Network UPS Tools User Manual

Network UPS Tools User Manual 9 / 84
3.2 Multiple architecture support
• Cross-platform - different flavors of Unix can be managed together with a common set of tools, even crossing architectures.
• This software has been reported to run on Linux distributions, the BSDs, Apple’s OS X, Solaris, IRIX, HP/UX, Tru64 Unix,
and AIX.
• Windows users may be able to build it directly with Cygwin. There is also a port of the client-side monitoring to Windows
called WinNUT.
• Your system will probably run it too. You just need a good C compiler and possibly some more packages to gain access to the
serial ports. Other features, such as USB / SNMP / whatever, will also need extra software installed.
3.3 Layered and modular design with multiple processes
• Three layers: drivers, server, clients.
• Drivers run on the same host as the server, and clients communicate with the server over the network.
• This means clients can monitor any UPS anywhere as long as there is a network path between them.
Warning
Be sure to plug your network’s physical hardware (switches, hubs, routers, bridges, . . . ) into the UPS!
3.4 Redundancy support - Hot swap/high availability power supplies
• upsmon can handle high-end servers which receive power from multiple UPSes simultaneously.
• upsmon won’t initiate a shutdown until the total power situation across all source UPSes becomes critical (on battery and low
battery).
• You can lose a UPS completely as long as you still have at least the minimum number of sources available. The minimum
value is configurable.
3.5 Security and access control
• Manager functions are granted with per-user granularity. The admin can have full powers, while the admin’s helper can only
do specific non-destructive tasks such as a battery test.
• The drivers, server, and monitoring client (upsmon) can all run as separate user IDs if this is desired for privilege separation.
• Only one tiny part of one program has root powers. upsmon starts as root and forks an unprivileged process which does the
actual monitoring over the network. They remain connected over a pipe. When a shutdown is necessary, a single character is
sent to the privileged process. It then calls the predefined shutdown command. In any other case, the privileged process exits.
This was inspired by the auth mechanism in Solar Designer’s excellent popa3d.
• The drivers and network server may be run in a chroot jail for further security benefits. This is supported directly since version
1.4 and beyond with the chroot= configuration directive.
• IP-based access control relies on the local firewall and TCP Wrapper.
• SSL is available as a build option ("--with-ssl"). It encrypts sessions with upsd and can also be used to authenticate servers.