Sudo privileges for the SAP HANA environment users
Each environment must have an environment (or operating system) user account. The Delphix Continuous Data Engine uses this environment user to communicate with other staging and target environments. You must grant this environment user the following two key privileges:
Disable `requiretty` The Delphix Continuous Data Engine requires the `requiretty` setting to be disabled. This allows the environment user to run sudo commands without a logged-in terminal session (tty).
Add `NOPASSWD` By including the `NOPASSWD` qualifier, you ensure that the "sudo" command does not prompt for a password when executing certain commands such as mount, umount, mkdir, and rmdir.
In the example configurations, the environment username hdbadm is used. Make sure to modify the username based on the environment user available in the environment for performing the linking and provisioning operations.
Procedure
Perform the following steps on both the staging and target environments.
The sudo configuration is located in the /etc/sudoers file. Run the following commands to open the `sudoers’ file:
CODEvi /etc/sudoers
Note: Third-party tools like `visudo`, can help minimize syntax errors.
Next, update the file with the following snippet to grant the two required privileges to the `hdbadm` user:
CODEDefaults:hdbadm !requiretty hdbadm ALL=NOPASSWD: /sbin/mount, /sbin/umount, /bin/mkdir, /bin/rmdir
Additional examples
The examples below demonstrate how a user’s privileges can be further refined. Note that these examples are for illustrative purposes only and are subject to change.
Example: Restrict sudo privileges
This example restricts sudo privileges to the /hana
directory.
Example: /etc/sudoers File Configuration on the Target Environment for sudo Privileges on the VDB Mount Directory Only (Linux OS)
Defaults:delphix_os !requiretty
delphix_os ALL=(root) NOPASSWD: \
/bin/mount * /hana/*, \
/bin/umount * /hana/*, \
/bin/umount /hana/*, \
/bin/mkdir -p /hana/*, \
/bin/mkdir -p -m 755 /hana/*, \ /
bin/mkdir /hana/*, \
/bin/rmdir /hana/*
Note: The wildcards are allowed for the options with mount
and umount
commands because those commands expect a fixed number of arguments after the options. The option wildcard on the mount command also enables you to specify the file system being mounted from the Delphix Continuous Data Engine. However, wildcards are not allowed with mkdir
and rmkdir
because they can have any number of arguments after the options. For those commands, you must specify the exact options (p, -p -m 755) used by the Delphix Continuous Data Engine.
Example: Stronger user security
This example restricts the delphix_os user's use of sudo privileges to the directory /hana
, restricts the mount commands to a specific Delphix Continuous Data Engine hostname and IP, and does not allow user-specified options for the umount
command.
Defaults:delphix_os !requiretty
delphix_os ALL=(root) NOPASSWD: \
/bin/mount <delphix-server-name>* /hana/*, \
/bin/mount * <delphix-server-name>* /hana/*, \
/bin/mount <delphix-server-ip>* /hana/*, \
/bin/mount * <delphix-server-ip>* /hana/*, \
/bin/mount "", \
/bin/umount /hana/*, \
/bin/umount * /hana/*, \
/bin/mkdir [*] /hana/*, \
/bin/mkdir /hana/*, \
/bin/mkdir -p /hana/*, \
/bin/mkdir -p -m 755 /hana/*, \
/bin/rmdir /hana/*
This configuration is more secure, but there is a tradeoff with deployment simplicity. This approach would require a different sudo configuration for targets configured for different Delphix Continuous Data Engines.
Example Configuring the /etc/sudoers File on the Target Environment for Privileges on the VDB Mount Directory Only, and Allows Mounting Only from a Single Server (Linux OS).
Note: Non-database users, low-privileged users, and users for which privileges need to be elevated are not supported for performing SAP HANA operations.