Configuration. The BMC Atrium Orchestrator password for the specified user. this field is read-only.* authorizations. Other types of peers are not supported. Parameter Host Port Grid Name Description The IP address or fully-qualified host name of the BMC Atrium Orchestrator CDP server. The default is 300 seconds (five minutes). click Add. you must add the configuration information required to connect to BMC Atrium Orchestrator. User Name The name of the BMC Atrium Orchestrator user used to log on to the CDP. This user must be associated with the ADMIN role in BMC Atrium Orchestrator. as all defined connections must be on the same grid. 3 On the Add new AO configuration dialog box. enter the configuration information required to connect to BMC Atrium Orchestrator. NOTE The integration between BMC BladeLogic Server Automation and BMC Atrium Orchestrator supports connections to a single grid only.Setting up the connection to BMC Atrium Orchestrator Setting up the connection to BMC Atrium Orchestrator Through the BMC BladeLogic Console. Specify the name of a grid only if this is the first defined CDP connection.* and the AutomationPrincipal. Password Time-out Chapter 8 Integrating BMC BladeLogic and Change Management 335 . before a BMC BladeLogic job that connects to BMC Atrium Orchestrator times out. ensure that your role is granted the AOConfig. The connection with BMC Atrium Orchestrator is established through the CDP or through a high availability CDP (HACDP). The port number used to connect to the BMC Atrium Orchestrator CDP. 2 On the AO Configuration dialog box.

Enabling HTTPS support for the BMC Atrium Orchestrator connection If you want to secure the communication of data between BMC BladeLogic Server Automation and BMC Atrium Orchestrator.keystore -storepass changeit The value entered for the -dname option must match the host name where the BMC Atrium Orchestrator CDP is installed. 336 BMC BladeLogic Server Automation Administration Guide . If you want to test whether or not you can connect to the CDP with the host. click Check Connection. repeat step 2 and step 3 for every additional CDP instance of the same grid. to ensure high availability. and password details that you specified. as defined in BMC Atrium Orchestrator. SSL enabled? Whether the connection to the CDP is SSL enabled and based on an HTTPS connection (as described in “Enabling HTTPS support for the BMC Atrium Orchestrator connection”). ensure that only one of your CDPs is set as the primary instance (using the Primary AO check box). grid name. create the keystore file by entering a command such as the following example: keytool -genkey -alias w2k3-sp-vm5 -dname "cn=w2k3-sp-vm5" -keyalg RSA -keystore C:\. 4 If you want to add additional CDP connections to BMC Atrium Orchestrator. the value is w2k3-sp-vm5. In a high-availability environment with multiple CDP instances. user name.Enabling HTTPS support for the BMC Atrium Orchestrator connection Parameter Primary AO Description Whether to specify this CDP as the primary instance. To enable HTTPS support on BMC Atrium Orchestrator 1 On the system where the BMC Atrium Orchestrator CDP is installed. port. In this example. 5 Click Close on the AO Configuration dialog box. Multiple CDPs installed on a grid form a High Availability (HACDP) environment and allow communication to continue even when the connection with one CDP fails. you must enable an HTTPS connection on both products. ensure that you select the correct CDP. If you define multiple BMC Atrium Orchestrator CDP instances.

