Andy Paton's most Technical Adventure

Solstice DiskSuite Command Summary

2026-03-08T06:38:00.002+00:00

Having a sort out and found this course handout originally written by John Furlong - Sun Trainer in 23/10/2002 (Free to distribute).

Reminder of days gone by, DiskSuite 1.1 on SunOS 4.1 to Solaris Volume Manager Solaris 10, these were day-to-day commands for me.

State Database Operations.
Operation	Command Example.

Create first database replica	metadb –a –f c0t0d0s7
Create additional replicas (2 copies in single partition)	metadb –a –c2 c1t1d0s7
Create the database as defined in the mddb99 entry in md.tab.	metadb –a mddb99
Delete replicas.	metadb –d c1t0d0s7
Check status of databases.	metadb

Simple Metadevice Operations.
Operation		Command Example.

Create metadevice with a single partition.		metainit d22 1 1 c1t5d0s3
Create metadevice, concat over 2 partitions.		metainit d22 2 1 c1t5d0s5 1 c1t6d0s4
Create metadevice, striped across 2 partitions.		metainit d22 1 2 c1t5d0s4 c2t5d0s4
Create metadevice striped across 2 partitions with a chunk size of 64K		metainit d22 1 2 c1t5d0s4 c2t5d0s4 -i 64K
Create all metadevices in md.tab		metainit –a
Create a raid5 metadevice over 3 partitions.		metainit d50 –r c1t0d0s3 c2t0d0s3 3t0d0s3
Delete metadevices.		metaclear d50 (Single), metaclear –a (ALL)
Check status of metadevices.		metastat
Create a metatrans device.	metainit d50 –t c1t5d0s5(Master) c1t2d0s1(Log)

Growing Metadevices.
Operation	Command Example.

Attach single partition to metadevice.	metattach d45 c1t5d0s4
Attach a 2 partition stripe to metadevice.	metattach d45 c1t4d0s5 c2d4d0s5
Grow file system on resized metadevice.	growfs –M /mnt /dev/md/rdsk/d45

Hotspare Operations. Note:- xxx is either the hot spare pool (hsp001) or all for all hot spare pools.
Operation	Command Example.

Create a hot spare pool.	metahs –a hsp001 c1t5d0s4
Add partition to hot spare pool.	metahs –a xxx c2t5d0s4
Delete partition from hot spare pool.	metahs –d xxx c2t5d0s4
Replace failed partition in hot spare pool.	metahs –r xxx c1t5d0s3 (Old) c1t6d0s3(new)
Enable partition.	metahs –e c1t5d0s4
Attach hot spare pool to sub-mirror.	metaparam –h hsp000 d55
Remove hot spare pool from sub-mirror.	metaparam –h none d55
Check status of hot spare pool.	metahs –i

Soft Partition Operations.^
Operation	Command Example.

Partition disk & create 1Gb soft partition.	metainit d50 –p –e c1t5d0 1g
Create 2Gbyte soft-partition from disk partition.	metainit d50 –p c1t0d0s0 2g
Create 2Gbyte soft partition from metadevice.	metainit d50 –p d10 2g
Grow soft partition by 5GByte.	metattach d50 5g
List soft partitions & free space disk partition.	metarecover –v –n c1t0d0s0 -p
Recover soft partitions from database info.	metarecover c1t0d0s0 –p -m
Recover soft partitions from disk info.	metarecover c1t0d0s0 –p -d
Delete all soft-partitions on slice.	metaclear –p c1t0d0s4

Mirror Operations.
Operation	Command Example.

Create a mirror with 1 sub-mirror. (d20 is the mirror, d21 is the sub-mirror.)	metainit d21 1 1 c1t0d0s3 metainit d20 –m d21
Create and attach 2^nd. sub-mirror. (d20 is the mirror, d22 the attached sub-mirror.)	metainit d22 1 1 c1t1d0s3 metattach d20 d22
Create mirror with 2 sub-mirrors. (d20 is the mirror.) (d21 and d22 are the sub-mirrors.)	metainit d21 1 1 c1t5d0s5 metainit d22 1 1 c1t6d0s0 metainit d20 –m d21 d22
Detach sub-mirror from mirror. (d20 is the mirror, d21 the sub-mirror)	metadetach d20 d21
Attach sub-mirror to mirror.(Causes full sync)	metattach d20 d21
Offline a sub-mirror.(remains part of mirror)	metaoffline d20 d21
On-line a sub-mirror. (Causes partial sync)	metaonline d20 d21
Delete a mirror and all its’ sub-mirrors.	metaclear –r d20
Change read policy of mirror.	metaparam –r roundrobin d20 metaparam –r geometric d20 metaparam –r first d20
Change write policy of mirror.	metaparam –w parallel d20 metaparam –w serial d20
Change pass number of resync at boot time. 0=skip, 1=first, 9=last.	metaparam –p 2 d20

Disk and Partition Replacement Operations.
Operation	Command Example.

Copy partition table from existing disk to new disk. prtvtoc /dev/rdsk/c1t0d0s2 (existing) \| fmthard –s - /dev/rdsk/c1t2d0s2 (new)
Enable a partition that has been replaced.	metareplace –e d50 (Mirror) c4t5d0s4
Replace failed partition with another.	metareplace d50 c1t5d0s4(old) c1t6d0s4(New)

Metaset Operations.
Operation	Command Example.

Create metaset with 1 host.	metaset –s MySet –a –h grommit
Add host to set.	metaset –s MySet –a –h wallace
Delete host from set.	metaset –s MySet –d –h wallace
Add disks to set.	metaset –s MySet –a c1t5d0 c1t6d0
Delete disks from set.	metaset –s MySet –d c1t6d0
Release ownership of set.	metaset –s Myset –r
Take ownership of set.	metaset –s MySet –t
Force takeover of ownership of set.	metaset –s MySet –t –f
After metaset creation normal commands can be used by selecting the set to work with. e.g., metainit –s MySet d44 1 1 c5t4d0s6

Graphical Interface Operation.

metatool [-s SetA ]

/etc/opt/SUNWmd/md.tab (Up to version 4.2), /etc/lvm/md.tab (From version 4.2.1)

Soft partitions are available in Solaris 9 or 4.2.1 with patch 108693-xx

Solaris 11.4 SRU 90 Name Service Checks

2026-03-04T06:35:00.002+00:00

Solaris 11.4 SRU 90: Stricter Name Service Validation

I recently upgrading to Solaris 11.4 SRU 90 and found a new service SMF service in a degraded state: svc:/system/check/name-services, which didn't like my DNS client options "timeout:1 attempts:5"

The svc:/system/check/name-services uses the new "/usr/sbin/nscfg check" option to ensure the correct syntax.

# Failed service
$ svcs svc:/system/check/name-services:default
STATE STIME FMRI
degraded 2026-03-04T06:25:11 svc:/system/check/name-services:default

# Checked FMRI name-service logs
$ tail -4 /var/svc/log/system-check-name-services:default.log
[ 2026 Mar 4 06:25:10 Executing start method ("/lib/svc/method/check-naming"). ]
[ 2026 Mar 4 06:25:11 check-naming: One naming service configuration issue detected: ]
Error: issue in svc:/network/dns/client: bad value in property config/options = timeout:1 attempts:5
[ 2026 Mar 4 06:25:11 Method "start" exited with status 103. ]
[ 2026 Mar 4 06:25:11 "start" method requested degraded state: "One naming service configuration issue detected."

This confused me initially as the legacy /etc/resolv.conf file looked perfectly fine.

