Oracle Solaris

To prevent block FTP access by anonymous users Solaris 10

noreply@blogger.com (Anonymous) — Tue, 20 Dec 2016 07:09:00 +0000

To prevent access by anonymous users, add the entry

"defaultserver private" to /etc/ftpd/ftpaccess:

Adding guestserver to the ftpaccess file:

# echo "guestserver" >> /etc/ftpd/ftpaccess

# cat /etc/ftpd/ftpaccess
# ident "@(#)ftpaccess 1.2 03/05/14 SMI"
#
# FTP server configuration file, see ftpaccess(4).
#

class   anonusers       anonymous       *
class   guestusers      guest   *
class   realusers       real    *

loginfails      3
passwd-check    trivial         warn
private         no
shutdown        /etc/ftpd/shutdown.msg
# email         user@hostname
# guestuser     username
# rhostlookup   no

#To prevent access by anonymous users#
defaultserver private
.
.
.
.
guestserver
.
.

Next restart the FTP service :

Veryfy the status now -> blocked FTP access for anonymous user :

C:\Users\U Computers>ftp 172.16.0.1
Connected to 172.16.0.1.
220-_________________________________
220-
220- welcome to SLT HQ server!
220- Authorised access only!
220-
220-**********************************
220-
220-
220 NTU-HQ-EMS FTP server ready.
User (172.16.0.1:(none)): anonymous
530 Guest login not allowed on this machine.
Connection closed by remote host.

How to ensure that anonymous FTP has been disabled on a Solaris 10 system

Configuring a NTP(Network Time Protocol ) client on Solaris 10

noreply@blogger.com (Anonymous) — Tue, 05 Jul 2016 06:28:00 +0000

Configuring a NTP client

Create the ntp.conf file

You can use ntp.client file as template and edit ntp.conf

#cd /etc/inet
# cp ntp.client ntp.conf

Eg :

#vi /etc/inet/ntp.client

# An example file that could be copied over to /etc/inet/ntp.conf; it

# provides a configuration for a host that passively waits for a server
# to provide NTP packets on the ntp multicast net.
#
server 192.168.10.6 prefer
server 172.16.0.2
driftfile /var/ntp/ntp.drift
multicastclient 224.0.1.1
#

Save and exit from ntp.conf

Check the NTP server reachability and response to NTP client:

# ntpdate -d 192.168.10.6

30 Jun 12:51:46 ntpdate[9927]: ntpdate 3-5.93e+sun 03/06/05 23:16:45 (1.4)
transmit(192.168.10.6)
receive(192.168.10.6)
transmit(192.168.10.6)
receive(192.168.10.6)
transmit(192.168.10.6)
receive(192.168.10.6)
transmit(192.168.10.6)
receive(192.168.10.6)
transmit(192.168.10.6)
server 192.168.10.6, port 123
stratum 4, precision -18, leap 00, trust 000
refid [127.127.1.0], delay 0.02591, dispersion 0.00000
transmitted 4, in filter 4
reference time: db1f46e8.a3e1a000 Thu, Jun 30 2016 12:51:12.640
originate timestamp: db1f470a.efb60000 Thu, Jun 30 2016 12:51:46.936
transmit timestamp: db1f470a.efa4d000 Thu, Jun 30 2016 12:51:46.936
filter delay: 0.02599 0.02591 0.02591 0.02591
0.00000 0.00000 0.00000 0.00000
filter offset: 0.000024 0.000012 0.000012 0.000012

0.000000 0.000000 0.000000 0.000000

delay 0.02591, dispersion 0.00000
offset 0.000012

30 Jun 12:51:46 ntpdate[9927]: adjust time server 172.16.0.2 offset 0.000012 sec

Start the ntpd daemon

# svcadm enable svc:/network/ntp:default

Check the ntp service status:

#svcs ntp
STATE STIME FMRI
online 10:23:44 svc:/network/ntp:default

driftfile /var/ntp/ntp.drift à The difference between your clock and the time provided by NTP servers can be examined by viwing the drift file:

Eg:

# cat /var/ntp/ntp.drift
-40.65

Once the service is running you can check which server is sync with the client:

if there is * against 192.168.10.6 means NTP sync is working with particular server.

