How to use dlpx_db_exec privilege elevation script

The following section describes how the Db2 Plugin works with a Kerberos environment. Customers use principal (A user in Kerberos is called a principal ) to connect with DE. All operations where Plugin needs to execute commands using database users, in that case, privilege elevation script will be used.

The following example shows how the Db2 Plugin works in the Kerberos enabled environment for a customer:

1. All SSH connections to remote hosts use a single environment user that is principal in the case of a Kerberos environment.

2. All Db2 commands which need to be executed using a particular OS user (in the case of DB2 it’ll be an instance user) will pass through a privilege elevation script. Commands requiring privilege elevation will be executed under a script dlpx_db_exec, with the first parameter being the user to execute as, and the remaining parameters being the command to execute. This script may be customized by the customer, but it must always return the results of the executed command and exit with the return code from the executed command.

3. When a command is invoked with dlpx_db_exec then we’ll pass the instance IDs which was discovered during the discovery phase.

Implementation

1. The customer will specify the same primary environment user for the execution of all Delphix object requests.

2. All SSH connections will then be made with this user.

3. A new utility dlpx_db_exec has been added to the Plugin.

   1. The first param to this command will be the db2 instance user to execute the remaining args.

   2. This script will be customizable by the customer to use their internal utility or command to essentially sudo to the requested instance user.

4. The Db2 Plugin is updated to pass the instance ID string to the dlpx_db_exec script such that the customer can update this to use sudo (or some other custom elevation utility).

5. The Db2 Plugin scripts are updated to prefix all commands required to be executed as the instance ID with dlpx_db_exec.

6. All Db2 changes are based on top of the Db2 DB level changes.

Sample content of dlpx_db_exec script

#

# This script allows customization of command execution with an alternate user

# account.

# Arg $1 contains "-u<optional user account>" for the desired user under

# which database commands will be executed.

# By default this argument is ignored and the script is executed as the default

# account.

#


if [[ $1 != -u* ]]; then

   echo "Incorrect command line parameters, -u<optional user account> is required as the first parameter"

   exit 1

fi

user_id=`echo $1 | sed -e "s/^-u//"`

echo "$user_id" >> /tmp/test.log

shift 1

echo "$user_id and $DB2_DB_NAME" >> /tmp/test.log

if [[ $user_id != "delphix_os" ]]; then

command=$(printf "%s " "$@")

sudo su - $user_id -c "cd /home/delphix_os;export DB2DBDFT=$DB2DBDFT;$command"

else

$@

fi