# resolv.conf looks correct
$ grep options /etc/resolv.conf
options timeout:1 attempts:5

# Manual check of SMF Name Service syntax
$ /usr/sbin/nscfg check
Error: issue in svc:/network/dns/client: bad value in property config/options = timeout:1 attempts:5

The new validation requires multiple options to be defined as a proper astring array. To clear the degraded state, update your configuration using the following syntax:

# Correctly format the options as an array
$ svccfg -s svc:/network/dns/client setprop config/options = astring: $"timeout:1" "attempts:5"$

# Apply the changes
$ svcadm refresh dns/client

Once updated, svc:/system/check/name-services should return to online.

Life in the old dog yet - Solaris and me

2023-04-11T18:40:00.002+01:00

As I approach my 35th year at WTL, I am reminded of the countless times I have supported, deployed, migrated, and virtualized Solaris systems. Despite its age, Solaris remains an incredibly secure, reliable, capable, and stable platform that delivers critical applications to millions of users every day. And I'm happy to report that Solaris is not going anywhere soon - nor am I.

Over the years, Solaris has proven itself time and time again, earning the trust of organizations that require a dependable operating system for their most critical applications. And while there may be newer, flashier options out there, Solaris continues to provide the features and functionality that many users require.

Solaris and I may be getting up there in years, but we're not ready to slow down just yet. We still have plenty to offer, and we're not going anywhere anytime soon. So if you're looking for a secure, reliable, and stable platform for your critical applications, consider giving Solaris a try - and know that you'll have experienced professionals like me to support you every step of the way.

2016 - 30 Years in Unix - Tools of the trade

2016-03-12T16:13:00.002+00:00

Celebrating my 30th Year in Unix.

Expect some reminiscing from the days gone by.

I still have my first "vi" reference guide, dog eared and tea stain (I'm British), dated 1987.
I came to vi late as I started with "ed" writing Cobol on a PDP11/44, AT&T V7 Unix. Yes I did have to use coding sheets, before I could start coding on the terminal.

KeePassX 2.0 On Redhat 6 / Cent OS 6 / OL6

2015-12-30T13:50:00.003+00:00

I'm sure we all know the virtues of long, complex and unrememberable passwords and the need for a tool to store them. My favourite has been KeePass, with a shared database on a cloud drive.

KeePassX has long been around for native Linux support, but hasn't been compatibility with the KeePass 2 (Professional Edition) database format kdbx. Well the excellent authors have release KeePassX 2.0 which is a rewrite with kdbx support. Currently only available as source code, the following instructions will help you to compile and install on Redhat 6/ CentOS 6 /Oracle Linux 6.

Required packages
$ sudo yum install cmake gcc-c++ qt-devel qt libgcrypt libgcrypt-devel libXtst libXtst-devel

NOTE* GIT version https://github.com/keepassx/keepassx uses QT5 plus other packages.

Download source
$ wget https://www.keepassx.org/releases/2.0/keepassx-2.0.tar.gz
$ tar zxvf keepassx-2.0.tar.gz
$ cd keepassx-2.0

Create UNIX Makefiles
$ cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_VERBOSE_MAKEFILE=ON -DWITH_GUI_TESTS=ON

Compile and install
$ make
$ sudo make install

Execute
$ /usr/local/bin/keepassx

Solaris Leap second - Time well spent

2015-07-01T01:44:00.002+01:00

Stayed on line for the extra second 01:00BST.

Glad to say all Solaris system good so far.

Solaris 11.2 Latest SRU - NTPv4 Slew mode
Jul 1 01:00:01 sol11-2 ntpd[659]: [ID 702911 daemon.notice] Positive leap second, expect slowdown slew soon. System clock will be inaccurate until it finishes.

Solaris 11.1 - NTPv4 Slew mode (bug doesn't handle leap second correctly)
Jul 1 01:00:00 sol11-1 ntpd[3459]: [ID 702911 daemon.notice] Inserting positive leap second.

Solaris 10 NTPv3 client in slew mode
Jul 1 01:01:48 sol10 xntpd[3183]: [ID 774427 daemon.notice] time reset (slew) -0.997015 s

Pocket full of caps!

2015-05-03T15:04:00.001+01:00

Pocket full of LC Fibre dust caps, after all-nighter DC relocation and SAN build.

25 years as an IT Professional.

2014-04-24T23:33:00.002+01:00

25 years today I started work at WTL PLC. Then known as CEC, which was Data General and Wang broker. I came on board in 1989 at the start of the Unix technical workstation revolution, "Power to the Desktop". Along came Apollo's running Aegis/Domain OS and Sun MicroSystems Sun-3 range with SunOS 3. Installing and patching from QIC tape was the highlight of my day!

A lot of things have changed over the years in IT, which is itself is the catalyst that has kept me challenged, motivated and passionate about delivering solutions to customers.

As the longest serving employee at WTL I've seen a few people come and go, but the core people and values haven't. The technical team around me, are dedicated to the customers challenges and issues and continue to make my life easier. Equally the WTL sales team, driven commitment in finding outstanding projects, to which the WTL technical team can deliver the foremost technology with latest servers, storage, software and networks.

Thanks to all customers and colleagues(friends) for all your support over the years.

Andy

A Multitude of Putty Sessions

2012-08-27T20:50:00.000+01:00

Many hands may light work, doesn't really work with in IT. I usually look for consistency and reproducible results. So let change this for one hand and many windows make light work!

Come across a nice tool PuttyCS for Windows people which did just the job.

In the Solaris world I would use Sun's Cluster Console on CDE, but other seem to favour Cluster SSH or PSSH.

I would be amiss to say, a better answer to issues above is to automate and use confguration management tools such as Chef and Puppet.

Solaris 11 Locale en_GB.UTF-8 / en_GB.ISO8859-1 / en_GB.ISO8859-15

2012-07-28T23:53:00.003+01:00

When you install Solaris 11.3 or 11.4 from standard text installer cdrom, the en_GB-UTF-8 locales are not installed, even if you select British locales on install.

To make sure packages are have the correct localisation, IPS uses facet as a localisation personality.
$ pkg facet
FACETS VALUE
facet.locale.pt_BR True
facet.locale.es_ES True
facet.locale.en_US True
facet.locale.zh_TW True
facet.locale.zh_CN True
facet.locale.de_DE True
facet.locale.fr_FR True
facet.locale.it_IT True
facet.locale.ko_* True
facet.locale.ja_* True
facet.locale.es True
facet.locale.de True
facet.locale.zh True
facet.locale.ko True
facet.locale.it True
facet.locale.pt True
facet.locale.fr True
facet.locale.en True
facet.locale.ja True
facet.locale.* False

As you can see no en_GB is described and "facet.locale.* False" is a deny everything else rule. So let change this. I'm assuming you have a Solaris 11 repository already configured. Install en_GB packages/files and creates a backup boot environment.

$ sudo pkg change-facet 'facet.locale.en_GB=True'

Packages to update: 463
Create boot environment: No
Create backup boot environment: Yes

PHASE ITEMS
Image State Update Phase 2/2

Now let's make the en_GB.UTF-8 the default locale. Previously in Solaris 10 we would edit /etc/default/init. But as with many things in Solaris 11 this has moved to SMF and /etc/default/init is read-only.

$ sudo svccfg -s svc:/system/environment:init setprop \

environment/LANG = astring: en_GB.UTF-8

$ sudo svcadm refresh svc:/system/environment

Now the system defaults to en_GB.UTF-8 for new processes, but remember not children processes. So thing like CRON and ssh have to be restarted, but I would go for a reboot.

