HMC Tips III - User Management

HMC Tips III - User Management

1. To list all users in a HMC

# lshmcusr

2. To list only user names and managed resource roles for all HMC users :

# lshmcusr -F name:resourcerole

3. To create a user :

# mkhmcusr -u User_Id -a ROLE -d DESCRIPTION --passwd PASSWORD -M PASSWD_EXPIRATION_DAYS

3. To remove a user :

# rmhmcusr -u USER_NAME

4. To change an hmc user's password :

# chhmcusr -u User_Name -t passwd -v New_Password

5. To change the task role for the user "user1" to hmcoperator :

# chhmcusr -r user1 -t taskrole -v hmcoperator

Available task roles are
hmcsuperadmin, hmcoperator, hmcviewer, hmcpe, hmcservicerep or a user defined task role

6. To list all managed resource objects :

# lsaccfg -t resource

7. To list all managed resource roles :

# lsaccfg -t resourcerole

8. To create a task role using a config file :

# mkaccfg -t resourcerole -f /tmp/fil1

9. To create a task role :

# mkaccfg -t taskrole -i "name=tr1,parent=hmcsuperadmin,"resources=cec:chcod+lscod+lshwres,lpar:chssyscfg+lssyscfg+mksyscfg""

10. To change a task role :

# chaccfg -t taskrole -i "name=tr1,"resources=cec:chhwres+chsysstate,lpar:chssyscfg+chled+chhwres""

11. To remove a task role :

# rmaccfg -t taskrole -n tr1

HMC Tips II - Partitions and Profiles

HMC Tips II - Partitions and Profiles

1. To list all machines configured in a hmc

# lssyscfg -r sys

2. To list all lpars(partitions) in a power machine

# lssyscfg -r lpar -m Managed_System

3. To activate/start an LPAR :

# chsysstate -r lpar -m Managed_System -o on -n LPAR_Name -f Profile_ name

4. To deactivate/shutdown an LPAR :

# chsysstate -r lpar -m Managed_System -o shutdown --immed -n LPAR_Name

5. To open the console of a partition :

# mkvterm -m Managed_System -p LPAR_Name

6. To close the console of a partition:

# rmvterm -m Managed_System -p LPAR_Name

7. To list the profile of a partition:

# lssyscfg -r prof -m Managed_System --filter "lpar_names=LPAR_Name,profile_names=Profile_Name"

8. To change the min/desired/maximum memory settings of a partition profile :

# chsyscfg -r prof -m Managed_System -i "name=Profile_Name,lpar_name=LPAR_Name,min_mem=512,desired_mem=19456,max_mem=20480"

9. To change the min/desired/maximum processor units of a partition profile :

# chsyscfg -r prof -m Managed_System -i "name=Profile_Name,lpar_name=LPAR_Name,min_proc_units=0.2,desired_proc_units=0.5,max_proc_units=2.0"

10. To change the min/desired/maximum virtual processor of a partition profile :

# chsyscfg -r prof -m Managed_System -i "name=Profile_Name,lpar_name=LPAR_Name,min_procs=1,desired_procs=2,max_procs=6"

11. To change capped/uncapped setting in a partition profile :
# chsyscfg -r prof -m Managed_System -i "name=Profile_Name,lpar_name=LPAR_Name,sharing_mode=uncap,uncap_weight=128"

Possible values for sharing_mode are cap and uncap.
Possible values for uncap_weight are from 0 to 128.