- outlyer

The peer is discarded by the clustering algorithm as an outlyer.

+ candidat

The peer is a survivor and a candidate for the combining algorithm.

# selected

The peer is a survivor, but not among the first six peers sorted by synchronization distance. If the association is ephemeral, it may be demobilized to conserve resources.

* sys.peer

The peer has been declared the system peer and lends its variables to the system variables.

NTP default port :123 UDP

Capture snoop Output Into a File in Solaris

noreply@blogger.com (Anonymous) — Thu, 26 Jun 2014 07:26:00 +0000

Save snoop capture output into file in Solaris

Capture a snoop session into a file:

# snoop -o filename

Eg:

# snoop -o cap.cap ip 50.200.0.4

Using device igb0 (promiscuous mode)

In above example we can see 2 packets have been captured and saved it in to cap.cap file.We can abort capture at any time using press Control+c.

Inspect the snoop output captures file:

# snoop -i filename

Eg:

# snoop -i a.cap
1   0.00000   172.16.0.1 -> 50.200.0.4   UDP D=1728 S=51479 LEN=32
2   0.01544   50.200.0.4 -> 172.16.0.1   ICMP Destination unreachable (UDP port 1728 unreachable)
3   2.98764   50.200.0.4 -> NTU-HQ-GLOBAL DHCP/BOOTP DHCPDISCOVER
4   0.00094 NTU-HQ-GLOBAL -> 50.200.0.4   DHCP/BOOTP DHCPOFFER

Or we can inspect this captured file by open through Wireshark

For more information about SNOOP command :
http://solaris4servers.blogspot.com/2012/09/how-to-capture-network-packets-in.html

Searching for Files that have been modified within a specified time frame (using find command)

noreply@blogger.com (Anonymous) — Fri, 30 May 2014 07:27:00 +0000

Searching for Files that have been modified within a specified time frame (using find command)

Find command is use for searching files that meet conditions you specify.

For more information about find command:

http://www.solaris4servers.tk/2012/10/find-command-in-solaris-10-egfind-some.html

man page in Solaris 10:

find directory options

-atimen True if the file was accessed n days ago. The access time of directories in

path is changed by find itself.

-ctime n True if the file's status was changed n days ago.

-mtime n True if the file's data was modified n days ago.

The descriptions of -atime, -ctime, and -mtime use the ter-minology n ``24-hour periods''. For example, a file accessed at 23:59 is selected by:

example% find . -atime -1 -print

at 00:01 the next day (less than 24 hours later, not more than one day ago). The midnight boundary between days has no effect on the 24-hour calculation.

Eg:Find files in current directory that have been modified in last 24h time

#find . -ctime -1 -type f

How to add telnet SSH warning/logging banner/message in solaris 10

noreply@blogger.com (Anonymous) — Wed, 12 Mar 2014 08:45:00 +0000

We can add our system warning/logging banner/message by editing /etc/motd file. This message will appear once after we are logging in to system using Telnet/SSh/..etc. methord. (displayed after login)

# vi /etc/motd

"/etc/motd" 1 line, 57 characters

#########################################################################

# ----Sri Lanka XXXX PVT. LTD.----

# This system is for the use of authorized users only.

# Individuals using this computer system without authority, or

# in excess of their authority, are subject to having all of

# activities on this system monitored and recorded by system personnel.

#########################################################################

Eg:

Using keyboard-interactive authentication.

Password:

Access denied

Using keyboard-interactive authentication.

Password:

Last login: Wed Mar 12 11:43:09 2014 from 172.16.0.6

#########################################################################

# ----Sri Lanka XXXX PVT. LTD.----

# This system is for the use of authorized users only.

# Individuals using this computer system without authority, or

# in excess of their authority, are subject to having all of

# activities on this system monitored and recorded by system personnel.

#########################################################################

-bash-3.00$

For telnet we can place a banner to display while trying to access server by editing /etc/default/telnetd file.