$ sudo svcadm restart ssh

$ sudo svcadm restart cron

Settings for Non-UTF-8 locales (en_GB.ISO8859-15 / en_GB.ISO8859-1)

Non-UTF-8 locales such as en_GB.ISO8859-15 require the "system/locale/extra" package to be installed.

$ sudo pkg install system/locale/extra

$ sudo svccfg -s svc:/system/environment:init setprop \

environment/LANG = astring: en_GB.ISO8859-15

Additional Options

These are set correctly on install, but added here for completeness.

$ svccfg -s keymap:default setprop keymap/layout = UK-English

$ svcadm refresh keymap
$ svcadm restart keymap
$ svccfg -s timezone:default setprop timezone/localtime= astring: GB
$ svcadm refresh timezone:default

My Raspberry Pi

2012-06-22T17:23:00.000+01:00

How can you be a geek without a Raspberry Pi ? You can't!

Raided my daughter Lego box and now my Raspberry Pi has got a case.

Debian installed and updated. Planning to put my mail project on it.

Python
Django
Rabbit MQ
Twisted 12
lighttpd

Next project I'm planning to integrate Nagios with physical alarms/lights.

Sun Security Tool Kit - Finish Script Descriptions

2011-07-12T23:48:00.000+01:00

Sun Security Tool Kit (SUNWjass) provides a Oracle Solaris OS Hardening driver (template). Behind this is a number of Finish scripts (.fin) which actually does the OS hardening. This a brief description of each one when the name isn't obvious..

disable-ab2.fin	Answer Book 2
disable-apache.fin
disable-apache2.fin
disable-appserv.fin	Java App Server
disable-asppp.fin	Async PPP
disable-autoinst.fin	Disables SYS-UNCONFIG
disable-automount.fin	NFS Automouter
disable-dhcpd.fin	Disables DHCP server
disable-directory.fin	Sun One Directory Server LDAP
disable-dmi.fin	Desktop Management Interface lrc:/etc/rc3_d/S77dmi
disable-dtlogin.fin	Disabled CDE from starting
disable-face-log.fin	Removed write permission on log for SUNWfac - rarely used
disable-ipv6.fin	Disables IPV6
disable-IIim.fin	Internet-Intranet Input Method - Asian input
disable-kdc.fin	Kerberos Key Server
disable-keyserv-uid-nobody.fin	disables User ID Nobody for secure RPC
disable-ldap-client.fin	Prevents LDAP Client from starting
disable-lp.fin	Stop Print Services
disable-mipagent.fin	Mobile IP
disable-named.fin	BIND DNS Server
disable-nfs-client.fin
disable-nfs-server.fin
disable-nscd-caching.fin	disable caching of passwords/groups & hosts
disable-ppp.fin	Sync PPP
disable-preserve.fin	Stops moving saved files - been edited
disable-power-mgmt.fin
disable-remote-root-login.fin
disable-rhosts.fin	Disable use of .rhosts changes PAM config
disable-routing.fin	Disables RDISC/RIP/Forwarding - routeadm
disable-rpc.fin	RPC - Also breaks NFS
disable-samba.fin	Disable from starting
disable-sendmail.fin	Disable sendmail accepting mail
disable-slp.fin	Disables Service Location Protocol RFC 2608
disable-sma.fin	System Management Agent - NET-SNMP
disable-smcwebserver.fin	Solaris Management Console
disable-snmp.fin	SNMP
disable-spc.fin	Sun Soft print Client svc:/application/print/cleanup:default
disable-ssh-root-login.fin	Disables ROOT login via SSH
disable-syslogd-listen.fin	Disable SYSLOGD from accepting logs
disable-system-accounts.fin	remove smtp listen nobody4
disable-uucp.fin	Disable Unix to Unix Copy
disable-vold.fin	VOLD = CDROM automount
disable-xfs.fin	X Font Server
disable-xserver-listen.fin	Disable X11 port 6000
enable-account-lockout.fin	Enabling account lockout to lock user accounts with repeated failed entries
enable-coreadm.fin	Save cores
enable-ftpaccess.fin	Enable -a flag - FTPACCESS
enable-ftp-syslog.fin	Enable -l flag - SYSLOG
enable-inetd-syslog.fin	SYSLOG all connections to inetd services
enable-ipfilter.fin	Enable Firewall - rules /etc/ipf/ipf.conf
enable-password-history.fin	Remember previous passwords
enable-priv-nfs-ports.fin	Allow NFS access from port <1024
enable-process-accounting.fin	Enable process accounting SUNWaccr
enable-rfc1948.fin	TCP Sequence Number - TCP_STRONG_ISS=2
enable-stack-protection.fin	Kernel Level Stack Protection
enable-tcpwrappers.fin	create hosts.allow and hosts.deny SSHD may be too restrictive.
install-at-allow.fin	at.allow - restrict access to at command
install-ftpusers.fin	Add all users for ftpusers to denied access
install-loginlog.fin	Enable logging of failed login attempts - loginlog
install-md5.fin	Install MD5 on Solaris 8 and 9, Sol 10 use digest cmd
install-nddconfig.fin	Enable secure network settings
install-newaliases.fin	Creates correct aliases for Sendmail - minimal install
install-sadmind-options.fin	Sol 8 & 9 - Security level for sadmind service
install-security-mode.fin	Enable OBP Command security - need passwd
install-shells.fin	Add SHELLS
install-sulog.fin	Track SU use and attempted use
print-rhosts.fin	Finds .rhosts & hosts.equiv
remove-unneeded-accounts.fin	Removes unneeded accounts
set-banner-dtlogin.fin	adds banner to DTLOGIN
set-banner-ftpd.fin
set-banner-sendmail.fin
set-banner-sshd.fin
set-banner-telnetd.fin
set-flexible-crypt.fin	Enable stronger encryption of local passwords - md5
set-ftpd-umask.fin
set-login-retries.fin	Allow 3 attempts to login
set-power-restrictions.fin	Restrict access to power commands
set-rmmount-nosuid.fin	Disable mounting of SET-UID files of CDROMS
set-root-group.fin	Change root group to 0
set-strict-password-checks.fin	Complex passwords for local users
set-sys-suspend-restrictions.fin	Restrict suspend function
set-system-umask.fin	Create umask 022
set-tmpfs-limit.fin	Set to 512Mb
set-user-password-reqs.fin	Min Length, Expire etc..
set-user-umask.fin	Profile /etc/skel ..
update-at-deny.fin
update-cron-allow.fin
update-cron-deny.fin
update-cron-log-size.fin	CRON LOG set to 512K
update-inetd-conf.fin	JASS_SVCS_DISABLE Drivers/finish.init
enable-bart.fin	Sol10 only - Setup BART - basic audit reporting tool

Windows - Must Install Open Source Utilities

2011-06-04T12:38:00.000+01:00

Windows - Must Install Open Source Utilities

Name	Description	URL
7Zip	Archive/Compression	http://www.7-zip.org
Putty	The default SSH client	http://www.chiark.greenend.org.uk/~sgtatham/putty/
GIMP	Graphics	http://www.gimp.org/
Wireshark	Network Sniffer/Analyser	http://www.wireshark.org/
WINscp	SCP/FTP client	http://winscp.net
UltraVNC	VNC Server/Client	http://www.uvnc.com/
FreeMind	Mind Mapper	http://freemind.sourceforge.net
Lanchy	Windows Quick Launcher	http://www.launchy.net/
Greenshot	Screen Capture	http://getgreenshot.org/
VIM	VI Improved Editor	http://www.vim.org/
CCleaner	Remove cache and cookies	http://www.piriform.com/ccleaner
Notepad++	Notepad replacement	http://notepad-plus-plus.org/
NX Client	NoMachine Client	http://www.nomachine.com/
NMAP	Port Scanner Zenmap GUI	http://nmap.org/
LibreOffice	Word processor, Spreadsheet	http://www.libreoffice.org
Putty Session Manager	Putty Quick Launcher - Hot Keys	http://puttysm.sourceforge.net/
VirtualBox	Desktop Virtualisation	http://www.virtualbox.org/
Firefox 4	Mozilla Browser	http://www.mozilla.com
Google Chrome 11	Google Browser	http://www.google.com/chrome
Drop Box	Cloud Storage	http://www.dropbox.com/

2011 Todo List

2011-01-03T13:15:00.000+00:00

Certifications
Veritas Storage Foundation HA re-certify for 5.1
RedHat RHCE
Translate Sun Microsystems certifications to Oracle Knowledge Zones

Courses
VMware 4.x Design Workshop (Required for Partner Enterprise Certification)

Learn
IBM Director for AIX and x86 world
Oracle VM Server (x86)
Cloud Deployment of Infrastucture and Services.
Solaris 11, been playing with OpenSolaris but need to get serious now.

