arsstash - Revision history

Jderrick: /* Related Articles */

2024-08-20T18:09:59Z

← Older revision		Revision as of 18:09, 20 August 2024
Line 7:		Line 7:
	[http://www.ibm.com/support/knowledgecenter/SSEPCD_9.5.0/com.ibm.ondemand.administeringmp.doc/arsstash.htm IBM Knowledge Center - arsstash]		[http://www.ibm.com/support/knowledgecenter/SSEPCD_9.5.0/com.ibm.ondemand.administeringmp.doc/arsstash.htm IBM Knowledge Center - arsstash]

	[~~http~~://~~www~~.~~odusergroup.org/forums~~/index.php?topic=1168.0 ODUG Forums - OnDemand User Group - ars.stash usage]		[https://ODUG.net/index.php?topic=1168.0 ODUG Forums - OnDemand User Group - ars.stash usage]

	[https://developer.ibm.com/answers/questions/192390/what-is-the-stash-file-used-for-in-cmod.html What is the stash file used for in IBM CMOD?]		[https://developer.ibm.com/answers/questions/192390/what-is-the-stash-file-used-for-in-cmod.html What is the stash file used for in IBM CMOD?]

Jderrick: Updated link to ars.cfg

2020-10-20T21:29:03Z

Updated link to ars.cfg

← Older revision		Revision as of 21:29, 20 October 2020
Line 11:		Line 11:
	[https://developer.ibm.com/answers/questions/192390/what-is-the-stash-file-used-for-in-cmod.html What is the stash file used for in IBM CMOD?]		[https://developer.ibm.com/answers/questions/192390/what-is-the-stash-file-used-for-in-cmod.html What is the stash file used for in IBM CMOD?]

	[[ars.cfg\| Parameters ~~related to CMOD stash files in ars.cfg~~]]		[[ars.cfg\| IBM CMOD Configuration Parameters Reference]]

	== Criticism ==		== Criticism ==

Jderrick: Formatting.

2018-03-25T10:43:06Z

Formatting.

← Older revision		Revision as of 10:43, 25 March 2018
Line 73:		Line 73:
	: On systems with remote databases or forced password authentication, store the DB2 database User ID & password.		: On systems with remote databases or forced password authentication, store the DB2 database User ID & password.

	: 9		; 9
	: On systems with remote databases or forced password authentication, store the Oracle database User ID & password.		: On systems with remote databases or forced password authentication, store the Oracle database User ID & password.

Jderrick: Completed first draft of arsstash article.

2017-03-07T15:26:10Z

Completed first draft of arsstash article.

← Older revision		Revision as of 15:26, 7 March 2017
Line 86:		Line 86:
	For more information about configuring stash files for multiple CMOD servers, see the [[ars.ini]] page.		For more information about configuring stash files for multiple CMOD servers, see the [[ars.ini]] page.

	== ~~Using multiple stash files~~ ==		=== arsstash environment variables ===

	=~~= Assigning a~~ stash ~~file per-user ==~~		All of the parameters defined in the OnDemand [[ars.ini]] and [[ars.cfg]] files are used as 'Environment Variables'. You can replace these environment variables at any time by 'exporting' them from your UNIX/Linux shell:
			export SRVR_OD_STASH=/home/odadmin/config/ars.stash

	~~=== arsstash environment variables ===~~		This way, you can use an alternate User ID and password for any commands issued by the CMOD Administrator account on the interactive command line. This is useful for complying with regulatory and audit requirements for specific industries.

Jderrick: Added info on configuring the IBM CMOD stash file.

2017-03-07T15:21:50Z

Added info on configuring the IBM CMOD stash file.

← Older revision		Revision as of 15:21, 7 March 2017
Line 78:		Line 78:
	If you don't specify the -u option with an action, OnDemand will display the currently assigned User ID stored in the stash file, and update the password.		If you don't specify the -u option with an action, OnDemand will display the currently assigned User ID stored in the stash file, and update the password.