# vi /etc/default/telnetd

"/etc/default/telnetd" [Read only] 20 lines, 652 characters

#ident "@(#)telnetd.dfl 1.1 01/11/01 SMI"

# /etc/default/telnetd

# telnetd default settings processed via telnetd(1M).

# BANNER defines the connection banner which is displayed before the

# telnet login prompt, see telnetd(1M) for details. The following

# commented line shows the default value.

#BANNER="\\r\\n\\r\\n`uname -s` `uname -r`\\r\\n\\r\\n"

# Suppress the telnet banner by supplying a null definition.

BANNER="**********************Warning************************\\r\\n\\r\\n uthorized uses only.All activity may be monitored and reported\\r\\n\\r\\n"

For SSH:

# vi /etc/ssh/sshd_config

# Banner to be printed before authentication starts.

Banner /etc/issue

Eg:

>telnet 172.16.0.4

**********************Warning************************

uthorized uses only.All activity may be monitored and reported

See default ports in solaris 10

noreply@blogger.com (Anonymous) — Fri, 07 Mar 2014 12:04:00 +0000

# cat /etc/services
#
# Copyright 2008 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
#ident "@(#)services 1.34 08/11/19 SMI"
#
# Network services, Internet style
#
tcpmux 1/tcp
echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp users
daytime 13/tcp
daytime 13/udp
netstat 15/tcp
chargen 19/tcp ttytst source
chargen 19/udp ttytst source
ftp-data 20/tcp
ftp 21/tcp
ssh 22/tcp # Secure Shell
telnet 23/tcp
smtp 25/tcp mail
time 37/tcp timserver
time 37/udp timserver
name 42/udp nameserver
whois 43/tcp nicname # usually to sri-nic
domain 53/udp
domain 53/tcp
bootps 67/udp # BOOTP/DHCP server
bootpc 68/udp # BOOTP/DHCP client
kerberos 88/udp kdc # Kerberos V5 KDC
kerberos 88/tcp kdc # Kerberos V5 KDC
hostnames 101/tcp hostname # usually to sri-nic
pop2 109/tcp pop-2 # Post Office Protocol - V2
pop3 110/tcp # Post Office Protocol - Version 3
sunrpc 111/udp rpcbind
sunrpc 111/tcp rpcbind
imap 143/tcp imap2 # Internet Mail Access Protocol v2
ldap 389/tcp # Lightweight Directory Access Protocol
ldap 389/udp # Lightweight Directory Access Protocol
dhcpv6-client 546/udp dhcpv6c # DHCPv6 Client (RFC 3315)
dhcpv6-server 547/udp dhcpv6s # DHCPv6 Server (RFC 3315)
submission 587/tcp # Mail Message Submission
submission 587/udp # see RFC 2476
ldaps 636/tcp # LDAP protocol over TLS/SSL (was sldap)
ldaps 636/udp # LDAP protocol over TLS/SSL (was sldap)
#
# Host specific functions
#
tftp 69/udp
rje 77/tcp
finger 79/tcp
link 87/tcp ttylink
supdup 95/tcp
iso-tsap 102/tcp
x400 103/tcp # ISO Mail
x400-snd 104/tcp
csnet-ns 105/tcp
pop-2 109/tcp # Post Office
uucp-path 117/tcp
nntp 119/tcp usenet # Network News Transfer
ntp 123/tcp # Network Time Protocol
ntp 123/udp # Network Time Protocol
netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp # NETBIOS Name Service
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp # NETBIOS Datagram Service
netbios-ssn 139/tcp # NETBIOS Session Service
netbios-ssn 139/udp # NETBIOS Session Service
NeWS 144/tcp news # Window System
slp 427/tcp slp # Service Location Protocol, V2
slp 427/udp slp # Service Location Protocol, V2
mobile-ip 434/udp mobile-ip # Mobile-IP
cvc_hostd 442/tcp # Network Console
ike 500/udp ike # Internet Key Exchange
uuidgen 697/tcp # UUID Generator
uuidgen 697/udp # UUID Generator
#
# UNIX specific services
#
# these are NOT officially assigned
#
exec 512/tcp
login 513/tcp
shell 514/tcp cmd # no passwords used
printer 515/tcp spooler # line printer spooler
courier 530/tcp rpc # experimental
uucp 540/tcp uucpd # uucp daemon
biff 512/udp comsat
who 513/udp whod
syslog 514/udp
talk 517/udp
route 520/udp router routed
ripng 521/udp
klogin 543/tcp # Kerberos authenticated rlogin
kshell 544/tcp cmd # Kerberos authenticated remote shell
new-rwho 550/udp new-who # experimental
rmonitor 560/udp rmonitord # experimental
monitor 561/udp # experimental
pcserver 600/tcp # ECD Integrated PC board srvr
sun-dr 665/tcp # Remote Dynamic Reconfiguration
kerberos-adm 749/tcp # Kerberos V5 Administration
kerberos-adm 749/udp # Kerberos V5 Administration
kerberos-iv 750/udp # Kerberos V4 key server
krb5_prop 754/tcp # Kerberos V5 KDC propogation
ufsd 1008/tcp ufsd # UFS-aware server
ufsd 1008/udp ufsd
cvc 1495/tcp # Network Console
ingreslock 1524/tcp
www-ldap-gw 1760/tcp # HTTP to LDAP gateway
www-ldap-gw 1760/udp # HTTP to LDAP gateway
listen 2766/tcp # System V listener port
nfsd 2049/udp nfs # NFS server daemon (clts)
nfsd 2049/tcp nfs # NFS server daemon (cots)
eklogin 2105/tcp # Kerberos encrypted rlogin
lockd 4045/udp # NFS lock daemon/manager
lockd 4045/tcp
ipsec-nat-t 4500/udp # IPsec NAT-Traversal
dtspc 6112/tcp # CDE subprocess control
fs 7100/tcp # Font server
#[swat] The swat service is added by the SUNWsmbar package.
#[swat] Removing the swat service manually while SUNWsmbar
#[swat] package is installed in the system can cause issues
#[swat] with smf(5) stability or with zones(5) installation.
swat 901/tcp # Samba Web Adm.Tool
apocd 38900/udp
snmpd 161/udp snmp # SMA snmp daemon
servicetag 6481/udp
servicetag 6481/tcp