12. To change the name of a partition profile :

# chsyscfg -r prof -m Managed_System -i "name=Profile_Name,lpar_name=LPAR_Name,new_name=New_Profile_Name"

13. To change the name of a partition :

# chsyscfg -r lpar -m Managed_System -i "name=LPAR_Name,new_name=New_LPAR_Name"

14. To change the default profile of a partition :

# chsyscfg -r lpar -m Managed_System -i "name=LPAR_Name,default_profile=Partition_Profile_Name"

15. To set "power off the machine after all partitions are shutdown" for a power machine :

# chsysscfg -r sys -m Managed_System -i "power_off_policy=0"

Possible values are

0 -> Power off after all partitions are shutdown
1 -> Do not power off after all partitions are shutdown

16. To rename a system profile :

# chsyscfg -r sysprof -m Managed_System -i "name=Sys_Prof_Name,new_name=New_Sys_Prof_Name"

17. To add 2 more partition profiles to a system profile :

# chsyscfg -r sysprof -m Managed_System -i "name=,"lpar_names+=partition3,partition4",
"profile_names+=profile3,profile4""

HMC Tips I - HMC and Managed System

HMC Tips I - HMC and Managed System

1. To enable ssh in a hmc :

# chhmc -c ssh -s enable
You can disable it by replacing the word 'enable' with 'disable'

2. To enable xntp in a hmc :

# chhmc -c xntp -s enable
You can disable it by replacing the word 'enable' with 'disable'

3. To add an entry in the syslog config file :

# chhmc -c syslog -s add -a IP_Addr ( or '-h host_name' )
You can remove an entry by replacing the word 'add' with 'remove'

4. To add an entry in the ntp config file :

# chhmc -c xntp -s add -a IP_Addr ( or 'h host_name' )
You can remove an entry by replacing the word 'add' with 'remove'

5. To configure the network as a startup device :

# chhmc -c netboot -s enable
You can disable it by replacing the word 'enable' with 'disable'

6. To permit IP addresses from utilizing HMC services :

# chhmc -s ssh ( or any_service) -s add -a IP_Addr
You can remove an entry by replacing the word 'add' with 'remove'

7. To add a DNC_server or domain_suffix :

chhmc -c network -s add [-ns DNS_Server] [-ds domain_suffix ]
You can remove an entry by replacing the word 'add' with 'remove'

8. To change network settings for a specific network interface :

# chhmc -c network -s modify -i interface_name
[-a IP_Addr] [-nm network_mask] [ --lparcomm on|off]

Note: Network settings for the s10 interface cannot be changed.

9. To change other network settings :

# chhmc -c network -s modify
[-h hostname] [-d network-domain-name]
[-g gateway]

10. To change the locale for the HMC :

# chhmc -c locale -s modify -l locale

11. To change the HMC date and time, time zone :

# chhmc -c date -s modify
[ --datetime ]
[ --clock {local | utc} ]
[ --timezone {time-zone | none} ]

12. To list the BIOS Level of the HMC :

# lshmc -b

13. To list the current locale :

# lshmc -l

14. To list all of the locales supported by HMC :

# lshmc -L

15. To list network settings :

# lshmc -n

16. To list remote access settings :

# lshmc -r

17. To list VPD information :

# lshmc -v

18. To list version information :

# lshmc -V

19. List IP Connections to SP's and Bulk Power Controllers :

# lssysconn -r all

20. To list all machines configured in a hmc

# lssyscfg -r sys

21. To power on a managed system :

# chsysstate -r sys -m MANAGED_SYSTEM -o on -f SYS_PROF_NAME

22. To power on a managed system in standby mode :

# chsysstate -r sys -m MANAGED_SYSTEM -o onstandby -f SYS_PROF_NAME

23. To power off a managed system :

# chsysstate -r sys -m MANAGED_SYSTEM -o off --immed

24. To restart a managed system :

# chsysstate -r sys -m MANAGED_SYSTEM -o off --immed --restart

25. To recover partition data for a managed system :

# chsysstate -r sys -m MANAGED_SYSTEM -o recover

26. To initiate service processor failover for a managed system :

# chsysstate -r sys -m MANAGED_SYSTEM -o spfailover

27. To validate or activate a system profile :

# chsysstate -r sysprof -m MANAGED_SYSTEM -n SYS_PROF_NAME --test


28. To change the password of a managed system :

# chsyspwd -t {access | admin | general} -m MANAGED_SYSTEM --passwd Current_Password --newpassword New_Password

Performance Monitoring and Tuning in AIX

Performance Monitoring and Tuning in AIX
Performance Monitoring :

