UNIX BY EXAMPLE

Disable direct ssh root login in Solaris 10

2014-01-02T03:15:00.001-08:00

1. Edit /etc/ssh/sshd_config with your favorite text editor.

[root@root ~]# vi /etc/ssh/sshd_config

Change this line:

#PermitRootLogin yes

Edit to this:

PermitRootLogin no

2. Ensure that you are logged into the box with another shell before restarting sshd to avoid locking yourself out of the server.

[root@root ~]# /etc/init.d/sshd restart

Stopping sshd: [ OK ]

Starting sshd: [ OK ]

[root@root ~]#

Enabling SSL for Apache

2013-08-18T12:45:00.003-07:00

This appendix describes the method of enabling SSL for Apache. The following topics guide you through the necessary steps:

Generate the Certification Request

Perform the following steps to generate a certificate request:

Make the following changes to the openssl.cnf file to generate the certificate request:

#

#OpenSSL example configuration file
#This is mostly being used for generation of certificate requests.
#

#This definition stops the following lines choking if HOME isn't defined.
HOME =
RANDFILE=$ENV::HOME/.rnd
oid_section=new_oids

Use the commands below to generate the certification request:

...\Apache\open_ssl\bin\openssl md5 *>rand.dat
...\Apache\open_ssl\bin\openssl genrsa -rand rand.dat -des3 1024 > key.pem
...\Apache\open_ssl\bin\openssl req -new -key.pem -out csr.pem -config 
openssl.cnf

When you run the final command, a certificate request is generated. The following is an example of a certification request:

Country Name (2 letter code) [AU]: US

State or Province Name (full name)[Some-State]: California

Locality name (eg, city) []: Redwood Shores

Organization Name (eg, company) [Internet Widgits Pty Ltd}: Oracle

Organizational Unit Name (eg, section) []: EITQA

Common Name (eg, YOUR name) []:pdarshan-pc.us.oracle.com

Email Address []: username@oracle.com

Please enter the following "extra" attributes to be sent with your certification request:

A challange password []:

An optional company name []:

Be sure to take note of the following:

These commands create two files: key.pem and csr.pem (certificate request).
For Common Name, include the FULL name of the HOST and DOMAIN you are running the command on.
Remember the password you enter. This password is used every time Oracle HTTP Server is started.

Send the Certification Request. In the CSR area, paste the certification request from csr.pem file.
When you receive the certificate, paste it into a file named portalcert.crt.

Be sure that you get the Root Trial CA certificate by going to the URL mentioned in the Certificate Authority email. Export that certificate from the browser to a file named rootcacert.crt.
Copy the following in appropriate directories:
- Certificate file portalcert.crt into the ...\Apache\Apache\conf\ssl.crt directory.
- key.pem file into the ...\Apache\Apache\conf\ssl.key directory.
- Root Trial CA file rootcacert.crt into the ...\Apache\Apache\conf\ssl.crt directory.

Modify httpd.conf File to Enable SSL

Make the following changes to the httpd.conf file to enable SSL:

Port changes: Be sure your entries are similar to the ones in the example below:

#

# This port is used when starting without SSL

Port 80
# This port is used when starting with SSL



Port 80

Port 443





##

##SSL Support

##

##When we also provide SSL we have to listen to the standard HTTP port 
##(see above) abd to the HTTPS port

##


Listen 80
Listen 443


##
##SSL Virtual Host Context

##

SSL Certificate related entries: For Entry for Certificate, search for SSLCertificateFile and make this entry as below pointing to your certificate that came from the certificate authority. This is illustrated in the following example:

SSLCertificateFile\conf\ssl.crt\portalcert.crt

Entry for Server Private Key

SSLCertificateKeyFile conf\ssl.key\key.pem

Entry for Server Certificate Chain: (The Root Trial CA Certificate)

Entry for Certificate Authority (CA): as below

#Certificate Authority (CA):
#Set the CA certificate verification path where to find CA 
#certificates for client authentication or alternatively one 
#huge file containing all of this (file must be PEM encoded). 
#Note: Inside SSLCACertificatePath you beed hash symlinks 
#to point to the certificate files. Use the provided
#Makefile to update the hash symlinks after changes.
#SSLCACertificateFile conf\ssl.crt\ca-bundle.crt
SSLCACertificateFile conf\ssl.crt
SSLCACertificateFile conf\ssl.crt\rootcacert.crt

Restart Apache.

How to Limit Display of Other User's Processes

2013-08-13T10:23:00.000-07:00

In this update, I will be talking about how to restrict the output of the ps(1) command such that users can only see processes that they own. This is a very useful capability especially for ISPs and other organizations that do not want to allow users to see what other users are doing.

This new feature would not have been possible without the introduction of process privileges into the Solaris 10 OS. For a great overview of process privileges, see Casper Dik's blog entry on this topic. Be sure to read his article to get a more in depth understanding of process privileges.

So, before we begin, let's see what the output of ps -aef might look like for an average user (in this case, gmb):

$ ps -aef
     UID   PID  PPID   C    STIME TTY         TIME CMD
    root     0     0   0   Sep 23 ?           0:07 sched
    root     1     0   0   Sep 23 ?           0:01 /sbin/init
    root     2     0   0   Sep 23 ?           0:00 pageout
    root     3     0   0   Sep 23 ?           2:31 fsflush
    root   393     1   0   Sep 23 ?           0:00 /usr/sbin/auditd
    root     7     1   0   Sep 23 ?           0:11 /lib/svc/bin/svc.startd
    root     9     1   0   Sep 23 ?           0:19 svc.configd
    root   176     1   0   Sep 23 ?           0:00 /usr/sbin/syslogd
    root    64     1   0   Sep 23 ?           0:00 /usr/sbin/nscd
  daemon    91     1   0   Sep 23 ?           0:02 kcfd
    root   170     1   0   Sep 23 ?           0:01 /usr/lib/utmpd
     gmb  1795  1792   0 22:17:26 pts/1       0:00 -sh
    root  1527     7   0 00:53:24 console     0:00 /usr/bin/login
    root    82     1   0   Sep 23 ?           0:00 /usr/lib/sysevent/syseventd
   smmsp   334     1   0   Sep 23 ?           0:00 /usr/lib/sendmail -Ac -q15m
  daemon   137     1   0   Sep 23 ?           0:06 /usr/sbin/rpcbind
    root    84     1   0   Sep 23 ?           0:00 /usr/lib/picl/picld
    root  1601  1527   0 07:36:19 console     0:00 -sh
    root   181     1   0   Sep 23 ?           0:04 /usr/lib/inet/inetd start
    root   281     1   0   Sep 23 ?           0:00 /usr/lib/nfs/mountd
    root   187     1   0   Sep 23 ?           0:00 /usr/sbin/cron
    root  1402     1   0 00:26:14 ?           0:00 /usr/lib/ssh/sshd
  daemon   289     1   0   Sep 23 ?           0:00 /usr/lib/nfs/nfsd
  daemon   264     1   0   Sep 23 ?           0:00 /usr/lib/nfs/statd
    root   303     1   0   Sep 23 ?           0:00 /usr/lib/fm/fmd/fmd
  daemon   268     1   0   Sep 23 ?           0:00 /usr/lib/nfs/lockd
    root   291     1   0   Sep 23 ?           0:00 /usr/lib/autofs/automountd
     gmb  1799  1795   0 22:17:28 pts/1       0:00 ps -aef
    root  1789   181   1 22:17:19 ?           0:00 /usr/sbin/in.telnetd
    root  1792  1789   1 22:17:19 pts/1       0:00 login -p -h 10.1.1.100 -d /dev/pts/1
    root   335     1   0   Sep 23 ?           0:06 /usr/lib/sendmail -bd -q15m
  daemon   296     1   0   Sep 23 ?           0:00 /usr/lib/nfs/nfsmapid

As you can see, the gmb user can see not only his processes but also those of the root, daemon, and smmspaccounts. We can change this behavior either globally or on a per-user basis. Just as we discussed in the Solaris 10 Account Lockout entry, we can use user-specific changes to force a subset of users to comply with some policy or use the user-specific changes to make exceptions for those users. The flexibility of this format allows it to be adapted quite easily to the needs of many organizations.

For our first example, we will illustrate how the global change can be made. So do this, we must edit the/etc/security/policy.conf file, uncomment the PRIV_DEFAULT entry and set its value as follows:

PRIV_DEFAULT=basic,!proc_info

For those not familiar with the proc_info privilege, you can find more information about it using the ppriv(1) command:

# ppriv -l -v proc_info
proc_info
        Allows a process to examine the status of processes other
        than those it can send signals to.  Processes which cannot
        be examined cannot be seen in /proc and appear not to exist.

This is all that you need to do to globally configure your Solaris 10 system so that users will only be able to see processes that they own. Note that this will obviously not apply to root who by default has all privileges or to other users or processes that have been explicitly given the proc_info privilege. Regardless, it is still a very quick and effective way to limit what processes users may see.

Returning to the gmb account example, I re-login to the system and again run the ps -aef command, but this time I receive different results:

$  ssh -l gmb sampleHost
gmb@sampleHost's password:
Last login: Fri Sep 24 22:25:18 2004 from 10.1.1.100
Sun Microsystems Inc.   SunOS 5.10      s10_67  May 2004
$ ps -aef
     UID   PID  PPID   C    STIME TTY         TIME CMD
     gmb  1823  1819   0 22:30:17 pts/1       0:00 ps -aef
     gmb  1819  1815   0 22:30:14 pts/1       0:00 -sh
$

As you can see, the gmb user may now only see his own processes. Way cool. Next, to illustrate the per-user configuration ability, I will leave this global configuration in place and use the per-user configuration ability to allow the gmb user to view processes owned by other users. This is just an example of how exceptions can be implemented. The same process could be used to enable this feature for just a user or subset of users on the system.

To accomplish this task, we go back to the user_attr(4) file. In this file, we will modify the existing entry for the gmbuser (or create one if one had not already been there). The following example illustrates the change that needs to be made. Specifically you need to add the defaultpriv entry to specify the default list of privileges that will be available to this user. By modifying this parameter, you will change the default set of privileges available to a user (by either adding or removing privileges as needed.) In this case, we are returning the user's default set of privileges to basic from basic,!proc_info.

gmb::::lock_after_retries=no;defaultpriv=basic

So, let's see if this really works. In the following example, we will confirm the configuration of the system, login to the system as the gmb user, and run the ps -aef command to verify that the gmb user can see processes owned by other users.