You can just edit and restart

Setting Up NFS Services in Solaris10

noreply@blogger.com (Anonymous) — Thu, 06 Feb 2014 12:07:00 +0000

Setting Up NFS Services for Sharing directories

Checking nfs service status

# svcs -a |grep -i nfs

online 2012 svc:/network/nfs/status:default

online 2012 svc:/network/nfs/cbd:default

online 2012 svc:/network/nfs/mapid:default

online 2012 svc:/network/nfs/nlockmgr:default

online 2012 svc:/network/nfs/client:default

online 2012 svc:/network/nfs/rquota:default

online 12:17:33 svc:/network/nfs/server:default

Share any folder that you need share with nfs by editing /etc/dfs/dfstab file.

# cat /etc/dfs/dfstab

# Place share(1M) commands here for automatic execution

# on entering init state 3.

# Issue the command 'svcadm enable network/nfs/server' to

# run the NFS daemon processes and the share commands, after adding

# the very first entry to this file.

# share [-F fstype] [ -o options] [-d ""] [resource]

# .e.g,

# share -F nfs -o rw=engineering -d "home dirs" /export/home2

/usr/sbin/share -F nfs -o rw -d "" /share

Disable the NFS service on the server.

# svcadm disable network/nfs/server

Enable the NFS service on the server.

# svcadm enable network/nfs/server

Select Different Versions of NFS on a Server

Edit the /etc/default/nfs file

NFS_SERVER_VERSMAX=value

NFS_SERVER_VERSMIN=value

Value :Provide the version number.

Mount NFS on the client.