1. How to find out the system-wide memory usage ?
# svmon -G -i 2 5

2. How to list top 10 memory consuming processes ?

You can use any of the below commands
# svmon -Put 10
# ps aux head -1; ps aux sort -rn +3 head

3. How to list top 10 cpu consuming processes ?

# ps aux head -1; ps aux sort -rn +2 head -10

4. What is the best command for general performance monitoring :

# topas

You can even use 'jtopas', which is a java based system monitoring tool.

5. How to start trace for the entire system ?

# trace -a

6. How to stop trace ?

# trcstop

7. Where is the log file for trace tool located ?

/var/adm/ras/trcfile

8. What is the command used to generate trace report from a trace log file ?

# trcrpt

9. How to generate report on utilization statistics related to an LPAR ?

# lparstat

10. How to display the LPAR configuration report ?

# lpstat -i

11. What are the mostly used commands to find the cpu, memory,disk i/o statistics ?

# sar -> CPU, Memory statistics
# vmstat -> CPU, Memory statistics
# iostat -> CPU, Disk I/O satistics
# topas -> CPU, Memory, Network and Disk I/O statistics
# ps aux -> CPU, Memory statistics

12. How to display processes related to a specific user ?

# ps -fu username

13. How to list all the 64bit processes running in a system ?

# ps -efM

14. How to enable Interface Specific Network Options in AIX ?
# no -o use_isno=1

By enabling use_isno option, you can set buffer settings on a specific interface, giving you better control over performance management of network interfaces.

15. What is 'thewall' and how to set ?
'thewall' in AIX defines the upper limit for network kernel buffers.

When running AIX 5L V5.3 running a 32 bit kernel is 1GB or half the size of real memory depending on which of the two is the smallest. If you have AIX 5L V5.3 running a 64bit kernel the size of thewall will be 65GB or half the size of real memory, depending on which of the two is smaller.
To display the size of the the wall,

# no -o thewall

Note:
the size of thewall is static from AIX 5L Version 5.1 and later, and cannot be changed, to reduce the upper limit of memory used for networking make use of the maxmbuf tunable.

16. What is maxbuf tunable variable and how to set it ?

The maxmbuf tunable used by AIX specifies the maximum amount of memory that can be used by the networking subsystem.

It can displayed by using the below command,
# lsattr -El sys0 -a maxbuf

By default the maxmbuf tunable is disabled, it is set to 0, this means that the value of thewall will be used to define the maximum amount of memory used for network communications. By setting a non zero value to maxmbuf will override the value of thewall. This is the only way of reducing the value set by thewall.

The value of maxbuf's is defined by 1Kb units. To set its value to 1GB,
# chdev -l sys0 -a maxmbuf=1000000

17. How to find out the media speed of a network interface ?

# netstat -v ent0 grep Media

18. How to view the statistics for a specific network adapter ?

# entstat -d ent1

You can also use "netstat -v ent1".

19. How to reset the above network statistics ?

# entstat -r ent1

20. How to start iptrace on a specific network adapter ?

To Start :
# startsrc -s iptrace -a "-i en0 iptrc.out" &

To Stop:
# stopsrc -s iptrace

21. How to generate report from the iptrace's output file ?

# ipreport -r -s iptrc.out > ipreport

22. How to get the NFS statistics ?

NFS server RPC statistics : # nfsstat -sr
NFS server NFS statistics : # nfsstat -sn
NFS client RPC statistics : # netstat -cr
NFS client NFS statistics : #netstat -cn
Statistics on mounted file systems : # nfsstat -m
To reset the nfsstat statistics : # nfsstat -z

23. How to list the current values of all the network tunables?

# no -a

24. How to display the current value of a specific network tunable?

# no -o tcp_recvspace

25. How to display all the values (current, default, boot, min, max..) values of a network tunable ?

# no -L tcp_recvspace

26. What is the file that holds the next boot tunables's values ?

/etc/tunables/nextboot

27. What is the file that automatically generated with all the values of the network tunables that were set immediately after the reboot ?

