Agent Post-installation Procedures

The following guidelines and procedures describe the required and optional steps that you must perform after you install an Agent:

To avoid performance issues, BMC recommends that you work with your IT or security personnel to prevent your anti-virus software from scanning the following items:

Windows Agent Service

By default, the Windows Control-M/Agent service is configured to start as a Local System account and has limited access to Windows services. If you configure the Control-M/Agent service as an Administrator under This Account, you enable the Agent to access network resources and as Log in as to order jobs as a Run as UserClosed An OS account name that is used to execute jobs on the host..

The following list describes required and optional post-installation guidelines for a Windows Agent.

  • To enable a different user to start up the Agent Windows service, such as a local OS or domain user, or a group Managed Service Account (gMSA), you must define that user as a member of the Local Administrative Group (<Domain>\<User>).

    gMSA users can run Agent-based jobs, but they cannot run and execute jobs on Agentless Hosts.

    To configure a gMSA account on a Windows Server, see KA000263820.

    For complete gMSA user setup and configuration instructions, see the Microsoft documentation.

  • The Administrator that is defined as part of This Account must have the following permissions in the Local Security Policy > Local Policies > User Rights Assignment section (run command: secpol.msc):

    • Adjust memory quotas for a process.

    • Replace a process level token.

    • Act as Part of Operating System.

    • Log on as a batch job.

    • Log on as a service permissions.

    • Back up files and directories

    • Restore files and directories

    • Impersonate a client after authentication

    If an Agent is configured to run under This Account, see Security Parameters.

  • If you have modified the Agent Windows service properties or changed the Log in as option to Local System account or This account, you must terminate all Agent processes before new jobs can runClosed A Control-M process that adds your job to the Run Queue of the day, according to automatic or manual scheduling, and which enables the job to execute after it fulfills its prerequisites. with the new Log in details.

  • If the Agent service is defined as This Account, the Agent Run as User must have List Folder Contents permissions on the Agent drive.

Configuring SELinux on the Agent

This procedure describes how to configure SELinux on an Agent if you are using SELinux custom settings, which might restrict the Agent path. If you are using default settings, Agent functionality is not affected.

Begin

  1. Run the following commands on the affected path:

    • semanage fcontext -a -t textrel_shlib_t $HOME/ctm/exe

    • restorecon -v $HOME/ctm/exe

    • semanage fcontext -a -t bin_t "$HOME/ctm/scripts(/.*)?"

    • restorecon -Rv $HOME/ctm/scripts

  2. Do one of the following, based on the relevant Linux distribution and version:

Enabling Agent Startup on SELinux on SUSE 16 and RHEL on IBM Z

This procedure describes how to enable the Agent to start up on SELinux on SUSE 16 and RHEL on IBM Z.

Begin

  • Do one of the following, based on your security requirements:

    • Toggle On the Global SELinux Boolean: Run the following command to toggle on the global SELinux boolean policy, which enables all system services to transition to user domains when you run privileged identity-switching commands, such as su, runuser, and sudo -u <Username>:

      sudo setsebool -P unconfined_service_transition_to_unconfined_user 1

    • Create a Custom SELinux Policy Module: Do the following to create a custom policy module that enables only the Control-M/Agent service to start up in SELinux:

      1. Run the following command to generate the custom policy module:

        sudo ausearch -m AVC -ts recent | audit2allow -M ctmag_su

      2. Run the following command to install the custom policy module:

        sudo semodule -i ctmag_su.pp

      3. Run the following command to restart the Control-M/Agent service:

        sudo systemctl restart ctmag.service

Enabling Agent for Non-Root Mode

This procedure describes how to enable an Agent for non-root mode jobs that are owned by a user who is different from the one running the Agent.

If the only jobs run are owned by the same user that runs the Agent, it is not necessary to take any action to set up non-root operation mode.

Begin

  1. Log in as the root user and run the set_agent_mode script with the enable non root mode option on each installed Agent. You only need to run the script once for each Agent.

  2. Define a Run as User password for each Run as User that is used by the Agent, as described in Adding a Run as User.

  3. For an upgrade installation, you must replace the automatic startup script on each Agent host to reflect its root or non-root status.