copy the C:\. To enable HTTPS support for BMC Atrium Orchestrator on BMC BladeLogic 1 If BMC Atrium Orchestrator is installed on a different machine.keystore" truststoreFile="C:\Program Files\Java\jdk1.csr -keystore C:\. export the public certificate from the keystore file which was generated for BMC Atrium Orchestrator to a temporary file by entering a command such as the following example: keytool -export -alias w2k3-sp-vm5 -file C:\cert. note the following: ■ file is the name and location of the certificate file that is going to be created from this command.0_13\jre\lib\security\cacerts" /> The keystoreFile attribute points to the location where the keystore file resides and the truststoreFile attribute points to the CA issued certs in the JDK installation location.keystore file from the BMC Atrium Orchestrator CDP system to the system where the BMC BladeLogic application server is installed. B Uncomment the following block of configuration information and add two attributes. 2 On the system where the BMC BladeLogic application server is installed.5. 3 Restart the BMC Atrium Orchestrator CDP.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="C:\. ■ ■ 3 Add the public certificate from the temporary file to the trusted certificate file by entering a command such as the following example: Chapter 8 Integrating BMC BladeLogic and Change Management 337 .keystore storepass changeit In the command shown above. keystore is the keystore file name and location that you created for BMC Atrium Orchestrator.xml file. <Connector port="8443" protocol="HTTP/1. alias is the name used to distinguish certificates.Enabling HTTPS support for the BMC Atrium Orchestrator connection 2 Enable HTTPS on Tomcat by completing the following steps: A Open the server.

4 Enter the following command to check whether the certificate was added to the cacerts file: keytool -list -keystore C:\Program Files\BMC Software\BladeLogic\version\NSH\jre\lib\security\cacerts 5 Restart the BMC BladeLogic application server. 338 BMC BladeLogic Server Automation Administration Guide . Change the path if BMC BladeLogic was installed in a different location.csr -keystore "C:\Program Files\BMC Software\BladeLogic\version\NSH\jre\lib\security\cacerts" -keypass changeit where C:\Program Files\BMC Software\BladeLogic\version is the default installation path of BMC BladeLogic.Enabling HTTPS support for the BMC Atrium Orchestrator connection keytool -import -alias w2k3-sp-vm5 -file C:\cert.

Authentication Service A service implemented within the BMC BladeLogic Application Server that is responsible for authenticating a user and issuing a session credential. Typically. or the BLCLI) uses to specify the Authentication Service from which a session credential should be obtained and the authentication mechanism that should be USED to acquire that session credential. is used to encrypt data. such as applications. which integrates BMC BladeLogic with a key distribution center (KDC) to utilize the Kerberos v5 protocol for authenticating client-tier users. files. and users. is used to decrypt the data. A Active Directory Microsoft's directory service. printers. known only to the recipient of the data. authentication profile A collection of information that a BMC BladeLogic client (BMC BladeLogic Console. AD/Kerberos authentication The Active Directory/Kerberos (AD/Kerberos) approach to authentication.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Security Glossary This chapter provides definitions of terms commonly encountered when discussing network security. but for BMC BladeLogic Decision Support for Server Automation. Network Shell. the authentication service stands alone. known to everyone. AES The Advanced Encryption Standard (AES) is an encryption algorithm that has become the encryption standard used in most commercial transactions. asymmetric encryption A method of encryption that uses public and private keys. C certificate authority (CA) Security Glossary 339 . which provides a centralized system for automating management of networked entities. and the private key. an authentication service is implemented within the BMC BladeLogic Application Server. The public key.

CAs can also issue certificates to other sub-CAs. DC=sub1. The highest trusted CA in the tree is called a root CA. certification service provider (CSP) An organization that acts as a trusted third party or a certificate authority (CA) host providing public key infrastructure (PKI) services to other organizations and individuals. distinguished name An PKCS entry that identifies a user for an LDAP server. certificate management protocol (CMP) A definition of the online interactions between end entities. Those objects are listed from bottom to top. A certificate is digitally signed by a trusted third party who has verified that the key pair actually belongs to the entity. The CA usually issues new CRLs at frequent intervals. CN=Users. a certificate can be issued based on the request. certification request A request for a certificate. a distinguished name might be CN=admin. DC=com. If allowed by the certificate policy of the CA. This leads to a tree-like certification hierarchy. For example. A certification request contains at least the public key and some identity information about the entity making the request.509 public-key certificates) to an identified end entity and vouching for the binding between the data items in a certificate. A certificate binds identity information about an entity to the entity's public key for a certain validity period. certificate revocation list (CRL) A signed list containing the serial numbers of the certificates that have been revoked or suspended by the certificate issuer (the certificate authority (CA)) before their expiration date. and the certificate authority (CA) in a public key infrastructure (PKI). Certificates can be thought of as analogous to passports that guarantee the identity of their bearers. A certificate is signed with the private key of the entity. DC=bladelogic. generated by end entities or registration authority (RA) and sent to the certificate authority (CA).A B C D E F G H I J K L M N O P Q R S T U V W X Y Z The trusted party issuing digital certificates (especially X. certificates Digital documents used for secure authentication of communicating parties. registration authority (RA). D Data Encryption Standard (DES) A common method of data encryption using a secret key that is shared by the sender and receiver. A distinguished name consists of the name of an entry as well as the names of the objects above that entry in the LDAP directory. DC=kerbtest. DN 340 BMC BladeLogic Server Automation Administration Guide . A certificate authority can be managed by an external certification service provider or the CA can belong to the same organization as the end entities in a public key infrastructure (PKI).