WTL Internal,
Move vSphere 4.0 ESX hosts to 4.1 ESXi
Updated Firewall hardware.

An Ode to a putty and screen. Also keeping green

2010-12-24T00:00:00.005+00:00

I love the simple things in life, especially those that make life simple.

I was requested to build two Solaris 10 servers remotely, Setup SUNWjet & template (very straight forward these days)
One putty session over VPN, loaded with screen utility with named split screens.

I didn't use any carbon travelling to site, but shouldn't I get some bonus points for low bandwidth as well!!

Screen Options

^AA = to name a session
^As = Split screen
^ATAB = Switch split screen

Putty Setting's, SSH2, Compression and Blowfish encryption.

OpenIndiana - First install

2010-09-15T23:32:00.000+01:00

Curious on how this will evolve. OpenSolaris life outside of Oracle/Sun is uncertain, will the community strength or fold?

Can you use Solaris wanboot to boot a system into single user mode?

2010-09-15T16:58:00.003+01:00

Can you use Solaris wanboot to boot a system into single user mode?

Google or Sun Docs didn't have the definitive answer for me.

Answer is YES

T5240, No Keyboard
Copyright 2010 Sun Microsystems, Inc. All rights reserved.
OpenBoot 4.30.7, 8192 MB memory available, Serial #xxxxxx.
Ethernet address 0:ff:ff:ff:f:ff, Host ID: 8xxxxxx.

{0} ok

{0} ok setenv network-boot-arguments host-ip=10.1.1.1,router-ip=10.1.1.254,subnet-mask=255.255.255.0,hostname=hostname-gd,file=http://172.16.1.1:80/cgi-bin/wanboot-cgi
network-boot-arguments = host-ip=10.1.1.1,router-ip=10.1.1.254,subnet-mask=255.255.255.0,hostname=hostname-gd,file=http://172.16.1.1:80/cgi-bin/wanboot-cgi
{0} ok boot net -s
Boot device: /virtual-devices@100/channel-devices@200/network@0 File and args: -s
wanboot info: WAN boot messages->console
wanboot info: configuring /virtual-devices@100/channel-devices@200/network@0

wanboot progress: wanbootfs: Read 368 of 368 kB (100%)
wanboot info: wanbootfs: Download complete
Wed Sep 15 14:04:06 wanboot info: WAN boot messages->172.16.1.1:80
SunOS Release 5.10 Version Generic_141444-09 64-bit
Copyright 1983-2009 Sun Microsystems, Inc. All rights reserved.
Use is subject to license terms.
Booting to milestone "milestone/single-user:default".
Configuring devices.
Network interface was configured manually.
10.1.1.1
Requesting System Maintenance Mode
SINGLE USER MODE
# ls /dev/dsk
c0d0s0 c0d0s1 c0d0s2 c0d0s3 c0d0s4 c0d0s5 c0d0s6 c0d0s7
# mount /dev/dsk/c0d0s0 /a
# ls /a
bin         etc         lost+found proc        tmp
boot        export      mnt         root        usr
dev         kernel      opt         sbin        var
devices     lib         platform    system

The Jumpstart/Wanboot environment was created using Sun JET with the wanboot module.

apaton@jedi:~ $ pkginfo -l JetWanBoot
   PKGINST: JetWanBoot
      NAME: JET WanBoot support
CATEGORY: application
      ARCH: sparc
   VERSION: 1.3.2
   BASEDIR: /opt/SUNWjet
    VENDOR: Sun Microsystems
    PSTAMP: ceng20100122090411
INSTDATE: Jun 19 2010 13:06
    STATUS: completely installed
     FILES:       29 installed pathnames
                   5 shared pathnames
                   7 directories
                  20 executables
                 115 blocks used (approx)

Reduce Swap in Red Hat 5

2010-07-11T16:19:00.000+01:00

Red Hat recommended SWAP to be no larger than 4Gb,

1) Show current swap
swapon -s

2) Unmount Swap
swapoff /dev/mapper/VolGroup00-LogVol01

3) Reduce from 54Gb to 4Gb (Each LV Extent is 32Mb)
lvreduce -l -1600 /dev/VolGroup00/LogVol01

4) Reformat swap
mkswap /dev/VolGroup00/LogVol01

5) Mount swap as defined in /etc/fstab
swapon -a

VMware vMA - UK setup

2010-02-20T12:25:00.001+00:00

VMware's vMA is an execllet tool for managing ESXi environments and comes as a pre-built Virtual machine (Appliance).

My method of setting it up for the UK, thus my cronjobs run in GMT/BST.

Setup Authentification to vCenter/ESX hosts

sudo vifp addserver <192.168.10.90>
vifp listservers
vifpinit
Test it works
vicfg-nics -l --vihost

Update vMA

$ sudo vi /etc/vmware/esxupdate/vimaupdate.conf
 proxy = http://
 proxyport = 
$ sudo vima-update scan
$ sudo vima-update update

Setup SSH Keys

$ mkdir ~/.ssh
$ vi ~/.ssh/authorized_keys2
$ chmod 700 ~/.ssh/authorized_keys2

Set Time and local

$ sudo mv /etc/localtime /etc/localtime.org
$ sudo ln -s /usr/share/zoneinfo/Europe/London /etc/localtime
$ sudo vi /etc/sysconfig/keyboard
  KEYTABLE="uk"
$ sudo vi /boot/grub/menu.1st
title Red Hat Enterprise Linux Server (2.6.18-164.el5)
       root (hd0,0)
       kernel /vmlinuz-2.6.18-164.el5 ro root=/dev/VolGroup00/root quiet notsc divider=10
      initrd /initrd-2.6.18-164.el5.img

$ sudo vi /etc/ntp.conf
comment out lines
#server 127.127.1.0 
#fudge  127.127.1.0 stratum 10
add lines
server <1st NTPSERVER FQDN/IP>
server <2nd NTPSERVER FQDN/IP>

$ sudo vi /etc/ntp/step-tickers
<1st NTPSERVER FQDN/IP>
<2nd NTPSERVER FQDN/IP>

Scheduled network capture on Windows using Wireshark (tshark.exe)

2010-02-20T12:08:00.005+00:00

A customer had an iSCSI issue and was required to capture network packets at a specific time on a Windows 2008 server.

