Back to Contents Page

Installing Management Applications: Broadcom NetXtreme BCM57XX User Guide

Overview

Installation Tasks

Detailed Procedures

Installing the Broadcom Advanced Control Suite and Related Management Applications

Managing Management Applications (Windows)

Overview

The Broadcom Advanced Control Suite version 4 (BACS4) is a management application for configuring the NetXtreme I family of adapters. BACS4 software operates on Windows and Linux server and client operating systems. This chapter describes how to install the BACS4 management application.

There are two main components of the BACS4 utility: the provider component and the client software.

A provider is installed on a server, or "managed host", that contains one or more CNAs. The provider collects information on the CNAs and makes it available for retrieval from a management PC on which the client software is installed. The client software enables viewing information from the providers and configuring the CNAs.The BACS client software includes a graphical user interface (GUI) and a command line interface (CLI).

Communication Protocols

A communication protocol enables exchanging information between provider and the client software. These are proprietary or open-source implementations of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF). Network administrators can choose the best option based on the prevailing standard on their network.

The following table shows the available options based on the operating systems installed on the managed host and the client.

If the client uses:
And the managed host uses:
BACS can use these communication protocols:
Windows
Windows
WMI
WS-MAN (WinRM)
Windows
Linux
CIM-XML (OpenPegasus)
WS-MAN (OpenPegasus)
Linux
Windows
WS-MAN (WinRM)
Linux
Linux
CIM-XML (OpenPegasus)
WS-MAN (OpenPegasus)
  • WMI = Windows Management Instrumentation.
  • WS-MAN = Web Service-Management. WinRM is a Windows-based implementation and OpenPegasus is an open-source implementation of the that operates on Linux.
  • CIM-XML = An XML-based version of OpenPegasus.

If your network includes a mix of Windows and Linux clients accessing Windows and Linux servers, then WS-MAN is a suitable choice. If Linux is the only OS installed on the servers, then CIM-XML is an option. If the network includes only Windows servers and clients, WMI is an option. WMI is very simple to configure but is supported only on the Windows OS.

Installation Tasks

BACS installation includes installing the provider component on the managed host and the client software on the management station. The installation process differs based on the combination of operating systems installed on the client and managed host and on the selected communication protocol. The following sections list each task in the overall process and provide links to the specific steps for each task, as found in Detailed Procedures.

WS-MAN

The following steps install the WS-MAN protocol for communication between the client and managed host (server). WS-MAN is supported on both Windows and Linux clients and servers.

Windows Server

On Windows servers, configure the WinRM service as follows:

  1. Install the WinRM Software Component on Server.
  2. Perform Basic Configuration on the Server.
  3. Perform User Configuration on the Server.
  4. Perform HTTP Configuration on the Server.
  5. Perform HTTPS Configuration on the Server (to use HTTPS rather than HTTP)
    1. Generate a Self-Signed Certificate for Windows/Linux Server.
    2. Install the Self-Signed Certificate on Windows Server.
  6. Configure WinRM HTTPS/SSL on the Server.
  7. Perform Additional Server Configuration, if required.
  8. Installing the Broadcom Advanced Control Suite and Related Management Applications.
Windows Client

On the Windows client, perform following configuration steps.

  1. Perform HTTP Configuration (if you plan to use HTTP).
  2. Perform HTTPS Configuration (if you plan to use HTTPS).
  3. Configure WinRM HTTPS/SSL.
  4. Installing the Broadcom Advanced Control Suite and Related Management Applications.
Linux Server

On Linux server, use the following steps to install OpenPegasus from Inbox (Red Hat only).

  1. Install OpenPegasus From Source (Red Hat and SuSE).
  2. Start CIM Server on the Server.
  3. Configure OpenPegasus on the Server.
  4. Install Broadcom CMPI Provider.
  5. Perform additional configuration, if required, such as firewall configuration. See Perform Linux Firewall Configuration, If Required.
  6. Installing the Broadcom Advanced Control Suite and Related Management Applications.
Linux Client

To use HTTP, no special configuration is required on the Linux client system. Only the BACS management application must be installed. Perform the following configuration steps:

  1. Configure HTTPS on Linux Client.
  2. Installing the Broadcom Advanced Control Suite and Related Management Applications.

CIM-XML

CIM-XML is supported only when the server uses the Linux OS. To install CIM-XML on a Linux server and client, you can follow the same procedure as described in WS-MAN. Note, however, that for CIM-XML on the Red Hat Linux OS, two installation options are available:

WMI

The WMI protocol is only supported on Windows OSs. If servers and clients both are running Windows, then WMI can be used.