	== Configuring ars.~~cfg~~ for ars.stash ==		== Configuring ars.ini for ars.stash ==

	After the stash file is creates and contains the required credentials, you must configure IBM CMOD to use the stash file by modifying the ars.~~cfg~~ configuration file to specify which stash file to use.		After the stash file is creates and contains the required credentials, you must configure IBM CMOD to use the stash file by modifying the ars.ini configuration file to specify which stash file to use.

			SRVR_OD_STASH=/opt/IBM/ondemand/V9.5/config/ars.stash

			For more information about configuring stash files for multiple CMOD servers, see the [[ars.ini]] page.

	== Using multiple stash files ==		== Using multiple stash files ==

Jderrick: /* Related Articles */

2017-03-04T17:01:01Z

← Older revision		Revision as of 17:01, 4 March 2017
Line 10:		Line 10:

	[https://developer.ibm.com/answers/questions/192390/what-is-the-stash-file-used-for-in-cmod.html What is the stash file used for in IBM CMOD?]		[https://developer.ibm.com/answers/questions/192390/what-is-the-stash-file-used-for-in-cmod.html What is the stash file used for in IBM CMOD?]

			[[ars.cfg\| Parameters related to CMOD stash files in ars.cfg]]

	== Criticism ==		== Criticism ==

Jderrick: A little more detail on the usage of the IBM CMOD arsstash command.

2017-03-04T16:59:42Z

A little more detail on the usage of the IBM CMOD arsstash command.

← Older revision		Revision as of 16:59, 4 March 2017
Line 2:		Line 2:
	The IBM CMOD arsstash command allows for the storage of user credentials (User ID & Password) in an encrypted format, which meets many organizations requirement for storing authentication information securely (i.e., non-plain text files like shell scripts or files protected only by Operating Systems permissions). Stash files replace the arsload.cfg configuration file used in versions of IBM Content Manager OnDemand prior to V9.0.		The IBM CMOD arsstash command allows for the storage of user credentials (User ID & Password) in an encrypted format, which meets many organizations requirement for storing authentication information securely (i.e., non-plain text files like shell scripts or files protected only by Operating Systems permissions). Stash files replace the arsload.cfg configuration file used in versions of IBM Content Manager OnDemand prior to V9.0.

	arsstash can be used to store credentials for the [[arsload]] utility, OnDemand ~~Report~~ Distribution, LDAP, or database passwords. This allows automated scripts to access Content Manager OnDemand without having to store passwords in clear-text inside shell scripts or files.		arsstash can be used to store credentials for the [[arsload]] utility, OnDemand Distribution Facility, LDAP, or database passwords. This allows automated scripts (like scheduled jobs) to access Content Manager OnDemand without having to store passwords in clear-text inside shell scripts or files.

	== Related Articles ==		== Related Articles ==
Line 43:		Line 43:
	=== arsstash -a parameter ===		=== arsstash -a parameter ===
	The -a parameter defines the action to be taken.		The -a parameter defines the action to be taken.

			; 1
			: Stores an IBM CMOD User ID and password for usage with [[arsdoc]], [[arsadmin]], and other Content Manager OnDemand commands.

			; 2
			: Deletes a previously stored User ID and password combination from the arsstash file.

			; 3
			: Stores an IBM CMOD User ID and password pair for usage with the [[arsload]] command.
			: It is STRONGLY RECOMMENDED that you do not use the IBM CMOD Admin password with this option. Instead, create a new user, and assign it permission to add documents to specific Application Groups.

			; 4
			: Stores a User ID & password for use with the IBM OnDemand Distribution Facility ("ODF").

			; 5
			: Stores a User ID & password for use with the IBM CMOD Report Distribution Facility.
			: The functionality of RDF has been integrated into ODF starting in Content Manager OnDemand v9.0.