# mount server-name:/share-point /local-dir

Check that the NFS services started on the NFS server

# rpcinfo -s 172.16.0.4|egrep 'nfs|mountd'

100005 3,2,1 ticots,ticotsord,tcp,ticlts,udp mountd superuser

100003 4,3,2 tcp,udp nfs 1

100227 3,2 tcp,udp nfs_acl 1

Check that the server's mountd is responding

# /usr/bin/rpcinfo -u 172.16.0.4 mountd

program 100005 version 1 ready and waiting

program 100005 version 2 ready and waiting

program 100005 version 3 ready and waiting

Verify that file system is shared as expected on the server

# showmount -e

export list for NTU-HQ-GLOBAL:

/share (everyone)

Some Troubleshoots:

#svcs -xv nfs/server

svc:/network/nfs/server:default (NFS server)

State: disabled since Tue Jan 12 12:19:22 2013

Reason: Disabled by an administrator.

See: Sun Message ID: SMF-8000-06

See: man -M /usr/share/man -s 1M nfsd

Impact: This service is not running.

It will say what is the problem of not starting the service, you can also go to that mention log file and observe error logs.

Nfs client mount RPC Error: Program not registered.

When trying to mount nfs partition from nfs client, its keep getting above message that saying

nfs client mount RPC Error: Program not registered.

# mount -t nfs 172.16.0.1:/usr/local/backup

mount: mount to NFS server 172.16.0.1' failed: RPC Error: Program not registered.

Solution

This is generally happens due to following reasons..

*not having any shared folders in server or

*not having necessary access rights to server or folder

NFS run in local Zones in solaris:

For this you have to enable nfs server in global Zone and for shearing you have to give local Zone path to mount point in nfstab

Eg: /usr/sbin/share -F nfs -o rw -d "" /Zones/EMS/root/share/backup

Display the number of files in a directory

noreply@blogger.com (Anonymous) — Thu, 30 Jan 2014 07:49:00 +0000

Count the number of files in a directory

# ls -l | wc -l
11484

#ls -1 targetdir | wc -l

Creating Persistent Routes in Solaris

noreply@blogger.com (Anonymous) — Tue, 28 Jan 2014 06:29:00 +0000

Creating Persistent Routes in Solaris

Print the currently active routes:

# netstat -rn

Routing Table: IPv4

Destination Gateway Flags Ref Use Interface

-------------------- -------------------- ----- ----- ---------- ---------

default 172.16.0.254 UG 1 1650937522

10.0.0.0 172.16.0.12 UG 1 10206514

172.16.0.0 172.16.0.3 U 1 9528249 igb0:1

224.0.0.0 172.16.0.3 U 1 0 igb0:1

127.0.0.1 127.0.0.1 UH 19 26626 lo0:1

Add a route persistently:

# route -p add default ip-address

Eg:

# route -p add 192.168.10.0/24 172.16.0.10

-p Make changes to the network route tables per-

sistent across system restarts. The operation

is applied to the network routing tables

first and, if successful, is then applied to

the list of saved routes used at system

startup. In determining whether an operation

was successful, a failure to add a route that

already exists or to delete a route that is

not in the routing table is ignored. Particu-

lar care should be taken when using host or

network names in persistent routes, as

network-based name resolution services are

not available at the time routes are added at

startup.

(Reference :Solaris man page)

For routes that are created by using this method, use following command

to display all of the static routes

#route -p show

Following examples creates an IPv4 route to the destination 192.168.10.0 and subnet with the subnet mask of 255.255.255.0(/24):

# route add 192.168.10.0/24 somegateway

# route add 192.168.10.0 -netmask 255.255.255.0 somegateway

# route add 192.168.10.0 somegateway 255.255.255.0

For IPv6, only “/” format is accepting for subnet. The following example creates an IPv6 route to the destination 35dd:: with netmask of 16 one-bits followed by 112 zero-bits.

# route add -inet6 35dd::/16 somegateway

Useful commands for checking/find Directories/Files in Solaris

noreply@blogger.com (Anonymous) — Tue, 07 Jan 2014 07:32:00 +0000

Useful commands for checking/find Directories/Files in Solaris

Display the Size of Directories, Sub-directories, and Files

du -summarize disk usage

(By default, file sizes are written in 512-byte units, rounded up to the next 512-byte unit.)

OPTIONS:

-a

Displays the size of each file and subdirectory, and the total number of blocks that are contained in the specified directory.