Windows server
  1. Set up Namespace Security Using WMI Control.
  2. Grant DCOM Remote Launch and Activate Permission for a user or group.
  3. Perform special configuration if necessary. See Special Configuration for WMI on Different Systems.
Windows client

No special configuration is required on the Windows client except installing the BACS management application. See Installing the Broadcom Advanced Control Suite and Related Management Applications.

Detailed Procedures

This section provides the step-by-step instructions for each installation task. The required tasks for each communication protocol differ, as listed in Installation Tasks. Refer to the appropriate task list to ensure you complete all necessary tasks for the chosen protocol.

WS-MAN on Windows Server

Install the WinRM Software Component on Server

On the following operating systems, WinRM 2.0 is preinstalled:

For Windows XP and Windows Server, 2008, install Windows Management Framework Core, which includes WinRM 2.0 and Windows Powershell 2.0, from the following link:

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=11829

Perform Basic Configuration on the Server

The Windows firewall must be enabled for WinRM to work properly. For detailed information about firewall configuration, see Additional Server Configuration. After the firewall is configured, open a command prompt and run the following command to enable the remote management on the Windows server: 

winrm quickconfig

You can use the following command to view the configuration information for the service: 

winrm get winrm/config
Perform User Configuration on the Server

To connect to WinRM, the account must be a member of the local administrators group on the local or remote computer. The output of the get winrm/config command will be as follows: 

RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)

BA stands for BUILTIN\Administrators.

To add another user group to the WinRM allowed connect list, you can modify the RootSDDL to include the new user group. You will need the SSDL ID for the new group. For example, the following command adds the new user group with SDDL ID S-1-5-21-1866529496-2433358402-1775838904-1021. 

winrm set winrm/config/Service @{RootSDDL="O:NSG:BAD:P(A;GA;;;BA)(A;;GA;;;

S-1-5-21-1866529496-2433358402-1775838904-1021)S:P(AU;FA;GA;;

WD)(AU;SA;GWGX;;;WD)"}
Perform HTTP Configuration on the Server

To use the BACS GUI, you must configure the HTTP protocol, as follows:

NOTE: The default HTTP port is 5985 for WinRM 2.0.

  1. Click Start (or press the Windows logo key) and select Run.
  2. Enter gpedit.msc to open the local Group Policy editor.
  3. Under Computer Configuration, open the Administrative Templates folder and then open the Windows Components folder.
  4. Select Windows Remote Management (WinRM).
  5. Under Windows Remote Management (WinRM), select WinRm Client.
  6. Under WinRM Client, double-click Trusted Hosts.
  7. In the TrustedHostsList, enter the host names of the clients. If all clients are trusted then enter an asterisk (*) only.
  8. Select WinRM Service.
  9. Enable Allow Basic Authentication.
  10. Enable Allow unencrypted traffic.
  11. Close the Group Policy wIndow.
  12. From the command prompt, run the following command to configure WinRM with default settings:
    13. winrm qc or winrm quickconfig
  13. When the tool displays "Make these changes[y/n]?", enter "y".
  14. Enter one of the following commands to check whether an HTTP listener is created:
    15. winrm enumerate winrm/confg/listener

    or 

    winrm e winrm/config/Listener
  15. Enter the following command from the command prompt to test locally.
    16. winrm id
Perform HTTPS Configuration on the Server (to use HTTPS rather than HTTP)

This step consists of two distinct processes: generating a self-signed certificate, if certificate does not exist, and importing it to a Windows server. If one does not already exist, you must configure a self-signed certificate on the Windows server to enable HTTPS/SSL communication with the BACS GUI on the Windows or Linux client. The Windows and Linux client also must be configured with the self-signed certificate. See Perform HTTPS Configuration (if you plan to use HTTPS) to configure Windows and Configure HTTPS on Linux Client to configure Linux client.

NOTE: The self-signed certificate can be created on any Windows or Linux server. The server does not require BACS to be installed. The self-signed certificate generated on any Windows/Linux server should be copied on the local drive of client.

  1. Click Start (or press the Windows logo key) and select Run.
  2. Enter gpedit.msc to open the local Group Policy editor.
  3. Under Computer Configuration, open the Administrative Templates folder and then open the Windows Components folder.
  4. Select Windows Remote Management (WinRM).
  5. Under Windows Remote Management (WinRM), select WinRm Client.
  6. Under WinRM Client, double-click Trusted Hosts.
  7. In the TrustedHostsList, enter the host names of the clients. If all clients are trusted then enter an asterisk (*) only.
  8. Select WinRM Service.
  9. Enable Allow Basic Authentication.
Generate a Self-Signed Certificate for Windows/Linux Server

Openssl on Linux or Windows can be used to generate the self-signed certificate, as follows:

NOTE: You can download and install openssl from http://gnuwin32.sourceforge.net/packages/openssl.htm.