# grep "\^PRIV_DEFAULT=" /etc/security/policy.conf
PRIV_DEFAULT=basic,!proc_info
# grep "\^gmb:" /etc/user_attr
gmb::::lock_after_retries=no;defaultpriv=basic
# ssh -l gmb localhost
Password:
Last login: Fri Sep 24 22:37:55 2004 from 10.1.1.100
Sun Microsystems Inc.   SunOS 5.10      s10_67  May 2004
$ id -a
uid=100(gmb) gid=1(other) groups=1(other)
$ ps -aef
     UID   PID  PPID   C    STIME TTY         TIME CMD
    root     0     0   0   Sep 23 ?           0:07 sched
    root     1     0   0   Sep 23 ?           0:01 /sbin/init
    root     2     0   0   Sep 23 ?           0:00 pageout
    root     3     0   0   Sep 23 ?           2:33 fsflush
    root   393     1   0   Sep 23 ?           0:00 /usr/sbin/auditd
    root     7     1   0   Sep 23 ?           0:11 /lib/svc/bin/svc.startd
    root     9     1   0   Sep 23 ?           0:19 svc.configd
    root   176     1   0   Sep 23 ?           0:00 /usr/sbin/syslogd
    root    64     1   0   Sep 23 ?           0:00 /usr/sbin/nscd
  daemon    91     1   0   Sep 23 ?           0:02 kcfd
    root   170     1   0   Sep 23 ?           0:01 /usr/lib/utmpd
    root  1900  1402   7 22:42:05 ?           0:02 /usr/lib/ssh/sshd
    root  1527     7   0 00:53:24 console     0:00 /usr/bin/login
    root    82     1   0   Sep 23 ?           0:00 /usr/lib/sysevent/syseventd
   smmsp   334     1   0   Sep 23 ?           0:00 /usr/lib/sendmail -Ac -q15m
  daemon   137     1   0   Sep 23 ?           0:06 /usr/sbin/rpcbind
    root    84     1   0   Sep 23 ?           0:00 /usr/lib/picl/picld
    root  1601  1527   0 07:36:19 console     0:00 -sh
    root   181     1   0   Sep 23 ?           0:04 /usr/lib/inet/inetd start
    root   281     1   0   Sep 23 ?           0:00 /usr/lib/nfs/mountd
    root   187     1   0   Sep 23 ?           0:00 /usr/sbin/cron
    root  1402     1   0 00:26:14 ?           0:00 /usr/lib/ssh/sshd
  daemon   289     1   0   Sep 23 ?           0:00 /usr/lib/nfs/nfsd
  daemon   264     1   0   Sep 23 ?           0:00 /usr/lib/nfs/statd
    root   303     1   0   Sep 23 ?           0:00 /usr/lib/fm/fmd/fmd
  daemon   268     1   0   Sep 23 ?           0:00 /usr/lib/nfs/lockd
    root   291     1   0   Sep 23 ?           0:00 /usr/lib/autofs/automountd
     gmb  1912  1908   0 22:42:12 pts/1       0:00 ps -aef
    root   335     1   0   Sep 23 ?           0:06 /usr/lib/sendmail -bd -q15m
  daemon   296     1   0   Sep 23 ?           0:00 /usr/lib/nfs/nfsmapid
     gmb  1908  1900   0 22:42:10 pts/1       0:00 -sh
    root  1899  1601   6 22:42:05 console     0:02 ssh -l gmb localhost

It worked! That was pretty easy, right? This is just one very small example of how you can use process privileges in your daily lives. I will try to add more interesting examples of practical uses for process privileges in the future.

Before ending, I do want to highlight that while these examples focused on the ps(1) command - other process related commands will also be impacted such as ptree(1), pcred(1), pmap(1), psig(1), etc. Further, as a user running without the proc_info privilege, you will not even be able to see other processes in the /proc directory:

$ id -a
uid=101(foo) gid=1(other) groups=1(other)
$ ppriv $$
1915:   -sh
flags = 
        E: basic,!proc_info
        I: basic,!proc_info
        P: basic,!proc_info
        L: all
$ ls -l /proc
total 4
dr-x--x--x   5 foo      other        832 Sep 24 22:52 1915
dr-x--x--x   5 foo      other        832 Sep 24 22:56 1932

Managing Non-Login and Locked Solaris Accounts

2013-08-13T10:12:00.000-07:00

For those not already aware, a non-login account is one that must exist on the system (to provide a UID for example) but should not be allowed to login to a system interactively. That is, while a non-login account may be able to leverage delayed execution mechanism such as cron(1M), they cannot access the system using login(1), telnet(1) ftp(1), ssh(1), etc. Accounts that are non-login will have the token NP as their password. You can also identify non-login accounts using the passwd(1) command:

# passwd -s daemon
daemon    NL
# grep "\^daemon:" /etc/shadow
daemon:NP:6445::::::

In this case, the daemon account has been configured as a non-login account.

A locked account on the other hand is one that is not permitted to access the system in any way - it is locked. A locked account differs from one marked as non-login in that locked accounts are not permitted to use delayed execution methods like cron(1M). Locked accounts are those whose password string has the prefix \*LK\*. Further, you can identify locked accounts using the passwd(1) command:

# passwd -s listen
listen    LK
# grep "\^listen:" /etc/shadow
listen:\*LK\*:::::::

In this case, the listen account has been locked.

Here is a practical example. In this case, I will add a new account gmb to the system. By default, new accounts created using useradd(1M) are locked. After assigning a new password, I will demonstrate the use and result of the new -N and -u options to the passwd(1) command in addition to the -l option which has been around for ever.

First, let's create a test account called gmb. You will notice that by default the account will be locked.

# useradd -d /export/home/gmb gmb
# passwd -s gmb
gmb       LK

Next, a password will be assigned to the gmb account in the usual way using the passwd(1) command...

# passwd gmb
New Password:
Re-enter new Password:
passwd: password successfully changed for gmb
# passwd -s gmb
gmb       PS
# grep "\^gmb:" /etc/shadow
gmb:Onk28eSYhYJ8s:12683::::::

You will notice that the "passwd -s" command now returns the keyword PS for "password set". If the account did not have a password defined, the keyword NP (for "no password") would have been returned.

Now that we have a password, let's lock the account and see what happens to the password string in /etc/shadow as well as to the output of "passwd -s":

# passwd -l gmb
passwd: password information changed for gmb
# passwd -s gmb
gmb       LK
# grep "\^gmb:" /etc/shadow
gmb:\*LK\*Onk28eSYhYJ8s:12683::::::

You will notice that the account was in fact locked, but what is new in Solaris 10 is that the password string is not replaced with the "\*LK\*" value. Instead, a "\*LK\*" string prefix is prepended to the password so that the original value can be kept if desired. The great thing about this is that it does not depend on the password algorithm used. With the addition of flexible crypt in Solaris 9, you can replace the default crypt algorithm with either others provided by default in Solaris or one of your own and this new locking mechanism will still just work.

To unlock a locked account, you just use the new "-u" option to the passwd(1) command:

# passwd -u gmb
passwd: password information changed for gmb
# passwd -s gmb
gmb       PS
# grep "\^gmb:" /etc/shadow
gmb:Onk28eSYhYJ8s:12683::::::

The account is now unlocked and the "\*LK\*" prefix has been removed from the user's password string. The last thing that we will look at today is how you create a non-login account. To do this, simply use the "-N" option to the password command:

# passwd -N gmb
passwd: password information changed for gmb
# passwd -s gmb
gmb       NL
# grep "\^gmb:" /etc/shadow
gmb:NP:12683::::::

You will notice that the user's original password has been removed and replaced with the string "NP". This account is now a non-login account and the original password has been discarded. You will not be able to login to this account, but the account will be able to make use of delayed execution facilities. To re-enable an account for interactive logins, simply reassign a password to the account using the passwd(1) command.

Solaris 10 Account Lock

2013-08-13T10:02:00.000-07:00

Solaris 10 Account Lockout

Account lockout is the ability of a system or service to administratively lock an account after that account has suffered "n" consecutive failed authentication attempts. Very often "n" is three.

Locked accounts are not able to access any system services whether interactively or through the use of delayed execution mechanisms such as cron(1M). So, when an account is locked out using this capability, only a system administrator is able to re-enable the account, using the passwd(1) command with the "-u" option.

Account lockout can be enabled in one of two ways. The first way will enable account lockout globally for all users. The second method will all more granular control of which users will or will not be subject to account lockout policy.Note that the account lockout capability will only apply to accounts local to the system. We will look at both in a little more detail below.

Before we look at how to enable or disable the account lockout policy, let's first take a look at how you configure the number of consecutive, failed authentication attempts that will serve as your line in the sand. Any number of consecutive, failed attempts beyond the number selected will result in the account being locked. This number is based on the RETRIES parameter in the /etc/default/login file. By default, this parameter is set to 5. You can certainly customize this parameter based on your local needs and policy. By default, the Solaris Security Toolkit will set theRETRIES parameter to 3.

Now that we know how to define how many consecutive, unsuccessful authentication attempts we will allow, let's take a look at how you can enable the account lockout policy globally. This policy can be altered using theLOCK_AFTER_RETRIES variable in the /etc/security/policy.conf file. Just as it sounds, if you set this parameter toYES, then the account lockout policy is enabled for all users on the system (unless there is a user override which we will talk about in a minute). By default, this parameter is set to NO which means that account lockout is not enabled.