-s

Displays the total number of blocks that are contained in the specified directory.

# du -s /var/adm/

1198 /var/adm

-h

All sizes are scaled to a human readable format,for example, 34K, 244M, 5.7G, or 2.0T.

Displays the size of each directory in 1024–byte blocks.

# du -h /var/adm/

1K /var/adm/acct/fiscal

1K /var/adm/acct/nite

1K /var/adm/acct/sum

4K /var/adm/acct

1K /var/adm/streams

1K /var/adm/sm.bin

1K /var/adm/exacct

1K /var/adm/log

1K /var/adm/sa

599K /var/adm

-H

Displays the size of each directory in 1000–byte blocks.

# du -H /var/adm/

2 /var/adm/acct/fiscal

2 /var/adm/acct/nite

2 /var/adm/acct/sum

8 /var/adm/acct

2 /var/adm/streams

2 /var/adm/sm.bin

2 /var/adm/exacct

2 /var/adm/log

2 /var/adm/sa

1198 /var/adm

Using ls and find commands:

Changes the directory in to the place of files are locating

# ls [-lh] [-s]

-l

Displays a list of files and directories in long format , sizes in bytes.

# ls -l

total 115540

-rw-r--r-- 1 root root 233 May 21 2013 Cms2Serv.bak

-rw-rw-rw- 1 root root 213 May 21 2013 Cms2Serv.ini

-rw-r--r-- 1 root root 56479733 Jan 7 10:26 EMdatabase0.sa

-rw-r--r-- 1 root root 639742 Jan 7 10:28 EMdetect_00.bin

-h

Scales file sizes and directory sizes into human readable format like Kbytes, Mbytes, Gbytes, or Tbytes when the file or directory size is larger than 1024 bytes.

# ls -l -h

total 115540

-rw-r--r-- 1 root root 233 May 21 2013 Cms2Serv.bak

-rw-rw-rw- 1 root root 213 May 21 2013 Cms2Serv.ini

-rw-r--r-- 1 root root 54M Jan 7 10:26 EMdatabase0.sav

-rw-r--r-- 1 root root 625K Jan 7 10:28 EMdetect_00.bin

-S

Displays a list of the files and directories, showing the sizes in blocks.

# ls -s

total 115800

2 Cms2Serv.bak 1280 EMdetect_00.bin 92 EMhist.sav 28 elementMan.cms

How to Find Large Files

If the characters or columns for the files are different, use following command to sort a list of files by block size, from largest to smallest.

# ls -l| sort +4rn | more

# ls -l | sort +4rn | more

-rw-r--r-- 1 root root 56660746 Jan 7 10:34 EMdatabase0.sav

-rw-r--r-- 1 root root 961820 Jan 7 09:58 EMhist.bak

-rw-r--r-- 1 root root 640113 Jan 7 10:33 EMdetect_01.bin

-rw-r--r-- 1 root root 639742 Jan 7 10:28 EMdetect_00.bin

drwxr-xr-x 2 root root 233984 Jan 7 10:33 ipcfg

-rw-r--r-- 1 root root 51608 Jan 7 10:36 EMhist.sav

drwxr-xr-x 2 root root 41472 Jan 7 09:48 ipinv

Note that this command sorts files in a list by the character that is in the fourth field, starting from the left.

If the characters or columns for the files are the same, use the following command to sort a list of files by block size, from largest to smallest.

# ls -s | sort -nr |more

Note that this command sorts files in a list, starting with the left most character.

Find Files That Exceed a Specified Size Limit

find directory -size +nnn

directory

Identifies the directory that you want to search.

-size +nnn

Nnn in 512-byte blocks. Files that exceed this size will list.

# find . -size +400 -print

./ipcfg

./ipcfg/ipdevcfg.bin

./EMdetect_01.bin

./EMdetect_00.bin

./EMhist.bak

./EMdatabase0.sav

How to Add Access to CD/DVD Media in a Non-Global Zone in Solaris 10

noreply@blogger.com (Anonymous) — Wed, 21 Aug 2013 11:47:00 +0000

How to Add Access to CD/DVD Media in aNon-Global Zone.

