Tag: SAS

New Book: The 50 Keys to Learning SAS Stored Processes

At the SAS® Global Forum 2012 last month I picked up a copy of “The 50 Keys to Learning SAS Stored Processes“, the latest book from the dynamic writing duo, Tricia Aanderud & Angela Hall.

As it happens, my partner Michelle also won a copy in a draw so we actually got 2 copies! We met Tricia and Angela in person too, and they kindly signed both books for us. Michelle is giving her signed copy away as a random door prize at our local SAS user group meeting (QUEST) later this month, so if you are in the vicinity of Brisbane at the end of May Continue reading “New Book: The 50 Keys to Learning SAS Stored Processes”

Sneak Peek at our new Effective Permissions Explorers

Update 16Apr2015: The Effective Permissions Explorers discussed in this blog post were first made available in Metacoda Plug-ins V3.0 and further enhanced in Metacoda Plug-ins V4.0. Details of additional improvements coming in the next release, including export to HTML and CSV, are discussed in this more recent blog post: Getting Ready for SASGF15

Update 08Aug2012: The Effective Permissions Explorers discussed in this blog post are now available for testing. More information is available in this Metacoda blog post: Metacoda Plug-ins V3.0 BETA2 (with free Metadata Explorer & ACT Reviewer!)

This post is a sneak peek at a couple of effective permissions explorers that we are putting into the next version of our Metacoda Security Plug-ins. We’ll also be demoing these at the SAS Global Forum 2012 in Orlando next week, so if you’re attending please pop by and visit us.

One of the most common requests we had been hearing at Metacoda was about providing extra information for effective permissions with SAS® metadata security. Effective permissions will tell you exactly what permissions are granted or denied for a particular user on a particular object, taking into account all of the factors such as Access Control Templates (ACTs), Access Controls Entries (ACEs or explicit permissions), object inheritance paths and identity hierarchies. Effective permissions give you this information without you having to understand all of the rules that SAS software follows to work them out. Of course, I still think an understanding of the rules is essential knowledge for SAS platform administrators to help with planning and impact awareness but that’s another story. Attending the SAS Platform Administration: Fast Track course from SAS Institute is a great way to learn these rules.

Why Another Effective Permissions Tool?

Effective permissions can already be seen in SAS Management Console 9.2 & 9.3 through the Explore Authorizations tab (accessible to administrators via the Advanced button on any objects Authorization tab). This is a great feature and I can’t recommend it enough to people who are troubleshooting metadata permissions on a single object. What we were hearing was Continue reading “Sneak Peek at our new Effective Permissions Explorers”

SAS & IWA: Reviewing SPNs

My last post was about configuring additional Service Principal Names (SPNs) in Active Directory to support the use of Integrated Windows Authentication (IWA) in a SAS® platform installation that uses host name aliases in preference to physical host names.

When working on a SAS & IWA setup like this, I’d start by reviewing the currently registered SPNs for all of the SAS servers involved (as well as any other servers that might be accessed from a SAS server using IWA). This gives an idea of what SPNs might have already been added, which ones still need to be added, and potentially which ones might need to be removed.

This is the command I use Continue reading “SAS & IWA: Reviewing SPNs”

SAS & IWA: Host Name Aliases and SPNs

I’m quite keen on using host name aliases, rather than their physical host names, when referring to machines in SAS® platform installations. It does however mean a little extra configuration is required when using Integrated Windows Authentication. That is what this post is about: configuring Active Directory with additional Service Principal Names (SPNs) based on the aliases.

Host name aliases have several benefits over using physical host names. They can be easier to remember (e.g. sasmeta v.s. p106547). They can be easily redirected from primary environments to disaster recovery environments (e.g. sasmeta from p106547 to d106547) with no client reconfiguration requirements. They also allow host machines to be readily renamed if/when required with little or no changes to SAS configuration files, programs and/or metadata.

Whilst they have obvious benefits, Continue reading “SAS & IWA: Host Name Aliases and SPNs”

SAS Management Console over SSH

I was asked recently how to get SAS® Management Console to remotely access a SAS metadata server using SSH tunnels. In the absence of a VPN connection to your network, SSH can be an alternative for SAS Management Console access to a remote SAS metadata server.

I am a huge fan of SSH (Secure Shell). I have been using it several times a day for many years now. It’s great. If you haven’t heard of SSH before, take a look at the Wikipedia page for Secure Shell. Here’s a quote from the page that provides a nice intro/summary:

Secure Shell (SSH) is a network protocol for secure data communication, remote shell services or command execution and other secure network services between two networked computers that it connects via a secure channel over an insecure network.

Here are a couple of methods for using SAS Management Console over SSH:

1. Remote execution of SAS Management Console with X11 forwarding to the client

This method can be used when you are accessing a SAS platform installation on Linux or UNIX and have SSH client software and X server software on your remote workstation. Mac or Linux workstations are great for this since they usually have all the required software pre-installed. Windows can also be used if you obtain SSH client and X server software. I personally use Putty as an SSH client when I am working on Windows and would defintely recommend it. I have no specific recommendations for an X server on Windows since it’s been a long time since I’ve done X on Windows.

Assuming, as a SAS platform administrator, you have remote SSH access to the SAS metadata server machine then you can use SSH from your workstation to execute the SAS Management Console remotely and forward the X display to your client workstation.

Here’s an example command to do this:

ssh -X sasmeta.example.com /opt/sas93/SASManagementConsole/9.3/sasmc

Which means SSH connect, with X11 forwarding, to the machine sasmeta.example.com and then execute the SAS Management Console (/opt/sas93/SASManagementConsole/9.3/sasmc) on that remote machine sending the X windows back to the client workstation.

2. Local execution of SAS Management Console with SSH tunneling

SSH also allows you to configure a tunnel – a local port on your workstation that that forwards traffic to a designated server and port in the remote network. This tunnel can be used to make a remote service appear to be a local service. We can use it to make a remote SAS metadata server port appear to be on the local workstation so that a local installation of the SAS Management Console can connect to it as if it had a local metadata server.

Here’s an example command to do this:

ssh -L 8561:sasmeta.example.com:8561 sasmid.example.com

Which means SSH connect to the machine sasmid.example.com and establish a local machine port (8561) that forwards traffic to the remote host/port sasmeta.example.com:8561 accessible via sasmid.example.com. If you are not using public key authentication (recommended) then you will be prompted for a user id and password for the server. Once the connection is active, a local SAS Management Console can be started and will be able to access the remote SAS metadata server using a connection profile that connects to a metadata server on host/port localhost:8561. All traffic to this local port will be sent to the remote metadata server over the SSH tunnel.

Bear in mind that this only makes the metadata server port available on the local machine. So the local SAS Management Console instance can only access the metadata server. It doesn’t necessarily make the client fully functional as it may require additional connections to additional servers e.g. access to a SAS Object Spawner for a SAS Workspace Server session or a connection to the SAS Content Server. You could look into forwarding other ports and will also need to modify your local hosts file to redirect the remote host names found in metadata to the localhost interface. For anything more complex than pure metadata server access it would probably be easier and more robust to use a VPN connection (or remote access via something like X or RDP to remote network client workstations).