So, let's try a simple example. First, I created a test account called gmb. Next, I set the LOCK_AFTER_RETRIESparameter in /etc/security/policy.conf to YES. To see, how this feature works, I attempted to authenticate to a system (and failed) using three different services:(1) TELNET, (2) FTP and (3) RLOGIN. I failed the login attempt for each of these services (in turn) twice with the exception of RLOGIN since after the fifth failed attempt the account was locked. I ran this test from the system's console so that the log messages could be injected into the output stream to give you a better idea of what was happening. Here is the actual log of the test that was run:

# telnet localhost
Trying 127.0.0.1...
Connected to localhost.
Escape character is '\^]'.
login: gmb
Password:
Login incorrect
login: gmb
Password:
Login incorrect
login: 
Connection to localhost closed by foreign host.
# ftp localhost
Connected to localhost.
220 sampleHost FTP server ready.
Name (localhost:root): gmb
331 Password required for gmb.
Password:
530 Login incorrect.
Login failed.
ftp> user gmb
331 Password required for gmb.
Password:
530 Login incorrect.
Login failed.
ftp> quit 221 Goodbye.
# rlogin -l gmb localhost Password:
Sep 23 23:23:47 sampleHost login: Excessive (5) login failures for gmb: locking account. Login incorrect
login:

As you can see, after the fifth attempt, the gmb account was locked. This can also be verified by looking at the shadow(4) file entry for that account:

# grep "\^gmb:" /etc/shadow
gmb:\*LK\*R12OfCMPngtJQ:12685::::::5

You can see that the account has been locked and that a record of the number of failures is available in the last column. From the shadow(4) manual page, the last field (called "flag") stores the failed login count in the low order four bits while reserving the remainder for future use. This means that you can also look at individual shadow(4) entries and see how many consecutive failed authentication attempts have been made per user. For example, you could do the following to see how many users have had failed authentication attempts since their last successful login:

# awk -F: '$NF >= 1 { print; }' /etc/shadow
gmb:\*LK\*R12OfCMPngtJQ:12685::::::5
foo:02YZb5ZaMrcrk:12685::::::2
bar:XF0Ggjq1c6tYQ:12685::::::1
baz:.VxOG4ytNE8es:12685::::::3

If a user who has had failed authentication attempts is finally able to successfully login to the system, that user will be presented with a message like:

# telnet localhost
Trying 127.0.0.1...
Connected to localhost.
Escape character is '\^]'.
login: baz
Password:
Warning: 3 failed login attempts since last successful login.
Last login: Thu Sep 23 23:36:44 from localhost

This warning message is available for interactive login services (not FTP) and is very helpful in providing warning to users who may not have been responsible for the failed authentication attempts. It is important that you educate your users to not simply ignore these messages as they could be a symptom of an ongoing attack on their account.

Also, note that once a user has successfully authenticated to a system, the failed login count is reset:

# grep "\^baz" /etc/shadow
baz:.VxOG4ytNE8es:12685::::::

Note that the use of alternate authentication mechanisms such as rhosts or Secure Shell public key authentication will not reset the failed login count even on successful login. Should an account be locked however (either administratively or through the account lockout facility), the account would no longer be accessible even when using these alternate authentication methods. For example:

# grep gmb /etc/shadow
gmb:\*LK\*R12OfCMPngtJQ:12685::::::
# rsh -l gmb localhost /bin/finger
account expired

or for Secure Shell...

# ssh -l gmb -i /export/home/gmb/.ssh/id_dsa localhost
Enter passphrase for key '/export/home/gmb/.ssh/id_dsa':
Sep 24 00:34:59 sampleHost sshd[1504]: Failed publickey for gmb from 127.0.0.1 port 32801 ssh2
Password:

The second way in which account lockout can be configured is per-user in the /etc/user_attr file. Each user listed in the /etc/user_attr file can have an attribute defined called lock_after_retries. For a description of the format of this file, see the user_attr(4) manual page. By default, this value is set to no.

To configure account lockout for a specific user, simply add the lock_after_retries attribute with a value of yes. For example, let's assume you have an entry for user gmb:

gmb::::type=normal;profiles=FOO Security Management;roles=secadm

To enable account lockout, you simple change the above line to:

gmb::::type=normal;profiles=FOO Security Management;roles=secadm;lock_after_retries=yes

Let's take another view on this. Let's assume that the account lockout policy has been enabled globally using the method described above. You can then configure some users to be immune to this policy using this user-specific override. For example, if the LOCK_AFTER_RETRIES parameter was set to YES in /etc/security/policy.conf, but you did not want the policy to apply to the gmb account, then you only need to make sure that the /etc/user_attr file contains an entry for the gmb account that sets the lock_after_retries attribute to no as in:

gmb::::lock_after_retries=no

Here is an example of how this works. I will attempt to access the gmb account with an invalid password five times using TELNET. In contrast to the above example, the account should not be locked and no account locked message should be generated. First, let's confirm we have our system configured correctly for this test:

# grep "\^gmb:" /etc/shadow
gmb:h8HsRoqrne1oQ:12685::::::::::
# grep "\^gmb:" /etc/user_attr
gmb::::lock_after_retries=no
# grep "\^LOCK_AFTER_RETRIES=" /etc/security/policy.conf
LOCK_AFTER_RETRIES=YES

Now, let's see if the account actually gets locked after 5 failed authentication attempts.

# telnet localhost
Trying 127.0.0.1...
Connected to localhost.
Escape character is '\^]'.
login: gmb
Password:
Login incorrect
login: gmb
Password:
Login incorrect
login: gmb
Password:
Login incorrect
login: gmb
Password:
Login incorrect
login: gmb
Password:
Login incorrect
Sep 23 23:51:46 sampleHost login: REPEATED LOGIN FAILURES ON /dev/pts/1 FROM localhost, gmb
Connection to localhost closed by foreign host.
# grep "\^gmb:" /etc/shadow
gmb:h8HsRoqrne1oQ:12685::::::

Just as expected, the gmb account is immune from the account lockout policy that applies to other users on the system. This is in fact what is implemented by default for the root account. That is, even if account lockout is enabled globally (which is not the default), the root account is still immune from being locked out. This is done to prevent a malicious user from locking the root account out of the system. If you would like this policy to apply to the rootaccount, then simply change the value of the lock_after_retries parameter to yes in the /etc/user_attr file.

This concludes another installment. As always, I hope you find this information useful in understanding how some of the new Solaris 10 security enhancements work and how they can be applied to solve real-world problems in your environment.

Script to search in gzipped file

2013-05-04T08:33:00.001-07:00

Many times we have to do search in gzipped files in Unix. For that generally we follow a very simple approach ,simply gunzip all the files and search the content through grep command. But this simple approach will work only if the number of gzipped files is very less. What happens when the number of gzipped files are 30000 and more. Then the above steps fails and we have to use gzcat command the grep the command from the gzipped file without gunzipping the files. But there is a problem that while using the grep command with gzcat , we are not able to know in which file the content is present.

Ex:-

gzcat *.gz|grep abc

the above command will not show file name where the "abc" is present.

For that I have a simple script, that will show the name of the file in which it is present.

for i in *.gz
do
a=`gzcat $i |grep abc |wc -l`
if [ $a != 0 ]
then
echo $i
fi
done

You can use the above script , by modifying according to you requirement

SSH Without password

2013-04-09T11:34:00.000-07:00

Sometime in our unix environment we have a need to use ssh without password. In that case one user(suppose user91) from server hostA wants to login to another server hostB without entering any password. In that case, following steps can be performed to achieve the goal.

Generate public and private rsa keys:-

1. Login to the server hostA with user91.

2. Generate rsa key with following command :-

user91@hostA$ ssh-keygen -t rsa

Generating public/private rsa key pair.

Enter file in which to save the key (/user91/user91/.ssh/id_rsa): [Press enter key]

Enter passphrase (empty for no passphrase): [Press enter key]

Enter same passphrase again: [Press enter key]

Your identification has been saved in /user91/user91/.ssh/id_rsa.

Your public key has been saved in /user91/user91/.ssh/id_rsa.pub.

The key fingerprint is:

17:4d:74:24:24:8c:83:10:09:65:85:cc:fe:6b:85:9c user91@hostA

user91@hostA$ ls -lrt

total 4

-rw-------   1 user91 dba          887 Apr  8 16:52 id_rsa

-rw-r--r--   1 user91 dba          233 Apr  8 16:52 id_rsa.pub

Copy public key to the remote host

Now create .ssh directory in the user91’s home directory of the other remote host server hostB. You can create the .ssh directory manually or through SSH login from hostA to hostB or through ssh-copy-id command.

user91@hostA$ ssh user91@hostB mkdir -p .ssh

user91’s password:

then copy id_rsa.pub keys to hostB and rename it to authorized_keys.

user91@hostA$ rcp id_rsa.pub hostB:/user91/.ssh/authorized_keys

user91@hostA$ rsh 10.2.2.1 chmod 600 /user91/.ssh/authorized_keys

user91@hostA$ rsh 10.2.2.1 chmod 700 /user91/.ssh

Or,

user91@hostA$ ssh-copy-id -i ~/.ssh/id_rsa.pub hostB

user91@hostB's password:

Now try logging into the machine, with "ssh 'remote-host'", and check in:

.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.

Note: ssh-copy-id appends the keys to the remote-host’s .ssh/authorized_key.

The above two steps will be sufficient to enable ssh without password in most of the cases.

How to extract a gzipped tar file without extracting in one line.

2013-04-05T22:45:00.001-07:00

To extract a gzipped tar file we can use following command :-

gzip -dc test.tar.gz|tar xf-

Monitoring Performance in Solaris

2013-03-23T10:26:00.000-07:00

This chapter describes procedures for monitoring system performance by using the vmstat, iostat, df, andsar commands. This is a list of the step-by-step instructions in this chapter.

How to Display Virtual Memory Statistics (vmstat)

The following example shows the vmstat display of statistics gathered at five-second intervals.