I came up with simple method using Wireshark's tshark.exe and Windows scheduler "AT".

at cmd /c c:\capture.bat

type c:\capture.bat
rem Capture WireShark example
rem Andy Paton
rem WTL
rem use AT to run batch
rem example at 01:50 cmd /c c:\capture.bat

rem debug at issues
rem example at 09:50 /interactive cmd /k c:\capture.bat

rem -a duration:1200 in seconds
rem -B Buffer Size - default is 1Mb
rem -i Interface number - use "tshark.exe -D" to list interface numbers
rem -n don't resolve IP addresses
rem -q Quiet output
rem -w output file
rem capture filter "host "

c:\"Program Files"\Wireshark\tshark -a duration:1200 -B 2 -i 4 -n -q -w c:\network.out host 192.168.1.1

ZFS Compression Vs Deduplication (dedup)

2010-02-06T14:28:00.006+00:00

Been playing with ZFS dedupe for the last two weeks and just wanted to share my findings.

Setup OpenSolaris build 131
Sun X4200, 2 x Dual Core Opteron 2.6Ghz, 8Gb Ram, 4 x 73Gb SAS 10Krpm

root@osol:~# zfs list
NAME                       USED AVAIL REFER MOUNTPOINT
compress                    72K 66.9G    21K /compress
dedupe                      72K 66.9G    21K /dedupe

root@osol:~# zfs set compression=on compress
root@osol:~# zfs set dedup=on dedupe

Wanted to see how much real data would dedupe.

I loaded the my company project/Software folders, 68,000 files (Visio/PDF/Project/Word/OpenOffice/Excel,ISO's... ) total of 38.9Gb

Load times, copying files from local UFS filesystem to ZFS dataset.

root@osol:/ufs# ptime tar cf - iso projects software | pv | ( cd /dedupe/ ; tar xf - )
real    19:51.930407394
user        5.807881662
sys      1:48.025965013
38.8GB 0:19:51 [33.3MB/s]

root@osol:/ufs# ptime tar cf - iso projects software | pv | ( cd /compress/ ; tar xf - )
real    18:46.544321180
user        3.368262960
sys      1:52.065809786
38.8GB 0:18:46 [35.3MB/s]

The deupe ZFS volume was 66 seconds slower than the compress volume.

Let see how much space we saved for both methods

root@osol:/ufs# zpool list
NAME       SIZE ALLOC   FREE    CAP DEDUP HEALTH ALTROOT
compress    68G 36.1G 31.9G    53% 1.00x ONLINE -
dedupe      68G 38.4G 29.6G    56% 1.02x ONLINE -
rpool       67G 49.8G 17.2G    74% 1.00x ONLINE -

root@osol:/ufs# zfs get compressratio compress
NAME      PROPERTY       VALUE SOURCE
compress compressratio 1.08x -

The compressed volume did a better job than dedupe and saving an extra 6% storage.

Conclusion
There isn't any advantages for dedupe on a general home file share, slight slower performance and less space saved when compared to compression.

Now why would you want to dedupe ? Well just look at my dedupe ratio of 2.28 for a NFS share with VMware, now this is exciting!

root@osol:~$ zpool list vm-dedupe

NAME       SIZE  ALLOC   FREE    CAP  DEDUP  HEALTH  ALTROOT 

vm-dedupe 68G 16.1G 51.9G 23% 2.28x ONLINE -

Therefore I can only say "Some data is more equal than others."

Andy
(Minor edit 7.02.10)

VIM in Windows

2009-11-27T14:59:00.000+00:00

I've been using VIM as my main editor on windows desktop for a number of years. I've resisted my peers suggesting programs like Notepad++.

But today I found a new little hack.From the windows CLI, I can convert my shell scripts in html quickly for my documentation. (I could do this from GUI but took a little time). Next little adventure is write a PowerShell/VBS script to make it even easier.

"C:\Program Files\Vim\vim72\gvim.exe" -n -c ":so $VIMRUNTIME\syntax\2html.vim" -c ":wqa" SourceFilename.sh

Solaris10Guide

2009-11-21T13:21:00.004+00:00

Solaris 10 Quick Reference (Work In Progress)

This document is a quick reference to the major difference and new technologies in Solaris 10. Its is not fully extensive and will only feature on.

● ZFS

● Solaris Containers (Zones)

● Resource Management

● Predictive Self Healing

● DTrace

● Misc

ZFS – Solaris Zettabyte File System

Features

● 128-bit Filesystem

● File System and Volume Manager Integrated

● RAID 0, RAID 1, RAID-Z (RAID5) & RAID-Z2 Double Parity

● Snap Shot and Clone Support

● Compression

● Self healing

● Checksum of data blocks

● Does not use /etc/vfstab as standard

● Setup NFS through zfs

● Does not support ufsdump/ufsrestore

Commands

zpool	Manages Pools (disks)
zfs	Manages file systems

Pool tasks

zpool create mypool c0t1d0	Create mypool with whole disk
zpool create mypool c0t1d0s7	Create mypool with slice
zpool create mypool c1t0d0 c2t0d0	Create mypool with stripe
zpool create mypool mirror c1t0d0 c2t0d0	Create mypool with mirror
zpool create mypool raidz c1t0d0 c1t1d0 c1t2d0	Create mypool with RAID-Z
zpool create mypool raidz2 c1t0d0 c1t1d0 c1t2d0	Create mypool with RAID-Z Double Parity
zpool create -m /export/home mypool c2t0d0	Create mypool with whole disk with mount point /export/home
mkdir 2g /disk1 ; mkdir 2g /disk2 ; mkdir 2g /disk3 ; mkdir 2g /disk4 zpool create mypool mirror /disk1 /disk2 zpool add mypool mirror /disk3 /disk4	Create mypool from files!!
zpool destroy mypool	DESTROY POOL AND FILESYSTEM
zpool list	List pools
zpool status -x	Display pool status
zpool replace mypool c1t0d0 c1t4d0	Replaces drive c1t0d0 to c1t4s0
zpool clear mypool c1t2d0	Clears transient errors from drive
zpool online mypool c1t3d0	Notify ZFS to rescan c1t3d0
zpool scrub mypool	Disk scrubber (checks drives & data)
zpool iostat [-v] [<pool>] <interval>	Display disk status

ZFS File system Tasks

zfs create mypool/home	Create filesystem home
zfs set -o mountpoint=/export/home mypool/home	Create /export/home
zfs create mypool/home/user	Create user directory
zfs destroy mypool/home	Delete home filesystem and below (users)
zfs set quota=20G mypool/home/user
zfs set compression=on mypool/home
zfs get all mypool/home	View settings
zfs set sharenfs=on mypool/home/user	Create NFS share
zfs set sharenfs=ro myspool/home/jumpstart	Create Read only NFS share
zfs set sharenfs=root=192.168.10.162 rpool/export/zones
zfs unshare mypool/home/user	disable NFS share
zfs list	List ZFS filesystem
zfs list -o name,quota,mountpoint	List ZFS filesystem options
zfs snapshot mypool/home@today	Create readonly snapshot of home called today
zfs set snapdir=visable mypool	Enable access to snapshot
ls /export/home/.zfs/snapshot/today	Access to snapshot
zfs rollback mypool/home@today	Rollback to snapshot
zfs clone myspool/home@today mypool/home_new	Clone home snapshot and create a writeable mypool/home_new
zfs promote mypool/home_new	Make clone the primary data source
zfs rename mypool/home mypool/home_old ; zfs rename mypool/home_new mypool/home	rename clone to replace home, move old to home_old
zfs destroy mypool/home@today	Destroy snapshot

Solaris Containers (Zones)

Features

● Software partition, single kernel!

● share or individual packages and patches.

● chroot on steroids!

● Consolidation

● Test and development

● Resource Management

● BrandZ (Solaris 8/9 and Linux)

● IP Share & Exclusive Mode

● Zone enable commands (ps / prstat ..)

