Installing the Agent for UNIX

This document guides you through the new installationnull of a UNIX agent.

Each supported UNIX variant has a three-character code which is part of the the agent's file name. In this document the specific code is replaced by "???."

64-bit UNIX platforms: Automic recommends using a 64-bit agent in order to start 64-bit programs and applications. Problems may occur when you use a 32-bit agent for this purpose.

The following guide describes how to install an agent in an AE system in which authentication is not used. Additional installation steps are required before the agent can be started and used if you intend to use one of the available authentication methods. More detailed information is provided in the document Advanced Security.

Automic strongly recommends installing the agent in a separate directory.

Automic recommends running the UNIX agent with root rights. Without root rights, the agent cannot switch to the context of another user and jobs and file transfers must always run under the user under which the agent has started.
You can define the relevant rights for the agent by starting it under the real "root" user. Another method is to set the sbit for the agent and to define "root" as the owner. The effect is that every user of the group that is assigned to the agent can start it. 

Requirements

• User ID AE has been created.
• The following authorizations are required for the directories "out" and "temp":
  
  For owner: right to read and execute
  For group: right to execute
  For world: right to execute

  Note that authorizations must not be changed while the agent is running.

  When a login is specified in the script element PREP_PROCESS, the event file is created in the HOME directory of the user for security reasons. If no login is specified, the system assumes that the succeeding event job runs with agent rights. Therefore, PREP_PROCESS creates the file name with the temp path of the agent.
  At the time when PREP_PROCESS is being processed, the system does not know whether the job will use a login or not. From a technical perspective, this cannot currently be determined, because the event job could also specify the login dynamically (with a PUT_ATT script statement). There are two possible solutions:

  1. Specify a login in PREP_PROCESS (recommended by Automic and secure solution).
  2. Assign read and write access to the temp directory of the agent to the user who is defined in the Event job.

  Authorizations for jobreport files are specified using the INI-file parameter ReportMode=.

• Automic recommends adding the directory "$HOME/bin" to the system environment variable PATH.

  See step 1: Unloading the TAR files and setting up the system environment.

  Read the note referring to processes on AIX.

  Note that on AIX, the size for Core files must be extended.

The CallAPI implementation is described in a separate document.

Procedure

• HostRechner, Zielsystem.
• Jobs can either be started with the function fork, or the batch command. Set the agent's INI file parameter start_type= to the corresponding value. Depending on this setting, the following rules apply for the agent:
• "fork" - Jobs can start under any user ID if the agent has been started under a user ID with root rights. If no root right has been assigned, jobs must run under the user ID under which the agent has been started.
• "batch" - The agent must start under a User ID with root rights.

• Host
• Register with user ID AE.
• Transfer the TAR file ucxj???.tar.gz via FTP.
• Unpack the TAR files.
  gzip -d ucxj???.tar.gz or gunzip ucxj???.tar.gz
  tar -xvf ucxj???.tar
  (Linux: tar -zxvf ucs???.tar.gz)
  
  The unpacked files are displayed. The TAR file can be deleted after unpacking.

Note any TAR messages and verify that all files are unpacked correctly.

• Ensure that all files have the correct owner and group entry. AE must be the owner. The group must correspond with the code "AE". Only a privileged user, such as root, can make these modifications.
  chown AE * changes the owners of all files to AE.
  chgrp Group_name * changes the user groups of all files.
• Customize the INI file using an editor such as vi. You can also edit and transfer the INI file on the Admin computer via FTP. The program ucxj??? and the INI file must be in the same directory.

• For actual operation, the program ucxj??? can be given the permissions of a privileged user such as root.
• Change owner to root

  chown root ucxj???

• Set S-Bit (Set-Userid)

  chmod 4755 ucxj???

• Admin computer or Server computer
• Adjust the HEADER.UNIX, TRAILER.UNIX and RESTART.UNIX if necessary. See: Job - Execution

• Host

• Authentication via (Pluggable Authentication Modules) is now supported for the agents of the following UNIX platforms: Solaris, Linux and AIX.

1. PAM library installation
   The PAM library must be installed on your system (depends on the platform you use).
2. PAM library configuration
   The configuration process depends on the UNIX platform that you use. Typically, you will handle it by using the files /etc/pam.d or /etc/pam.conf
   The name of the service complies with the name of the executable agent file (ucxj???).
3. Configuring the agent
   In the INI file of the UNIX agent, set the parameter authentication= ([MISC] section) to "pam". In the parameter libname= ([PAM] section), you must specify the path and the file name of the PAM library:
   
   [MISC]
   authentication=pam
   
   [PAM]
   libname=/usr/lib/libpam32.o

• Server computer
• The AE System must be running.
• Host
•  If you start the agent for testing in the dialog, note the following:

  Quitting with the DEL key is only possible as of version 1.20 and when the corresponding parameter in the INI file has been set. Automic recommends that you do not set this parameter, but quit from another terminal using the kill -TERM instead.

• Start the agent in the background from the directory $HOME/bin.

  Enter the following if the directory $HOME/bin has been set in the system environment PATH:
  nohup ucxj??? 1> ucxj???.log 2>&1 &
  Enter the following if the directory $HOME/bin has not been set in the system environment PATH:
  nohup ./ucxj??? 1> ucxj???.log 2>&1 &
  Note displayed process ID pid.
  Information about this process with ps -ppid. Not always available.
  Information about all UCX processes with ps -ef | grep ucx.
  Information about all processes with ps -e.
  

• An Agent object is automatically created in system client 0000 and stored in the folder HOST.

The backup directory for the filebased rollback is automatically created when you start the agent. This directory is available for jobs and file transfers. You can define the path for the backup directory in the agent variable UC_EX_PATH_BACKUP. Note that for using the filebased rollback, you need the OS user under which the related jobs and file transfers are started, and write access to the backup directory.

• Admin computer or Server computer
• Verify whether the agent is logged on.  
  • Start the UserInterfaceVeralteter Begriff. Ersetzt durch: Automic Web Interface for client 0000. Information about agents is available in the System Overview. Because a newly logged-on agent has not yet been assigned a client, it can only be viewed in the client 0000. The new agent can now be assigned to clients with the required rights via the Agent object.

Use the ServiceManager to start or end agents.

• Host
• Ending the agent normally:

  kill-TERM pid

• Canceling agent in emergency cases. Network connections are not properly closed.

  kill -KILL pid or
  kill -9 pid