HMC Unrestricted Root Access

As we all know, the Hardware Management Console (HMC) is considered to be an "appliance" by IBM . It has tight security, such that users are not typically granted root access to the HMC itself. The user is kept within the system management interface or granted a restricted access shell for HMC CLI commands.

But did you know that you can get root access to the HMC - along with all the potential risk that always come with root access? Occasionally, it is a necessity and here is how you do it:

1. Make sure your HMC has the user account HSCPE. This is a special ID, as you shall soon see.

To create the HSCPE user, do the following:

• In the Navigation area, expand the HMC Management folder.
• Click the HMC users icon.
• In the Contents area, click Manage HMC Users and Access. The User Profiles window opens.
• Click User > Add. Fill in the appropriate fields and click OK.

2. Enable Remote Command Execution with ssh

To enable ssh, do the following:

• In the Navigation area, click the HMC Management icon.
• In the Contents area, double-click the HMC Configuration icon.
• In the Contents area, click Enable/Disable Remote Command Execution.
• Select the appropriate check box.
• Click OK.

3. Logon the HMC with ssh as the user hscpe and run the following
command to get the serialnumber of the HMC:

[hscpe@hmc hscpe]$ lshmc -v | grep ^*SE

4. Contact IBM and request the PE password. You will need to supply them with the serial number of your HMC as determined above.

5. Login to the PE Shell (pesh)

[hscpe@hmc1 hscpe]$ SE=`lshmc -v | grep ^*SE | cut -c 5-`
[hscpe@hmc1 hscpe]$ pesh $SE
Password:

Use the password you got from IBM.

6. Switch shell to root

[hscpe@hmc1 hscpe]$ su - # Become root
Password:

Use the default password which is "passw0rd" if you haven't changed it.

NOTE: The PE password that IBM supplies to you is time based. It is only valid until midnight of the day that IBM generates it. If you are performing some type of action close to midnight, you might want to have them generate the passowrd for the next day as well. Despite what they tell you, they can do that if you press them.