The primary domain controller periodically sends copies of its database to the backup domain controllers. domain controller A role assigned to a server in a network of computers running the Windows NT operating system. The protocol uses strong cryptography so a client can prove its identity to a server (and vice versa) across an insecure network connection. A user can access network resources by logging into the domain. domain. A type of keystore file used for holding certificates. Domain Authentication only requires a user to provide a name. One server on the network functions as the primary domain controller by managing a master database of users for the domain. After a client and server have used Kerberos to prove their identity. In Windows NT. Additional servers can function as backup domain controllers. The IPSec protocols are defined in RFC 2401. K keystore A file used to store a list of certificates along with their private keys. J JKS Java keystore. This information is passed to the Authentication Service. and password when logging in. I Internet Protocol Security (IPSec) A protocol suite. Domain Authentication An approach to authentication that is based on AD/Kerberos authentication. F failover A mode of operating in which a secondary component takes over the functions of a primary component when the primary component cannot function. for protecting IP traffic at the packet level. IPSec can be used for protecting the data transmitted by any service or application that is based on IP. Security Glossary 341 .A B C D E F G H I J K L M N O P Q R S T U V W X Y Z An LDAP distinguished name. domains are used to manage access to network resources. they can encrypt all of their communications to assure privacy and data integrity. which delegates user authentication to the Active Directory domain controller. The BMC BladeLogic implementation of Kerberos is based on MIT’s Kerberos v5. defined by the Internet Engineering Task Force (IETF). Kerberos A cross-platform mechanism for mutual authentication between a client and server or between two servers before a network connection is opened between the two.

R RC4 An encryption algorithm. Lightweight Directory Access Protocol (LDAP) A directory access protocol for accessing directories supporting the X. N nonce A random number used for cryptographic processes. public key cryptography A method for authenticating a sender or encrypting a message sent over a network. The protocol for querying and modifying directory entries that are arranged in a hierarchical. a public key and a private key. PKI See public key infrastructure (PKI). In public key cryptography.500 models. and decrypt communication using public key cryptography. proxy mode A method of using Network Shell to connect to a remote server via a Network Shell Proxy Server rather than connecting directly to the remote server. which requires a secure exchange of a shared key.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z L LDAP Lightweight Directory Access Protocol (LDAP). Public key infrastructure consists of a certificate authority (CA). Many companies are using LDAP-based solutions as directories and user management systems. and other mechanisms needed to authenticate. This means that each participating entity (person or device) of the public key infrastructure (PKI) has two keys. The number is used only once to ensure that any communication used for authentication cannot be reused. encrypt. the encryption and decryption of messages is done with different keys. P PKCS A group of public key cryptography standards devised and published by RSA Security. tree-like structure. 342 BMC BladeLogic Server Automation Administration Guide . public key infrastructure (PKI) A collection of mechanisms that together allow network users to exchange data securely over a network. BMC BladeLogic provides an approach to user authentication based on PKI. certificate repositories (directories).

