A Multitude of Putty Sessions

Many hands may light work, doesn't really work with in IT. I usually look for consistency and reproducible results. So let change this for one hand and many windows make light work!

Come across a nice tool PuttyCS for Windows people which did just the job.

In the Solaris world I would use Sun's Cluster Console on CDE, but other seem to favour Cluster SSH or PSSH.

I would be amiss to say, a better answer to issues above is to automate and use confguration management tools such as Chef and Puppet.

Solaris 11 Locale en_GB.UTF-8 / en_GB.ISO8859-1 / en_GB.ISO8859-15

When you install Solaris 11.3 or 11.4 from standard text installer cdrom, the en_GB-UTF-8 locales are not installed, even if you select British locales on install.

To make sure packages are have the correct localisation, IPS uses facet as a localisation personality.
$ pkg facet
FACETS VALUE
facet.locale.pt_BR True
facet.locale.es_ES True
facet.locale.en_US True
facet.locale.zh_TW True
facet.locale.zh_CN True
facet.locale.de_DE True
facet.locale.fr_FR True
facet.locale.it_IT True
facet.locale.ko_* True
facet.locale.ja_* True
facet.locale.es True
facet.locale.de True
facet.locale.zh True
facet.locale.ko True
facet.locale.it True
facet.locale.pt True
facet.locale.fr True
facet.locale.en True
facet.locale.ja True
facet.locale.* False

As you can see no en_GB is described and "facet.locale.* False" is a deny everything else rule. So let change this. I'm assuming you have a Solaris 11 repository already configured. Install en_GB packages/files and creates a backup boot environment.

$ sudo pkg change-facet 'facet.locale.en_GB=True'

            Packages to update: 463      
       Create boot environment:  No
Create backup boot environment: Yes


PHASE                                          ITEMS
Image State Update Phase                         2/2 

Now let's make the en_GB.UTF-8 the default locale. Previously in Solaris 10 we would edit /etc/default/init. But as with many things in Solaris 11 this has moved to SMF and /etc/default/init is read-only.

$ sudo svccfg -s svc:/system/environment:init setprop \

     environment/LANG = astring: en_GB.UTF-8

$ sudo svcadm refresh svc:/system/environment

Now the system defaults to en_GB.UTF-8 for new processes, but remember not children processes. So thing like CRON and ssh have to be restarted, but I would go for a reboot.

$ sudo svcadm restart ssh

$ sudo svcadm restart cron

Settings for Non-UTF-8 locales (en_GB.ISO8859-15 / en_GB.ISO8859-1)

Non-UTF-8 locales such as en_GB.ISO8859-15 require the "system/locale/extra" package to be installed.

$ sudo pkg install system/locale/extra

$ sudo svccfg -s svc:/system/environment:init setprop \

     environment/LANG = astring: en_GB.ISO8859-15

Additional Options

These are set correctly on install, but added here for completeness.

$ svccfg -s keymap:default setprop keymap/layout = UK-English

$ svcadm refresh keymap
$ svcadm restart keymap
$ svccfg -s timezone:default setprop timezone/localtime= astring: GB
$ svcadm refresh timezone:default

My Raspberry Pi

How can you be a geek without a Raspberry Pi ? You can't!

Raided my daughter Lego box and now my Raspberry Pi has got a case.

Debian installed and updated. Planning to put my mail project on it.

• Python
• Django
• Rabbit MQ
• Twisted 12
• lighttpd

Next project I'm planning to integrate Nagios with physical alarms/lights.

Sun Security Tool Kit - Finish Script Descriptions

Sun Security Tool Kit (SUNWjass) provides a Oracle Solaris OS Hardening driver (template). Behind this is a number of Finish scripts (.fin) which actually does the OS hardening. This a brief description of each one when the name isn't obvious..

