How to suppress license manager shutdown from a remote machine.
Topic:
A user on a remote
license client machine can run the
lmdown command if
lmgrd is started without any flags to prevent this functionality. Once the remote
license client has issued the
lmdown command, the
lmgrd on the
license server will stop running.
Method 1:
To suppress the use of lmdown functionality to shut down for a particular instance of lmgrd, fromany machine, start
lmgrd with the
-x lmdown switch:
lmgrd -x lmdown -c /usr/local/rsi/license/license.dat
Note that running
lmgrd -x lmdown disables the
lmdown command from any machine, including from the license server machine itself. To be able to shut down the license manager after it has been started using
lmgrd -x lmdown, the process ID of that lmgrd process must be killed with the system
kill command (
not kill -9 ). The companion idl_lmgrd process will then be automatically terminated by this approach.
Method 2:
Another possible method to prevent unauthorized use of lmdown (and lmreread and lmremove) by a remote client is to create a license group and restrict permissions on the FLEXlm binaries:
- Create a UNIX group called 'lmadmin'. (Refer to the UNIX documentation for information about creating a UNIX group.)
- Change the ownership and permissions of the lmreread, lmdown, and lmremove commands to restrict usage to the lmadmin group. (Refer to the UNIX documentation for file permissions.)
- Use the -2 -p switch for lmgrd ( lmgrd -2 -p ). By default, 'lmgrd -2 -p' prevents non-root users from issuing the lmdown command for the license manager.
If the UNIX "lmadmin" group is present then only members of the lmadmin group can issue the lmdown, lmreread and lmremove commands. If 'root' is not a member of the 'lmadmin' group then root will not be able to use the commands.
Method 3:
To suppress the use of lmdown from remote machines, but continue to allow the lmdown command to be used locally on the license server machine, start lmgrd with the -local switch:
lmgrd -local -c /usr/local/rsi/license/license.dat