Skip Navigation Links
Exit Print View
| Oracle Solaris Cluster Reference Manual Oracle Solaris Cluster 4.1

Search Scope:

- This Document
- Entire Library

### claccess

- manage Oracle Solaris Cluster access policies for nodes

### Synopsis

    /usr/cluster/bin/claccess -V

    /usr/cluster/bin/claccess [subcommand] -?

    /usr/cluster/bin/claccess subcommand [options] -v [hostname[,…]]

    /usr/cluster/bin/claccess allow  -h hostname[,…]

    /usr/cluster/bin/claccess allow-all

    /usr/cluster/bin/claccess deny  -h hostname[,…]

    /usr/cluster/bin/claccess deny-all

    /usr/cluster/bin/claccess list

    /usr/cluster/bin/claccess set  -p protocol=authprotocol

    /usr/cluster/bin/claccess show

## Description

The `claccess` command controls the network access policies for machines that attempt to access the cluster configuration. The `claccess` command has no short form.

The cluster maintains a list of machines that can access the cluster configuration. The cluster also stores the name of the authentication protocol that is used for these nodes to access the cluster configuration.

When a machine attempts to access the cluster configuration, for example when it asks to be added to the cluster configuration (see `clnode`(1CL)), the cluster checks this list to determine whether the node has access permission. If the node has permission, the node is authenticated and allowed access to the cluster configuration.

You can use the `claccess` command for the following tasks:

- To allow any new machines to add themselves to the cluster configuration and remove themselves from the cluster configuration

- To prevent any nodes from adding themselves to the cluster configuration and removing themselves from the cluster configuration

- To control the authentication type to check

You can use this command only in the global zone.

The general form of the `claccess` command is as follows:

`claccess` [subcommand] [options]

You can omit subcommand only if options specifies the `-?` option or the `-V` option.

Each option of this command has a long form and a short form. Both forms of each option are provided with the description of the option in the “OPTIONS” section of this man page.

## SUBCOMMANDS

The following subcommands are supported:

`allow`

  Allows the specified machine or machines to access the cluster configuration.

  Users other than superuser require `solaris.cluster.modify` role-based access control (RBAC) authorization to use this subcommand. See `rbac`(5).

  See also the description of the `deny` and the `allow-all` subcommands.

`allow-all`

  Allows all machines to add themselves to access the cluster configuration.

  Users other than superuser require `solaris.cluster.modify` RBAC authorization to use this subcommand. See `rbac`(5).

  See also the description of the `deny-all` and the `allow` subcommands.

`deny`

  Prevents the specified machine or machines from accessing the cluster configuration.

  Users other than superuser require `solaris.cluster.modify` RBAC authorization to use this subcommand. See `rbac`(5).

  See also the description of the `allow` and the `deny-all` subcommands.

`deny-all`

  Prevents all machines from accessing the cluster configuration.

  No access for any node is the default setting after the cluster is configured the first time.

  Users other than superuser require `solaris.cluster.modify` RBAC authorization to use this subcommand. See `rbac`(5).

  See also the description of the `allow-all` and the `deny` subcommands.

`list`

  Displays the names of the machines that have authorization to access the cluster configuration. To see the authentication protocol as well, use the `show` subcommand.

  Users other than superuser require `solaris.cluster.read` RBAC authorization to use this subcommand. See `rbac`(5).

`set`

  Sets the authentication protocol to the value that you specify with the `-p` option. By default, the system uses `sys` as the authentication protocol. See the `-p` option in “OPTIONS”.

  Users other than superuser require `solaris.cluster.modify` RBAC authorization to use this subcommand. See `rbac`(5).

`show`

  Displays the names of the machines that have permission to access the cluster configuration. Also displays the authentication protocol.

  Users other than superuser require `solaris.cluster.read` RBAC authorization to use this subcommand. See `rbac`(5).

## Options

The following options are supported:

`-?`
-`-help`

  Displays help information. When you use this option, no other processing is performed.

  You can specify this option without a subcommand or with a subcommand. If you specify this option without a subcommand, the list of subcommands of this command is displayed. If you specify this option with a subcommand, the usage options for the subcommand are displayed.

`-h` hostname
-`-host`=hostname
-`-host` hostname

  Specifies the name of the node being granted or denied access.

`-p` protocol=authentication-protocol
-`-authprotocol=`authentication-protocol
-`-authprotocol` authentication-protocol

  Specifies the authentication protocol that is used to check whether a machine has access to the cluster configuration.

  Supported protocols are `des` and `sys` (or `unix`). The default authentication type is `sys`, which provides the least amount of secure authentication. For more information on adding and removing nodes, see Chapter 8, Adding and Removing a Node, in Oracle Solaris Cluster System Administration Guide. For more information on these authentication types, see Chapter 18, Network Services Authentication (Tasks), in Oracle Solaris 11.1 Administration: Security Services.

`-V`
-`-version`

  Displays the version of the command.

  Do not specify this option with subcommands, operands, or other options. The subcommands, operands, or other options are ignored. The `-V` option displays only the version of the command. No other processing is performed.

`-v`
-`-verbose`

  Displays verbose information to standard output (`stdout`).

## Exit Status

If the command is successful for all specified operands, it returns zero (`CL_NOERR`). If an error occurs for an operand, the command processes the next operand in the operand list. The returned exit code always reflects the error that occurred first.

The following exit codes can be returned:

`0` `CL_NOERR`

  No error

  The command that you issued completed successfully.

`1` `CL_ENOMEM`

  Not enough swap space

  A cluster node ran out of swap memory or ran out of other operating system resources.

`3` `CL_EINVAL`

  Invalid argument

  You typed the command incorrectly, or the syntax of the cluster configuration information that you supplied with the `-i` option was incorrect.

`6` `CL_EACCESS`

  Permission denied

  The object that you specified is inaccessible. You might need superuser or RBAC access to issue the command. See the `su`(1M) and `rbac`(5) man pages for more information.

`18` `CL_EINTERNAL`

  Internal error was encountered

  An internal error indicates a software defect or other defect.

`39` `CL_EEXIST`

  Object exists

  The device, device group, cluster interconnect component, node, cluster, resource, resource type, resource group, or private string that you specified already exists.

## Examples

Example 1 Allow a New Host Access

The following `claccess` command allows a new host to access the cluster configuration.

    # claccess allow -h phys-schost-1

Example 2 Set the Authentication Type

The following `claccess` command sets the current authentication type to `des`.

    # claccess set -p protocol=des

Example 3 Deny Access to All Hosts

The following `claccess` command denies all hosts access to the cluster configuration.

    # claccess deny-all

## Attributes

See `attributes`(5) for descriptions of the following attributes:

ATTRIBUTE TYPE | ATTRIBUTE VALUE
--- | ---
Availability | ha-cluster/system/core
Interface Stability | Evolving

## See Also

`Intro`(1CL), `clnode`(1CL), `cluster`(1CL)

## Notes

The superuser user can run all forms of this command.

Any user can run this command with the following subcommands and options:

- `-?` option

- `-V` option

To run this command with other subcommands, users other than superuser require RBAC authorizations. See the following table.

Subcommand | RBAC Authorization
--- | ---
`allow` | `solaris.cluster.modify`
`allow-all` | `solaris.cluster.modify`
`deny` | `solaris.cluster.modify`
`deny-all` | `solaris.cluster.modify`
`list` | `solaris.cluster.read`
`set` | `solaris.cluster.modify`
`show` | `solaris.cluster.read`

Copyright © 2000, 2012, Oracle and/or its affiliates. All rights reserved. Legal Notices |