$ vmstat 5

procs    memory            page             disk      faults     cpu
r b w swap free re mf pi po fr de sr f0 s3 -- -- in sy cs us sy id
0 0 8 28312 668 0   9   2   0   1 0 0 0 1 0 0 10 61 82 1 2 97
0 0 3 31940 248 0 10 20   0 26 0 27 0 4 0 0 53 189 191 6 6 88
0 0 3 32080 288 3 19 49   6 26 0 15 0 9 0 0 75 415 277 6 15 79
0 0 3 32080 256 0 26 20   6 21 0 12 1 6 0 0 163 110 138 1 3 96
0 1 3 32060 256 3 45 52 28 61 0 27 5 12 0 0 195 191 223 7 11 82
0 0 3 32056 260 0   1   0   0   0 0 0 0 0 0 0   4 52 84 0 1 99

Category

Field Name

Description

procs



Reports the following states:

r

The number of kernel threads in the dispatch queue

b

Blocked kernel threads waiting for resources

w

Swapped out LWPs waiting for processing resources to finish

memory

Reports on usage of real and virtual memory:

swap

Available swap space

free

Size of the free list

page

Reports on page faults and paging activity, in units per second:

re

Pages reclaimed

mf

Minor and major faults

pi

Kbytes paged in

po

Kbytes paged out

fr

Kbytes freed

de

Anticipated memory needed by recently swapped-in processes

sr

Pages scanned by page daemon (not currently in use). If sr does not equal zero, the page daemon has been running.

disk

Reports the number of disk operations per second, showing data on up to four disks

faults

Reports the trap/interrupt rates (per second):

in

Interrupts per second

sy

System calls per second

cs

CPU context switch rate

cpu

Reports on the use of CPU time:

us

User time

sy

System time

id

Idle time

Category	Field Name	Description
procs		Reports the following states:
	r	The number of kernel threads in the dispatch queue
	b	Blocked kernel threads waiting for resources
	w	Swapped out LWPs waiting for processing resources to finish
memory		Reports on usage of real and virtual memory:
	swap	Available swap space
	free	Size of the free list
page		Reports on page faults and paging activity, in units per second:
	re	Pages reclaimed
	mf	Minor and major faults
	pi	Kbytes paged in
	po	Kbytes paged out
	fr	Kbytes freed
	de	Anticipated memory needed by recently swapped-in processes
	sr	Pages scanned by page daemon (not currently in use). If sr does not equal zero, the page daemon has been running.
disk		Reports the number of disk operations per second, showing data on up to four disks
faults		Reports the trap/interrupt rates (per second):
	in	Interrupts per second
	sy	System calls per second
	cs	CPU context switch rate
cpu		Reports on the use of CPU time:
	us	User time
	sy	System time
	id	Idle time

How to Display System Event Information

Run vmstat -s to show the total of various system events that have taken place since the system was last booted.

        0 swap ins
        0 swap outs
        0 pages swapped in
        0 pages swapped out
409376480 total address trans. faults taken
3075036 page ins
2601555 page outs
3812452 pages paged in
6525552 pages paged out
11007609 total reclaims
10927650 reclaims from free list
        0 micro (hat) faults
409376480 minor (as) faults
2957386 major faults
102738273 copy-on-write faults
61711047 zero fill page faults
1002562077 pages examined by the clock daemon
     7881 revolutions of the clock hand
16716370 pages freed by the clock daemon
4999048 forks
1138206 vforks
5747009 execs
741660225 cpu context switches
736047593 device interrupts
528054538 traps
2496638575 system calls
430283487 total name lookups (cache hits 95%)
    81727 toolong
10484677 user   cpu
9528364 system cpu
443762786 idle   cpu
16281790 wait   cpu

How to Display Swapping Statistics

Run vmstat -S to show swapping statistics.

procs     memory            page            disk          faults      cpu
r b w   swap free  si  so pi po fr de sr m1 m3 m4 m5   in   sy   cs us sy id
0 0 0   8512   888   0   0 12 21 55 0 417 1 0 0 0 206 1040 308 2 2 96

si = Average number of LWPs swapped in per second
so = Number of whole processes swapped out

How to Display Disk Utilization Information (iostat)

You can display disk activity information by using the iostat command with a time interval. The following example shows disk statistics gathered every five seconds.

iostat 5

      tty          md1           md3           md4           md5          cpu
tin tout kps tps serv kps tps serv kps tps serv kps tps serv us sy wt id
   0    2 10   1   28    2   0   22    0   0    0    1   0   10   2 2 3 92
   0   47 58   7   39   16   2   34    0   0    0    0   0    0   0 2 19 78
   0   16   0   0    0    0   0    0    0   0    0    0   0    0   0 1 0 98
   0   16   0   0    0    0   0    0    0   0    0    0   0    0   0 0 1 99
   0   16   2   0   22    0   0    0    0   0    0    0   0    0   2 3 1 95
   0   24   0   0    0    0   0    0    0   0    0    0   0    0   0 1 1 98

For Each ...

Field Name

Description

Terminal

tin

Number of characters in the terminal input queue

tout

Number of characters in the terminal output queue

Disk

bps

Blocks per second

tps

Transactions per second

serv

Average service time, in milliseconds

CPU

us

In user mode

sy

In system mode

wt

Waiting for I/O

id

Idle

How to Display Extended Disk Statistics

Run iostat -xtc to get extended disk statistics. This command displays a line of output for each disk.

                               extended device statistics      tty         cpu
device    r/s w/s   kr/s   kw/s wait actv svc_t %w %b tin tout us sy wt id
md1       0.4 0.9    3.6    6.9 0.0 0.0   27.7   1   1    0    2 2 2 3 92
md3       0.1 0.2    1.0    1.3 0.0 0.0   21.7   0   0
md4       0.0 0.0    0.0    0.0 0.0 0.0    0.0   0   0
md5       0.0 0.0    0.7    0.0 0.0 0.0    9.9   0   0
md8       0.8 0.3    6.7   14.2 0.0 0.0   13.1   0   1
md10      0.2 0.9    1.8    6.8 0.0 0.0   15.5   0   1
md11      0.2 0.9    1.8    6.8 0.0 0.0   14.8   0   1
md30      0.0 0.2    0.5    1.3 0.0 0.0   11.4   0   0
md31      0.0 0.2    0.5    1.3 0.0 0.0   10.2   0   0
md40      0.0 0.0    0.0    0.0 0.0 0.0    0.0   0   0
md41      0.0 0.0    0.0    0.0 0.0 0.0    0.0   0   0
md50      0.0 0.0    0.4    0.0 0.0 0.0    9.4   0   0
md51      0.0 0.0    0.4    0.0 0.0 0.0    7.3   0   0
md80      0.4 0.3    3.3   14.2 0.0 0.0   10.3   0   0
md81      0.4 0.3    3.3   14.2 0.0 0.0   11.7   0   1
sd0       0.6 2.1    6.0   22.8 0.0 0.0   16.3   0   3
sd1       0.6 2.1    6.0   22.8 0.0 0.0   15.2   0   2

Field Name

Description

r/s

Reads per second

w/s

Writes per second

Kr/s

Kbytes read per second

Kw/s

Kbytes written per second

wait

Average number of transactions waiting for service (queue length)

actv

Average number of transactions actively being serviced

svc_t

Average service time, in milliseconds

%w

Percentage of time the queue is not empty

%b

Percentage of time the disk is busy

How to Check CPU Utilization (sar)

Display CPU utilization with the sar -u command. (The sar command without any options is equivalent to sar -u.) At any given moment, the processor is either busy or idle. When busy, the processor is in either user or system mode. When idle, the processor is either waiting for I/O completion or "sitting still" with no work to do.

Measure CPU utilization during 5 secs one time.

sar -u 5 1

Measure CPU utilization during 60 secs 1440 times and write result in file sar.log.

sar -u -o sar.log 60 1440

To later review disk and tape activity from that period:

sar -d -f sar.log

Field Name

Description

%sys

Lists the percentage of time that the processor is in system mode

%user

Lists the percentage of time that the processor is in user mode

%wio

Lists the percentage of time the processor is idle and waiting for I/O completion

%idle

Lists the percentage of time the processor is idle and is not waiting for I/O

A high %wio generally means a disk slowdown has occurred.

For Each ...	Field Name	Description
Terminal
	tin	Number of characters in the terminal input queue
	tout	Number of characters in the terminal output queue
Disk
	bps	Blocks per second
	tps	Transactions per second
	serv	Average service time, in milliseconds
CPU
	us	In user mode
	sy	In system mode
	wt	Waiting for I/O
	id	Idle

Field Name	Description
r/s	Reads per second
w/s	Writes per second
Kr/s	Kbytes read per second
Kw/s	Kbytes written per second
wait	Average number of transactions waiting for service (queue length)
actv	Average number of transactions actively being serviced
svc_t	Average service time, in milliseconds
%w	Percentage of time the queue is not empty
%b	Percentage of time the disk is busy

Field Name	Description
%sys	Lists the percentage of time that the processor is in system mode
%user	Lists the percentage of time that the processor is in user mode
%wio	Lists the percentage of time the processor is idle and waiting for I/O completion
%idle	Lists the percentage of time the processor is idle and is not waiting for I/O

Disable SSH login for individual users

2013-03-23T08:17:00.002-07:00

1.)Edit the /etc/ssh/sshd_config file

Add the user names after “DenyUsers” string which you want disable .

Example :
DenyUsers ftpuser fdpuser2

2.) Restart the ssh service

For Solaris 10
--------------
svcadm refresh svc:/network/ssh:default

For Solaris 7,8 & 9
------------------
/etc/init.d/sshd restart

Solaris 10 - Increasing Number of Processes Per User

2013-03-23T08:14:00.000-07:00

The below example is given for increasing the number of processes on Solaris 10 system on PER UID. The hardware used here is UltraSPARC T2 based system with Solaris 10 and 32 GB RAM.