  1. Enter the following command to generate a private key:
    2. openssl genrsa -des3 -out server.key 1024
  2. You are prompted to enter a passphrase. Be sure to remember the passphrase.
  3. Use the following steps to generate a Certificate Signing Request (CSR).

    4. During the generation of the CSR, you are prompted for several pieces of information. When prompted for the "Common Name", enter the Windows Server host name or IP address.

    Enter the following command (sample responses are shown): 

    openssl req -new -key server.key -out server.csr

    If this command does not work, try the following: 

    openssl req –new –key server.key –out server.csr –config openssl.cnf

    The openssl.cnf file should be placed in the same directory where openssl is placed. Openssl.cnf is located in the folder C:\Program Files (x86)\GnuWin32\share.

    The following information is requested:

    • Country Name (2 letter code) []:US
    • State or Province Name (full name) []: California
    • Locality Name (e.g., city) []: Irvine
    • Organization Name (e.g., company) []: Broadcom Corporation
    • Organizational Unit Name (e.g., section) []: Engineering
    • Common Name (e.g., YOUR name) []: Enter the host name or IP address of the Windows server. For iPv6, enter the Common Name in the format [xyxy:xxx:....::xxx], including the brackets [ ].
    • (Optional) Email Address []:

      • Enter the following additional attributes to be sent with your certificate request:

    • A challenge password []:linux1
    • An optional company name []:
  4. Remove the passphrase from the key.

    5. Enter the following commands: 

    cp server.key server.key.org

    openssl rsa -in server.key.org -out server.key
  5. Generate a self-signed certificate:

    6. To generate a self-signed certificate which is active for 365 days, enter the following command: 

    openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

    The following output displays: 

    Signature ok

    subject=/C=US/ST=California/L=Irvine/O=Broadcom Corporation/OU=Engineering/CN=MGMTAPP-   LAB3/emailAddress=

    Getting Private key
  6. Enter the following command to verify the generated self-signed certificate.
    7. openssl verify server.crt

    The following output displays: 

    server.crt:/C=US/ST=California/L=Irvine/O=Broadcom Corporation/OU=Engineering/CN=MGMTAPP-   LAB3/emailAddress=

    error 18 at 0 depth lookup:self signed certificate

    OK

    Ignore the error message "error 18 at 0 depth lookup:self signed certificate". This error indicates that this is a self-signed certificate.

  7. Convert the certificate from "crt" to "pkcs12" format, as follows:

    8. For a Windows server, the certificate should be in pkcs12 format. Enter the following command: 

    openssl pkcs12 -export -in server.crt -inkey server.key -out hostname.pfx

    You will be prompted for the following: 

    Enter Export Password:

    Verifying - Enter Export Password:

    Enter the password and be sure to remember it. The password is required when importing the certificate on the Windows server and client.

  8. Make a copy of the certificate file server.crt and place it on the server where BACS will be installed, so that it can be imported. If you plan to use a Windows or Linux client to connect to the server running BACS, then the certificate also needs to be transferred (copied and pasted) to the client system.

    9. In Linux, the certificate should have the extension ".pem". The extension ".crt" and ".pem" are the same, so there is no need to use the openssl command to convert from .crt to .pem. You can simply copy the file as-is.

    NOTE: A separate certificate must be generated for an IPv4 address, IPv6 address, and Hostname.

Install the Self-Signed Certificate on Windows Server

Transfer the file hostname.pfx you generated on the Windows server before you install the certificate:

  1. Click Start (or press the Windows logo key) and select Run.
  2. Enter MMC and click OK.
  3. Click File > Add/Remove Snap-in.
  4. Click Add.
  5. Select Certificates and click Add.
  6. Select Computer account.
  7. Click Next and then click Finish.
  8. Click Close, then click OK.
  9. Open the Certificates (Local Computer) folder and then open the Personal folder.
  10. Right-click Certificates, select All Tasks and then click Import.
  11. Click Next to begin the Certificate Import Wizard.
  12. Browse to select hostname.pfx.
  13. When you are prompted for the password for the private key, enter the same password you created in Generate a Self-Signed Certificate for Windows/Linux Server.
  14. Follow the instructions, select the defaults, and continue.

