Running MSDP commands with the non-root user
If MSDP command is running with the root user, it automatically switches to the service user. If a non-root user wants to run MSDP command, he can use the wrapper command msdpcmdrun to run MSDP commands. The tool msdpcmdrun is supported on NetBackup BYO, media server on Flex Appliance, and NetBackup Appliance.
If nbcmdrun is configured and enabled, you can use msdpcmdrun as follows:
/usr/openv/netbackup/bin/nbcmdrun msdpcmdrun <msdp commands>
For example,
$ /usr/openv/netbackup/bin/nbcmdrun msdpcmdrun crstats
For more information about nbcmdrun, see Running NetBackup commands using the nbcmdrun wrapper command topic of the NetBackup Security and Encryption Guide.
nbcmdrun does not support to pass environment variable and user inputs to the MSDP commands. Alternately, you can also run msdpcmdrun, as follows:
sudo -E /usr/openv/pdde/pdcr/bin/msdpcmdrun <msdp commands>
It requires configuration of sudoers for the msdpcmdrun and allow only one command msdpcmdrun. Administrator creates and edits /etc/sudoers.d/custom file, and configures it.
For example, the following configuration helps give the 'test' user the permission to run msdpcmdrun with root user privileges.
test ALL=NOPASSWD:SETENV: /usr/openv/pdde/pdcr/bin/msdpcmdrun
The examples of sudo and msdpcmdrun:
Run the following command to get MSDP LSU data statistics.
$ sudo /usr/openv/pdde/pdcr/bin/msdpcmdrun crstats
Run the following command to list all the users.
$ sudo /usr/openv/pdde/pdcr/bin/msdpcmdrun spauser -l
Run the following command to list immutable cloud volumes and configurations.
$ export MSDPC_ACCESS_KEY=AccessKeyID $ export MSDPC_SECRET_KEY=SecretAccessKey $ export MSDPC_REGION=us-east-1 $ export MSDPC_PROVIDER=amazon $ sudo -E /usr/openv/pdde/pdcr/bin/msdpcmdrun msdpcldutil list
Run msdpcmdrun -l command to list the MSDP commands that are supported by msdpcmdrun.
When MSDP command runs as service user, if the option requires a file path, the file path should be accessible to the service user. For example, msdpcldutil list --credfile /tmp/env.txt. The file /tmp/env.txt should be readable for MSDP service user because msdpcldutil runs as a service user.
You can find MSDP service user according to MSDP_SERVICE_USER configuration in /etc/pdregistry.cfg file.
On the NetBackup Appliance, log in to the NetBackup Appliance shell menu with the NetBackup CLI user. Then you can run MSDP commands in the shell.
For example, nbcliuser-!> msdpcmdrun catdbutil --count
For the usage of NetBackup CLI, see About the NetBackupCLI user role topic of the Veritas NetBackup Appliance Security Guide.