● Unbundled application Zonestat

Configuration Guide Lines

Network & Routing

The global zone must be connected and routing table correctly configured.

DHCP

Is not supported in a zone in IP Share mode on in Exclusive Mode

NFS Server

Unable to export

Commands

zonecfg

Manages zones configuration

zoneadm

Manages Zones

zlogin

~. (drop to shell but my break ssh shell)

Change SSH break character.

ssh -e ^ <user>@<globalzone>

Create Zone

zonecfg -z myzone zonecfg:myzone> create zonecfg:myzone> set zonepath=/export/zones/myzone zonecfg:myzone> set autoboot=true zonecfg:myzone> add net zonecfg:myzone:net> set address=10.10.25.33 zonecfg:myzone:net> set physical=e1000g0 zonecfg:myzone:net> end zonecfg:myzone> verify zonecfg:myzone> commit zonecfg:myzone> exit	Basic Zone
zonecfg -z webzone zonecfg:webzone> set zonepath=/export/zones/webzone zonecfg:webzone> set autoboot=true zonecfg:webzone> add net zonecfg:webzone:net> set address=10.10.25.34 zonecfg:webzone:net> set physical=e1000g0 zonecfg:webzone:net> end zonecfg:webzone> add fs zonecfg:webzone:fs> set dir=/export/home zonecfg:webzone:fs> set type=lofs zonecfg:webzone:fs> set special=/export/home zonecfg:webzone:fs> end zonecfg:webzone> info zonecfg:webzone> verify zonecfg:webzone> commit zonecfg:webzone> exit	Zone with home directories shared with Global zone
zonecfg -z ownzone zonecfg:ownzone> create zonecfg:ownzone> set zonepath=/export/zones/ownzone zonecfg:ownzone> set autoboot=true zonecfg:ownzone> add net zonecfg:ownzone:net> set address=10.10.25.35 zonecfg:ownzone:net> set physical=e1000g0 zonecfg:ownzone:net> end zonecfg:ownzone> remove inherit-pkg-dir dir=/lib zonecfg:ownzone> remove inherit-pkg-dir \ dir=/platform zonecfg:ownzone> remove inherit-pkg-dir dir=/sbin zonecfg:ownzone> remove inherit-pkg-dir dir=/usr zonecfg:ownzone> verify zonecfg:ownzone> commit zonecfg:ownzone> exit	Zone with no inherited packages
zonecfg -z poolzone zonecfg:poolzone> create zonecfg:poolzone> set zonepath=/export/zones/poolzone zonecfg:poolzone> set autoboot=true zonecfg:poolzone> set pool=qa-pool zonecfg:poolzone> add net zonecfg:poolzone:net> set address=10.10.25.33 zonecfg:poolzone:net> set physical=e1000g0 zonecfg:poolzone:net> end zonecfg:poolzone> verify zonecfg:poolzone> commit zonecfg:poolzone> exit	Zone with resource pool “qa-pool” allocated, See pools.

sysidcfg file, copy in <zonepath>/root/etc/sysidcfg to pre answer boot questions

name_service=DNS

{domain_name=<domain>

name_server=<default router>}

system_locale=en_GB.ISO8859-1

terminal=vt100

network_interface=primary {

hostname=<hostname>}

security_policy=NONE

nfs4_domain=LOCAL.com

timezone=GB-Eire

root_password=<encrypted password>

Administer Zone

zoneadm -z myzone install	Install a configured zone
zoneadm -z myzone boot	Boot a zone
zoneadm -z myzone boot && zlogin -C myzone	Boot and watch console of a zone
zoneadm -z myzone halt	Stop a zone ( eg pull power)
zoneadm -z myzone reboot
zoneadm -z myzone uninstall -F	Deletes a zone
zonecfg -z myzone delete -F	Removes a zone config
zoneadm list -civ	Display Zones Status
zoneadm -z myzone detach	Detach zones (ready to move)
zoneadm -z myzone attach	Attach Zone
zoneadm -z myzone attach -F	Attach Zone with out verify
zoneadm -z myzone attach -u	Attach Zone update any patches with global zone
zoneadm -z myzone attach -u -b <patch=id>	Attach Zone update any patches with global zone, backing out patch id
zlogin -C myzone	Login to the zone console ~. to drop out
zlogin -l sysadmin myzone	Login as sysadmin user
zlogin myzone shutdown -i 0	Shutdown zone gracefully
zlogin -S myzone	Login Safe mode for diagnostics
zonename	Tell me my zonename

Clone myzone to dolly (ZFS)

zlogin myzone shutdown -i 0	Shut down zone gracefully
zonecfg -z myzone export -f /export/zones/myzone.cfg
chmod 700 /export/zones/dolly	Strict permissions
vi /export/zones/myzone.cfg	Change path and IP address
zonecfg -z dolly -f /export/zones/myzone.cfg	Create zone from master template
zoneadm -z dolly clone myzone	Clone myzone to dolly.
zoneadm -z dolly boot	Boot dolly

Move myzone to different server

Source Host

1	zlogin myzone shutdown -i 0	Shut down zone gracefully
2	zonecfg -z myzone export -f /export/zones/myzone.cfg	Create export file
3	zoneadm -z myzone detach
4	tar cf myzone.tar /export/zones/myzone
5	scp myzone.cfg <user>@<target-host>

Target Host

1	tar xvf myzone.tar	Untar in to new root zonepath.
2	Edit myzone.cfg to reflect new zonepath
3	zonecfg -z myzone -f myzone.cfg	Create zone from master template
4	zoneadm -z myzone attach	Attach zone
5	zoneadm -z myzone boot

Resource Management CPU

Features

● Fixed number of CPU's per zone

● Variable CPU's per zone

● FSS Fair Share, weighted zones. recommended for most application

● Mixed workloads

● In Solaris 10 8/07 and later we have dedicated CPU' feature which can be an effective alternative to pools.

Commands

pooladm	Administer pools
poolcfg	Configure pools
dispadmin	Dispatch “Scheduler” Admin

Create Fixed CPU Zone Pool

pooladm -e	Enable pools
svcadm enable pools	Enable pools
pooladm -s	Save configuration
poolcfg -c 'create pset db-pset (uint pset.min=10; uint pset.max=10)'	Processor Set “db-pset” 10 CPU's
poolcfg -c 'create pool db-pool'
poolcfg -c 'associate pool db-pool (pset db-pset)'
pooladm -c	Activate configuration
zonecfg -z dbzone zonecfg:dbzone> set pool=db-pool zonecfg:dbzone> verify zonecfg:dbzone> commit zonecfg:dbzone> exit	Associate the zone with a resource pool

Create FSS Zone (Pool)

pooladm -e	Enable pools
svcadm enable pools	Enable pools
pooladm -s	Save configuration
poolcfg -c 'create pool db-pool ( string pool.scheduler = "FSS" )'	Resource pool with FSS
poolcfg -c 'create pool ap-pool ( string pool.scheduler = "FSS" )'	Resource pool with FSS
pooladm -c	Activate configuration
pooladm	Display configuration
zonecfg -z dbzone zonecfg:dbzone> set pool=dbpool zonecfg:dbzone> add rctl zonecfg:dbzone:rctl>set name=zone.cpu-shares zonecfg:dbzone:rctl>add add value (priv=privileged,limit=3,action=none) zonecfg:dbzone:rctl> end zonecfg:dbzone> verify zonecfg:dbzone> commit zonecfg:dbzone> exit	Associate the zone with a resource pool and set FSS CPU share to 3
zonecfg -z apzone zonecfg:apzone> set pool=appool zonecfg:apzone> add rctl zonecfg:apzone:rctl>set name=zone.cpu-shares zonecfg:apzone:rctl>add add value (priv=privileged,limit=2,action=none) zonecfg:apzone:rctl> end zonecfg:apzone> verify zonecfg:apzone> commit zonecfg:apzone> exit	Associate the zone with a resource pool and set FSS CPU share to 2
zlogin apzone init 6 && zlogin dbzone init 6	Reboot zones
dispadmin -d	Display default scheduler
dispadmin -d FSS	Set scheduler to FSS
priocntl -s -c FSS -i all	Set scheduler to FSS now
prctl -n zone.cpu-shares -i zone global	Display Global zone CPU shares
prctl -n zone.cpu-shares -v 2 -r -i zone global	Set Global Zone to FSS CPU share to 2 * not persistent after reboots
Prctl -n zone.cpu-shares -r -v 3 -i zone <zone>	Dynamically change zone CPU shares

Oracle Database Example using dedicated (need to add filesystems for /u01 ..)