    15. The certificate is shown as installed on the right side of the window. The name will be the name you specified while creating a self-signed certificate.

  15. Right-click on the certificate and select Properties.

    16. A dialog box displays, as follows:



  16. Ensure that only Server Authentication is enabled, as shown in the figure.
  17. Open Trusted Root Certification Authorities and then open Certificates.
  18. Follow the instructions from Step 11. to Step 17.

    19. NOTE: See Perform HTTPS Configuration (if you plan to use HTTPS) for instructions on importing the self-signed certificate on a client.

Configure WinRM HTTPS/SSL on the Server
  1. Create WinRM Listener, as follows:
    1. Click Start (or press the Windows logo key) and select Run.
    2. Enter MMC and click OK.
    3. Select the self-signed certificate from the Personal store.

      4. For example, if the certificate is created with a host name, the host name will appear.

    4. Double-click the certificate to open it.
    5. Click the Details tab.
    6. Scroll down and select the Thumbprint field.
    7. Select and copy the thumbprint in the Details window so you can insert it in the next step.
    8. Return to the command prompt.
    9. Enter the following command:
      10. 		winrm create winrm/config/Listener?Address=*+Transport=

      		HTTPS @{Hostname="<HostName or IPAddress>";

      		CertificateThumbprint="<paste from the previous step and remove the spaces>"}

      NOTES:

        • If the certificate was generated using the host name, enter the host name. If it was generated using the IP address, enter the IP address. For an IPv6 address, use brackets [ ] around the address.
        • If HTTPS is configured in your system, the listener must be deleted before creating a new HTTPS listener. Use the following command:
          winrm delete winrm/config/Listener?Address=*+Transport=HTTPS

    10. The above command creates a listener on the HTTPS port (5986) using any/all network address of the server, and my SelfSSL generated certificate.
    11. You can use the winrm command to modify or set the HTTPS listener, as WinRM listeners can be configured on any user defined port.
    12. From command prompt, run the following command to verify that the listener(s) that have been configured:
      13. 		winrm e winrm/config/listener
  2. Test HTTPS/SSL connection on the server.
    1. At the command prompt on the server, enter the following command: 
      2. 		winrs -r:https://yourserver:5986 -u:username -p:password hostname
    2. If setup correctly, the output of the command shows the server host name.
    3. To check WinRM Service Configuration, run the following command:
      4. 		winrm get winrm/config/service
Additional Server Configuration

If necessary, modify the firewall rules as follows:

Windows Server 2008 R2
  1. From the Administrative Tools menu, open Windows Firewall with Advanced Security.
  2. Right-click Inbound Rules and select New Rule.

    3. The new rule wizard opens.

  3. Select Port and click Next.
  4. On the Protocol and Ports screen, select TCP and enter the specific port, for example, 5985 for HTTP or 5986 for HTTPS.
  5. Click Next.
  6. On the Action screen, select Allow the connection and click Next.
  7. For Profile, you can select all three profiles if your server is in a workgroup.
  8. Specify a name for the rule and click Finish.
  9. Ensure that the new rule and is enabled (the green check box is selected).
Windows XP
  1. Click Start > Control Panel, and then double-click Windows Firewall.
  2. Click the Exceptions tab
  3. Click Add Port.
  4. Enter a meaningful Name, for example "WinRM rule" and port number, for example, 5985 for HTTP or 5986 for HTTPS.
  5. Click OK.
Useful WinRM Commands

Command
Description 
winrm quickconfig or winrm qc

Configures WinRM with default settings

winrm enumerate winrm/config/Listener or winrm e winrm/config/Listener

Helps to check which service listener are enabled and listening on which port and IP Address. 

winrm get winrm/config/Service

Checks WinRM Service Configuration. 

winrm delete winrm/config/Listener?Address=*+Transport=HTTPS

Deletes a Listener (in this case deleting a HTTPS listener).

Useful WinRM Websites

WS-MAN—Windows Client

Perform HTTP Configuration (if you plan to use HTTP)
  1. Click Start (or press the Windows logo key) and select Run.
  2. Enter gpedit.msc to open the local Group Policy editor.
  3. Under Computer Configuration, open the Administrative Templates folder and then open the Windows Components folder.
  4. Select Windows Remote Management (WinRM).
  5. Under Windows Remote Management (WinRM), select WinRm Client.
  6. Under WinRM Client, double-click Trusted Hosts.
  7. In the TrustedHostsList, enter the host names of the clients and click OK. If all clients are trusted then enter an asterisk (*) only.
  8. Select WinRM Service.
  9. Enable Allow Basic Authentication and click OK.
  10. Run the following command from the command prompt to test the connection:
    11.  winrm id -remote:<remote machine Hostname or IP Address>
Perform HTTPS Configuration (if you plan to use HTTPS)

After you generate a self-signed certificate, as described in Generate a Self-Signed Certificate for Windows/Linux Server, you can import the certificate on the client to facilitate a connection between server and client. Ensure that all steps mentioned in section Generate a Self-Signed Certificate for Windows/Linux Server are completed, including copying hostname.pfx at the location from where client can access it, before you proceed with the following steps.