disable-ab2.fin	Answer Book 2
disable-apache.fin
disable-apache2.fin
disable-appserv.fin	Java App Server
disable-asppp.fin	Async PPP
disable-autoinst.fin	Disables SYS-UNCONFIG
disable-automount.fin	NFS Automouter
disable-dhcpd.fin	Disables DHCP server
disable-directory.fin	Sun One Directory Server LDAP
disable-dmi.fin	Desktop Management Interface lrc:/etc/rc3_d/S77dmi
disable-dtlogin.fin	Disabled CDE from starting
disable-face-log.fin	Removed write permission on log for SUNWfac - rarely used
disable-ipv6.fin	Disables IPV6
disable-IIim.fin	Internet-Intranet Input Method - Asian input
disable-kdc.fin	Kerberos Key Server
disable-keyserv-uid-nobody.fin	disables User ID Nobody for secure RPC
disable-ldap-client.fin	Prevents LDAP Client from starting
disable-lp.fin	Stop Print Services
disable-mipagent.fin	Mobile IP
disable-named.fin	BIND DNS Server
disable-nfs-client.fin
disable-nfs-server.fin
disable-nscd-caching.fin	disable caching of passwords/groups & hosts
disable-ppp.fin	Sync PPP
disable-preserve.fin	Stops moving saved files - been edited
disable-power-mgmt.fin
disable-remote-root-login.fin
disable-rhosts.fin	Disable use of .rhosts changes PAM config
disable-routing.fin	Disables RDISC/RIP/Forwarding - routeadm
disable-rpc.fin	RPC - Also breaks NFS
disable-samba.fin	Disable from starting
disable-sendmail.fin	Disable sendmail accepting mail
disable-slp.fin	Disables Service Location Protocol RFC 2608
disable-sma.fin	System Management Agent - NET-SNMP
disable-smcwebserver.fin	Solaris Management Console
disable-snmp.fin	SNMP
disable-spc.fin	Sun Soft print Client svc:/application/print/cleanup:default
disable-ssh-root-login.fin	Disables ROOT login via SSH
disable-syslogd-listen.fin	Disable SYSLOGD from accepting logs
disable-system-accounts.fin	remove smtp listen nobody4
disable-uucp.fin	Disable Unix to Unix Copy
disable-vold.fin	VOLD = CDROM automount
disable-xfs.fin	X Font Server
disable-xserver-listen.fin	Disable X11 port 6000
enable-account-lockout.fin	Enabling account lockout to lock user accounts with repeated failed entries
enable-coreadm.fin	Save cores
enable-ftpaccess.fin	Enable -a flag - FTPACCESS
enable-ftp-syslog.fin	Enable -l flag - SYSLOG
enable-inetd-syslog.fin	SYSLOG all connections to inetd services
enable-ipfilter.fin	Enable Firewall - rules /etc/ipf/ipf.conf
enable-password-history.fin	Remember previous passwords
enable-priv-nfs-ports.fin	Allow NFS access from port <1024
enable-process-accounting.fin	Enable process accounting SUNWaccr
enable-rfc1948.fin	TCP Sequence Number - TCP_STRONG_ISS=2
enable-stack-protection.fin	Kernel Level Stack Protection
enable-tcpwrappers.fin	create hosts.allow and hosts.deny SSHD may be too restrictive.
install-at-allow.fin	at.allow - restrict access to at command
install-ftpusers.fin	Add all users for ftpusers to denied access
install-loginlog.fin	Enable logging of failed login attempts - loginlog
install-md5.fin	Install MD5 on Solaris 8 and 9, Sol 10 use digest cmd
install-nddconfig.fin	Enable secure network settings
install-newaliases.fin	Creates correct aliases for Sendmail - minimal install
install-sadmind-options.fin	Sol 8 & 9 - Security level for sadmind service
install-security-mode.fin	Enable OBP Command security - need passwd
install-shells.fin	Add SHELLS
install-sulog.fin	Track SU use and attempted use
print-rhosts.fin	Finds .rhosts & hosts.equiv
remove-unneeded-accounts.fin	Removes unneeded accounts
set-banner-dtlogin.fin	adds banner to DTLOGIN
set-banner-ftpd.fin
set-banner-sendmail.fin
set-banner-sshd.fin
set-banner-telnetd.fin
set-flexible-crypt.fin	Enable stronger encryption of local passwords - md5
set-ftpd-umask.fin
set-login-retries.fin	Allow 3 attempts to login
set-power-restrictions.fin	Restrict access to power commands
set-rmmount-nosuid.fin	Disable mounting of SET-UID files of CDROMS
set-root-group.fin	Change root group to 0
set-strict-password-checks.fin	Complex passwords for local users
set-sys-suspend-restrictions.fin	Restrict suspend function
set-system-umask.fin	Create umask 022
set-tmpfs-limit.fin	Set to 512Mb
set-user-password-reqs.fin	Min Length, Expire etc..
set-user-umask.fin	Profile /etc/skel ..
update-at-deny.fin
update-cron-allow.fin
update-cron-deny.fin
update-cron-log-size.fin	CRON LOG set to 512K
update-inetd-conf.fin	JASS_SVCS_DISABLE Drivers/finish.init
enable-bart.fin	Sol10 only - Setup BART - basic audit reporting tool

Windows - Must Install Open Source Utilities

Windows - Must Install Open Source Utilities

Name	Description	URL
7Zip	Archive/Compression	http://www.7-zip.org
Putty	The default SSH client	http://www.chiark.greenend.org.uk/~sgtatham/putty/
GIMP	Graphics	http://www.gimp.org/
Wireshark	Network Sniffer/Analyser	http://www.wireshark.org/
WINscp	SCP/FTP client	http://winscp.net
UltraVNC	VNC Server/Client	http://www.uvnc.com/
FreeMind	Mind Mapper	http://freemind.sourceforge.net
Lanchy	Windows Quick Launcher	http://www.launchy.net/
Greenshot	Screen Capture	http://getgreenshot.org/
VIM	VI Improved Editor	http://www.vim.org/
CCleaner	Remove cache and cookies	http://www.piriform.com/ccleaner
Notepad++	Notepad replacement	http://notepad-plus-plus.org/
NX Client	NoMachine Client	http://www.nomachine.com/
NMAP	Port Scanner Zenmap GUI	http://nmap.org/
LibreOffice	Word processor, Spreadsheet	http://www.libreoffice.org
Putty Session Manager	Putty Quick Launcher - Hot Keys	http://puttysm.sourceforge.net/
VirtualBox	Desktop Virtualisation	http://www.virtualbox.org/
Firefox 4	Mozilla Browser	http://www.mozilla.com
Google Chrome 11	Google Browser	http://www.google.com/chrome
Drop Box	Cloud Storage	http://www.dropbox.com/

2011 Todo List

Certifications
Veritas Storage Foundation HA re-certify for 5.1
RedHat RHCE
Translate Sun Microsystems certifications to Oracle Knowledge Zones

Courses
VMware 4.x Design Workshop (Required for Partner Enterprise Certification)

Learn
IBM Director for AIX and x86 world
Oracle VM Server (x86)
Cloud Deployment of Infrastucture and Services.
Solaris 11, been playing with OpenSolaris but need to get serious now.