/etc/tunables/lastboot

28. How to change the current value of a network tunable's value as well as add the entry to the /etc/tunables/nextboot file ?

Use the 'p' flag in the no command.

For Ex., # no -p -o tcp_recvspace=16k

29. How to display all the NFS network variables ?

# nfs -a

30. How to enable the collection of disk input/output statistics ?

# chdev -l sys0 -a iostat=true

31. How to display the 5 busiest logical volumes in a VG ?

# lvmstat -v datavg -c 5

32. How to display, enable and disable the statistics collection for a VG ?

To enable: # lvmstat -v datavg -e
To disable: # lvmstat -v datavg -d
To show : # lvmstat -v datavg

33. How to display the statistics for a LV ?

# lvmstat -l lv001

34. How to report disk statistics ?

# sar -d 5 60
Abovc command displays the disk i/o statistics 60 times in 5 sec interval.

35. How to list top 10 real memory consuming processes ?

# svmon -Put 10

36. How to list top 10 paging space consuming processes ?

# svmon -Pgt 10

37. How to list the files opened by a process ?

# svmon -pP Process_id

38. How to find out the memory usage of a specific process ?

# svmon -wP

39. How to display the paging (swap) usage ?

# swap -s allocated = 4718592 blocks used = 1475527 blocks free = 3243065 blocks

#swap -l
device maj,min total free
/dev/paging02 38, 4 4608MB 3166MB
/dev/paging01 38, 3 4608MB 3168MB
/dev/paging00 10, 14 4608MB 3167MB
/dev/hd6 10, 2 4608MB 3167MB

NIM

NIM
Required Filesets:

For Server - bos.sysmgt.nim.master and bos.sysmgt.nim.spot
For Client - bos.sysmgt.nim.client

Few Resource Definitions:

SPOT - Shared Product Object Tree is a directory containing files required to boot a machine and the boot image

LPP_SOURCE - Licensed Program Product source is a directory containing images/filesets that AIX uses to load software

MKSYSB - Mksysb resource used to build a machine

Requirements for NIM Server:

Disk Space :
1. 3 GB per base lpp_source resource
2. 500 MB + per mksysb resource
3. 500 MB per SPOT resource
4. Additional buffer space for future growth

Other Requirements:
# Minimum 512 MB real memory
# 10 or 100 MBPS ethernet adapter

My Recommendations for NIM VG and Filesystems :

1. Create a seperate VG called 'nimvg' with enough space.

2. Create the following filesystems in nimvg based upon your requirement

a. /tftpboot - To hold boot images
b. /export/nim - To hold the resources like SPOT, LPP, Mksysb

Directory Structure :
/export/nim/lpp_source - To hold lpp source resources
/export/nim/spot - To hold spot resources
/export/nim/mksysb - To hold the mksysb backup for clients

Naming Schemes:

Follow the below schemes to easily identify during regular operations :

spot530TL6 - SPOT for AIX V 5.3 TL 6
spot530TL9 - SPOT for AIX V 5.3 TL 9
lpp_source530TL6 - LPP_SOURCE for AIX V 5.3 TL 6
lpp_source530TL9 - LPP_SOURCE for AIX V 5.3 TL 6
client_server1 - Mksysb image of the host server1
client_server2 - Mksysb image of the hsot server2


How to setup the NIM Master :

0. Create the /tftpboot and /export/nim file systems as per yoru requirement

1. Initial setup of NIM Master
a. ODM database
b. Boot Area: /tftpboot directory that is used to store boot files (images)
c. /etc/niminfo - Is the Key configuration file that exists on both master and clients
d. nimesis daemon - This is the daemon which used to communicate with the nim clients

