topic Re: SAS EXTERNAL ACCOUNTS in Administration and Deployment

SAS EXTERNAL ACCOUNTS

Achraf_Ougdal — Fri, 05 May 2023 19:15:29 GMT

Hello,

I'm sorry if my question is a bit trivial :
Can the SAS installer account and the sas spawned account be the same ? Or I should use different users for each account ?

I already found that the spawned & the first user account should be different but what about the installer & the spawned.

Thank you.

Re: SAS EXTERNAL ACCOUNTS

gwootton — Fri, 05 May 2023 19:17:58 GMT

These should be different, user processes run as the spawned account.

Re: SAS EXTERNAL ACCOUNTS

PaulHomes — Fri, 05 May 2023 22:53:11 GMT

As @gwootton says they should be different accounts. To add some security context, the SAS installer account (e.g. sas) is the owner of the installed software and deployments and can therefore make changes to them. The SAS Spawned Servers account (e.g. sassrv) is the process owner for spawned processes for shared services like the SAS Stored Process Server and SAS Pooled Workspace Server. If one were to use the same account for sas and sassrv then you have the possibility that an unprivileged user could author a stored process which when executed could make changes to the installed SAS software, configuration files and running SAS server processes. For example, among many other things, they could write a stored process to make themselves a unrestricted user by writing to the adminUsers.txt file (owned by the SAS Installer) and restarting the SAS Metadata Server.

Re: SAS EXTERNAL ACCOUNTS

Achraf_Ougdal — Sat, 06 May 2023 20:10:16 GMT

So if I'm getting it right, they should be different accounts for security purposes. But during the installation process it won't have an impact on (installation error for example).

Re: SAS EXTERNAL ACCOUNTS

PaulHomes — Sat, 06 May 2023 21:08:32 GMT

I can't say I have ever tried the install with them as the same external account, so cannot say whether it would cause any installation errors. I would recommend against it regardless, as the work to undo it after installation would be more effort than creating an extra account in the first place.

Re: SAS EXTERNAL ACCOUNTS

Achraf_Ougdal — Sat, 06 May 2023 21:46:49 GMT

I understand, thank you so much for your help. I really appreciate it 🙏🙏

Re: SAS EXTERNAL ACCOUNTS

AhmedAl_Attar — Sat, 06 May 2023 23:16:58 GMT

Hi @Achraf_Ougdal

Not sure if you have seen/read this before SAS® 9.4 Intelligence Platform: Installation and Configuration Guide, Second Edition

If you had not read it already, I would highly recommend making the time to do that.

Hope this helps

Re: SAS EXTERNAL ACCOUNTS

Kurt_Bremser — Sun, 07 May 2023 05:53:31 GMT

During the installation phase, you only need the installer account. But as soon as you start the configuration phase, the external accounts must be there, and you clearly need them to be separate, for (IMO very obvious) security reasons.

Out of experience, I have done my SAS setups in two separate, discrete stages: install and configuration. That way a problem during configuration (where problems are much more likely) does not cause a complete rollback of the installation.