I have been told to change our flexlm server so that another department's machine is also covered by a particular license. This department thinks I can restrict the usage of this license to a particular user on that machine. I have not been able to find documentation on how this might be accomplished. In my mind, flexlm would have to know something about authentication (eg radius or PAM). I'm fairly certain our instance of flexlm doesn't know anything about authentication. My guess this might be a fairly complicated process if at all possible. My inclination is that this should be handled by moving the license over to a machine admined by that department and put the binaries in a permission protected directory for the user. That might be kludgey and problematic if there are other users on the system using the same program. Does anyone have any experience at limiting flexlm licensed programs to specific people? Thanks, David
Look at creating a flexlm options file. http://www.vcpc.univie.ac.at/information/software/pgi/flexuser/chap6.htm You can restrict based on hostname and username. The combination of those should give you something reasonably trustworthy. Ken Raffenetti Systems Administration Associate MCS Division - Argonne National Laboratory On 04/09/2013 11:41 AM, David Forero wrote:
I have been told to change our flexlm server so that another department's machine is also covered by a particular license. This department thinks I can restrict the usage of this license to a particular user on that machine.
I have not been able to find documentation on how this might be accomplished.
In my mind, flexlm would have to know something about authentication (eg radius or PAM). I'm fairly certain our instance of flexlm doesn't know anything about authentication. My guess this might be a fairly complicated process if at all possible.
My inclination is that this should be handled by moving the license over to a machine admined by that department and put the binaries in a permission protected directory for the user. That might be kludgey and problematic if there are other users on the system using the same program.
Does anyone have any experience at limiting flexlm licensed programs to specific people?
Thanks,
David
Ken Raffenetti wrote:
David Forero wrote:
I have been told to change our flexlm server so that another department's machine is also covered by a particular license. This department thinks I can restrict the usage of this license to a particular user on that machine.
I have not been able to find documentation on how this might be accomplished
Look at creating a flexlm options file.
http://www.vcpc.univie.ac.at/information/software/pgi/flexuser/chap6.htm
You can restrict based on hostname and username. The combination of those should give you something reasonably trustworthy.
What Ken says; the options file will let you do this quite easily.
In my mind, flexlm would have to know something about authentication (eg radius or PAM). I'm fairly certain our instance of flexlm doesn't know anything about authentication.
flexlm doesn't authenticate the user; it simply uses the username presented by the client (the software running on the machine requesting a license); see the flexlm log file for the type of data the client presents. This means that if a user of a machine has root (or admin, for Windows) on the machine, he could change his username to match that of an allowed user. This also assumes that usernames refer to the same persons across all client machines. Usually not a problem, but this tells you that the flexlm restrictions don't given 100% guarantee that the only the allowed users are using the licenses. The flexlm docs also mention that you can restrict access by group; note that these groups have nothing to do with groups defined in /etc/group (or its NIS/LDAP equivalent). flexlm groups are simply a list of users you define in the options file using the GROUP option. John
participants (3)
-
David Forero -
John Valdes -
Ken Raffenetti