WTL Internal,
Move vSphere 4.0 ESX hosts to 4.1 ESXi
Updated Firewall hardware.

An Ode to a putty and screen. Also keeping green

I love the simple things in life, especially those that make life simple.

I was requested to build two Solaris 10 servers remotely, Setup SUNWjet & template (very straight forward these days)
One putty session over VPN, loaded with screen utility with named split screens.


I didn't use any carbon travelling to site, but shouldn't I get some bonus points for low bandwidth as well!!

Screen Options

^AA = to name a session
^As = Split screen
^ATAB = Switch split screen

Putty Setting's, SSH2, Compression and Blowfish encryption.

OpenIndiana - First install

Curious on how this will evolve. OpenSolaris life outside of Oracle/Sun is uncertain, will the community strength or fold?

Can you use Solaris wanboot to boot a system into single user mode?

Can you use Solaris wanboot to boot a system into single user mode?

Google or Sun Docs didn't have the definitive answer for me.

Answer is YES

T5240, No Keyboard
Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
OpenBoot 4.30.7, 8192 MB memory available, Serial #xxxxxx.
Ethernet address 0:ff:ff:ff:f:ff, Host ID: 8xxxxxx.

{0} ok

{0} ok setenv network-boot-arguments host-ip=10.1.1.1,router-ip=10.1.1.254,subnet-mask=255.255.255.0,hostname=hostname-gd,file=http://172.16.1.1:80/cgi-bin/wanboot-cgi
network-boot-arguments =  host-ip=10.1.1.1,router-ip=10.1.1.254,subnet-mask=255.255.255.0,hostname=hostname-gd,file=http://172.16.1.1:80/cgi-bin/wanboot-cgi
{0} ok boot net -s
Boot device: /virtual-devices@100/channel-devices@200/network@0  File and args: -s
wanboot info: WAN boot messages->console
wanboot info: configuring /virtual-devices@100/channel-devices@200/network@0

wanboot progress: wanbootfs: Read 368 of 368 kB (100%)
wanboot info: wanbootfs: Download complete
Wed Sep 15 14:04:06 wanboot info: WAN boot messages->172.16.1.1:80
SunOS Release 5.10 Version Generic_141444-09 64-bit
Copyright 1983-2009 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
Booting to milestone "milestone/single-user:default".
Configuring devices.
Network interface was configured manually.
10.1.1.1
Requesting System Maintenance Mode
SINGLE USER MODE
# ls /dev/dsk
c0d0s0  c0d0s1  c0d0s2  c0d0s3  c0d0s4  c0d0s5  c0d0s6  c0d0s7
# mount /dev/dsk/c0d0s0 /a
# ls /a
bin         etc         lost+found  proc        tmp
boot        export      mnt         root        usr
dev         kernel      opt         sbin        var
devices     lib         platform    system

Reduce Swap in Red Hat 5

Red Hat recommended SWAP to be no larger than 4Gb,

1) Show current swap
swapon -s

2) Unmount Swap
swapoff /dev/mapper/VolGroup00-LogVol01

3) Reduce from 54Gb to 4Gb (Each LV Extent is 32Mb)
lvreduce -l -1600 /dev/VolGroup00/LogVol01

4) Reformat swap
mkswap /dev/VolGroup00/LogVol01

5) Mount swap as defined in /etc/fstab
swapon -a

VMware vMA - UK setup

VMware's vMA is an execllet tool for managing ESXi environments and comes as a pre-built Virtual machine (Appliance).

My method of setting it up for the UK, thus my cronjobs run in GMT/BST.

Setup Authentification to vCenter/ESX hosts

sudo vifp addserver <192.168.10.90>
vifp listservers
vifpinit
Test it works
vicfg-nics -l --vihost 

Update vMA

$ sudo vi /etc/vmware/esxupdate/vimaupdate.conf
 proxy = http://
 proxyport = 
$ sudo vima-update scan
$ sudo vima-update update

Setup SSH Keys

$ mkdir ~/.ssh
$ vi ~/.ssh/authorized_keys2
$ chmod 700 ~/.ssh/authorized_keys2

Set Time and local

$ sudo mv /etc/localtime /etc/localtime.org
$ sudo ln -s /usr/share/zoneinfo/Europe/London /etc/localtime
$ sudo vi /etc/sysconfig/keyboard
  KEYTABLE="uk"
$ sudo vi /boot/grub/menu.1st
title Red Hat Enterprise Linux Server (2.6.18-164.el5)
       root (hd0,0)
       kernel /vmlinuz-2.6.18-164.el5 ro root=/dev/VolGroup00/root quiet notsc divider=10
      initrd /initrd-2.6.18-164.el5.img 

$ sudo vi /etc/ntp.conf
comment out lines
#server 127.127.1.0 
#fudge  127.127.1.0 stratum 10
add lines
server <1st NTPSERVER FQDN/IP>
server <2nd NTPSERVER FQDN/IP>
 

$ sudo vi /etc/ntp/step-tickers
<1st NTPSERVER FQDN/IP>
<2nd NTPSERVER FQDN/IP>

Scheduled network capture on Windows using Wireshark (tshark.exe)

A customer had an iSCSI issue and was required to capture network packets at a specific time on a Windows 2008 server.