2. Insert the AIX CD into the master server's CD Drive

3. Create LPP_SOURCE and SPOT resources

Commands to manage NIM master and clients:

To setup NIM Server:
# nim_master_setup -B -a device=/dev/cd0 -a file_system=/nim -a volume_group=nimvg

To setup NIM installation in a client:
# smitty nim_bosinst

To view the status of NIM installation in a NIM client:
# lsnim -l client_hostname

To define a lpp_source resource:
# nim -o define -t lpp_source -a source=/dev/cd0 -a server=master -a location=/nim/lpp_source/AIX_5_3_4 AIX_5_3_4

To define a spot resource:
# nim -o define -t spot -a server=master -a location=/export/nim/spot -a source=lpp_source530 spot530
To remove a resource:
# nim -o remove AIX_5_3_4

To initialize a NIM client for diag operation:
# nim -o diag client_hostname

To initialize a NIM client for maintenance operation:
# nim -o maint client_hostname

To unconfigure a NIM server:
# nim -o unconfig master_server

To allocate a SPOT to a NIM client:
# nim -o allocate -a spot=AIX_5_3 client_hostname

To deallocate a SPOT from a NIM client:
# nim -o deallocate -a spot=AIX_5_3 client_hostname

To remove a NIM client after deallocating all its resources:
# nim -o remove client_hostname

To reboot a client:
# nim -o reboot client_hostname

To list all the NIM resources:
# lsnim

To list detailed information about a nim client:
# lsnim -l client_hostname

To list the resources allocated to a NIM client:
# lsnim -c resources client_hostname

NIM
To list all the mksysb resources
# lsnim -t mksysb
# lsnim -t spot
To list all the machines
# lsnim -t standalone
OR
# lsnim -c machines
To reset the NIM status of system host-10
# nim -o reset -a force=yes host-10
or
# nim -Fo reset host10
To Force Deallocate all the resources from system host-01
# nim -Fo deallocate -a subclass=all host-01
To rebuild the /etc/niminfo file in the master
# nimconfig -r
To rebuild the /etc/niminof file in the NIM client
# niminit -a master= -a name=
To remove a machine from the NIM environment
# nim -o remove
To define a mksysb resource
# nim -o define -t mksysb -a server=master -a location=

To enable Base OS install in a client using mksysb resource
# nim -o bos_inst -a source=mksysb -a spot=spot_53ML4 -a accept_licenses=yes
-a mksysb=
To add additional software to lppsource1
# nim -o update -a packages=all source=/dev/cd0 lppsource1
To update the spot and lppsource to the latest level
# nim_update_all -l -s -d -u -B



Some useful NIM SMIT Fast paths
________________________________________
smit nim_mkmac # Adding new machines
smit nim_bosinst # For doing BOS install operation on a machine
Common NIM Error codes
________________________________________
608 - tftp retrieve of client info file failure
Action If a 608 hang is encountered, verify that the ClientName.info file exists in the /tftpboot directory. If it does not exist, retry the NIM operation to create it. If it does exist, verify that tftp access to the /tftpboot directory is not restricted in the /etc/tftpaccess.ctl file. is also possible that the network adapter was not configured properly in the boot environment
611 - Remote mount of NFS file system failure
Action 611 hangs occur when the client machine is unable to mount a resource from a server. Ensure that NFS is running on the resource server. Verify that the resources specified for the operation are exported properly by checking the /etc/exports and /etc/xtab files on the server. Also, confirm that the resources have permissions set correctly for reading.
613 - Failure setting up route tables
Action 613 hangs usually occur because a route is incorrectly defined for a network in the NIM database. Verify that the correct gateways are specified between networks, and all gateways are functional. Use debug-enabled network boot images to determine which routes could not be defined.