After the session key is decrypted.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z RBAC The BMC BladeLogic system of role-based access control (RBAC). it is used for symmetric encryption of all subsequent communication during a session. meaning the same key is used to encrypt and decrypt data. The RBAC Manager workspace in the BMC BladeLogic Console lets you define roles. SRP is the default approach to user authentication in BMC BladeLogic. service URL The identity and address of a BMC BladeLogic Application Service or Network Shell Proxy Service that can be accessed using a session credential. session credential A credential issued to a BMC BladeLogic client application after a successful user login. single sign-on Security Glossary 343 . BMC BladeLogic clients use session credentials to establish secure sessions with BMC BladeLogic Application Servers and Network Shell Proxy Servers. see the BMC BladeLogic Server Automation User Guide. asymmetric encryption is used only to encrypt a session key. This output is sometimes called a digital fingerprint. S secure remote password (SRP) A protocol for integrating secure password authentication into networked applications. SHA1 is used for many security application and protocols. In this way you can define a set of permissions that might be used by an entire class of users. For more information on RBAC. SecurID RSA’s authentication protocol based on two-factor authentication. RSA SecurID See SecurID. role-based access control (RBAC) A system of granting permissions to perform certain types of actions to a role and then assigning users who need those permissions to the role. Because symmetric encryption is very fast and asymmetric encryption is very slow. SHA1 The most commonly used function in the Secure Hash Algorithm (SHA) family of cryptographic hash functions. A hash function like SHA1 takes a long string as input and produces a fixed-length string as output. including TLS. session key A key used for encrypting and decrypting traffic during a communication session. Session keys are symmetric. such as expert administrators or help desk personnel.

and integrity for stream-like connections. 344 BMC BladeLogic Server Automation Administration Guide . The ITU-T X.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z The capability for users to cache session credentials so they can be used to secure subsequent sessions between client-tier applications and the Application Server or Network Shell Proxy Server.509 A standard for defining digital certificates. the user does not have to authenticate again. As long as the session credential is valid. authentication.509 certificates and the X.509 certificate revocation list (CRL).509 recommendation defines the formats for X. T Transport Layer Security (TLS) A protocol providing confidentiality. trust store A file used to store a list of trusted certificates. X X. TLS is typically used to secure HTTP connections. TLS is the successor to the Secure Socket Layer (SSL) protocol.

237 provisioning with SHA1 fingerprints 204.conf file 188 creating blclient_krb5.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Index Symbols <appender> tag for log4crc.conf file 198 creating blclient_login. 208 scheduling cleanup of 300 secure file 253 users file 247 users.local file 247 anonymous user on Windows 17 Application Server information about 106 reporting information about 108 Application Server Administration console 44 binding to an IP address 67 canceling jobs 60 configuring Application Server 52 configuring database server 78 configuring file server 74 configuring mail server 76 configuring Network Shell Proxy Server 68 configuring Perl 77 configuring process spawner 79 configuring remote execution objects 68 configuring SNMP server 77 configuring the PXE Server 89 A access to RSCD agents 233. 235 cleanup of 293 configuring to authenticate using client-side certs 206. 191 console to Application Server 194 copying keytab file to Application Server 185 creating blappserv_krb5.conf file 196 creating user accounts 181 default users and roles 194 defined 339 exporting keytab file 181 implementing 177 locating KDC for client’s domain 197 locating KDC for service principal 186 overview 178 registering Authentication Service 180 requirements for Active Directory server 180 running kinit to get a TGT 201 sample domain structure 171 updating config.txt file 273 <layout> tag for log4crc.txt file 277 network throttling options 315 advanced repeater configuring 316 disk space recommendations 306 installing 307 network throttling options 318 overview 305 securing communication 319 using network throttling 324 AES defined 339 agent logs disabling secure logging 280 enabling secure logging 279 security overview 277 verifying integrity of 279 agents and configuration files 233. 209 exports file 240 granting access 233.conf file 186 creating blappserv_login. 237 accounts locking out 88 Active Directory defined 339 Active Directory/Kerberos 123 AD/Kerberos setting up Network Shell Proxy Servers 193 user names 192 AD/Kerberos authentication configuring Authentication Service 184.properties file for clients 200 updating Kerberos registry settings 196 verifying a keytab file 190 advanced file server configuring 312 Index 345 . 185.txt file 274 <category> tag for log4crc.