I came up with simple method using Wireshark's tshark.exe and Windows scheduler "AT".

at cmd /c c:\capture.bat

type c:\capture.bat
rem Capture WireShark example
rem Andy Paton
rem WTL
rem use AT to run batch
rem example at 01:50 cmd /c c:\capture.bat

rem debug at issues
rem example at 09:50 /interactive cmd /k c:\capture.bat

rem -a duration:1200 in seconds
rem -B Buffer Size - default is 1Mb
rem -i Interface number - use "tshark.exe -D" to list interface numbers
rem -n don't resolve IP addresses
rem -q Quiet output
rem -w output file
rem capture filter "host "

c:\"Program Files"\Wireshark\tshark -a duration:1200 -B 2 -i 4 -n -q -w c:\network.out host 192.168.1.1

ZFS Compression Vs Deduplication (dedup)

Been playing with ZFS dedupe for the last two weeks and just wanted to share my findings.  

Setup OpenSolaris build 131
Sun X4200, 2 x Dual Core Opteron 2.6Ghz, 8Gb Ram, 4 x 73Gb SAS 10Krpm

root@osol:~# zfs list
NAME                       USED  AVAIL  REFER  MOUNTPOINT
compress                    72K  66.9G    21K  /compress
dedupe                      72K  66.9G    21K  /dedupe

root@osol:~# zfs set compression=on compress
root@osol:~# zfs set dedup=on dedupe

Wanted to see how much real data would dedupe.

I loaded the my company  project/Software folders, 68,000 files (Visio/PDF/Project/Word/OpenOffice/Excel,ISO's... ) total of 38.9Gb

Load times, copying files from local UFS filesystem to ZFS dataset.

root@osol:/ufs# ptime tar cf - iso projects software | pv | ( cd /dedupe/ ; tar xf - )
real    19:51.930407394
user        5.807881662
sys      1:48.025965013
38.8GB 0:19:51 [33.3MB/s]

root@osol:/ufs# ptime tar cf - iso projects software | pv | ( cd /compress/ ; tar xf - )
real    18:46.544321180
user        3.368262960
sys      1:52.065809786
38.8GB 0:18:46 [35.3MB/s]

The deupe ZFS volume was 66 seconds slower than the compress volume.

Let see how much space we saved for both methods

root@osol:/ufs# zpool list
NAME       SIZE  ALLOC   FREE    CAP  DEDUP  HEALTH  ALTROOT
compress    68G  36.1G  31.9G    53%  1.00x  ONLINE  -
dedupe      68G  38.4G  29.6G    56%  1.02x  ONLINE  -
rpool       67G  49.8G  17.2G    74%  1.00x  ONLINE  -

root@osol:/ufs# zfs get compressratio compress
NAME      PROPERTY       VALUE  SOURCE
compress  compressratio  1.08x  -

The compressed volume did a better job than dedupe and saving an extra 6% storage.

Conclusion
There isn't any advantages for dedupe on a general home file share, slight slower performance and less space saved when compared to compression.

Now why would you want to dedupe ? Well just look at my dedupe ratio of 2.28 for a NFS share with VMware, now this is exciting!

root@osol:~$ zpool list vm-dedupe
NAME       SIZE  ALLOC   FREE    CAP  DEDUP  HEALTH  ALTROOT

vm-dedupe  68G   16.1G  51.9G    23%  2.28x  ONLINE  -

Therefore I can only say "Some data is more equal than others."

Andy
 (Minor edit  7.02.10)

VIM in Windows

I've been using VIM as my main editor on windows desktop for a number of years. I've resisted my peers suggesting programs like Notepad++.

But today I found a new little hack.From the windows CLI, I can convert my shell scripts in html quickly for my documentation. (I could do this from GUI but took a little time). Next little adventure is write a PowerShell/VBS script to make it even easier.

"C:\Program Files\Vim\vim72\gvim.exe" -n -c ":so $VIMRUNTIME\syntax\2html.vim" -c ":wqa" SourceFilename.sh

Solaris10Guide

Solaris 10 Quick Reference (Work In Progress)

 

This document is a quick reference to the major difference and new technologies in Solaris 10. Its is not fully extensive and will only feature on.

