This topic provides sample sudo file privilege configurations for using the Delphix Engine with various operating systems and the Oracle RDBMS.
Configuring sudo Access on Linux for DB2 Source and Target Environments
mount, umount, mkdir, and rmdir is required.
Example: Linux /etc/sudoers file for a Delphix Target for DB2
Defaults:delphix_os !requiretty delphix_os ALL=NOPASSWD: \ /bin/mount, /bin/umount, /bin/mkdir, /bin/rmdir
Examples of Limiting sudo Access for the Delphix OS User
sudoers file to provide these privileges only on specific mount points or from specific Delphix Engines, as shown in these two examples.
The Delphix Engines tests its ability to run the mount command using sudo on the target environment by issuing the sudo mount command with no arguments. Many of the examples shown in this topic do not allow that. This causes a warning during environment discovery and monitoring, but otherwise does not cause a problem. If your VDB operations succeed, it is safe to Ignore this warning.
However, some users configure the security on the target environments to monitor sudo failures and lock out the offending account after some threshold. In those situations, the failure of the sudo commands might cause the delphix_os account to become locked. One work-around for this situation is to increase the threshold for locking out the user account. Another option is to modify /etc/sudoers to permit the delphix_os user to run mkdir, rmdir, umount and mount command without parameters.
Example 1
This example restricts the delphix_os user's use of sudo privileges to the directory /db2.
Note that wildcards are allowed for the options on mount and umount because those commands expect a fixed number of arguments after the options. The option wildcard on the mount command also makes it possible to specify the file-system being mounted from the Delphix Engine.
However, wildcards are not acceptable on mkdir and rmdir because they can have any number of arguments after the options. For those commands, you must specify the exact options (-p, -p -m 755) used by the Delphix Engine.
Delphix requires umount -lf for emergency force unmounts on Linux. For other Unix OSes, Delphix requires umount -f.
Example /etc/sudoers File Configuration on the Target Environment for sudo Privileges on the VDB Mount Directory Only (Linux OS)
Defaults:delphix_os !requiretty delphix_os ALL=(root) NOPASSWD: \ /bin/mount * /db2/*, \ /bin/umount * /db2/*, \ /bin/umount /db2/*, \ /bin/umount -lf /db2/*, \ /bin/mkdir -p /db2/*, \ /bin/mkdir -p -m 755 /db2/*, \ /bin/mkdir /db2/*, \ /bin/rmdir /db2/*
Example 2
This example restricts the delphix_os user's use of sudo privileges to the directory /db2, restricts the mount commands to a specific Delphix Engine hostname and IP, and does not allow user-specified options for the umount command.
Delphix requires umount -lf for emergency force unmounts on Linux. For other Unix OSes, Delphix requires umount -f.
This configuration is more secure, but there is a tradeoff with deployment simplicity. This approach would require a different sudo configuration for targets configured for different Delphix Engines.
A Second Example of Configuring the /etc/sudoers File on the Target Environment for Privileges on the VDB Mount Directory Only, and Allows Mounting Only from a Single Server (Linux OS)
Defaults:delphix_os !requiretty delphix_os ALL=(root) NOPASSWD: \ /bin/mount <delphix-server-name>* /db2/*, \ /bin/mount * <delphix-server-name>* /db2/*, \ /bin/mount <delphix-server-ip>* /db2/*, \ /bin/mount * <delphix-server-ip>* /db2/*, \ /bin/mount "", \ /bin/umount /db2/*, \ /bin/umount * /db2/*, \ /bin/umount -lf /db2/*, \ /bin/mkdir [*] /db2/*, \ /bin/mkdir /db2/*, \ /bin/mkdir -p /db2/*, \ /bin/mkdir -p -m 755 /db2/*, \ /bin/rmdir /db2/*
Related Links