    You can toggle between root and non-root mode on any Agent by shutting down the Agent from the user that is currently running the Agent, and then re-starting the Agent with the user necessary for the new mode.

Configuring the Automatic Start-Up and Shut-Down Procedure for Linux Agents

This procedure describes how to configure the automatic start-up and shut-down procedure for Linux Agents.

Begin

  1. Log in as the root user.

  2. Navigate to the following to location:

    <Root_User_Home>etc/systemd/system/

  3. Create a new unit service file, as follows:

    1. Create a new unit service file with the following extension:

      .service, such as ctmag.service

    2. Set the file permissions to rw-r--r-- (Octal mode: 644).

    3. Open the file in a text editor and type the following:

      Copy 
      [Unit]
      Description=Control-M Agent
      [Service]
      Type=forking
      RemainAfterExit=yes
      ExecStart=[agent_home_dir]/ctm/scripts/rc.agent_user start
      ExecStop=[agent_home_dir]/ctm/scripts/rc.agent_user stop 
      [Install]
      WantedBy=multi-user.target

  4. Save the file.

  5. Run the following commands:

    systemctl daemon-reload

    systemctl enable [unit service file].service

  6. Restart the Agent.

Configuring the Automatic Start-Up Procedure for AIX Agents

This procedure describes how to configure the automatic AIX Agent start-up procedure.

Begin

  1. Log in as a privileged root user.

  2. Run the following command:

    cp <Agent_Home>/ctm/scripts/rc.agent_user /etc/<Agent_User>

  3. Do the following:

    1. Run the following command to verify the execution permissions:

      -rwxr-xr-x

      The following response must appear: 

      ls -la /etc/<Agent_User>

    2. If ls -la /etc/<Agent_User> does not appear, run the following command:

      chmod 755 /etc/<Agent_User>

  4. Open the /etc/inittab file in a text editor, and add the following line:

    <Agent_User>:2:once:/etc/<Agent_User>

    • The following command is run on user Agent_1:

      cp /home/agent1/ctm/scripts/rc.agent_user /etc/Agent_1

    • The following line is added to the /etc/inittab file:

      agent1:2:once:/etc/Agent_1

Configuring Western European Language Support on Linux

This procedure describes how to configure Western European language support on Linux. You must update the locale to the same value on every host or Linux account.

Begin

  1. Run the following command:

    locale -a

  2. Define the required values in the .cshrc or profile file, as described in Linux Environment Variables for West European Languages.

    LC_ALL=

    LC_CTYPE=de_DE.ISO8859-1

    LANG=de_DE.ISO8859-1

    LC_COLLATE=C

    LC_MESSAGES=C

  3. Run the following command:

    source ~/.cshrc

Linux Environment Variables for West European Languages

The following table lists the environment variables and values that you must use to define Western European language support on Linux hosts, as described in Configuring Western European Language Support on Linux.

Environment Variable

Description

LC_ALL

"" (empty string)

Set this variable by adding setenv LC_ALL "" to the .cshrc or .profile file

LC_CTYPE and LANG

The value of the required language locale for Linux

  • setenv LC_CTYPE localeName

  • setenv LANG localeName

LC_COLLATE

C for all languages (or c, as defined on the host)

To determine whether the C locale is present, use the locale -a command. If the C (or c) locale is not present, you can use POSIX or one of the English locales that appear in the previous table.

To define this variable, add the following line to the .cshrc or .profile file:

setenv LC_COLLATE C

LC_MESSAGES

C (or c, as defined on the host) for all languages on accounts where the Agent is installed

To determine whether the C locale is present, use the locale -a command. If the C (or c) locale is not present, use POSIX or one of the English locales that appear in the previous table.

To define this variable, add the following line to the .cshrc or .profile file:

setenv LC_MESSAGES C

ISO Latin-1 Character Set Locale Settings for Linux

The following table lists the character set locale settings for each of the Linux hosts for each of the ISO-Latin-1 supported languages.

If the required locale is missing, ask your Linux administrator to install it.

Language

Red Hat Linux

SuSE Linux

English (USA)

en_US.iso88591

en_US

English (UK)

en_GB.iso88591

en_GB

German

german

german

French

french

french

Spanish

spanish

spanish