Logical Volume Manager :

Logical Volume Manager :
Volume Group
 To create a vg on hdisk1 :
# mkvg -vg newvg hdisk1
 To drain I/O's for a vg and suspends future I/O's :
# chvg -suspend vg03
 To resume normal I/O operations for a vg :
# chvg -resume vg03
 Unlock a VG if left in a locked state by abnormal termination of another lvm operation :
# chvg -unlock vg03
 To add a physical volume to a volume group :
# extendvg vg3 hdisk3
 To remove a PV from a VG :
# reducevg vg01 hdisk1
 To remove a PV and all residing LVs from a VG with no confirmation :
# reducevg –rmlv –f vg01
 To activate a vg :
# activatevg vg03
 To deactivate a vg :
# deactivatevg vg03
 To mirror the VIO Server’s rootvg to hdisk4 and reboots VIO Server :
# mirrorios –force hdisk4
 To mirror the VIO Server’s rootvg to hdisk4 but don’t reboot the server :
# mirrorios –defer hdisk4
 To remove the rootvg mirror from hdisk4 :
# unmirrorios hdisk4
 To import a VG from hdisk07 :
# importvg –vg vg001 hdisk07
 To export a VG :
# exportvg vg3
Note: Volume Group containing a paging space can’t be exported
 To sync a VG :
# syncvg –vg vg01
 To sync a LV :
# syncvg –lv lv001
 To sync a PV :
# syncvg –pv hdisk4 hdisk5
 To redefine a VG based on the VGDA from hdisk04 :
# redefvg –dev hdisk04
Logical Volume :
 To create a logical volume of size 1MB in vg01 :
# mklv –lv lv001 vg01 1M hdisk1
 To create a logical volume with mirror in place in vg01 of size 1GB :
# mklv –mirror vg01 1G
 To extend an LV by 3MB :
# extendlv lv01 3M
 To extend an LV by 1GB with space taken from hdisk5 :
# extendlv lv01 1G hdisk5
 To remove a logical volume :
# rmlv lv05
 To display the properties of a logical volume :
# lslv lv03
 To display info about LV by Physical volume :
# lslv –pv lv03
 To display LVs that can be used as backing devices :
# lslv –free
 To make a copy for lv01 in hdisk03 :
# mklvcopy lv01 hdisk03
 To remove lv01’s copy from hdisk03 :
# rmlvcopy lv01 hdisk03
 To copy the contents of lv01 to lv02 :
# cplv lv01 lv02
 To copy the contents of lv01 to a new lv in vg01 :
# cplv –vg vg01 lv01
 To change the name of oldlv to newlv :
# chlv –lv newlv oldlv
Physical Volume
 To display all physical volumes in the system :
# lspv
 To display the status and characteristics of hdisk03 :
# lspv hdisk03
 To list all the available PVs used as virtual SCSI backing devices :
# lspv –avail
 To list PVs that can be used as virtual SCSI backing devices and are not currently a backing device :
# lspv –free
 To move physical partitions from hdisk1 to hdisk2 :
# migratepv hdisk1 hdisk2
 To move physical partitions in lv01 from hdisk1 to hdisk2 :
# migratepv –lv lv01 hdisk1 hdisk2

USER ADMINISTRATION

USER ADMINISTRATION


Few Restrictions on the User Name:

1. User names cannot start with a
• dash or minus sign(-)
• plus sign (+)
• At symbol (@)
• Tilde (~)
2. User names cannot include
• colon (:)
• single or double quotation marks( ' or ")
• hash symbol (#)
• comma (')
• equal sign
• Back or forward Slashes ( \ or /)
• Question mark (?)
• Back quote (`)
• White space (space or tab)

3. User names cannot be names ALL or default. Becoz those names are reserved for the AIX OS.

4. User names can have max. 8 characters in AIX V 5.2 or earlier. Starting with AIX 5.3, you can have a
max. of 255 characters. You can change this setting by using the below command,

# chdev -l sys0 -a max_logname=255

To view the setting, use any of the below commands

# lsdev -l sys0 -a max_logname
# getconf LOGIN_NAME_MAX


Configuration Files:
/etc/passwd :

Contains the basic user configuration details like user name, password flag, uid, gid, gecos (description), home directory, shell.