208 restarting 111 restricting size of configuration objects 83 restricting size of extended objects 83 scaling 52 securing with certificates 223 securing with client-side certs 202. 152 profiles 124. 129. 158 managing profiles with blcred 226 PKI 123 profile files 150. 111 terminating process for 111 tier 13 time-out behavior 61 types of 96 undeploying 110 understanding 30 work item threads 31 Application Service 135 configuring 140 architecture of BMC BladeLogic system 13 asymmetric encryption defined 339 asynchronous execution enabling 92 audience intended 11 authentication AD/Kerberos 123 Application Server framework 33 described 117 domain 124 for BMC Service Automation Reporting and Analytics 132 LDAP 122. 135 SRP 122 Authentication Service 135 configuring 137 configuring for AD/Kerberos 184. 70 setting connection types 65 setting database connections 64 setting login requirements 88 setting past due job behavior 63 setting retention time for automatically-generated objects 291 setting time-out behavior 61 showing no access nodes 84 specifying update group location 87 starting 45 Application Server cache scheduling cleanup of 299 Application Server Launchers editing access list for 113 Application Servers attributes for 100 attributes of 96 authentication framework 33 canceling jobs 60 changing access to 113 changing configuration of 100 cleanup of caches for 293 communication ports 65 compliance results maximum 62. 125 SecurID 123. 96 past due job behavior 63 pausing 43 profiles 93 profiles for 96. 128. 70 configuration wizard 34 configuring 29. 109. 166 single sign-on 121. 126.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z controlling user interface settings 84 crossing mount points 82 default permissions 86 deleting group 84 enabling asynchronous execution 92 enabling import/export of property classes 87 enabling import/export of Property Dictionary 87 enabling/disabling the retention policy utility 289 evaluating SOCKS Proxy Server rules 73 job distribution 55 limiting smart live browse results 85 preparing HTTP proxy server support 66 restricting size of configuration objects 83 restricting size of extended objects 83 scaling Application Server 52 setting client idle time 60 setting communication ports 65 setting compliance results maximum 62. 100 provisioning agents with SHA1 fingerprints 204. 93 creating client-side certs 203. 42. 207 creating multiple 97 database connections 33. 206 security for 133 setting up to cooperate 58 shutting down gracefully 43 starting 41. 64 deleting the deployment of 110 deployment directories for 95 deployments 94 discontinuing client-side certs 210 introduced 15 job distribution 32 job execution thread 31 managing 44 maximum client idle time 60 multiple 93. 163. 151. 109 stopping 42. 191 configuring for Domain Authentication 171 registering in Active Directory domain 180 authorization described 120 automatically-generated objects setting retention time for 291 346 BMC BladeLogic Server Automation Administration Guide .