In global

$ mkdir /usr/local

zonecfg -z orazone

zonecfg:orazone> set zonepath /zones/orazone

zonecfg:orazone> set max-shm-memory=4G

zonecfg:orazone> add dedicated-cpu

zonecfg:orazone:dedicated-cpu> set ncpus=12-16

zonecfg:orazone:dedicated-cpu> set importance=2

zonecfg:orazone:dedicated-cpu> end

zonecfg:orazone> add net

zonecfg:orazone:net> set address=10.10.25.35

zonecfg:orazone:net> set physical=e1000g0

zonecfg:orazone:net> end

zonecfg:orazone> add fs

zonecfg:orazone:fs> set dir=/usr/local

zonecfg:orazone:fs> set type=lofs

zonecfg:orazone:fs> set special=/usr/local

zonecfg:orazone:fs> end

zonecfg:orazone> verify

zonecfg:orazone> commit

zonecfg:orazone> exit

Create zone with

zonecfg -z orazone

zonecfg:orazone> set zonepath /zones/orazone

zonecfg:orazone> set max-shm-memory=4G

zonecfg:orazone> add capped-cpu

zonecfg:orazone:capped-cpu> set ncpus=3.75

zonecfg:orazone:capped-cpu> end

zonecfg:orazone> add net

zonecfg:orazone:net> set address=10.10.25.35

zonecfg:orazone:net> set physical=e1000g0

zonecfg:orazone:net> end

zonecfg:orazone> add fs

zonecfg:orazone:fs> set dir=/usr/local

zonecfg:orazone:fs> set type=lofs

zonecfg:orazone:fs> set special=/usr/local

zonecfg:orazone:fs> end

zonecfg:orazone> verify

zonecfg:orazone> commit

zonecfg:orazone> exit

Services management Facility

Features

● Predictive hardware monitoring

● isolation and deactivation

● Fault Management Architecture FMA / Service Management Facility SMF

● Message Identifier lookup @ http://www.sun.com/msg/

● RC script, /etc/inetd.conf & /etc/inittab are legacy

● Milestones as wellas run levels

● FMRI – example svc:/network/ssh:default

● Methods and Manifest (XML)

Commands and Logs

svcs	Display service status and dependencies
svcadm	Enable/Disable services
inetconv	convert inetd.conf
svccfg	Manifest Management
/var/adm/messages	System logs
/var/svc/log	Service Logs
/etc/svc/volatile	pre-single user logs

SMF Tasks

svcadm disable system/cron:default	Disables
svcadm enable system/cron:default	Enable cron
svcadm refresh network/ssh:default	reread ssh configuration
svcadm restart network/ssh:default	restart ssh
svcadm -v enable -r nfs/server	Enables all services required to start nfs
svcadm -v enable -r -t nfs/server	Enables all services required to start nfs until a reboot
svcs -a	List all services
svcs -p ssh	Show processes attached to ssh server
svcs -d /network/smtp	Show what service smtp depend on
svcs -D /network/smtp:sendmail	Show what service depend on smtp
svcs -xv	Display failed services
boot -m verbose	Display services on boot up.
svcadm milestone -d milestone/single-user:default	change default run level
svcadm milestone milestone/multi-user	change run level to multi-user
Ok> boot -m milestone=single-user	boot in to single user

Networking

Security

RBAC

• /etc/user/attr # User and Role information

• /etc/security/prof_attr # Predefined profile (collection of rights)

• /etc/security/policy.conf # User defaults

• /etc/security/exec_attr # Rights Profile and associated execution attributes

profiles <username>	Display security profiles assigned to user
profiles -l <username>	Displays individual commands within a profile
pfexec <cmd>	Executes commands with correct privileges
roles <username>	Display roles assigned to user

Solaris Security Toolkit

• Download from http://www.sun.com/software/security/jass/

• Installed into /opt/SUNWjass

• Run manual or integrated with Jumpstart

• Ready made templates in /opt/SUNWjass/Drivers

• Always have console access, as the tool-kit often blocks remote logins.

./jass-execute -d secure.driver	Hardens Solaris
./jass-execute -a secure.driver	Audits Solaris against template
./jass-execute -c	Clear previous edits.

Miscellaneous Settings

/etc/ssh/sshd_config

SSH Settings

Disable Root, Allow on SSH-2 protocol

Consider naming specific users.

Or disable well know users, oracle, admin....

vi /etc/security/policy.conf

change CRYPT_DEFAULT to 1 (BSD MD5)

CRYPT_DEFAULT=1

Change password encryption

Solaris IP Filter

• Not enables by default

• Packet Filtering available between zones.

• NAT

• Statefull

• Manual configuration only

vi /etc/ipf/ipf.conf	Edit rules file
ipf -f /etc/ipf/ipf.conf	Enabe rules files
ipf -Fa	Disable Rules
ipf -Fi	Disable incoming filter
Ipfstat	IP Filter stastics
svcadm enable network/ipfilter	Enable the IP Filter

Rule Examples

#/etc/ipf/ipf.conf

# pass and log everything by default

pass in log on elxl0 all

pass out log on elxl0 all

# Disable SSH access to this machine from 192.168.10.254

block in quick from 192.168.10.254/32 to port = 22

# block, but don't log, incoming packets from other reserved addresses

block in quick on elxl0 from 10.0.0.0/8 to any

block in quick on elxl0 from 172.16.0.0/12 to any

# block and log untrusted internal IPs. 0/32 is notation that replaces

# address of the machine running Solaris IP Filter.

block in log quick from 192.168.1.15 to <thishost>

block in log quick from 192.168.1.43 to <thishost>

# block and log X11 (port 6000) and remote procedure call

# and portmapper (port 111) attempts

block in log quick on elxl0 proto tcp from any to elxl0/32 port = 6000 keep state

block in log quick on elxl0 proto tcp/udp from any to elxl0/32 port = 111 keep state

Note – example taken from Sun IP Security Manual

DTrace

A dynamic tracing facility that provides a comprehensive view of operating system and application behaviour. It has functionality similar to truss, apptrace, prex and mdb, bundled into a single scriptable tool that can examine both userland activity and the kernel. DTrace can be used on live production servers with often negligible impact on performance.