 

●     ZFS

●     Solaris Containers (Zones)

●     Resource Management

●     Predictive Self Healing

●     DTrace

●     Misc

 

ZFS – Solaris Zettabyte File System

Features

●     128-bit Filesystem

●     File System and Volume Manager Integrated

●     RAID 0, RAID 1, RAID-Z (RAID5) &  RAID-Z2 Double Parity

●     Snap Shot and Clone Support

●     Compression

●     Self healing

●     Checksum of data blocks

●     Does not use /etc/vfstab as standard

●     Setup NFS through zfs

●     Does not support ufsdump/ufsrestore

 

Commands

zpool	Manages Pools (disks)
zfs	Manages file systems

 

Pool tasks

zpool create mypool c0t1d0	Create mypool with whole disk
zpool create mypool c0t1d0s7	Create mypool with slice
zpool create mypool c1t0d0 c2t0d0	Create mypool with stripe
zpool create mypool mirror c1t0d0 c2t0d0	Create mypool with mirror
zpool create mypool raidz c1t0d0 c1t1d0 c1t2d0	Create mypool with RAID-Z
zpool create mypool raidz2 c1t0d0 c1t1d0 c1t2d0	Create mypool with RAID-Z Double Parity
zpool create -m /export/home mypool c2t0d0	Create mypool with whole disk with mount point /export/home
mkdir 2g /disk1 ; mkdir 2g /disk2 ; mkdir 2g /disk3 ; mkdir 2g /disk4 zpool create mypool mirror /disk1 /disk2 zpool add mypool mirror /disk3 /disk4	Create mypool from files!!
zpool destroy mypool	DESTROY POOL AND FILESYSTEM
zpool list	List pools
zpool status -x	Display pool status
zpool replace mypool c1t0d0 c1t4d0	Replaces drive c1t0d0 to c1t4s0
zpool clear mypool c1t2d0	Clears transient errors from drive
zpool online mypool c1t3d0	Notify ZFS to rescan c1t3d0
zpool scrub mypool	Disk scrubber (checks drives & data)
zpool iostat [-v] [<pool>] <interval>	Display disk status

 

ZFS File system Tasks

zfs create mypool/home	Create filesystem home
zfs set -o mountpoint=/export/home mypool/home	Create /export/home
zfs create mypool/home/user	Create user directory
zfs destroy mypool/home	Delete home filesystem and below (users)
zfs set quota=20G mypool/home/user
zfs set compression=on mypool/home
zfs get all mypool/home	View settings
zfs set sharenfs=on mypool/home/user	Create NFS share
zfs set sharenfs=ro myspool/home/jumpstart	Create Read only NFS share
zfs set sharenfs=root=192.168.10.162 rpool/export/zones
zfs unshare mypool/home/user	disable NFS share
zfs list	List ZFS filesystem
zfs list -o name,quota,mountpoint	List ZFS filesystem options
zfs snapshot mypool/home@today	Create readonly snapshot of home called today
zfs set snapdir=visable mypool	Enable access to snapshot
ls /export/home/.zfs/snapshot/today	Access to snapshot
zfs rollback mypool/home@today	Rollback to snapshot
zfs clone myspool/home@today mypool/home_new	Clone home snapshot and create a   writeable mypool/home_new
zfs promote mypool/home_new	Make clone the primary data source
zfs rename mypool/home  mypool/home_old ; zfs rename mypool/home_new  mypool/home	rename clone to replace home, move old to home_old
zfs destroy mypool/home@today	Destroy snapshot

 

Solaris Containers (Zones)

 

Features

●     Software partition, single kernel!

●     share or individual packages and patches.

●     chroot on steroids!

●     Consolidation

●     Test and development

●     Resource Management

●     BrandZ (Solaris 8/9 and Linux)

●     IP Share & Exclusive Mode

●     Zone enable commands (ps / prstat ..)

●     Unbundled application Zonestat

Configuration Guide Lines

Network & Routing	The global zone must be connected and routing table correctly configured.
DHCP	Is not supported in a zone in IP Share mode on in Exclusive Mode
NFS Server	Unable to export

 

Commands

zonecfg	Manages zones configuration
zoneadm	Manages Zones
zlogin	Login into a zone ~. (drop to shell but my break ssh shell) Change SSH break character. ssh -e ^ <user>@<globalzone>

 

Create Zone

zonecfg -z myzone zonecfg:myzone> create zonecfg:myzone> set zonepath=/export/zones/myzone zonecfg:myzone> set autoboot=true zonecfg:myzone> add net zonecfg:myzone:net> set address=10.10.25.33 zonecfg:myzone:net> set physical=e1000g0 zonecfg:myzone:net> end zonecfg:myzone> verify zonecfg:myzone> commit zonecfg:myzone> exit	Basic Zone
zonecfg -z webzone zonecfg:webzone> set zonepath=/export/zones/webzone zonecfg:webzone> set autoboot=true zonecfg:webzone> add net zonecfg:webzone:net> set address=10.10.25.34 zonecfg:webzone:net> set physical=e1000g0 zonecfg:webzone:net> end zonecfg:webzone> add fs zonecfg:webzone:fs> set dir=/export/home zonecfg:webzone:fs> set type=lofs zonecfg:webzone:fs> set special=/export/home zonecfg:webzone:fs> end zonecfg:webzone> info zonecfg:webzone> verify zonecfg:webzone> commit zonecfg:webzone> exit	Zone with home directories shared with Global zone
zonecfg -z ownzone zonecfg:ownzone> create zonecfg:ownzone> set zonepath=/export/zones/ownzone zonecfg:ownzone> set autoboot=true zonecfg:ownzone> add net zonecfg:ownzone:net> set address=10.10.25.35 zonecfg:ownzone:net> set physical=e1000g0 zonecfg:ownzone:net> end zonecfg:ownzone> remove inherit-pkg-dir dir=/lib zonecfg:ownzone> remove inherit-pkg-dir \ dir=/platform zonecfg:ownzone> remove inherit-pkg-dir dir=/sbin zonecfg:ownzone> remove inherit-pkg-dir dir=/usr zonecfg:ownzone> verify zonecfg:ownzone> commit zonecfg:ownzone> exit	Zone with no inherited packages
zonecfg -z poolzone zonecfg:poolzone> create zonecfg:poolzone> set        zonepath=/export/zones/poolzone zonecfg:poolzone> set autoboot=true zonecfg:poolzone> set pool=qa-pool zonecfg:poolzone> add net zonecfg:poolzone:net> set address=10.10.25.33 zonecfg:poolzone:net> set physical=e1000g0 zonecfg:poolzone:net> end zonecfg:poolzone> verify zonecfg:poolzone> commit zonecfg:poolzone> exit	Zone with resource pool “qa-pool” allocated, See pools.