175 configuration files exports file 240 Index 347 . 217. 218. 194 illustrated 116 Network Shell to agent 133. contacting 2 browsing limiting number of results 85 C caching user information 230 certificate authority 339 management protocol 340 revocation list 340 certificate trust store for LDAP 159 certificates defined 340 for BMC Service Automation Reporting and Analytics 132 for secure communication 258 importing to clients 226 managing with blcred 226 setting up 223. 211. 206. 210 BLCLI to Application Server 130 console to Application Server 130. 209 commands restricting access with exports file 244 communication legs Application Server to agent or repeater 133. 224 verifying with OCSP 153 certification request 340 service provider 340 chrole command 128 cleanup of agents on servers 293 of BMC BladeLogic database 288 of repeater servers 294 of the Application Server cache 293 of the file server 295 scheduling of 297 cleanupDatabase command 292 client connections maximum idle time 60 client tier 13 of BMC BladeLogic 14 clients connections to database 64 secure file 253 use of term 11 client-side certs 119 discontinuing use 210.conf file creating for consoles 198 blclient_login. 222 for Application Server 202. 221. 207 for Network Shell client 212. 70 config. 14. 219. 233–264. 206.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z B BladeLogic integration configure job approval for job types 333 blappserv_krb5. 216 for repeaters 218. 174. 115–231 security glossary 339 BMC BladeLogic Console and secure file 253 job parts 31 jobs and Application Server 31 security 130 BMC Service Automation Reporting and Analytics authentication 132 security for 132 server-side certificates 132 BMC Software. 15 configuration files 233. 221. 203.conf file 173 creating for Application Server 186 blappserv_login.properties file for clients 200 configuration for Domain Authentication 172.conf file creating for consoles 196 blcred configuring for AD/Kerberos 194 utility 125. 271 configuring Application Server 29 default permissions 16 default security configuration 16 introduced 11. 219.conf file 174 creating for Application Server 188 blasadmin utility 44 starting 45 BLCLI security 130 settings for 84 blclient_krb5. 173. 222 used by agents to authenticate 206. 202. 212 Network Shell to Network Shell Proxy Server 131 repeater to agent 134. 222 reports client to reports server 132 security for 130 communication ports setting 65 Compliance Job results setting maximum number displayed 62. 13–19 Perl support 17 security 115. 226 bltray 215 BMC Atrium Orchestrator integration 333 BMC BladeLogic architecture 13. 216. 11–12 overview 13.

166. 192 customer support 3 user names 176 domain controller defined 341 E encryption described 118 for secure communication 258 environment variables 129 exports file 240. 169. 174. 64 databases configuring 78 connecting to Application Server 15 connections to 64 default entry in secure file 256 deployments 95 deleting for an Application Server 110 of Application Servers 94 DES defined 340 distinguished names for LDAP 160 documentation conventions 12 for Network Shell 12 Domain Authentication 124 configuring 171. 247–253 configuration objects restricting size 83 configuration wizard for Application Server 34 connection types for Application Server 65 console settings for 84 conventions used in documentation 12 copying objects default permissions 86 cross-registering users in RBAC database 160.local file 247. 173. 240–247 configuring 241 examples 246 introduced 233. 247–253 users. 74 configuring advanced file servers 312 scheduling cleanup of 299 D Data Encryption Standard defined 340 database cleanup 288. 272–285 overview 233.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z log4crc. 176. 253–262 securecert file 262 setting up 233. 289 scheduling 298 utility for 292 database configuration for Application Server 36 database connections for Application Server 33.txt 272–285 logging 272. 235 options for configuring 241 restricting access to commands 244 extended objects restricting size 83 F file servers cleanup of 295 configuring 37. 175 default users and roles 177 implementing 170 G groups deleting in console 84 H high availability 159 host entries in secure file 257 HTTP proxy server 66 I impersonation 119 described 119 import and update process specifying temporary group location 87 indirect deployments and certificates 262 Infrastructure Management window Application Server information 106 installing the BMC BladeLogic Advanced Repeater 307 integration and configuration checklist 332 Internet Protocol Security defined 341 348 BMC BladeLogic Server Automation Administration Guide . 233–264. 172. 271 subnet designations 236 users file 247. 235 secure file 253.