/etc/security/.profile :


It is the template for the user's .profile file. It has been copied to the user's home directory when we create the user.

/etc/security/limits :
It contains all the resource limits (ulimits) for the users.

Here are the various ulimit values ...

fsize, fsize_hard - Soft and hard limit for the size of a file a user can create
core, core_hard - Soft and hard limit for the Size of core file a user can create
cpu, cpu_hard - Soft and hard limit for the amount of system time allowed
data, data_hard - Soft and hard limit for the size of the process data segment
stack, stack_hard - Soft and hard limit for the size of the process stack segment
rss, rss_hard - Soft and hard limit for the physical memory allowed
nofiles, nofiles_hard - Soft and hard limit for the number of open file descriptors at one time
nproc, nproc_hard - Soft and hard limit for the number of running processes at one time
/etc/security/passwd :

This file contains the user's password information such as password, lastupdate and flags.

Here are the various flags user

ADMIN - It can be set so that only the root user can change the user's password.

ADMCHG - It can be set so that the user is prompted to change his or her password on the next login/su.

NOCHECK - It can be set so that any additional restrictions in /etc/security/user are ignored.


/etc/security/user : This file contains very very important settings for every user.

Here are the parameters configured in the file for each and every user :

account_locked - To lock the user account. This can takes values TRUE or FALSE

admin - To specify whether the user is admin or not. It can take calues TRUE or FALSE

expires - It is configured to set the expiration date for the user beyond which the user will be locked. It can take values in the format MMDDHHYY.

histexpire - To specify the # of weeks the user can't reuse a password. It can takes values between 0-260

histsize - To specify the # of passwords previously used that can't be reused. It can take values between 0-50

login - To specify whether a user can log in or not. It can take values TRUE or FALSE.

maxage - To specify the # of weeks a password is valid. It can take values between 0-52.
minage - To specify the # of weeks a user must wait before changing his or her password. It can take values between 0-52.

rlogin - To specify whether a user can be accessed remotely via telnet,ssh, ftp. It can take values TRUE or FALSE.

su - To specify whether other user can use su to access this account. It can take values TRUE or FALSE.

/usr/lib/security/mkuser.default : This file contains the default values that are set while creating an user.

/etc/security/login.cfg : This file contains the message that is displayed whenever you login to the system.
You can always change it using chsec command or by editing this file directly in vi editor.


Here are the few attributes of a user which you may be interested.


id - User Identification Number is a unique i dfor every user. root user's id is always 0.

pgrp - Primary Group of a user

groups - Secondary Groups of a user. An user can belong to maximum 128 groups in AIX 5.3 and 6.1.

home - Home directory to store the user's files

shell - Shell that runs when the user login

gecos - Description or some comments about the user


There are 6 main commands used in the administration of user :

mkuser - Add a user
chuser - Change an attribtue of a user
lsuser - List the attribtues of a user
rmuser - Remove a user
passwd - To set password for a user and for various other purposes

These words can also be used as fastpaths for smitty.
For example, # smitty mkuser will open a form to create a user.

For doing the whole user administration, you can use

# smitty user and go thru the menu items for various operations.

Now let us see the commands to administrate users ...

1. To create a user called 'jack' with default settings and allocate the next available uid :

# mkuser jack

2. To create a user with home dir as /opt/$username, primay group as 'dba' :

# mkuser home=/opt/jack pgrp=dba jack

3. To know about the user :

# finger jack

4. To change the primary group for a user :

# chuser pgrp=oracle jack

5. To list the attributes of a user in stanza structure :

# lsuser -f jack

6. To list the attributes of a user delimited by comma :

# lsuser -c jack

7. To list home and shell attributes for the users jack and tom :

# lsuser -a shell home jack,tom

8. To set the password for a newly created user :

# passwd jack

9. To clear the flag ADMCHK for jack :

# pwdadm -c jack

If you dont do this after setting a password for jack, he will be prompted to change his password on the first login.

