questions on SAS installer account

[SASWayne]

Hi All,

I'd like to know what are all the places in a SAS environment that are tied up internally with the SAS installer account?

Would I be able to start/stop SAS services with installer account even after removing its identity from SAS metadata?

I'm trying to remove the installer account from everywhere within SAS except for start/stop of SAS services, is it possible to achieve?

Thanks! 

[Kurt_Bremser]

What is the reason for fiddling around with something that might possibly render your SAS installation inoperable?

[SASWayne]

The reason is to have two separate installer accounts for test and prod environments.

Now that the environments are built already with the same installer account, we want to atleast minimize the utilization of installer account in test environment. We have created another service account (to use instead of SAS installer account) with same OS level privileges of the installer account and we want to use that account for all SAS admin and monitoring operations.

So if I remove the SAS installer account's metadata profile, would I still be able to start/stop services with it?

How could I achieve very minimal usage of the original installer account?

[SASKiwi]

Why do you use the installer account to stop and start services? Any account with admin privileges is able to do that. 

[SASWayne]

@SASKiwi

isn't it the best practice to use SAS installer account to start/stop SAS services?
Please advise me if I'm wrong.

By admin privileges do you mean at OS level?
I've never used another account than SAS installer to start/stop SAS services.

[SASKiwi · Accepted solution]

IMHO, best practice is to use the SAS installer account just for installing and configuring and nothing else. Then have another SAS server account (often called sassrv) for running SAS servers, then a SAS admin account (often called sasadm) for administration. Of course things can be a bit more granular than that to suit your SAS site.

As a SAS administrator myself I don't have any problem just using my own account for manually starting and stopping services.

[Anand_V]

Why was SAS installer account added to metadata in first place? I don't think it's required. Unless you are using platform web services component for LSF and the configuration ID for LSF is not as same as well the SAS installer account.

Also, it's fine to use a single installer account for both the environments. SAS Admin activities can be done using the internal sasadm@saspw account, if you have multiple admins at your site, you can create individual system accounts for them and add to SAS Administrator group so they can use their IDs instead of internal account, still starting/stopping of services you will have to use the installer account itself.

[SASWayne]

Thank you @SASKiwi and@Anand_V for your suggestions, we are planning to remove SAS installer from metadata. For some reason, SAS installer account gets locked often from one of the test servers and that's the reason we're planning to have separate ones for prod and test.

@Anand_V I'm curious to know if we could use other user accounts with admin privileges to start/stop services? (as suggested by @SASKiwi ).

Do you think doing so would cause any undesirable effects?

Thanks!

[Anand_V]

I haven't tried it myself as I was never in a scenario where there is a requirement to vault or not use the installer account to start/stop services. If @SASKiwi has done it successfully I am sure you can give it a try too!

[JuanS_OCS]

Please be careful with permissions and users who start/stop services.

Lock/pid files and log files with different owners and permissions can cause those "undesirable" situations.

[SASWayne]

@JuanS_OCS, I agree, we're replicating a new admin service account with the same folder and group level accesses of the original SAS installer account. Hope that it doesn't cause any issue.

[JuanS_OCS]

Good luck!

[SASWayne]

@JuanS_OCS @Anand_V @SASKiwi
Just a quick question

Does LIM starts vemkd and egosc with the same account used to start LIM?

Thanks

[JuanS_OCS]

@SASWayne , I would say by default, it does, with the same account. However, perhaps design or installed had to decide otherwise. The best you can do is to check what account generated the logs/temp files for each daemon,