  1. Click Start (or press the Windows logo key) and select Run.
  2. Enter MMC and click OK.
  3. Click File and select Add/Remove Snap-in.
  4. Click Add.
  5. Select Certificates and click Add.
  6. Select Computer account and click Next.
  7. Click Finish.
  8. Click Close and then click OK.
  9. Under Certificates (Local Computer), right-click on Trusted Root Certification Authorities, select All Tasks, and select Import.
  10. Click Next to begin the Certificate Import Wizard.
  11. Browse to select the .pfx file you generated in Generate a Self-Signed Certificate for Windows/Linux Server. Change the selection in the Files of type list to Personal Information Exchange (*.pfxas, *.p12), select the hostname.pfx file and click Open.
  12. Enter the password you assigned to the private key and click Next.
Configure WinRM HTTPS/SSL

You can run winrm from a client to retrieve information from the server using WinRM HTTPS connection. Use the following steps to test the WinRM HTTPS/SSL connection from client:

  1. To retrieve the server operating system information, enter the following command.
    2. winrm e wmi/root/cimv2/Win32_OperatingSystem -r:https://yourservername 
    -u:username -p:password -skipCAcheck
  2. To retrieve the server WinRM identity information, enter the following command.
    3. winrm id -r:https://yourservername -u:username -p:password -skipCAcheck
  3. To enumerate Windows services on the server, enter the following command.
    4. winrm e wmicimv2/Win32_service -r:https://yourservername -u:username -p:password -skipCAcheck

    NOTE: It is important to use -skipCAcheck switch in the winrm command line testing, as the certificate is self-generated and not imported on the client. Otherwise, the following error message displays: WSManFault.

The next section explains how to export and import the self-signed certificate.

WS-MAN and CIM-XML—Linux Server

There are two options available for installing OpenPegasus: install from an Inbox RPM or install from the source. The Inbox OpenPegasus is available only on the Red Hat Linux OS. For the SUSE Linux Enterprise Server 11 (SLES11) OS, you must use the source RPM.SLES11,

NOTE: The Inbox RPM does not support the WS-MAN communication protocol. To use WS-MAN, you must install OpenPegasus from source.

Install OpenPegasus From the Inbox RPM (Red Hat Only)

In Red Hat Linux, an Inbox OpenPegasus RPM is available as tog-pegasus-<version>.<arch>.rpm.

  1. Use the following command to install tog-pegasus:
    2. rpm -ivh tog-openpegasus-<version>.<arch>.rpm
  2. Use the following command to start Pegasus:
    3. /etc/init.d/tog-pegasus start

    NOTE: If your system has "Red Hat Security Enhancement for tog-pegasus" enabled, disable it before connecting to BACS. See /usr/share/doc/tog-pegasus-2.5.2/README.RedHat.Security for details. To disable it, remove the line from /etc/pam.d/wbem.

    NOTE: On SuSE Linux, the Inbox OpenPegasus RPM is not available. OpenPegasus must be installed from source, as described in the following section.

Note that in inbox Pegasus, HTTP is not enabled by default. After Inbox OpenPegasus is installed successfully, if no further configuration is required, then follow the instructions in Install Broadcom CMPI Provider. To enable HTTP, see Enable HTTP.

Install OpenPegasus From Source (Red Hat and SuSE)

The OpenPegasus source can be downloaded from www.openpegasus.org.

NOTE: If not already installed, download and install the openssl and libopenssl-devel rpm. This step is optional and required only if you are planning to use HTTPS to connect the client to the managed host.

Set the Environment Variable

Set the environment variables for building OpenPegasus as follows.

