HMC

How to change the HMC password (of user hscroot) You can ssh as user hscroot to the HMC, and change the password this way: hscroot@hmc> chhmcusr -u hscroot -t passwd Enter the new password: Retype the new password: Installing Linux websm client from HMC version 3.3.6 How do you install the Linux Web Based System Manager (websm) client from an HMC version 3.3.6, if your only access to the system is through ssh? The following procedure can be used: First, get the Linux websm software of the HMC to the Linux system: # ssh -l hscroot hmc ls -als /usr/websm/pc_client/* # cd /tmp # scp hscroot@labhmc1:/usr/websm/pc_client/*linux* . Install the java2 runtime environment: # rpm -ihv *rpm Install websm: # ./wsmlinuxclient.exe -silent Install some additional software required: # yum install libXp compat-libstdc* Run websm: # /opt/websm/bin/wsm Upgrading an HMC remotely If you have issues getting to the computer room easily, and you have to update an HMC on the raised floor, then you can also do that upgrade remotely. IBM describes two methods on their website: by using the update media and using the recoverable media. Using the update media method, you may end up with a corrupted HMC. The only way to solve this, us accessing the HMC in the computer room (*sigh*).

Therefore, use the recoverable media option. That one works better. A link to the documentation and software can be found here. Useful HMC commands lshmc -v Shows vital product data, such as the serial number. lshmc -V Shows the release of the HMC. lshmc -n Shows network information of the HMC. hmcshutdown -r -t now Reboot the HMC. lssysconn -r all Show the connected managed systems. chhmcusr -u hscpe -t passwd -v abc1234 Change the password of user hscpe. lshmcusr List the users of the HMC. ls -al /var/hsc/log/hmclogger.log ls -al /var/hsc/log/cimserver.log Intersting log files of the HMC. monhmc -r disk Look at the filesystems of the HMC. Try using "proc", "mem" and "swap as well. vtmenu Open a virtual console from the HMC. Exit by typing "~." (tilde dot) or "~~." (tilde tilde dot). rmvterm -m SYSTEM-9117-570-SN10XXXXX -p name Forces the closure of a virtual terminal session. chsysstate -m SYSTEM-9131-52A-SN10XXXXX -r lpar -o on -n name -f default_profile chsysstate -m SYSTEM-9131-52A-SN10XXXXX -r lpar -o shutdown -n name --immed Change the state of a partition.

lssyscfg -r prof -m SYSTEM-9117-570-SN10XXXXX List partition profiles for a managed system. lspartition Used for listing partition information. Stopping and starting a LPAR from the HMC prompt It is possible to stop and start an LPAR from the HMC prompt: # lssycfg -r lpar This command will list all partitions known to this HMC. # chsysstate -o osshutdown -r lpar -n [partition name] This command will send a shutdown OS command to the lpar. # chsysstate -o on -r lpar -n [partition name] This command will activate the partition. # lsrefcode -r lpar -F lpar_name,refcode This command will show the LED code. Inaccessible vterm on HMC? It may happen that a virtual terminal (vterm) from an HMC GUI only showes a black screen, even though the Lpar is running perfectly. Here's a solution to this problem:

Login to the HMC using ssh as hscroot. Run lssscfg -R sys to determine the machine name of your lpar on the HMC. Run mkvterm -m [machine-name] -p [partition-name]. You can end this session by typing "~." or "~~." (don't overlook the "dot" here!). Now go back to your HMC gui via WebBased System Manager and start-up a new vterm. It works again!

Opening a virtual terminal window on HMC version 3.3.6 You may run into an issue with opening a virtual terminal window on an OLD HMC version (version 3.3.6). You can access the HMC through ssh, but opening a terminal window doesn't work. This ocurs when the HMC is in use for a full system partition on a frame:

At the fist attempt to login through ssh to the HMC and running vtmenu: # ssh -l hscroot hmc hscroot@hmc's password: hscroot@lawhmc2:~> vtmenu

Retrieving name of managed system(s) . . .

---------------------------------------------------------Managed Systems: ---------------------------------------------------------1) 10XXXXX-XXXX 2) 10YYYYY-YYYY 3) 10ZZZZZ-ZZZZ

Enter Number of Managed System. (q to quit): 3

---------------------------------------------------------Partitions On Managed System: 10ZZZZZ-ZZZZ ----------------------------------------------------------

Enter Number of Running Partition (q to quit): Here's where you may get stuck. Vtmenu allows you to select a frame, but won't show show any partition to start a virtual terminal window on. Seems obvious, because there aren't any partitions available (fullSystemPartition only). The solution is to run: mkvterm -m 10ZZZZZ-ZZZZ. This opens the virtual terminal window all right. When you're done, you can log out by using "~.". And if someone else is using the virtual terminal