 

sysidcfg file, copy in <zonepath>/root/etc/sysidcfg to pre answer boot questions

name_service=DNS        {domain_name=<domain>        name_server=<default router>} system_locale=en_GB.ISO8859-1 terminal=vt100 network_interface=primary {                 hostname=<hostname>} security_policy=NONE nfs4_domain=LOCAL.com timezone=GB-Eire root_password=<encrypted password>

Administer Zone

zoneadm -z myzone install	Install a configured zone
zoneadm -z myzone boot	Boot a zone
zoneadm -z myzone boot && zlogin -C myzone	Boot and watch console of a zone
zoneadm -z myzone halt	Stop a zone ( eg pull power)
zoneadm -z myzone reboot
zoneadm -z myzone uninstall -F	Deletes a zone
zonecfg -z myzone delete -F	Removes a zone config
zoneadm list -civ	Display Zones Status
zoneadm -z myzone detach	Detach zones (ready to move)
zoneadm -z myzone attach	Attach  Zone
zoneadm -z myzone attach -F	Attach  Zone with out verify
zoneadm -z myzone attach -u	Attach  Zone update any patches with global zone
zoneadm -z myzone attach -u -b <patch=id>	Attach  Zone update any patches with global zone, backing out patch  id
zlogin -C myzone	Login to the zone console ~. to drop out
zlogin -l sysadmin myzone	Login as sysadmin user
zlogin myzone shutdown -i 0	Shutdown zone gracefully
zlogin -S myzone	Login Safe mode for diagnostics
zonename	Tell me my zonename

 

Clone myzone to dolly (ZFS)

zlogin myzone shutdown -i 0	Shut down zone gracefully
zonecfg -z myzone export -f /export/zones/myzone.cfg
chmod 700 /export/zones/dolly	Strict permissions
vi /export/zones/myzone.cfg	Change path and IP address
zonecfg -z dolly -f /export/zones/myzone.cfg	Create zone from master template
zoneadm -z dolly clone myzone	Clone myzone to dolly.
zoneadm -z dolly boot	Boot dolly

 

Move myzone to different server

Source Host

1	zlogin myzone shutdown -i 0	Shut down zone gracefully
2	zonecfg -z myzone export -f /export/zones/myzone.cfg	Create export file
3	zoneadm -z myzone detach
4	tar cf myzone.tar /export/zones/myzone
5	scp myzone.cfg <user>@<target-host>

 

Target Host

1	tar xvf myzone.tar	Untar in to new root zonepath.
2	Edit myzone.cfg to reflect new zonepath
3	zonecfg -z myzone -f myzone.cfg	Create zone from master template
4	zoneadm -z myzone attach	Attach zone
5	zoneadm -z myzone boot

 

Resource Management CPU

 

Features

●     Fixed number of CPU's per zone

●     Variable CPU's per zone

●     FSS Fair Share, weighted zones. recommended for most application

●     Mixed workloads

●     In Solaris 10 8/07 and later we have dedicated CPU' feature  which can be an effective alternative to pools.

Commands

pooladm	Administer pools
poolcfg	Configure pools
dispadmin	Dispatch “Scheduler” Admin

 

 

Create Fixed CPU Zone Pool

pooladm -e	Enable pools
svcadm enable pools	Enable pools
pooladm -s	Save configuration
poolcfg -c 'create pset db-pset (uint pset.min=10; uint pset.max=10)'	Processor Set “db-pset” 10 CPU's
poolcfg -c 'create pool db-pool'
poolcfg -c 'associate pool db-pool (pset db-pset)'
pooladm -c	Activate configuration
zonecfg -z dbzone zonecfg:dbzone> set pool=db-pool zonecfg:dbzone> verify zonecfg:dbzone> commit zonecfg:dbzone> exit	Associate the zone with a resource pool

 