We needed to increase the number of processesper user to more than current setting of 30000

bash-3.00# ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
file size (blocks, -f) unlimited
open files (-n) 260000
pipe size (512 bytes, -p) 10
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 29995
virtual memory (kbytes, -v) unlimited

Trying to increase the "max user processes" would fail with the following error:

bash-3.00# ulimit -u 50000
bash: ulimit: max user processes: cannot modify limit: Invalid argument
bash-3.00#

After going through the Solaris 10 Tunable Guide for Process sizing learned that there are 5 related parameters related to process sizing.

maxusers - The maximum number of processes on the system, The number of quota structures held in the system. The size of the directory name look-up cache (DNLC)
reserved_procs - Specifies the number of system process slots to be reserved in the process table for processes with a UID of root
pidmax - Specifies the value of the largest possible process ID. Specifies the value of the largest possible process ID. Valid for Solaris 8 and later releases.
max_nprocs - Specifies the maximum number of processes that can be created on a system. Includes system processes and user processes. Any value specified in /etc/system is used in the computation of maxuprc.
maxuprc - Specifies the maximum number of processes that can be created on a system by any one user

Looked at the current values for these parameter:

bash-3.00# echo reserved_procs/D | mdb -k
reserved_procs:
reserved_procs: 5

bash-3.00# echo pidmax/D| mdb -k
pidmax:
pidmax: 30000

bash-3.00# echo maxusers/D | mdb -k
maxusers:
maxusers: 2048
bash-3.00#

bash-3.00# echo max_nprocs/D | mdb -k
max_nprocs:
max_nprocs: 30000
bash-3.00#

bash-3.00# echo maxuprc/D| mdb -k
maxuprc:
maxuprc: 29995

So, in order to set the max per user processes in this scenario, we were required to make the changes to "pidmax" (upper cap), maxusers, max_nprocs & maxuprc
Sample entries in /etc/system & reboot

set pidmax=60000
set maxusers = 4096
set maxuprc = 50000
set max_nprocs = 50000

After making the above entries, we were able to increase the max user processes to 50000.
bash-3.00# ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
file size (blocks, -f) unlimited
open files (-n) 260000
pipe size (512 bytes, -p) 10
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 49995
virtual memory (kbytes, -v) unlimited
bash-3.00#

bash-3.00# echo reserved_procs/D |mdb -k
reserved_procs:
reserved_procs: 5
bash-3.00# echo pidmax/D |mdb -k
pidmax:
pidmax: 60000
bash-3.00# echo max_nprocs/D |mdb -k
max_nprocs:
max_nprocs: 50000
bash-3.00# echo maxuprc/D | mdb -k
maxuprc:
maxuprc: 50000
bash-3.00#

Note: If you are operating within the 30000 limit (default pidmax setting) the blog entry referred above seems to work fine. If you are looking at increasing the processes beyond 30000, it we need to make adjustment to other dependent parameters stated in this blog entry.

Add new printer queue on solaris server using lpadmin command

2013-03-23T08:09:00.002-07:00

Add new printer queue on solaris server using lpadmin command

1.) Add printer name and port details on /etc/printers.conf file
Eg:
mtysap:\
:bsdaddr=mtyun118,mtysap,Solaris:

mtysapq:\
:bsdaddr=mtysun118,mtysapq,Solaris:

mtysapt:\
:bsdaddr=mtysun118,mtysapt,Solaris:

In above mtysap is Print queue name and mtysun118 is Server name.
2.) Copy the existing interface configuration file to new printer name
Eg:
cp /etc/lp/interfaces/mtysap /etc/lp/interfaces/mtysaptest

3.) Copy the existing configuration file from file to new printer name
Eg:
mkdir /etc/lp/printers/mtysaptest
cp –p /etc/lp/printers/ mtysap/* /etc/lp/printers/mtysaptest
ls –l /etc/lp/printers/mtysaptest
total 10
-rwxrwx--- 1 lp lp 1347 Aug 2 2006 alert.sh
-rw-rw---- 1 lp lp 4 Aug 2 2006 alert.vars
-rw-rw-r-- 1 lp lp 168 Aug 2 2006 configuration
-rw-rw-r-- 1 lp lp 16 Aug 2 2006 faultMessage
-rw-rw-r-- 1 lp lp 0 Aug 2 2006 users.deny

4.) Edit new printer configuration file and replace the IP address with IP of your network printer
Eg:
vi /etc/lp/printers/mtysaptest/configuration

# cat /etc/lp/printers/ mtysaptest /configuration
Banner: on
Content types: any
Device: /dev/null
Interface: /usr/lib/lp/model/netstandard
Printer type: unknown
Modules:
Options: protocol=tcp,dest=134.200.172.26:9100

5.) Change the ownership of files
chmod 775 /etc/lp/interfaces/ mtysaptest
chown lp:lp /etc/lp/interfaces/ mtysaptest
chown-R lp:lp /etc/lp/printers/mtysaptest

6.) Create and enable the printer
eg:
lpadmin -p mtysaptest -v /dev/null -i /etc/lp/interfaces/ mtysaptest
accept mtysaptest
enable mtysaptest

7.) Check the new printer status
Eg:
# lpstat -p mtysaptest

printer mtysaptest is idle. enabled since Fri 28 Jan 2011 01:47:21 PM GMT. available.

Note : Another way you can also run below script after adding printer in /etc/printers.conf

#!/bin/ksh
# execute the script followed by the printer name and IP.
/usr/sbin/lpadmin -p $1 -v /dev/null -A write -i /usr/lib/lp/model/ne
tstandard -o dest=$2 -o protocol=bsd -o nobanner -I simple,postscript -u allow:all
/usr/bin/enable $1
/usr/sbin/accept $1
echo "Printer "$1" created!"
echo "Printer configuration..."
/usr/bin/lpstat -lp $1
exit

Netmask Conversions

2013-03-23T08:05:00.002-07:00

Netmask Conversions

If you have ever needed to know what a netmask looks like expressed in some other format this table of equivalents should help. It contains common IPv4 netmasks expressed in four different formats.

Add interface specific route

2013-03-23T08:03:00.001-07:00

Add interface specific route

In solaris , you can add a route whose traffic should go out a specific interface by adding -ifp [ifname] to the route command line. For instance, suppose a host has two interfaces (eri0 and hme0) on the same IP subnet (10.4.2.9/24 with gateway 10.4.2.254), and traffic for just a few hosts needs to go out the secondary hme0 interface. One reason this setup may be needed is for monitoring both some firewalls and the apps that those firewalls protect from a single network management station. On the firewalls you would add host-specific routes for the network management station’s secondary interface via the firewall management network, allowing that interface to talk directly to the firewalls. The primary interface of the network management station gets routed normally, though, and so is able to talk to hosts protected by the same firewalls.

The following command makes this happen:

# route add -host 172.29.4.3 10.4.2.254 -ifp hme0

add host 172.29.4.3: gateway 10.4.2.254

# route add -host 172.29.4.4 10.4.2.254 -ifp hme0

add host 172.29.4.4: gateway 10.4.2.254

# route add -host 172.29.7.31 10.4.2.254 -ifp hme0

add host 172.29.7.31: gateway 10.4.2.254

# route add -host 172.29.7.32 10.4.2.254 -ifp hme0

add host 172.29.7.31: gateway 10.4.2.254

Now all traffic for the four hosts above will go out hme0 instead of eri0.

snmpxdmid: Error in adding row for subscription Table Entry

2013-03-20T10:26:00.001-07:00

snmpxdmid: Error in adding row for subscription Table Entry

Solution :-

This is solaris 9 problem. The snmpdx startup scripts are in /etc/rc3.d

If you are not using SNMP to monitor the system, disable them. Particularly if you are not having completely up to date on security patches for snmpdx, mibiisa, and worse, the snmpXdmid. There
are buffer overflow and other exploits in unpatched or poorly configured daemons.

If you are running snmp, you still don't need the snmpXdmid, as that is a management interface that just happens to be bundled in the free solstice enterprise agent and runs as a sub agent under the snmpdx daemon.

Disable it...

cd /etc/rc3.d
./S76snmpdx stop
./S77dmi stop
mv S76snmpdx s76snmpdx_safe
mv S77dmi s77dmi_safe

sendmail:Unable to qualify my own domain name in Solaris 10

2013-03-19T10:34:00.001-07:00

How to resolve "Unable to qualify my own domain name" error

You may have received this error in /var/adm/messages

Symptom 1:

tail -f /var/adm/messages

Mar 13 11:15:16 myserver sendmail[8420]: [ID 702911 mail.crit] My unqualified host name (myserver.) unknown; sleeping for retry

Mar 13 11:15:16 myserver sendmail[8421]: [ID 702911 mail.crit] My unqualified host name (myserver.) unknown; sleeping for retry

Mar 13 11:16:16 myserver sendmail[8421]: [ID 702911 mail.alert] unable to qualify my own domain name (myserver.) -- using short name

Mar 13 11:16:16 myserver sendmail[8420]: [ID 702911 mail.alert] unable to qualify my own domain name (myserver.) -- using short name

Symptom 2:

when you try to manually telnet localhost 25 or mailx, either you can send to a particular domain or the respond is very slow after entering the "mail from" command.

Resolution:

update /etc/hosts ( and /etc/inet/ipnodes if you are on solaris 10) to use the following.

root@myserver:>more /etc/hosts

# internet host table

#====================

127.0.0.1 localhost

10.106.127.105 myserver. myserver

10.106.63.32 myserver-rsc

Description:

Usually i would add the "myserver." with the dot behind to /etc/hosts but in Solaris 10, things work a little differently.

It turn out that in solaris 10, the OS will go through /etc/inet/ipnodes for IPv4 address before going to /etc/hosts.

In this case, since ldap does not have the entry, OS will go straight to /etc/inet/ipnodes.

This also mean that if you change the host IP of the solaris 10 server, please change in /etc/inet/ipnodes as well otherwise you have conflict of IP addresses.

Note that this is Solaris specific.

# man ipnodes

...

NOTES

IPv4 addresses can be defined in the ipnodes file or in the

hosts file. See hosts(4). The ipnodes file will be searched

for IPv4 addresses when using the getipnodebyname(3SOCKET)

API. If no matching IPv4 addresses are found in the ipnodes

file, then the hosts file will be searched. To prevent

delays in name resolution and to keep /etc/inet/ipnodes and

/etc/inet/hosts synchronized, IPv4 addresses defined in the

hosts file should be copied to the ipnodes file.

...