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z introduction to BMC BladeLogic administration 11.properties file for clients 200 updating Kerberos registry settings 196 verifying a keytab file 190 keystore file for cooperating Application Servers 58 keystroke logs 281 M mail server configuring 76 man pages 12 middle tier communication 118 of BladeLogic 13 of BMC BladeLogic 15 mount points setting up in Application Server 82 N Network Shell and secure file 253 caching private keys 214 discontinuing use of client-side certs 216 Index 349 .conf file 186 creating blappserv_login. 55 past due 63 setting maximum for Application Server 52 L LDAP defined 342 user names 160 LDAP authentication 122 certificate trust store 159 configuring 161 distinguished names 160 high availability 159 implementing 158 overview 158 listening ports on Application Server 65 log4crc.conf file 198 creating blclient_login. 191 configuring blcred 194 copying keytab file to Application Server 185 creating blappserv_krb5. 11–12 IP address binding Application Server to 67 IPSec defined 341 disabling 283 enabling 283 keytab files 128 copying to Application Server 185 exporting 181 verifying 190 klist displaying SPN for Application Server 189 J job execution thread for Application Server 31 job parts for BMC BladeLogic Console jobs 31 job runs setting retention time for 290 jobs canceling 60 defining time-outs 60 distributing between Application Servers 32.txt file 272.conf file 188 creating blclient_krb5. 178 client to Application Server 194 configuring Application Server 185 configuring Authentication Service 184. 272–285 <appender> tag 274 <category> tag 273 <layout> tag 277 configuring syslog 284 default values 285 syntax 272 logging configuration file 272 configuring syslog 284 default values 285 login setting requirements 88 K KDC locating for client’s domain 197 locating for service principal’s domain 186 Kerberos defined 341 Kerberos authentication 123.conf file 196 creating user accounts 181 default users and roles 194 exporting keytab file 181 implementing 177 locating KDC for client’s domain 197 locating KDC for service principal 186 registering Authentication Service 180 requirements for Active Directory server 180 running kinit to get a TGT 201 sample domain structure 171 updating config.

219.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z documentation 12 man pages 12 managing private keys 214 securing with client-side certs 212 security 131. 208 securing with client-side certs 218. 235 R RBAC 128 cross-registering users 160. 221 security for 134 using advanced repeater servers 305 RESULTS_RETENTION_TIME property 290 retention policy utility P passwords requiring periodic changes 88 setting minimum length 88 setting through configuration wizard 38 past due jobs 63 Perl 17 configuring 77 permissions default 16 for copied objects 86 PKCS# 12 defined 342 PKI 350 BMC BladeLogic Server Automation Administration Guide . 149 Network Shell Script Jobs for Application Server cache cleanup 299 for cleanup 297 for database cleanup 298 for file server cleanup 299 for repeater server cleanup 300 for retention policy utility 297 for target server (agent) cleanup 300 network throttling for advanced file servers 315 for advanced repeater 318 overview 324 no access nodes showing in console 84 nobody user on UNIX 17 notifications setting through configuration wizard 38 defined 342 PKI authentication 123 ports Application Server 65 for remote execution objects 68 Post-Install Configuration wizard 34 database configuration 36 file server configuration 37 notification configuration 38 password configuration 38 private keys caching in UNIX 215 caching in Windows 215 managing 214 privilege mapping described 119 process spawner configuring 79 product support 3 profiles 100 property classes enabling import/export 87 Property Dictionary enabling import/export 87 protocol levels defined in secure file 255 for secure communication 258 public key cryptography defined 342 public key infrastructure defined 342 PXE Server configuring 89 O OCSP 153 overview BMC BladeLogic 13. 176. 166. 133 Network Shell Proxy Servers 68 configuring 142 configuring clients for 147 configuring stand-alone 145 setting up for AD/Kerberos 193 user information for scripts 147 Network Shell Proxy Service 135 configuring 142. 169. 13–19 of Application Server 30 of configuration files 233. 192 defined 343 RC4 defined 342 remote execution objects configuring ports 68 repeater servers cleanup of 294 scheduling cleanup of 300 repeaters and certificates 262 configuring advanced repeaters 316 discontinuing use of client-side certs 222 provisioning with SHA1 fingerprints 204.

