Below is the procedure for changing the passwords on a Unified VNX on both the block and file sides.
Please note that Changing the Global VNX administrator password can cause communication failures between the Control Station and the array, the issue is documented in emc261195 and is the reason I’m adding this post, I was researching how to avoid the issue. The article notes that in DART OS versions newer than v7.0.14 the synchronization was automated and the cached credentials are updated automatically, in DART OS v7.0.14 and prior you must do it manually on the active control station.
Whenever a change is made to the active Control Station always verify that the standby control station configuration matches on takeover. Takeover is initiated by the standby control station, failover is initiated by the active control station. As an example, if the time zone is changed on the active control station it is not part of the synchronization during the failover process. Time zone changes needs to be configured separately on each one and is a setting that requires a reboot to take effect. Unisphere will prompt you to do so as a reminder, however on takeover/failover the newly promoted control station never reboots.
Block Side: Change the sysadmin global domain account
A) Updating global domain account password
1) Log into Unisphere with the sysadmin global account, using the control station IP
2) From the “All Systems” page select “Domains”
3) Select “Manage Global Users”
4) Highlight sysadmin and click on “Modify”
5) Change the password
B) Update Security on Control Station
1) Open a putty session to the primary control station and run the commands below. They should be as is, however a possible exception would be the first 2 might make you add userid/password info before it would be accepted (add -user sysadmin –password “pswd ” –scope 0 to the commands below).
/nas/sbin/naviseccli -h spa -AddUserSecurity -user sysadmin -scope 0
/nas/sbin/naviseccli -h spb -AddUserSecurity -user sysadmin -scope 0
nas_storage –modify id=1 –security
C) Verify the updated sysadmin password in the following locations:
1) Via Unisphere (Log in with the newly changed password)
2) Verify communication between the control station and storage processors on each array:
* Log in to the active control station via putty using the nasadmin local account
* Run the following commands:
/nas/sbin/navicli -h SPA getagent
nas_storage -check -all
The NAS storage check command should respond with “done”.
File Side: Change the nasadmin and root local accounts
A) Local accounts need to be modified on each array individually
1) Log into Unisphere with the sysadmin global account
2) Select the desired array
3) Click on “Settings” -> “Security” -> “Local Users for File”
4) Highlight nasadmin click on “Properties”
5) Change the password
6) Highlight root, click on Properties
7) Change the password
Note that the password for the local nasadmin and root accounts can also be changed from the CLI:
[root@fakevnxprompt ~]# passwd nasadmin Changing password for user nasadmin. New UNIX password: <enter a password> BAD PASSWORD: it is based on a dictionary word Retype new UNIX password: passwd: all authentication tokens updated successfully. [root@fakevnxprompt ~]#
B) Verify both passwords
1) Log in to the active control station via putty as nasadmin, verify your newly changed password
2) run the su command and verify your newly changed root password
C) Propagate changes to the standby control station
At this point the standby control station local account passwords have not yet been updated. It’s now time to test control station failover. You can review one of my related prior blog posts on control station failover here.
1) While logged in to the active control station with root privileges, run this command:
/nas/sbin/cs_standby -failover
This will synchronize the control stations, reboot the active control station, and then make the standby control station active.
Caveats: Please note the expected issues listed below as part of out-of-band communication without an online, active control station:
* In-band production data will not be disrupted
* Data mover failover cannot occur
* Auto-extension of filesystems will not occur
* Scheduled checkpoints will not occur
* Replication sessions may be disrupted
2) Log in to the active control station (the previous standby control station)
3) Verify the new nasadmin password
4) su and verify the root password
5) Fail back to the original primary control station:
/nas/sbin/cs_standby -failover
