topic Re: questions on SAS installer account in Administration and Deployment

questions on SAS installer account

SASWayne — Mon, 07 Sep 2020 16:38:29 GMT

Hi All,

I'd like to know what are all the places in a SAS environment that are tied up internally with the SAS installer account?

Would I be able to start/stop SAS services with installer account even after removing its identity from SAS metadata?

I'm trying to remove the installer account from everywhere within SAS except for start/stop of SAS services, is it possible to achieve?

Thanks!

Re: questions on SAS installer account

Kurt_Bremser — Mon, 07 Sep 2020 18:03:13 GMT

What is the reason for fiddling around with something that might possibly render your SAS installation inoperable?

Re: questions on SAS installer account

SASWayne — Tue, 08 Sep 2020 02:33:40 GMT

The reason is to have two separate installer accounts for test and prod environments.

Now that the environments are built already with the same installer account, we want to atleast minimize the utilization of installer account in test environment. We have created another service account (to use instead of SAS installer account) with same OS level privileges of the installer account and we want to use that account for all SAS admin and monitoring operations.

So if I remove the SAS installer account's metadata profile, would I still be able to start/stop services with it?

How could I achieve very minimal usage of the original installer account?

Re: questions on SAS installer account

SASKiwi — Tue, 08 Sep 2020 03:03:44 GMT

Why do you use the installer account to stop and start services? Any account with admin privileges is able to do that.

Re: questions on SAS installer account

SASWayne — Tue, 08 Sep 2020 03:21:19 GMT

@SASKiwi

isn't it the best practice to use SAS installer account to start/stop SAS services?
Please advise me if I'm wrong.

By admin privileges do you mean at OS level?
I've never used another account than SAS installer to start/stop SAS services.

Re: questions on SAS installer account

SASKiwi — Tue, 08 Sep 2020 03:53:10 GMT

IMHO, best practice is to use the SAS installer account just for installing and configuring and nothing else. Then have another SAS server account (often called sassrv) for running SAS servers, then a SAS admin account (often called sasadm) for administration. Of course things can be a bit more granular than that to suit your SAS site.

As a SAS administrator myself I don't have any problem just using my own account for manually starting and stopping services.

Re: questions on SAS installer account

AnandVyas — Tue, 08 Sep 2020 13:14:45 GMT

Why was SAS installer account added to metadata in first place? I don't think it's required. Unless you are using platform web services component for LSF and the configuration ID for LSF is not as same as well the SAS installer account.

Also, it's fine to use a single installer account for both the environments. SAS Admin activities can be done using the internal sasadm@saspw account, if you have multiple admins at your site, you can create individual system accounts for them and add to SAS Administrator group so they can use their IDs instead of internal account, still starting/stopping of services you will have to use the installer account itself.

Re: questions on SAS installer account

SASWayne — Thu, 10 Sep 2020 07:54:01 GMT

Thank you @SASKiwi and@AnandVyas for your suggestions, we are planning to remove SAS installer from metadata. For some reason, SAS installer account gets locked often from one of the test servers and that's the reason we're planning to have separate ones for prod and test.

@AnandVyas I'm curious to know if we could use other user accounts with admin privileges to start/stop services? (as suggested by @SASKiwi ).

Do you think doing so would cause any undesirable effects?

Thanks!

Re: questions on SAS installer account

AnandVyas — Thu, 10 Sep 2020 08:30:31 GMT

I haven't tried it myself as I was never in a scenario where there is a requirement to vault or not use the installer account to start/stop services. If @SASKiwi has done it successfully I am sure you can give it a try too!

Re: questions on SAS installer account

JuanS_OCS — Thu, 10 Sep 2020 08:31:19 GMT

Please be careful with permissions and users who start/stop services.

Lock/pid files and log files with different owners and permissions can cause those "undesirable" situations.

Re: questions on SAS installer account

SASWayne — Thu, 10 Sep 2020 08:38:03 GMT

@JuanS_OCS, I agree, we're replicating a new admin service account with the same folder and group level accesses of the original SAS installer account. Hope that it doesn't cause any issue.

Re: questions on SAS installer account

JuanS_OCS — Fri, 11 Sep 2020 07:09:30 GMT

Good luck!

Re: questions on SAS installer account

SASWayne — Sat, 12 Sep 2020 12:35:49 GMT

@JuanS_OCS @AnandVyas @SASKiwi
Just a quick question

Does LIM starts vemkd and egosc with the same account used to start LIM?

Thanks

Re: questions on SAS installer account

JuanS_OCS — Mon, 14 Sep 2020 09:43:17 GMT

@SASWayne , I would say by default, it does, with the same account. However, perhaps design or installed had to decide otherwise. The best you can do is to check what account generated the logs/temp files for each daemon,