Create FSS Zone (Pool)

pooladm -e	Enable pools
svcadm enable pools	Enable pools
pooladm -s	Save configuration
poolcfg -c 'create pool db-pool ( string pool.scheduler = "FSS" )'	Resource pool with  FSS
poolcfg -c 'create pool ap-pool ( string pool.scheduler = "FSS" )'	Resource pool with  FSS
pooladm -c	Activate configuration
pooladm	Display configuration
zonecfg -z dbzone zonecfg:dbzone> set pool=dbpool zonecfg:dbzone> add rctl zonecfg:dbzone:rctl>set name=zone.cpu-shares zonecfg:dbzone:rctl>add add value (priv=privileged,limit=3,action=none) zonecfg:dbzone:rctl> end zonecfg:dbzone> verify zonecfg:dbzone> commit zonecfg:dbzone> exit	Associate the zone with a resource pool and set FSS CPU share to 3
zonecfg -z apzone zonecfg:apzone> set pool=appool zonecfg:apzone> add rctl zonecfg:apzone:rctl>set name=zone.cpu-shares zonecfg:apzone:rctl>add add value (priv=privileged,limit=2,action=none) zonecfg:apzone:rctl> end zonecfg:apzone> verify zonecfg:apzone> commit zonecfg:apzone> exit	Associate the zone with a resource pool and set FSS CPU share to 2
zlogin apzone init 6 && zlogin dbzone init 6	Reboot zones
dispadmin -d	Display default scheduler
dispadmin -d FSS	Set scheduler to FSS
priocntl -s -c FSS -i all	Set scheduler to FSS now
prctl -n zone.cpu-shares -i zone global	Display Global zone CPU shares
prctl -n zone.cpu-shares -v 2 -r -i zone global	Set Global Zone to FSS CPU share to 2 * not persistent after reboots
Prctl -n zone.cpu-shares -r -v 3 -i zone <zone>	Dynamically change zone CPU shares

 

Oracle Database Example using dedicated (need to add filesystems for /u01 ..)

In global $ mkdir /usr/local
zonecfg -z orazone zonecfg:orazone> set zonepath /zones/orazone zonecfg:orazone> set max-shm-memory=4G zonecfg:orazone> add dedicated-cpu zonecfg:orazone:dedicated-cpu> set ncpus=12-16 zonecfg:orazone:dedicated-cpu> set importance=2 zonecfg:orazone:dedicated-cpu> end zonecfg:orazone> add net zonecfg:orazone:net> set address=10.10.25.35 zonecfg:orazone:net> set physical=e1000g0 zonecfg:orazone:net> end zonecfg:orazone> add fs zonecfg:orazone:fs> set dir=/usr/local zonecfg:orazone:fs> set type=lofs zonecfg:orazone:fs> set special=/usr/local zonecfg:orazone:fs> end zonecfg:orazone> verify zonecfg:orazone> commit zonecfg:orazone> exit	Create zone with
zonecfg -z orazone zonecfg:orazone> set zonepath /zones/orazone zonecfg:orazone> set max-shm-memory=4G zonecfg:orazone> add capped-cpu zonecfg:orazone:capped-cpu> set ncpus=3.75 zonecfg:orazone:capped-cpu> end zonecfg:orazone> add net zonecfg:orazone:net> set address=10.10.25.35 zonecfg:orazone:net> set physical=e1000g0 zonecfg:orazone:net> end zonecfg:orazone> add fs zonecfg:orazone:fs> set dir=/usr/local zonecfg:orazone:fs> set type=lofs zonecfg:orazone:fs> set special=/usr/local zonecfg:orazone:fs> end zonecfg:orazone> verify zonecfg:orazone> commit zonecfg:orazone> exit

Services management Facility

 

Features

●      Predictive hardware monitoring

●      isolation and deactivation

●      Fault Management Architecture FMA / Service Management Facility SMF

●      Message Identifier lookup @ http://www.sun.com/msg/

●      RC script, /etc/inetd.conf & /etc/inittab are legacy

●      Milestones as wellas run levels

●      FMRI – example svc:/network/ssh:default

●      Methods and Manifest (XML)

             

Commands and Logs

svcs	Display service status and dependencies
svcadm	Enable/Disable services
inetconv	convert inetd.conf
svccfg	Manifest Management
/var/adm/messages	System logs
/var/svc/log	Service Logs
/etc/svc/volatile	pre-single user logs

 

SMF Tasks

svcadm disable system/cron:default	Disables
svcadm enable system/cron:default	Enable cron
svcadm refresh network/ssh:default	reread ssh configuration
svcadm restart network/ssh:default	restart ssh
svcadm -v enable -r nfs/server	Enables all services required to start nfs
svcadm -v enable -r -t nfs/server	Enables all services required to start nfs until a reboot
svcs -a	List all services
svcs -p ssh	Show processes attached to ssh server
svcs -d /network/smtp	Show what service smtp depend on
svcs -D /network/smtp:sendmail	Show what service  depend on smtp
svcs -xv	Display failed services
boot -m verbose	Display services on boot up.
svcadm milestone -d milestone/single-user:default	change default run level
svcadm milestone milestone/multi-user	change run level to multi-user
Ok> boot -m milestone=single-user	boot in to single user

 

Networking

 

 

 

 

 

 

Security

RBAC

•                   /etc/user/attr                                          # User and Role information

•                   /etc/security/prof_attr                            # Predefined profile (collection of rights)

•                   /etc/security/policy.conf              # User defaults

•                   /etc/security/exec_attr                            # Rights Profile and associated execution attributes

 

profiles <username>	Display security profiles assigned to user
profiles -l <username>	Displays individual commands within a profile
pfexec <cmd>	Executes commands with correct privileges
roles <username>	Display roles assigned to user

 

Solaris Security Toolkit

•                   Download from http://www.sun.com/software/security/jass/

•                   Installed into /opt/SUNWjass

•                   Run manual or integrated with Jumpstart

•                   Ready made templates in /opt/SUNWjass/Drivers

•                   Always have console access, as the tool-kit often blocks remote logins.