10. To change the gecoz for a user :

# passwd -f jack

11. To change the shell for a user :

# passwd -s jack

12. To list the last password update date/time and the flags for a user :

# passwd -q jack

13. To set the ADMIN flag for a user :

# passwd -f ADMIN jack

ADMIN flag ensures that only the root user can change the password for Jack.

14. To remove the user :

# rmuser jack

Note: rmsuer doesn't remove the home directory for a user.
You have to remove it may be after the backup.

15. To remove the user along with his password information :

# rmuser -p jack
16. To list the currently logged in users :

# who

Note: This command will show the contents of /etc/utmp which is a binary file.

17. To list the login and logout information for the machine :

# last

Note: This command will show the contents of /var/adm/wtmp file, which is a binary file. Over a period of time, this file will occupy the /var file system a lot. Hence nullify the file once in a 6 months or depending upon the # of login/logout actions in the system.

To clear(nullify) the wtmp file, you can use any of the below commands

# cp /dev/null /var/adm/wtmp
# > /var/adm/wtmp

18. To change the default message(herald) that is shown after user login :

# chsec -f /etc/security/login.cfg -a default -herald

19. As a user, you have to protect (lock) your terminal whenever you go for a coffee break.

# lock -> To lock your telnet or ssh terminal

If you use XWindowsm you can use the below command

# xlock

20. Sometimes you may want to login as root to execute some admin commands. For this you dont have to logout from current user and login as root.You can use su command to swtich user and execute the commands and say 'exit' to come out of the su window.

To su to root, you can use any of the below commands

# su - root
# su -

To su to other user called tom,
# su - tom
These su operations are logged into /var/adm/sulog file. You have to nullify this file on certain period of time to make some space in /var file system.

21. How to disable direct root login via telnet and ssh ?

To disable direct root login thru telnet or ssh, you have to set 'rlogin' attribtue for root user to false.
You can use the below command to do so.

# chuser rlogin=false root

22. How to enforce automatic logoff after certain timeout period ?

To enforce automatic logoff after timeout period of 10 minutes, enter the following line in /etc/security/.profile after the AIX installation.

TMOUT=600 ; TIMEOUT=600 ; export readonly TMOUT TIMEOUT

/usr/bin/mkuser Contains the mkuser command.
/usr/lib/security/mkuser.default
Contains the default values for new users.
/etc/passwd
Contains the basic attributes of users.
/etc/security/user
Contains the extended attributes of users.
/etc/security/user.roles
Contains the administrative role attributes of users.
/etc/security/passwd
Contains password information.
/etc/security/limits
Defines resource quotas and limits for each user.
/etc/security/environ
Contains the environment attributes of users.
/etc/group
Contains the basic attributes of groups.
/etc/security/group
Contains the extended attributes of groups.
/etc/security/.ids Contains standard and administrative user IDs and group IDs.
/usr/bin/passwd Contains the passwd command.
/etc/passwd Contains user IDs, user names, home directories, login shell, and finger information.
/etc/security/passwd Contains encrypted passwords and security information.
/usr/bin/chuser Contains the chuser command.
/etc/passwd
Contains the basic attributes of users.
/etc/group
Contains the basic attributes of groups.
/etc/security/group
Contains the extended attributes of groups.
/etc/security/user
Contains the extended attributes of users.
/etc/security/user.roles
Contains the administrative role attributes of users.
/etc/security/lastlog
Contains the last login attributes of users.
/etc/security/limits
Defines resource quotas and limits for each user.
/etc/security/audit/config
Contains audit configuration information.
/etc/security/environ
Contains the environment attributes of users.