Environment Variable
Description
PEGASUS_ROOT
The location of the Pegasus source tree
PEGASUS_HOME
The location for the built executable, repository; e.g., $PEGASUS_HOME/bin, PEGASUS_HOME/lib, $PEGAUS_HOME/repository, and $PEGASUS_HOME/mof subdirectories.
PATH
$PATH:$PEGASUS_HOME/bin
PEGASUS_ENABLE_CMPI_PROVIDER_MANAGER
True
PEGASUS_CIM_SCHEMA
"CIM222"
PEGASUS_PLATFORM
For Linux 32 bit systems: "LINUX_IX86_GNU"
For Linux 64 bit systems: "LINUX_X86_64_GNU"
PEGASUS_HAS_SSL
Optional. Set to "true" for HTTPS support.
PEGASUS_ENABLE_PROTOCOL_WSMAN
Optional. Set to "true" for WSMAN protocol support.

Additional Settings

The $PEGASUS_HOME variable must be set up in the shell environment, and $PEGASUS_HOME/bin needs to be appended to the $PATH environment.

Examples

For SSL Support, add the following environment variable:

For WS-MAN Support, add the following environment variable:

CIM-XML and WSMAN in OpenPegasus use the same ports for HTTP or HTTPs. The default port numbers for HTTP and HTTPS are 5989 and 5989, respectively.

NOTE: You can add these exports at the end of the .bash_profile. This file is located in the /root directory.

Build and install OpenPegasus

From $PEGASUS_ROOT (the location of the Pegasus source root directory), run the following: 

make clean

make

make repository

NOTE: Whenever OpenPegasus is built from source, all configurations are reset to the default values. If you are rebuilding OpenPegasus, you must redo the configuration as mentioned in Configure OpenPegasus on the Server.

Start CIM Server on the Server

Use the cimserver command to start CIM server. To stop CIM server, use the command cimserver -s.

To check whether OpenPegasus has been installed properly, enter the following command: 

 cimcli ei -n root/PG_Interop PG_ProviderModule

NOTE: For OpenPegasus compiled from source, PEGASUS_HOME must be defined when you start CIM server. Otherwise, CIM server will not load the repository properly. Consider setting PEGASUS_HOME in the ".bash_profile" file.

Configure OpenPegasus on the Server

Use the cimconfig command to configure OpenPegasus, as shown in the following table:

Command
Description 
cimconfig -l
List all valid property names. 
cimconfig -l -c
List all valid property names and its value 
cimconfig -g <property name>
Query a particular property. 
cimconfig -s <property name>=<value> -p
Set a particular property. 
cimconfig --help
Find out more about the command.

CIM server must be started before running cimconfig, and must be restarted for configuration changes to take effect.

Enable Authentication

The following OpenPegasus properties have to be set as described in this section. Otherwise, the Broadcom CIM Provider will not work properly. Ensure the following are set before launching BACS and connecting to the provider.

Start CIM server if it is not already started. Then, set the following:

If you want root user to connect remotely:

User configuration with privilege: The Linux system users are used for OpenPegasus authentication. The systems users have to be added to OpenPegasus using cimuser to connect via BACS:

Enable HTTP
  1. If CIM server is not started, start it.
  2. Use the following command to set up an HTTP port (optional):
    3. cimconfig -s httpPort=5988 -p

    This property is not available for Inbox OpenPegasus.

  3. Use the following command to enable HTTP connection:
    4. cimconfig -s enableHttpConnection=true -p
  4. Use the cimserver -s and cimserver commands, respectively, to stop and restart CIM server for the new configuration to take effect.
Enable HTTPS
  1. If CIM server is not started, start it.
  2. Set up HTTPS port with the following command (optional):
    3. cimconfig -s httpsPort=5989 -p

This property is not available for inbox OpenPegasus.

  1. Enable HTTPS connection with 'the following command:
    2. cimconfig -s enableHttpsConnection=true -p
  2. Use the cimserver -s and cimserver commands, respectively, to stop and restart CIM server for the new configuration to take effect.
Install Broadcom CMPI Provider

Ensure that OpenPegasus is installed properly before installing CMPI Provider.

Install

Enter following command to install Broadcom CMPI Provider. 

% rpm -i BRCM_CMPIProvider-{version}.{arch}.rpm
Uninstall

Enter following command to uninstall Broadcom CMPI Provider: 

% rpm -e BRCM_CMPIProvider
Perform Linux Firewall Configuration, If Required

Follow these procedures to open the appropriate ports in the firewall:

RedHat
  1. Click System, select Administration, and then select Firewall.
  2. Select Other Ports.
  3. In the Port and Protocol Dialog box, select User Defined.
  4. In the Port/Port Range field, add the port number.
  5. In the Protocol field, add the protocol as TCP or UDP, etc.
  6. Click Apply for the firewall rules to take effect.