The other ways to disable the message is following :-

Disable the sendmail service in Solaris 10;

*1)* Check that SendMail is under SMF control (older Solaris 10 releases didn't have SMF, if I recall correctly)

root@blade ~# svcs -l svc:/network/smtp:sendmail
fmri         svc:/network/smtp:sendmail
name         sendmail SMTP mail transfer agent
enabled      true
state        online
next_state   none
state_time   Fri Jun 06 01:15:58 2008
logfile      /var/svc/log/network-smtp:sendmail.log
restarter    svc:/system/svc/restarter:default
contract_id  142 
dependency   require_all/refresh file://localhost/etc/mail/sendmail.cf (online)
dependency   require_all/refresh file://localhost/etc/nsswitch.conf (online)
dependency   optional_all/none svc:/system/filesystem/autofs (online)
dependency   require_all/none svc:/system/filesystem/local (online)
dependency   require_all/none svc:/network/service (online)
dependency   require_all/refresh svc:/milestone/name-services (online)
dependency   optional_all/refresh svc:/system/identity:domain (online)
dependency   optional_all/none svc:/system/system-log (online)
root@blade ~ #

*2)* Disable the SendMail service;

root@blade ~ # ps -ef|grep sendmail
root  2669     1   0 01:16:59 ?           0:00 /usr/lib/sendmail -bd -q15m -C /etc/mail/local.cf
smmsp  2667     1   0 01:16:59 ?           0:00 /usr/lib/sendmail -Ac -q15m
root  2950  2788   0 01:56:18 pts/1       0:00 grep sendmail
root@blade ~ # svcadm disable svc:/network/smtp:sendmail
root@blade ~ # ps -ef | grep sendmail
root@blade ~ #

However, if your interested in stopping the error without disabling SendMail, you can attempt a few things;

*1)* Set the hostname to the desired FQDN;

root@blade ~ # hostname
blade
root@blade ~ # hostname blade.example.com
root@blade ~ # hostname
blade.example.com
root@blade ~ #

*2)* Set the default domain name;

root@blade ~ # echo "example.com" > /etc/defaultdomain
root@blade ~ # cat /etc/defaultdomain
example.com
root@blade ~ #

*3)* Use the "domainname" command to set the default domain

root@blade ~ # domainname example.com
root@blade ~ # domainname
example.com
root@blade ~ #

Note: Just using the "domainname" command is not persistent across reboots, the /etc/defaultdomain file is read by the system at boot up, and it should contain just the desired domain ("example.com"). Doing a "domainname" after a reboot when the /etc/defaultdomain file is set will return the domain name.

*4)* Check the entry in /etc/hosts;
A fresh install of Solaris 10 (Update 5) left me with the following (even though I setup DNS during the OS install);

#
# Internet host table
#
::1     localhost
127.0.0.1       localhost
192.168.1.200   blade   loghost

What fixed the SendMail error for me was changing it to the following;

#
# Internet host table
#
::1     localhost
127.0.0.1       localhost
192.168.1.200   blade.example.com blade loghost

I hope this helps!

Tips and Tricks of UNIX

2011-08-28T11:21:00.000-07:00

I've been working with variations of Unix for a long time and thought I'd write down some of my favorite tips and tricks. They are mostly OS/distribution/shell/language independent (unless I indicate otherwise...)

1. Get rid of blank lines in a file
grep . inputfile > outputfile
This matches (and thus prints) only lines that contain some text, not blank (empty) lines.

2. comm
Many people never cross paths with the comm command, but it is very useful. I works similarly to diff, but outputs the contents of two compared files into three columns. The first column is content only in the first file, second column is content only in the second file, and third column is content that is in both files (matches between the two files.) While this may not seem useful at first, you can select which columns to output, so if you only want to know what is in both file1 and file 2 (column 2) you'd suppress columns 1 and 2, by running:
comm -12 file1 file2
Don't forget that your input files must be sorted.

3. paste
Systems administrators frequently use the cut command to parse files, but many people I run into have never used the paste command. The paste command will concatenate two files line by line (as opposed to file by file, likecat.)

4. less instead of more
This is not available on all Unix-based OSes, but the less command works very similar to more, but will let you move through a file forwards and backwards more easily. Want to jump to the end of the file, type Shift-G Depending on the version of less you are running, it will provide context highlighting when you search for a pattern.

5. Jump to vi from more
While paging through a file in more, press "v" to jump to editting the file in vi at the current position in the file.

6. Jump to a line number when editing a file with vi
vi +linenumber filename
will open up the file with the cursor automatically moved down to the specified line. This is useful when you get an error that indicates "syntax error on line 2047." You can jump straight to the problem without fumbling around.

7. Invisible characters become visible
Sometimes you'll end up with carriage returns on each line in a file originally created on a DOS/Windows system, or filenames with spaces, tab, or other control characters in them, but you can't see them typically.
The cat command provides three useful options -v, -e, and -t that will let you understand these invisible characters
-v (displays non-printing characters)
-e (prints a "$" at the end of each line to indicate a NL character)
-t (prints "^I" for each Tab in the file)
cat -vet filename |more

8. Remove DOS ^M from ends of lines
The "^M" characters are visible when editing in vi but here are two approaches to remove the characters.

sed 's/

//g' -i filename

or in vi: :%s/

//g

or dos2unix filename filename

9. You've done something that has completely screwed up your terminal. Everything you type is either invisible or incomprehensible. Try the following:

$ ^C

$ stty sane^J

If this doesn't work, try:

$ echo ^V^O

10. To determine what program dumped an anonymous core file, use gdb:

$ gdb -core core

[...]

Core was generated by `a.out'.

Program terminated with signal 6, Abort trap.

[...]

If you are on a system without gdb, try the file command:

$ file core

core: ELF 32-bit LSB core file of 'a.out' (signal 6)

11. To create a vi macro that will wrap the current paragraph to a reasonable number of characters, add the following to your .exrc or.vimrc file:

map Q {!} fmt -c -u^M

Now, when you press 'Q' in visual mode, the current paragraph will be wrapped to approximately 70 characters.

12. Due to the Unix concept of sparse files, you can create seemingly enormous files that in reality take next to no disk space. The following program will create a 305,419,897 byte file called 'core' that may result in you receiving a 'cleanup' email message from a less-than-seasoned Unix sysadmin even though it occupies virtually no real disk space.

$ cat bigcore.c

#include

int main(void) {

int fd = open("core", O_CREAT|O_WRONLY|O_TRUNC, 0600);

lseek(fd, 0x12345678, SEEK_SET);

write(fd, "1", 1);

close(fd);

return 0;

}

$ cc -o bigcore bigcore.c

$ ./bigcore

$ ls -l core

-rw------- 1 dmr staff 305419897 May 1 03:50 core

$ du -k core

48 core

13. On older Unix systems, in particular those that don't support MD5password hashing, only the first 8 characters of a password are significant. If you use an 8 character password on these systems, you can type anything you want after the first 8 characters and it will be accepted by login. This allows you to type the first 8 characters of the password as usual, then have some fun. Enter a bunch of crap at superhuman speed, then enter the last few characters with your elbow. Then press backspace twice carefully and retype the characters with your other elbow. Etc....

14. When recursive copying, cp (cp -Rip, etc.) may not be the best tool for the job. For example, cp copies hard links as separate files, which is probably not what you want. To get a true copy of a directory, try:

$ tar cf - | (cd ; tar xf -)

This will create an exact copy of 'dir' in 'destdir'. The same principle can be used to create a recursive copy on a remote machine:

$ tar cf - | ssh remotehost "(cd ; tar xf -)"

15. To list the files in another directory that match more than one pattern, it is easiest to do:

$ ls -l /usr/local/foo/{*.conf,*.local,*.rc}

which is equivalent to:

$ ls -l /usr/local/foo/*.conf /usr/local/foo/*.local /usr/local/foo/*.rc

This syntax is supported by (at least) bash, ksh, csh and sh.

You can extend this idea to make renaming files in another directory, for example, a little easier:

$ mv -i /usr/local/foo/bar/baz/{stuff,stuff~}

16. A little insurance against running 'rm -rf *' in the wrong directory -- create an empty file called -i in any critical directory:

$ >-i

or...

$ touch -- -i

If the 'rm -rf *' command is issued in that directory, the shell will expand the '-i' early on and go into interactive mode, thus giving you a chance to say 'Whoa, that was close!', which always sounds better than 'Oh fsck!'.

This tip works because the -i option to rm will override any previous -f.

Be forewarned that this tip only protects against 'rm -fr *', i.e., files and directories in the current directory.

To remove the -i file (or any other file beginning with '-'):

$ rm ./-i

or...

$ rm -- -i

17. To return to the previous directory in ksh or bash, use:

$ cd -

18. To use the last argument of the previous command line as an argument, use $_. For example:

$ ls -l /usr/home/dmr/somefile

$ vi $_

19. To make the up and down arrow keys work and thereby enablecommand line editing and recall in ksh, include the following lines in your ~/.profile:

set -o emacs

alias __A='^P'

alias __D='^B'

alias __B='^N'

alias __C='^F'

alias __H='^A'

You need to enter the actual control characters ^P, ^B, etc.

Solaris One liner

2011-08-28T10:43:00.000-07:00

Working on solaris or any unix operating system need a lot of command to learn.But it is difficult to memories all those command.Keeping those command in hand will help a lot for Unix Administrator. I am here posting some one liner command that may be helpful to all UNIX administrator as well as UNIX beginners:-

–> change file date stamp

touch –t 199906042020 filename

–> move partitions

ufsdump 0f – /dev/rdsk/c0t0s0s0 | (cd /home; ufsrestore xv -)

–> lay down file system with 1% minfree and inode density

newfs –m1 –i81920 /dev/rdsk/c0t0d0s0

–> check file system

fsck /dev/rdsk/c0t0d0s0

Q: starting sybase

Q: logging in as sybase sa

isql -U sa

–> dump a partition and pipe to gzip. Watch > 2GB limit

ufsdump 0f – /home | gzip – >/tmp/home.dump.gz

–> rewind offline a tape

mt –f /dev/rmt/0 rewoffl

–> only allow 300MB for user /tmp access

swap – /tmp tmpfs – yes SIZE=300M

–> verbose interactive restore

ufsrestore –ivf /dev/rmt/1

–> remove a printer from a class

lpadmin –p level5-line1 –r level5-line

–> truss a command

truss –-f -–o /tmp/log.txt

–> [DB] feed a script into sybase

isql –Urfe_xfer -Uuser -Ppassword -isqlscript >>blah.txt

–> make a printer class

lpadmin –p level5-line1 –c level5-line

–> remove level2-line2 printer from printer class level2-line

lpadmin -p level2-line2 -r level2-line

–> add level2-line3 to printer class

lpadmin -c level2-line -p level2-line3

–> [DB] how to change your password in isql

sp_password password, password-new

–> move a directory

tar cf – ./games | (cd /tmp; tar xvBpf – )