122.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z description of 289 enabling/disabling 289 executing 291 scheduling for execution 297 retention time for automatically-generated objects 291 for job runs 290 roles selecting 128 RSA SecurID 123 RSCD agents and configuration files 233. 216 secure remote password defined 343 securecert file 262 configuring 263 SecurID user names 166. 151 described 121 Domain Authentication 124 environment variables 129 implementing 135. 140. 137. 253–262 certificates 258 client and server interaction 254 communication protocols 255 configuring 255 configuring for agents 210. 123. 222 configuring for Network Shell Proxy Servers 147 default entry 256 encryption method 258 examples 261 host entries 257 introduced 233. 169 Index 351 . 124. 235 secure agent logging 277 disabling 280 enabling 279 secure agent logs security overview 277 secure file 253. 152 session credentials 121. 125 certificate verification using OCSP 153 client file locations 152 client files 150. 237 secure file 253 users file 247 users.local file 247 rscd entry in secure file 256 SecurID authentication 123 configuring 163. 235 options for configuring 258 protocol levels 258 rscd entry 256 setting defaults for clients 256 setting defaults for servers 256 setting parameters for a client 257 setting up for NSH clients 212. 167. 142 importing CA certs to clients 226 keytab files 128 LDAP authentication 122 S scripts user information for 147 secadmin utility 258 introduced 233. 202 authentication using client-side certs 117 authorization 120 BLCLI to Application Server 130 console to Application Server 130 default configuration 16 for different communication legs 130 fundamentals 117 glossary 339 impersonation 119 Network Shell to agent 133. 235 exports file 240 granting access 233. 168 configuring RSA Authentication Manager 163 implementing 163. 211 Network Shell to Network Shell Proxy Server 131 privilege mapping 119 repeater to agent 134. 151. 166 security administering 115. 126 managing with blcred 226 session key defined 343 session layer security described 118 single sign-on 117 AD/Kerberos authentication 123 authentication profiles 124. 135 using blcred 226 self-signed certificates 119 server tier communication 119 of BladeLogic 13 of BMC BladeLogic 15 servers use of term 11 server-side certificates for BMC Service Automation Reporting and Analytics 132 service principal name displaying with klist 189 service URLs 117 session credential cache file 150. 115–231 Application Server to agent or repeater 133. 217 reports client to reports server 132 session layer 118 single sign-on 121.

509 certificates 118 U update process 352 BMC BladeLogic Server Automation Administration Guide .txt file 272 syslog configuring for logging 284 system architecture overview 13 specifying temporary group location 87 user accounts adding default for AD/Kerberos 194 adding default for Domain Authentication 177 creating in Application Server’s domain 181 locking out 88 user information for Network Shell scripts 147 generating 230 user interfaces settings for 84 user privilege mapping 17. 219. 52. 169. 247–253 configuring 249. 192 requirements for names 160. 210 Network Shell to agent 212 repeater to agent 218. 152 W wild cards using in users. 235 options for configuring 251 T target server scheduling cleanup of 300 target servers cleanup of 293 technical support 3 terminology BMC BladeLogic 11 TGT running kinit to get 201 three-tier architecture 13 ticket-gathering ticket running kinit to get 201 time-outs defining for job parts 60 defining for jobs 60 TLS communication protocol 118 middle tier communication 118 server tier communication 119 TLS with client-side certs Application Server to agent or repeater 202. 250 examples 252 introduced 233.A B C D E F G H I J K L M N O P Q R S T U V W X Y Z overrides for client SSO files 150 PKI authentication 123 SecurID authentication 123 selecting roles 128 session credentials 126 SRP authentication 122 smart card authentication 123 SNMP server configuring 77 SOCKS Proxy Servers 73 SPN displaying with klist 189 SRP defined 343 SRP authentication 122 standard terminology 11 subnet designations 236 support. 247–253 configuring 249 examples 252 introduced 233. customer 3 syntax for log4crc.local file 247.dat 128 users cross-registering 160. 176. 166. 176.local 250 Windows client configuration for Kerberos 196 Windows user mapping 149 work item threads for Application Server 31. 192 users file 247. 119 user_info. 151. 235 options for configuring 251 users. 169. 166. 222 trusted keystore 150. 61 Workflow Jobs 333 X X. 206. 221.

.

*363391* *363391* *363391* *363391* *193363* .

Sign up to vote on this title
UsefulNot useful