Example:

SuSE
  1. Click Compute and then click YaST.
  2. Select Security & Users on the left pane.
  3. On the right pane, double-click Firewall.
  4. Select Custom Rules on the left pane.
  5. On the right pane click Add.
  6. Enter the following values:
    • Source Network: 0/0 (means all)
    • Protocol: TCP (or the appropriate protocol)
    • Destination Port: <Port Number> or <Range of Port Numbers>
    • Source Port: Leave blank.
  7. Click Next and then click Finish for the firewall rules to take effect.

Example:

For CIM-XML, use the following values:

WS-MAN and CIM-XML—Linux Client

No special software components are required on the Linux client system to use the HTTP except installing the BACS management application. However, for WS-MAN installations, you can optionally configure the HTTPS protocol for use with BACS.

Configure HTTPS on Linux Client

Follow these steps if you want to use HTTPS rather than HTTP (WS-MAN only):

  1. Follow the instructions in Generate a Self-Signed Certificate for Windows/Linux Server.
  2. Import Self-Signed Certificate on Linux Client:

    3. On Linux distributions, note the following certificate directory:

    • For all SuSE versions, the certificate directory is /etc/ssl/certs.
    • For RedHat, the certificate directory can be different for each version. For some versions, it is /etc/ssl/certs or /etc/pki/tls/certs. For other versions, find out the certificate directory.

      • Copy hostname.pem, which you created in Generate a Self-Signed Certificate for Windows/Linux Server, into the certificate directory of the Linux client. For example, if the certificate directory is /etc/ssl/certs, copy hostname.pem to /etc/ssl/certs.

    • Change directory to /etc/ssl/certs.
    • Create a hash value by running the following command.

      • openssl x509 -noout -hash -in hostname.pem

      A value such as the following will be returned.

      100940db

    • Create a symbolic link to the hash value by running the following command:

      • ln -s hostname.pem 100940db.0

  3. Test HTTPS/SSL Connection from Linux Client

    4. Use the following command to test whether the certificate is installed correctly on Linux:

    # curl -v --capath /etc/ssl/certs https://Hostname or IPAddress:5986/wsman

    If this fails, then the certificate is not installed correctly and an error message displays, indicating to take corrective action.

Install BACS Management Application
  1. Download the latest BACS management application RPM package.
  2. Install the RPM package as: 
    3. rpm -i BACS-{version}.{arch}.rpm

WMI—Windows

Perform the steps in the following two sections only to configure WMI on the Windows server.

Set up Namespace Security Using WMI Control

The WMI Control provides one way to manage namespace security. You can start the WMI Control from the command prompt using this command: 

wmimgmt

On Windows 9x or Windows NT4 computers that have WMI installed, use this command instead: 

wbemcntl.exe

Alternatively, you can access the WMI Control and the Security tab as follows:

  1. Right-click on My Computer and click Manage.
  2. Double-click Services and Applications and then double-click WMI Control.
  3. Right-click WMI Control and then click Properties.
  4. In WMI Control Properties, click the Security tab.
  5. A folder named Root with a plus sign (+) next to it should now be visible. Expand this tree as necessary to locate the namespace for which you want to set permissions.
  6. Click Security.

    7. A list of users and their permissions appears. If the user is on the list, modify the permissions as appropriate. If the user is not on the list, click Add and add the user from the location (local machine, domain, etc.) where the account resides.

    NOTES: You can add these exports at the end of the .bash_profile. This file is located in the /root directory.

    • In order to view and set namespace security, the user must have Read Security and Edit Security permissions. Administrators have these permissions by default, and can assign the permissions to other user accounts as required.
    • If this user needs to access the namespace remotely, you must select the Remote Enable permission.
    • By default, user permissions set on a namespace apply only to that namespace. If you want the user to have access to a namespace and all subnamespaces in the tree below it, or in subnamespaces only, click Advanced. Click Edit and specify the scope of access in the dialog box that displays.
Grant DCOM Remote Launch and Activate Permission

In the Windows domain environment, the Domain Administrator account has the necessary privilege level to access the WMI component for BACS management and, therefore, no special configuration is needed. In a large enterprise, however, a user who is accessing the local or remote host using the BACS4 client GUI may not always have the domain administrator account privilege. It is necessary to configure WMI security access on the remote host to allow the user to connect to it using the BACS4 client GUI.

This configuration can be easily done using the following procedure. If you do not have sufficient privileges to configure security for WMI access, contact your Network Administrator.