–> [DB] run a sybase script, and dump to file

$ISQL -i$SCRIPTFILE -U$USER -D$DATABASE -P$PASS_ENC >> $SCRIPTLOGFILE

–> move a directory to another server

tar cf – ./games | rsh brucey cd /tmp\; tar xvBpf -

–> check for SUID SGID files

ncheck -F ufs -s /dev/dsk/c3t0d0s

– remove core files

find / -name core –exec rm –f {} \; -o –fstype nfs –prune

–> rebuild man pages

catman –w –M man-page-directory or /usr/lib/makewhatis

–> vi command to show special characters

: set list

–> adding an account

useradd -u 120 –g dls -d /apps/dls –s /bin/ksh -c “comment” -m dls

–> create a mysql database

mysqladmin -uroot -ppassword create ebs

–> starting mysql database

/etc/rc.d/init.d/mysql.server start

/usr/local/bin/safe_mysqld

–> Invoke CPAN module install

perl –MCPAN –eshell

–> dump to zip

ufsdump 0f – /filesystem | /opt/local/gzip – > /tmp/dump.gz

–> shutdown mysql databse

/usr/local/bin/mysqladmin shutdown -ppassword

/etc/rc.d/init.d/mysql.server stop

–> test the loading of a module

PERL_DL_DEBUG=255 perl -e ‘use CGI;’

–> shows open files

fuser –cu /

–> Writing a Daemon:

1. edit /etc/services

add service and port.

2. edit /etc/inetd.conf

add in: edwardd stream tcp nowait root /bin/sh /bin/sh /home/sextone/bin/SERVER.mine

3. kill –HUP inetd.conf

–> how to mount a file system

mount /dev/dsk/c3t0d0s4 /apps/data/easysoft/DEVT

–> look at sar log

sar –f /var/adm/sa/sa24

–> write file checksums and size

cksum filename

–> show storage array info

ssaadm display /dev/rdsk/c1t5d2s0

–> show all disks on device d

luxadm display d

–> examine for a specific OS finerprint

nmap –sS -p 80 -O -v = examine OS

–> show print jobs

/usr/ucb/lpq –Plevel6

–> Scan for known ports. log it. do OS scan.

nmap –sS -F -o foo.log -v -O www.foo.com//24 =

–> show status of printer

/usr/ucb/lpc status

–> make a swap file:

dd if=/dev/zero of=swapfile bs=1024 count=65535

mkswap ./swapfile

chmod 600 ./swapfile

swapon ./swapfile

–> show open files for process

lsof –p PID

–> show open files for all TCP connections

lsof –iTCP

–> show open files for internet address

lsof -iTCP@10.20.2.9

–> as above

lsof -i @10.20.2.122

–> examine tcp ports

lsof -iTCP@sarah:1-50000

–> show open files for user.

lsof –u username

–> show processes that has the file in use.

lsof /apps/cms/ECMS-Server

–> show open files and retry every 5 seconds

lsof –p process-id –r 5

–> mount a floppy

mount -t vfat /dev/fd0 /mnt/floppy

–> check here for debugging processes and errno.h for errors

/usr/include

/usr/include/sys

/usr/include/sys/errno.h

–> scp a whole directory, preserve mods

sudo scp -prv devel webadmin@203.19.123.140:/home/httpd/cgi-bin

–> take processor 2 and 3 offline.

psradm -f 2 3

–> show processor stats verbose.

psrinfo –v

–> how to skip grant tables in mysql (over ride security)

/usr/local/libexec/mysqld -Sg

–> how to feed in an SQL program

mysql

–> rm all files in directories

find . -type f -exec rm {} \;

–> dump packets to a capture file

sudo snoop –o /tmp/tcp.txt cp

–> backup one liner

tar cvf – /home/ebs | gzip – > ebs.tar.gz

–> Look at selected packets in capture file

sudo snoop -i /tmp/tcp.txt

–> unzip and pipe to tar

gzip -dc

–> watch packets from two servers.

snoop sarah brucey

–> enable ip masquerading

/sbin/ipchains -P forward DENY

/sbin/ipchains -A forward -s 10.100.100.100/8 -j MASQ

-> view su log file

cat /var/adm/sulog

–> establish a default router or gateway.

echo “sagacity.com” > /etc/defaultrouter

echo “10.100.100.100 sagacity.com sagacity” >> /etc/hosts

change /etc/nsswitch.conf so that hosts has files, dns

edit resolv.conf put in

search .

nameserver 203.7.132.98

–> turn off automounter on /export/home.

vi /etc/auto_master, comment out /export/home

–> configuration file for sudoers

/opt/local/etc/sudoers

–> building ssh-1.2.27 on x86Solaris2.6 needed a few things:

/usr/openwin/bin in path

/usr/xpg4/bin in path

declare AR=”/usr/xpg4/bin/ar”

declare NM_PATH=”/usr/xpg4/bin/nm”

–> snoop network packets and get size and time stamp entries.

snoop -S -ta empa1

–> access perl CPAN

perl -MCPAN -e shell

install DBI

–> search for no password entries and lock all accounts.

for i in `passwd –sa | grep NP | awk ‘{print $1’`

echo “locking $i”

passwd –l $i

done

–> delete from a tar

tar –delete -f fs_backup_Sunday.tar home/ebs/tmp

–> Example on backing up files to tape. Must specify non rewinding, else you will over-write the files.

for file in `ls`

echo “sending $file to tape…”

echo `date`

tar cvpf /dev/rmt/0n $file

done

–> making/adding a partition.

1. use fdisk to make a parition.

2. mkfs -t ext2 -c /dev/hda11

3. mount -t ext2 /dev/hda11 /opt2

4. update /etc/fstab

–> rebuild the windex file

catman –w –M /usr/share/man

–> execute tar on remote host sarah and send tarball to standard output,

which becomes standard input for tar xvf – and the file gets dumped locally,

in this case on crawl. you have to cd to dir before tar or else you

will include path in tar

ssh maggie “cd $DIRNAME; tar cvf – $BASENAME” | (cd $TPATH; tar xvf – )

–> dump a remote filesystem and send it to local tape drive.

ssh -–x $fw /usr/sbin/ufsdump 0cf – $fs | dd obs=63k of=$TAPE

–> encrypt filename 1 and output to 1.crypt file

crypt < 1 > 1.crypt ; rm 1

–> decrypt filename 1.crypt and stdout to screen

crypt < 1.crypt

--> send a file to tape

tar cvpf /dev/rmt/0 filename

–> quicker way to search and replace in vi

: %s/existing/new/g

–> shows where and which shared library files an application uses.

ldd binary

–> shell script stuff:

# repeat a command 100 times

x=100

while [ $x -gt 0 ]

command

x=$(($x-1))

done

–> Something very important to remember about partitions

It is important to note that Cylinder 0 contains the disklabel, which

contains the partition table. A normal filesystem can be placed

starting at Cylinder 0, since it will not touch the disklabel.

If you lay down a raw device, for a database, over Cylinder 0,

then you will completely lose all your partitions. You will then

have to restore the disklabel, and backup from tape if you happen to do this.

–> move a partition

find . |cpio -pdm /apps

–> cron structure

min hour day-of-month month weekday command

–> PatchDiag Tool. Get patches from:

http://sunsolve.sun.com/private-cgi/patchpage.pl

patchdiag.xref is available at: http://sunsolve.sun.com/sunsolve/patchdiag/

/opt/local/bin/patchdiag -x /opt/local/lib/patchdiag.xref > patchdiag.`uname -n`

–> command showing system parameters

/usr/sbin/sysdef

–> Get Ambient Temperature of Server

/usr/platform/SUNW,Ultra-4/sbin/prtdiag -v

–> good ps formatting showing percent cpu first.

ps -edf -o pcpu,pid,user,arg

–> full details on ps

/usr/bin/ps –A -o user,pid,pcpu,pmem,vsz,rss,tty,s,stime,time,args

–> chown the hidden files as well.

find . -print -exec chown -R sextone:staff {} \;

–> The nsradmin command is a command-line based administrative

program for the NetWorker system. Normally nsradmin monitors

and modifies NetWorker resources over the network.

/usr/sbin/nsr/nsradmin

–> Spray a server

-c number of packets

-d delay in microseconds

-l pakcet size in bytes

/usr/sbin/spray -c 1 –d 20 -l 4096 maggie

–> Turn on bold.

bold=`tput smso`

offbold=`tput rmso`

echo “${bold}You must be the \”root\” user to run this script.${offbold}”

–> good way to send a dir to tape

tar cf /dev/rmt/0n directory

–> example of bringing up an interface

ifconfig hme0:1 inet 10.2.25.52 up

–> show all connections

netstat –f inet

–> rpcinfo makes an RPC call to an RPC server and reports

what it finds.

rpcinfo -b 390109 2 | sort -u

–> rewind a tape fast

< /dev/rmt/0

--> show loaded modules

/usr/sbin/modinfo

–> find world readable files and dirs

find / -type d –perm -2 –print

find . -type f –perm -2 -print

–> adding in a boot alias, eg:

boot sarahroot1 –s

nvalias sarahroot1 /sbus@1f,0/sunw,fas@e,8800000/sd@9,0:a

–> clever way to archive

tar cvf – `find . –print` >/tmp/dumpfile.tar

tar xvf – tee to a file

echo “Start Date/Time: `date`” | tee -a $LOG_FILE

–> read a snoop file

snoop -i anz-telnet.snoop

–> write a snoop log (this will count the number of connections, which is pretty neat).

snoop –osnoop.log sarah

–> set default run level. 5 for gui.

/etc/inittab

–> show all exported filesystems

showmount -e crawl

–> shows all configurable variables for tcp interface.

sudo ndd -get /dev/tcp

- ?

eg:

sudo ndd -get /dev/tcp tcp_conn_req_max_q

128

ndd /dev/arp \?

ndd /dev/ip \?

ndd /dev/tcp \?

ndd /dev/udp \?

ndd /dev/icmp \?

–> set sticky bit on group files, only the owner can change the mode.

