ctsvhbar Command

The HBA security mechanism might use either a host name or a network address value as part of the identification information within a credential, depending on the method chosen by the application. If the local system is to service requests from remote systems, at least one network address and host name for that remote system must appear in the trusted host list on the local system. To verify that the remote system can successfully authenticate the local system, system administrators use a combination of RSCT cluster security commands:

1. On both the local and remote system, issue the ctsvhbac command to verify that each system has a valid HBA security mechanism configuration.
2. On the local system, issue the ctsvhbal command to determine the values that the HBA security mechanism will use to identify this host to a remote system.
3. On the remote system, issue the ctsvhbar command, specifying the local system host name or IP address, to determine the value that the remote system will use to verify HBA credentials transmitted from the local system.
4. Compare the ctsvhbal and ctsvhbar command output to determine whether the two systems are using the same scheme for host-name resolution. If an exact host-name match does not appear in the output, repair the host-name resolution scheme, and repeat the steps above until both commands yield an exact match.

Completing these steps verifies successful authentication in one direction; in other words, the procedure verifies only that the remote system can authenticate requests from the local system. Because RSCT subsystems often use mutual authentication, system administrators also should verify that the local system can successfully authenticate the remote system. To complete the verification, the following additional steps are required:

• On the remote system, issue the ctsvhbal command to determine the values that the HBA security mechanism will use to identify that host to the local system.
• On the local system, issue the ctsvhbar command, specifying the remote system host name or IP address, to determine the value that the local system will use to verify HBA credentials transmitted from the remote system.
• Compare the ctsvhbal and ctsvhbar command output to determine whether the two systems are using the same scheme for host-name resolution. If an exact host-name match does not appear in the output, repair the host-name resolution scheme, and repeat the steps above until both commands yield an exact match.

Completing these additional steps verifies successful authentication when traffic flows in the opposite direction, from the remote system to the local system.

-b

Produces brief output. When this option is used, the command displays the host identities provided by the command user, the fully qualified host identities obtained for them, and any errors. If the -l option is specified, this option is ignored.

-d

Displays the list of probes required for successful execution of this command.

-e

Specifies a list of error messages that are not to be displayed by this command during its execution. One or more message numbers may be specified. Message numbers must be in the xxxx-yyy format. Multiple messages are to be separated by commas (,) with no white space characters.

-h

Displays a help message for this command.

-l

Allows the Cluster System Management (CSM) Probe Infrastructure to set the detail level of the output. Accepted levels are:

1

Verbose mode. Displays the command purpose summary and status information for all tests.

2

Displays the command purpose summary and any attention or error conditions detected in any tests.

3

Displays any attention or error conditions detected in any tests.

4

Silent mode. Displays errors detected during the tests.

-m

Displays a detailed description of the command and its purpose.

-s

Displays a summary of the purpose for the command.

hostname

The host name of a remote system.

address

The network address of a remote system.

Exit status conforms to the CSM Probe Infrastructure conventions.

0

No problems detected. Any messages displayed are informational. No administration intervention is required.

10

No problems were detected. The command was unable to resolve the host name or IP address provided by the command user. The command user should verify that the correct host name or IP address was used. If the correct name or address was used, the system administrator should verify that the host-name resolution scheme used by the local system permits that name or address to be resolved.

127

Unexpected failure in this command.

To return the host name that the HBA security mechanism would use on the local node to verify credentials from the host identified by the host name zathras, you would enter:

ctsvhbar zathras

The output would look like this:

Host name or network address: zathras
Fully qualified host name
     used for authentication: zathras.ibm.com

To return the host name that the HBA security mechanism would use on the local node to verify credentials from the host identified by the network address 9.127.100.101, you would enter:

ctsvhbar 9.127.100.101

The output would look like this:

Host name or network address: 9.127.100.101
Fully qualified host name
     used for authentication: epsilon3.pok.ibm.com

To return the host name that the HBA security mechanism would use on the local node to verify credentials from both the host identified by the host name zathras, and the host identified by the network address 9.127.100.101, you would enter:

ctsvhbar zathras 9.127.100.101

The output would look like this:

Host name or network address: zathras
Fully qualified host name
     used for authentication: zathras.ibm.com
Host name or network address: 9.127.100.101
Fully qualified host name
     used for authentication: epsilon3.ibm.com