./jass-execute -d secure.driver	Hardens Solaris
./jass-execute -a secure.driver	Audits Solaris against template
./jass-execute -c	Clear previous edits.

 

Miscellaneous  Settings

/etc/ssh/sshd_config	SSH Settings Disable Root, Allow on SSH-2 protocol Consider naming specific users. Or disable well know users, oracle, admin....
vi /etc/security/policy.conf change CRYPT_DEFAULT to 1 (BSD MD5) CRYPT_DEFAULT=1	Change password encryption

 

 

Solaris IP Filter

•                   Not enables by default

•                   Packet Filtering available between zones.

•                   NAT

•                   Statefull

•                   Manual configuration only

 

vi /etc/ipf/ipf.conf	Edit rules file
ipf -f /etc/ipf/ipf.conf	Enabe rules files
ipf -Fa	Disable Rules
ipf -Fi	Disable incoming filter
Ipfstat	IP Filter stastics
svcadm enable network/ipfilter	Enable the IP Filter

 

Rule Examples

#/etc/ipf/ipf.conf   # pass and log everything by default pass in log on elxl0 all pass out log on elxl0 all   # Disable SSH access to this machine from  192.168.10.254 block in quick from 192.168.10.254/32 to port = 22   # block, but don't log, incoming packets from other reserved addresses block in quick on elxl0 from 10.0.0.0/8 to any block in quick on elxl0 from 172.16.0.0/12 to any   # block and log untrusted internal IPs. 0/32 is notation that replaces # address of the machine running Solaris IP Filter. block in log quick from 192.168.1.15 to <thishost> block in log quick from 192.168.1.43 to <thishost>   # block and log X11 (port 6000) and remote procedure call # and portmapper (port 111) attempts block in log quick on elxl0 proto tcp from any to elxl0/32 port = 6000 keep state block in log quick on elxl0 proto tcp/udp from any to elxl0/32 port = 111 keep state

Note – example taken from Sun IP Security Manual

 

DTrace

 

A dynamic tracing facility that provides a comprehensive view of operating system and application behaviour. It has functionality similar to truss, apptrace, prex and mdb, bundled into a single scriptable tool that can examine both userland activity and the kernel. DTrace can be used on live production servers with often negligible impact on performance.

 

Example D-scripts are provided in /usr/demo/dtrace

 

DTrace toolkit                            http://www.opensolaris.org/os/community/dtrace/dtracetoolkit

 

DTrace manual              http://docs.sun.com/app/docs/doc/817-6223

 

Quick Ref                            http://developers.sun.com/solaris/articles/dtrace_quickref/dtrace_quickref.html

 

How to                             http://www.sun.com/software/solaris/howtoguides/dtracehowto.jsp

 

Dtrace Cheatsheet              http://blogs.sun.com/brendan/entry/dtrace_cheatsheet

 

 

Solaris 10 minor differences

 

routeadm -e ipv4-forwarding routeadm -d ipv4-routing routeadm -e ipv4-routing	Routing commands, for IP Forwarding and routing (in.routed)
echo “server IP_ADDRESS” >> /etc/inet/ntp.conf svcadm enable /network/ntp	Enable NTP
vi /etc/security/policy.conf change CRYPT_DEFAULT to 1 (BSD MD5) CRYPT_DEFAULT=1	Change password encryption
svccfg -s x11-server setprop options/tcp_listen = true	Allow X11 connection Solaris 10
dumpadm -d /dev/dsk<device>	Manage Dumps to dedicated device (support ZFS root)
dumpadm -c /var/crash/<hostname>	Manage core dumps

 

Live Upgrade (ZFS)

lucreate -c <be_name> -n <new-be_name>	Name current boot environment and create New BE.
lucreate  -n <new-be_name>	Create new environment
lustatus	Display boot environment
luupgrade -u -n <new-be_name> -s /net/<ip address>/export/install	Live OS Upgrade
cd 10_Recommended luupgrade -t -n <new-be_name> -O  \ -t -s . ./patch_order	Patch a live environment from downloaded patch cluster.
luactivate <new-be_name>	Activate Boot environment, after reboot. DON'T USE “reboot” command, always use init or shutdown.

Reference Material

 

Little Known Solaris Features http://www.c0t0d0s0.org/pages/lksfbook.html

Solaris Security Tool Kit http://docs.sun.com/app/docs/prod/61ec778c-5688-47ba-b4bf-af20b140731a

Solaris Patching Best Practise http://www.sun.com/bigadmin/features/articles/patch_management.jsp

Solaris Zones FAQ http://hub.opensolaris.org/bin/view/Community+Group+zones/faq

Zonestat Util http://hub.opensolaris.org/bin/view/Project+zonestat/

SVC SMF https://www.sun.com/offers/docs/smfmanifest_howto.pdf

 

 

 

 

 

 

Andy Paton	18/18	7/11/09

Version 2.1