–> the +l is mandatory file and record locking while a program

–> is accessing that file.

chmod g+s,+l file

–> print duplex landscape 4 qudrant printing

mpage –t –l –4

–> install a patch

installpatch .

–> check to see if a patch has been installed

showrev –p |grep package name

–> unzip, untar in a /tmp directory

zcat 104708-16.tar.gz | ( cd /tmp; sudo tar xvf – )

–> check out revision level on ssa controller

/usr/sbin/ssaadm display controller

–> unzip and untar a file without having to create an intermediate tar file

sudo gzip -dc /tmp/270599/post-EOD.tar.gz |tar xvf -

–> selectively extract from a tar archive

tar xvf /tmp/iona.tar ./iona/.sh_history

–> send a bunch of files to tape

tar cf /tmp/rules.tar ruleb* objects.C *.W

–> examine section 5 of man

man -s 5 signal

–> shows signals and definitions of structures, eg sigaction

/usr/include/sys/signal.h

–> location of the limits file on solaris

/usr/include/limits.h

–> send an attachment via email from command prompt

uuencode file.tar.gz file.tar.gz | mailx –s “backup” root@crawl

–> zero a file

cat /dev/null > isam.log

–> good way to restore from cdrom a binary file

zcat < /cdrom/cdrom0/Solaris_2.6/Product/SUNWcsu/install/reloc.cpio.Z |

cpio –idm usr/lib/fs/ufs/ufsrestore

--> running su as a user then ssh

su – dls-PROD -c “/opt/local/bin/ssh drp-stagger \”cd /tmp; /bin/ls\” ”

–> verify a newfs format

sudo newfs –Nv /dev/md/dsk/d96

–> making lost_found. must be 8192 bytes in size.

mkdir ./lost+found;chown root ./lost+found; chgrp root ./lost+found ;chmod 700 ./lost+found’; cd ./lost+found

nofiles=0 ; while [ "$nofiles" -le 650 ] ; do ; /usr/ucb/touch $nofiles ; nofiles=`expr $nofiles + 1` ; done

–> execute lynx

lynx -cfg /usr/lib/lynx.cfg

–> sed search example

sed ‘/Sep\ 25/!d; /castill/!d’ /var/log/syslo

–>should only be used at the EEPROM

boot –r

–> should be used at single user mode

reboot — -r

–> should be used in multiuser mode

touch /reconfigure

–> performing a remote dump

find MFASYS

|cpio -oc |gzip -c

|ssh brucey -l chaup dd obs=18k of=/dev/rmt/0n

- to extract -

cd /ssa/emphasys/sybase/dump

dd ibs=18k if=|gunzip -c |cpio –idc

–> boot block located here.

/usr/platform/`uname –i`/lib/fs/ufs

–> getting a server on the network

add hosts entry for IP address

clear configs: ifconfig pe0 unplumb

ifconfig pe0 10.20.2.27 netmask 255.0.0.0 up

route add default 10.20.0.1 1

verify the routing table: netstat –rn

add resolv.conf entry: domain rabobank.com.au nameserver 192.192.192.252

edit /etc/nsswitch.conf change hosts to files, dns

lesson here is to unplumb interface, and let ifconfig setup the routing.

if you specify an ip address and a netmask it will manage

the routing and the broadcasting.

–> find all, files associated with PID 22240

/usr/proc/bin/pfiles 22240

find file based on inode

find –i number

“ncheck –i number

–> good redirection example

./a.out trash

–> synchronize files from one server to another. This is useful for

synchronizing database dump files, binary files, etc. This is definitely a powerful tool.

rsync -avz -e ssh –rsync-path=”/usr/local/bin/rsync” `pwd` myhost.com:/home/ebs/public_html

–> Example Awk Script

# run with awk -f/tmp/1.awk /etc/group

BEGIN { FS = “:” }

{ print $1 | “sort” }

{ nlines++ }

END { print nlines }

–> awk example.

awk ‘/#/ {print “Got a comment”}’ /etc/hosts

–> delete every 2nd field in file

awk ‘{$2= “”; print}’ datafile > datafile.new

–> awk average/standard deviation program

x1 += $1

x2 += $1*$1

END {

x1 = x1/NR

x2 = x2/NR

sigma = sqrt(x2 – x1*x1)

if (NR > 1) std_err = sigma/sqrt(NR – 1)

print “Number of points = ” NR

print “Mean = ” x1

print “Standard Deviation = ” sigma

print “Standard Error = ” std_err

These are simple one liner tips for solaris.

Processor Information:

The psrinfo command displays the Processor info on the Sun Server

# psrinfo -v

Status of virtual processor 0 as of: 08/31/06 12:27:07
on-line since 08/28/06 01:46:34.
The sparcv9 processor operates at 296 MHz,
and has a sparcv9 floating point processor.

Open Boot Prompt (OBP) revision:

The prtconf command displays the Open Boot Prompt revision

#prtconf -V

OBP 3.29.0 2000/12/20 18:41

3.29.0 indicates the revision of the Open Boot Prompt.

Patch Revision info:

The showrev command displays the revision of a particular patch. This helps when you install a version of the patch to check if it is the latest and/or check if it is obsolete.

#showrev -p |grep

System Type:

The uname command can be used to find the hardware type.

#uname -i

SUNW,Ultra-60

The above command is run on a SPARC Ultra60

Solaris revision:

Use the uname command to find the revision number of your Solaris Operating System.

#uname -v

Generic_108528-29

where 108528-29 is the Solaris patching revision.

Please note, Newly installed patch revisions will not show until the server is rebooted.

Solaris Server Version:

The uname command can be used to find the Solaris operating system version.

#uname -r

5.8

#uname -a

SunOS myserver 5.8 Generic_108528-29 sun4u sparc SUNW,Ultra-60

where 5.8 indicates Solaris 8.

How do I get Oracle to automatically start when my server boots up?

2011-08-28T08:41:00.000-07:00

Oracle provides two UNIX scripts that assist DBAs with starting and stopping the database: dbstart and dbshut. For Windows platforms, the oradim utility is provided for starting and stopping the Oracle instance.

The dbstart utility reads the oratab file, shown in the example below. The oratab file will reside in either /etc or /var/opt/oracle, depending on the UNIX version. It contains three data items separated by colons:

ASG920xr:/usr/oracle/9.2.0:Y

ASG817xr:/usr/oracle/8.1.7:Y

TEST920xr:/usr/oracle/9.2.0:N

PROD920xr:/usr/oracle/9.2.0:N

The first field is the Oracle SID. The second field is the home directory for that Oracle SID. The Y or N instructs Oracle whether to start or stop the particular database when either the dbstart or dbshut command is issued. The dbstart command simply parses the oratab file and starts those databases that have a Y in the third field. It also uses the ORACLE_HOME specified in the file to connect internally to the database and issue the startup command.

The dbstart command can be added to the UNIX servers’ initialization or run level scripts. This enables dbstart to be executed each time the machine is booted or when it changes run levels. The method for implementing this is platform specific, as we see below.

Auto Start on HP-UX and Solaris

For HP-UX version 10 and above, the system initialization scripts are contained in /etc/rc.d directories, where “n” is the operating system run-level. These directories contain scripts that begin with a K or S, followed by a number, and then a file name (S75cron). All scripts that begin with “S” are executed at system startup in ascending order of their number. Scripts beginning with “K” (Kill) are called at system shutdown time.

As a general rule of thumb, the Oracle startup script should have a high sequence number (S99dbstart), which will ensure that other system processes have been started prior to Oracle. Likewise, the kill scripts should have a low sequence number in order to shutdown Oracle early in the process (K01dbshut).

Auto Start on AIX

For AIX servers, the system initialization file is /etc/inittab and the initialization script is /etc/rc. A utility (/usr/sbin/mkitab) can be used to make an entry in the inittab file. The shutdown script for AIX is /usr/sbin/shutdown, although it should not be modified to support dbshut.

To add the dbstart utility to the AIX initialization process, the following steps can be performed:

1. Create the script /etc/rc.oracle. The script should contain the following:

su oracle <

<$ORACLE_HOME>/bin/dbstart

EOF

2. Add the script to the inittab using the mkitab utility.

$ /usr/sbin/mkitab “rcoracle:2:wait:/etc.rc.oracle >/dev/console 2>&1”

All references to <$ORACLE_HOME> should be replaced with the actual Oracle Home directory. Now upon system startup, the dbstart utility is invoked at run level 2.

--------------------------------------------------

Make sure the entry for your database SID in the ORATAB file ends in a capital "Y". Eg:

#   $ORACLE_SID:$ORACLE_HOME:[N|Y] # ORCL:/u01/app/oracle/product/8.0.5:Y #

The scripts for starting and stopping databases are: $ORACLE_HOME/bin/dbstart and dbshut. SQL*Net (or Net8) is started with the lsnrctl command. Add the following entries to your/etc/rc2.d/S99dbstart (or equivalent - for example HP-UX uses /sbin/rc2.d/*) file:

su - oracle -c "/path/to/$ORACLE_HOME/bin/dbstart"         # Start DB's su - oracle -c "/path/to/$ORACLE_HOME/bin/lsnrctl start"   # Start listener su - oracle -c "/path/tp/$ORACLE_HOME/bin/namesctl start"  # Start OraNames (optional)

How to know the status of tape in a tape drive

2009-10-24T03:53:00.000-07:00

Sometime we unknowingly enter the tape in tape drive with write protection on. And when we try to take backup of any file with the below command then we get error :

root@dc # tar cvf /dev/rmt/0 /tmp/template_161009.tar.gz
tar: /dev/rmt/0: Permission denied

In unix to know what causing this problem we have a command mt.

root@dc # mt -f /dev/rmt/0 status
HP DDS-4 DAT (Sun) tape drive:
sense key(0x7)= Write Protected residual= 0 retries= 0
file no= 0 block no= 0

The above command clearly shows that the problem was write protection of the tape drive. After correcting the protection level of tape(that you have to do manually i.e eject the tape and shift the write protection button) the above command will show the status as

root@dc # mt -f /dev/rmt/0 status
HP DDS-4 DAT (Sun) tape drive:
sense key(0x0)= No Additional Sense residual= 0 retries= 0
file no= 0 block no= 0