  1. Click Start (or press the Windows logo key) and select Run.
  2. Enter DCOMCNFG, and then click OK.
  3. The Component Services dialogue box displays.
  4. Open Component Services and then open Computers.
  5. Right-click My Computer and click Properties.
  6. In My Computer Properties, click the COM Security tab.
  7. Under Launch and Activation Permissions, click Edit Limits.
  8. Follow these steps if your name or your group does not appear in the Groups or user names list.
    1. In the Launch Permission dialog box, click Add.
    2. In the Select Users, Computers, or Groups dialog box, add your name and the group in the Enter the object names to select box, and then click OK.
    3. In the Launch Permission dialog box, select your user and group in the Group or user names list.
    4. In the Permissions for User area, select Allow for Remote Launch and Remote Activation, and then click OK.
Figure 1: Launch and Activation Permission

For more information, see Securing a Remote WMI Connection on the Microsoft Developer Network site.

Special Configuration for WMI on Different Systems

Installing the Broadcom Advanced Control Suite and Related Management Applications

Installing on a Windows System

The Broadcom Advanced Control Suite (BACS) software and related management applications can be installed from the installation CD or by using the silent install option.

The following are installed when running the installer:

Using the Installer

To install the management applications

  1. Insert the installation CD into the CD or DVD drive.
  2. On the installation CD, open the MgmtApps folder, select IA32 or x64, and then double-click Setup.exe to open the InstallShield Wizard.
  3. Click Next to continue.
  4. After you review the license agreement, click I accept the terms in the license agreement and then click Next to continue.
  5. Select the features you want installed.
  6. Click Next.
  7. Click Install.
  8. Click Finish to close the wizard.

After successful installation, you can start the GUI from Windows Start menu.

Using Silent Installation

NOTES:

To perform a silent install (or upgrade) from within the installer source folder

Type the following: 

setup /s /v/qn

If performing a silent upgrade, your system may reboot automatically. To suppress the reboot, type the following: 

setup /s /v"/qn REBOOT=ReallySuppress"

To perform a silent install and create a log file

Type the following: 

setup /s /v"/qn /L f:\ia32\1testlog.txt"

The 1testlog.txt log file will be created at f:\ia32.

To perform a silent uninstall from any folder on the hard drive 

msiexec /x "{26E1BFB0-E87E-4696-9F89-B467F01F81E5}" /qn

NOTES:

To perform a silent install by feature on IA32 platforms

Use ADDSOURCE to include any of the features listed below.

NOTE: CHM32 or CHM64 installs the BACS help file and must be included when installing the BACS feature. 

setup /s /v"/qn ADDSOURCE=BACSi32,CHM32,BASPi32,SNMPi32,CIMi32"

To perform a silent install by feature on AMD64/EM64T platforms

Type the following: 

setup /s /v"/qn ADDSOURCE=BACSa64,CHMa64,BASPa64,SNMPa64"

To perform a silent install from within a batch file

To perform a silent install from within a batch file and wait for the install to complete before continuing with the next command line, type the following: 

start /wait setup /s /w /v/qn

Installing on a Linux System

The Broadcom Advanced Control Suite (BACS) software can be installed on a Linux system using the Linux RPM package. This installation includes a BACS GUI and a CLI client.

Before you begin:

To install BACS

  1. Download the latest BACS management application RPM package.
  2. Install the RPM package using the following command: 
    3. % rpm -i BACS-{version}.{arch}.rpm

To Use BACS

To remove BACS

To uninstall the RPM package, use the following command: 

% rpm -e BACS

Managing Management Applications (Windows)

Modifying the Management Application

To modify the management applications:

  1. In Control Panel, double-click Add or Remove Programs.
  2. Click Broadcom Management Programs and then click Change.
  3. Click Next to continue.
  4. Click Modify to change program features.
  5. Click Next to continue.
  6. Click on an icon to change how a feature is installed.
  7. Click Next.
  8. Click Install.
  9. Click Finish to close the wizard.
  10. Reboot your system to complete the modification of the management applications.

Repairing Management Applications

To repairthe management applications:

  1. In Control Panel, double-click Add or Remove Programs.
  2. Click Broadcom Management Programs, and then click Change.
  3. Click Next to continue.
  4. Click Repair to repair errors in installed applications.
  5. Click Next to continue.
  6. Click Install.
  7. Click Finish to close the wizard.

Removing Management Applications

To remove all management applications:

  1. In Control panel, double-click Add or Remove Programs.
  2. Click Broadcom Management Programs, and then click Remove.
  3. Reboot your system to complete the removal of management applications.

To remove the management application using the CLI:

Enter following command: 

rpm -e BACS

Back to Contents Page