Example D-scripts are provided in /usr/demo/dtrace

DTrace toolkit http://www.opensolaris.org/os/community/dtrace/dtracetoolkit

DTrace manual http://docs.sun.com/app/docs/doc/817-6223

Quick Ref http://developers.sun.com/solaris/articles/dtrace_quickref/dtrace_quickref.html

How to http://www.sun.com/software/solaris/howtoguides/dtracehowto.jsp

Dtrace Cheatsheet http://blogs.sun.com/brendan/entry/dtrace_cheatsheet

Solaris 10 minor differences

routeadm -e ipv4-forwarding routeadm -d ipv4-routing routeadm -e ipv4-routing	Routing commands, for IP Forwarding and routing (in.routed)
echo “server IP_ADDRESS” >> /etc/inet/ntp.conf svcadm enable /network/ntp	Enable NTP
vi /etc/security/policy.conf change CRYPT_DEFAULT to 1 (BSD MD5) CRYPT_DEFAULT=1	Change password encryption
svccfg -s x11-server setprop options/tcp_listen = true	Allow X11 connection Solaris 10
dumpadm -d /dev/dsk<device>	Manage Dumps to dedicated device (support ZFS root)
dumpadm -c /var/crash/<hostname>	Manage core dumps

Live Upgrade (ZFS)

lucreate -c <be_name> -n <new-be_name>	Name current boot environment and create New BE.
lucreate -n <new-be_name>	Create new environment
lustatus	Display boot environment
luupgrade -u -n <new-be_name> -s /net/<ip address>/export/install	Live OS Upgrade
cd 10_Recommended luupgrade -t -n <new-be_name> -O \ -t -s . ./patch_order	Patch a live environment from downloaded patch cluster.
luactivate <new-be_name>	Activate Boot environment, after reboot. DON'T USE “reboot” command, always use init or shutdown.

Reference Material

Little Known Solaris Features http://www.c0t0d0s0.org/pages/lksfbook.html

Solaris Security Tool Kit http://docs.sun.com/app/docs/prod/61ec778c-5688-47ba-b4bf-af20b140731a

Solaris Patching Best Practise http://www.sun.com/bigadmin/features/articles/patch_management.jsp

Solaris Zones FAQ http://hub.opensolaris.org/bin/view/Community+Group+zones/faq

Zonestat Util http://hub.opensolaris.org/bin/view/Project+zonestat/

SVC SMF https://www.sun.com/offers/docs/smfmanifest_howto.pdf

Andy Paton	18/18	7/11/09

Version 2.1

SMcli Examples

2009-10-21T23:42:00.003+01:00

SMcli Examples from the command line

\\ Create snapshot
SMcli <ip address> -c "set session password=\"<password>\" ; create snapshotVolume basevolume=\"TEST_VOL_REPL\" repositoryPercentOfBase=80 repositoryFullPolicy=failSnapShot ; "

\\ Delete snapshot/volume
SMcli <ip address> -c "set session password=\"<password>\" ; delete volume [\"TEST_VOL_REPL-1\"] ; "

\\ Create Remote Mirror (ON PRIMARY STORAGE)
SMcli <Primary IP address> -c "set session password=\"<password>\" ; create remoteMirror primary=\"TEST_VOL\" secondary=\"TEST_VOL_REPL\" remotestorageArrayName=\"<Secondary ARRAY NAME>\" remotePassword=\"<password>\" syncPriority=medium writeOrder=preserved writeMode=synchronous;"

\\ Remove Remote Mirror
SMcli <ip address> -c "set session password=\"<password>\" ; remove remoteMirror localVolume [\"TEST_VOL_REPL\"] ;"

\\ Map LUN
SMcli <ip address> -c "set session password=\"<password>\" ; set volume [\"TEST_VOL_REPL\"] logicalUnitNumber=6 host=\"<HOST NAME>\"; "

\\ Un Mapp LUN
SMcli <ip address> -c "set session password=\"<password>\" ; remove volume [\"TEST_VOL_REPL\"] lunMapping host=\"<HOST NAME>\"; "

\\ View Lun Maps
SMcli <ip address> -c "set session password=\"<password>\" ; Show storageArray lunMappings host [\"<HOST NAME>\"];"

SMcli Examples from a SMcli Script File

// call by SMcli <ip address> -f <script name>

// Set Password
set session password="<password>" ;

// Print statement
show "Hello World" ;

// Create snapshot
create snapshotVolume basevolume="TEST_VOL_REPL" repositoryPercentOfBase=80 repositoryFullPolicy=failSnapShot ;

// Delete snapshot-volume
delete volume ["TEST_VOL_REPL-1"] ;

// Create Remote Mirror

create remoteMirror primary="TEST_VOL" secondary="TEST_VOL_REPL" remotestorageArrayName="<Secondary ARRAY NAME>" remotePassword="<password>" syncPriority=medium writeOrder=preserved writeMode=synchronous;

// Remove Remote Mirror
show "* Break Mirror for TEST_VOL_REPL" ;
remove remoteMirror localVolume ["TEST_VOL_REPL"] ;

// Map LUN to HOST
set volume ["TEST_VOL_REPL"] logicalUnitNumber=<LUN ID> host="<HOST NAME>";

// Un Mapp LUN
remove volume ["TEST_VOL_REPL"] lunMapping host="<HOST NAME>";

// view mappings
show storageArray lunMappings host ["<HOST NAME>"];

Solaris 10 Administration Guide (11/06)

2009-03-06T21:09:00.001+00:00

My Solaris 10 Admin Guide (Sol10 11/06), needs updating but its a good start. click here to view.

Andy Paton's most Technical Adventure

Solstice DiskSuite Command Summary

State Database Operations.

Operation

Simple Metadevice Operations.

Operation

Growing Metadevices.

Operation

Hotspare Operations.

Operation

Soft Partition Operations.

Operation

Mirror Operations.

Operation

Disk and Partition Replacement Operations.

Operation

Metaset Operations.

Operation

Graphical Interface Operation.

Solaris 11.4 SRU 90 Name Service Checks

Solaris 11.4 SRU 90: Stricter Name Service Validation

Life in the old dog yet - Solaris and me

2016 - 30 Years in Unix - Tools of the trade

Celebrating my 30th Year in Unix.

KeePassX 2.0 On Redhat 6 / Cent OS 6 / OL6

Solaris Leap second - Time well spent

Pocket full of caps!

25 years as an IT Professional.

A Multitude of Putty Sessions

Solaris 11 Locale en_GB.UTF-8 / en_GB.ISO8859-1 / en_GB.ISO8859-15

Settings for Non-UTF-8 locales (en_GB.ISO8859-15 / en_GB.ISO8859-1)

Additional Options

My Raspberry Pi

Sun Security Tool Kit - Finish Script Descriptions

Windows - Must Install Open Source Utilities

2011 Todo List

An Ode to a putty and screen. Also keeping green

OpenIndiana - First install

Can you use Solaris wanboot to boot a system into single user mode?

Reduce Swap in Red Hat 5

VMware vMA - UK setup

Scheduled network capture on Windows using Wireshark (tshark.exe)

ZFS Compression Vs Deduplication (dedup)

VIM in Windows

Solaris10Guide

ZFS – Solaris Zettabyte File System

Features

Commands

Pool tasks

ZFS File system Tasks

Solaris Containers (Zones)

Features

Configuration Guide Lines

Commands

Create Zone

Administer Zone

Clone myzone to dolly (ZFS)

Move myzone to different server

Resource Management CPU

Features

Commands

Create Fixed CPU Zone Pool

Create FSS Zone (Pool)

Services management Facility

Features

Commands and Logs

SMF Tasks

Networking

Security

RBAC

Solaris Security Toolkit

Miscellaneous Settings

Solaris IP Filter

DTrace

Solaris 10 minor differences

Live Upgrade (ZFS)

Reference Material

SMcli Examples

Solaris 10 Administration Guide (11/06)

Soft Partition Operations.^