window, and you wish to close that virtual terminal window, run rmvterm -m 10ZZZZZ-ZZZZ. In case you're wondering, how to figure out the managed machine name to use with the mkvterm and rmvterm commands, simply run vtmenu first. It shows you a list of managed machines controlled by this HMC. Useful HMC key combintaions CTRL-ALT-F1: Switch to Linux command line; no login possible. If you then click on CTRL-ALT-DEL the system will reboot. CTRL-ALT-F2: Takes you back to the Xserver window. CTRL-ALT-BACKSPACE: Kills of the Xserver and will start a new -fresh- one, so you can login again. Secure shell access to HMC If you wish to be able to access an HMC from the command line, without the need of logging in, you can use ssh (secure shell). Set-up a secure shell connection to your HMC: # ssh userid@hostname You will have to enter a password to get into your HMC. To allow your root user direct access to the HMC without the need of logging in, you'll have to update the authorized_keys2 file in the .ssh subdirectory of the home directory of your HMC user. There's a problem: a regular user only gets a restricted shell on an HMC and therefore is unable to edit the authorized_keys2 file in subdirectory .ssh. In an HMC version 3 it is possible to disable the restricted shell for users by editing file/opt/hsc/data/ssh/hmcsshrc. In an HMC version 4 you no longer get root access (except, you may get it, by contacting IBM), so you can no longer edit this file. Let's say your hmc user ID is hmcuser and you were able to logon to the HMC calledhmcsystem using this ID and a password (like described above). First, get a valid authorized_keys2 file, that allows root at your current host access to the HMC. Place this file in /tmp. Then, use scp to copy the authorized_keys2 file to the HMC:

# scp /tmp/authorized_keys2 hmcuser@hmcsystem:~hmcuser/.ssh/authorized_keys2

[Enter your hmcuser's password, when required] Now, just test if it works: # ssh hmcuser@hmcsystem date You should now be able to access the system without entering a password. HMC Access & Security Issues As of Hardware Management Console (HMC) Release 3, Version 2.3, the rexeccommand is no longer available on the HMC. Use ssh command instead. From Version 2.5, users are required to enter a valid HMC user id/password when downloading the WebSM client from the HMC. The URL for the WebSM client is: http://[HMC fully qualified domain name]/remote_client.html. Standard users receive the restriced shell via a set -r in .mysshrc when logging in. Comment the set r command in /opt/hsc/data/ssh/hmcsshrc to get rid of the restricted shell for your users (it gets copied to $HOME/.mysshrc). For more information on commands that can be used in restriced shell on the HMC, go to HMC Power 4 Hints & Tips. A special hscpe user ID can be created which has unrestricted shell access via thepesh command. Use lshmc -v to determine the serial number of the HMC (after *SE). Then call IBM support and request for the password of the hscpe user for the peshcommand. IBM is able to generate a password for the hscpe user for one day

The uname -Ls command will show you the partition number and the partition (lpar) name. When setting the resource allocation for a partition profile, set the minimum to the absolute bare minimum, and set the maximum as high as possible. For memory there are special considerations:

If you set the maximum too low and you wish to exceed above the maximum amount of memory defined in the active profile, you can't simply adjust the profile and put extra memory in via DLPAR, because the LPAR has been initialized with a certain page table size, based on the maximum amount of memory setting. Therefore, a reboot will be required when you wish to use more memory than defined in the active profile. If you do try it however, you'll receive the following error:

HMCERRV3DLPAR018: There is no memory available for dynamic logical partioning on this partition.

If you set the maximum too high, the partition will be initialize with a large page table size, which uses too much memory for overhead, which you might never use.

HMC network update to v7.3.5 If you decide to update to HMC release 7.3.5, Fix Central only supplies you the ISO images. This procedure describes how you can update your HMC using the network without having to sit physically in front of the console. First, check if this new HMC level is supported by the firmware levels of your supported systems using this link. If you're certain you can upgrade to V7.3.5, then make sure to download all the required mandatory fixes from IBM Fix Central. Don't download the actual base level of HMV v7.3.5 of 3 Gigabytes. We'll download that directly to the HMC later on. Then, perform the "Save upgrade data" task using either the Web interface or the command line. Then get the required files from the IBM server using ftp protocol using the following command: # getupgfiles -h ftp.software.ibm.com -u anonymous --passwd ftp -d /software/server/hmc/network/v7350 Hint: Once this procedure gets interrupted for any reason, you need to reboot your HMC before restarting it. Otherwise, some files will remain in the local download directory which will lead to incorrect checksums. You can check the progress of the procedure using the command ls -l /hmcdump in a different terminal. Once it has finished, you will see a prompt without any additional messages and the directory will be empty (the files will be copied to a different location). Then tell the HMC to boot from an alternate media by issuing the following command: # chhmc -c altdiskboot -s enable --mode upgrade Finally reboot your HMC with the following command from the console: # hmcshutdown -r -t now The installation should start automatically with the reboot. Once it has finished you should be able to login from remote again. The whole procedure takes up to one hour. Once you have finished you should add in any case the mandatory efixes for HMC 7.3.5 as ISO images. You can update the HMC with these fixes through the HMC. For more information, please visit this page. HMC access through SSH tunnel If your HMC is located behind a firewall and your only access is through SSH, then you have to use SSH tunneling to get browser-based access to your HMC. The ports you need to use for setting up the SSH tunnel are: 22, 23, 8443, 9960, 9735, 657, 443, 2300, 2301 and 2302. This applies to version 7 of the HMC. For example, if you're using a jump server to get access to the HMC, you need to run:

# ssh -l user -g -L 8443:10.48.32.99:8443 -L 9960:10.48.32.99:9960 -L 9735:10.48.32.99:9735 -L 2300:10.48.32.99:2300 -L 2301:10.48.32.99:2301 -L 443:10.48.32.99:443 -L 2302:10.48.32.99:2302 -L 657:10.48.32.99:657 -L 22:10.48.32.99:22 -L 23:10.48.32.99:23 jumpserver.domain.com -N When you've run the command above (and have logged in to your jumpserver), then point the browser to https://jumpserver.domain.com.