			; 6
			: Stores a User ID & password for use with PDD

			; 7
			: Stores a User ID & password for use with Lightweight Directory Access Protocol
			: LDAP intergration with CMOD allows you to authenticate passwords from a central respository.

			; 8
			: On systems with remote databases or forced password authentication, store the DB2 database User ID & password.

			: 9
			: On systems with remote databases or forced password authentication, store the Oracle database User ID & password.

			If you don't specify the -u option with an action, OnDemand will display the currently assigned User ID stored in the stash file, and update the password.

			== Configuring ars.cfg for ars.stash ==

			After the stash file is creates and contains the required credentials, you must configure IBM CMOD to use the stash file by modifying the ars.cfg configuration file to specify which stash file to use.

			== Using multiple stash files ==

			== Assigning a stash file per-user ==

			=== arsstash environment variables ===

Jderrick: Initial draft of IBM CMOD arsstash article.

2017-03-04T15:58:34Z

Initial draft of IBM CMOD arsstash article.

New page

{{TOCright}}
The IBM CMOD arsstash command allows for the storage of user credentials (User ID & Password) in an encrypted format, which meets many organizations requirement for storing authentication information securely (i.e., non-plain text files like shell scripts or files protected only by Operating Systems permissions). Stash files replace the arsload.cfg configuration file used in versions of IBM Content Manager OnDemand prior to V9.0.

arsstash can be used to store credentials for the [[arsload]] utility, OnDemand Report Distribution, LDAP, or database passwords. This allows automated scripts to access Content Manager OnDemand without having to store passwords in clear-text inside shell scripts or files.

== Related Articles ==
[http://www.ibm.com/support/knowledgecenter/SSEPCD_9.5.0/com.ibm.ondemand.administeringmp.doc/arsstash.htm IBM Knowledge Center - arsstash]

[http://www.odusergroup.org/forums/index.php?topic=1168.0 ODUG Forums - OnDemand User Group - ars.stash usage]

[https://developer.ibm.com/answers/questions/192390/what-is-the-stash-file-used-for-in-cmod.html What is the stash file used for in IBM CMOD?]

== Criticism ==
The cryptographic method(s) used to protect the stash file aren't clearly documented in the IBM CMOD V9.0 documentation. It's unknown if an attacker that was able to obtain a copy of the stash file (either by obtaining access through a user account, or by a side-channel such as stolen backup tapes) could decrypt the stash file and use the credentials to access the CMOD server. Most production installs simply assign IBM CMOD System Administrator privileges to an 'ARSLOAD' user, or store the admin password in the stash file -- making any potential compromise of the IBM CMOD stash file providing an attacker with total and complete control of the Content Manager OnDemand server.

== Upgrading from arsload.cfg to ars.stash ==
In IBM CMOD V9.0 and higher, using the arsload.cfg file is deprecated, and will produce warnings on the system console, and in the OnDemand System Log. Simply delete the existing arsload.cfg file, and follow the instructions for creating a new stash file.

== arsstash parameters ==
Here is the online help for arsstash:

ARS1600I Usage: arsstash [-a <action>] [-c] -s <stash_file> -u <userid>
Version: 9.5.0.6
-a <action> Action to perform
1 - Store the OnDemand userid and password (default)
2 - Delete the OnDemand userid and password
3 - Store the OnDemand userid and password for ARSLOAD
4 - Store the OnDemand userid and password for ODF
5 - Store the OnDemand userid and password for RDF
6 - Store the OnDemand userid and password for PDD
7 - Store the LDAP userid and password
8 - Store the DB2 userid and password
9 - Store the Oracle userid and password
If no userid (-u) is given for actions 3 thru 9, then
the currently assigned userid for the corresponding
OnDemand command or database will be displayed
-c Create stash file
-s <stash_file> Stash file name
-u <userid> Userid
-1 <trace_file> Trace file
-2 <trace_level> Trace level

=== arsstash -a parameter ===
The -a parameter defines the action to be taken.