Below is the procedure for Add Access to CD/DVD Media to Non-Global zone permanently.

1. Login to global zone become super user.

2. Determine whether the Volume Management file system is running in the global zone.

global # svcs volfs

STATE STIME FMRI

online 2012 svc:/system/filesystem/volfs:default

3. (Optional) If the Volume Management file system is not running(offline) in the global zone,enable it.

global# svcadm volfs enable

4. Insert the media.

5. Check for media in the drive.

global# volcheck

6. Test whether the DVD is auto mounted.

global# ls /cdrom

You will see a output similar to the following:

cdrom cdrom1

7. Take backup of existing zone configuration similar to attached file with info command under zonecfg

Eg:

# zonename

global

# zonecfg -z EMS

zonecfg:EMS> info

zonename: EMS

zonepath: /Zones/EMS

brand: native

autoboot: true

bootargs:

pool:

limitpriv:

scheduling-class:

ip-type: shared

hostid:

inherit-pkg-dir:

dir: /lib

inherit-pkg-dir:

dir: /platform

inherit-pkg-dir:

dir: /sbin

inherit-pkg-dir:

dir: /usr

fs:

dir: /usr/local

special: /Zones/storage/local/EMS

raw not specified

type: lofs

options: []

net:

address: 172.16.0.3

physical: igb0

defrouter not specified

zonecfg:EMS>exit

8. Loopback mount the file system with the options nodevices, ro (no devices, read-only) in the Non-global zone.

global# zonecfg -z EMS

zonecfg:EMS> add fs

zonecfg:EMS> set dir=/cdrom

zonecfg:EMS> set special=/cdrom

zonecfg:EMS> set type=lofs

zonecfg:EMS> add options [ro,nodevices]

zonecfg:EMS> end

zonecfg:EMS> commit

zonecfg:EMS> exit

9. Reboot the non-global zone.

global# zoneadm -z EMS reboot

EMS—is Name of Non-Global Zone

10. Use the zoneadm list command with the -v option to verify the status.

global# zoneadm list -v

11. You will see a display that is similar to the following:

ID NAME STATUS PATH BRAND IP

0 global running / native shared

1 EMS running /Zones/storage/local/EMS native shared

12. Log in to the non-global zone.

global# zlogin EMS

13. Verify the DVD-ROM mount.

EMS# ls /cdrom

14. You will see a display similar to this:

cdrom cdrom1

15. Get the use of DVD/CD in Non-Global zone..:-)

16. Exit the non-global zone.

EMS# exit

If you want to retain the /cdrom file system in your non-global zone. The mount will always reflect the current contents of the CD-ROM drive, or an empty directory if the drive is empty.

17. (Optional) If you want to remove the /cdrom file system from the non-global zone, use the following procedure.

global# zonecfg -z EMS

zonecfg:EMS> remove fs dir=/cdrom

zonecfg:EMS> commit

zonecfg:EMS> exit

Create ftp access only user in Solaris 10 with user restrictions(access rights)

noreply@blogger.com (Anonymous) — Wed, 26 Jun 2013 10:05:00 +0000

We are going to create user who can access toserver via ftp with following access rights:

Access to server via:

Telnet/ssh/other: No

FTP:Yes

Read file: only user home directory.

For that you can give whatever the location you need to give access to user

Eg:/var/apache2/http/ftp/

Then user can access only to that folder

Chmod NotAllowe

Delete NotAllowe

Overwrite NotAllowe

Rename NotAllowe

Unmask NotAllowe

Upload NotAllowe

Verify ftp service is running in the server:

# svcs -a |grep -i ftp

online 12:17:58 svc:/network/ftp:default

Create new user for access server only for FTP

#useradd -g other -d /export/home/sltftp -m -s/bin/ftponly -c "ftp only user account for ftp backup" sltftp

other : This is the group that by default will own any files or processes created by this user. If this user attempts to access a file and the group of that file is the user's primary group then the group permissions for that file will apply (unless the user is the owner of the file).(not necessary)

/export/home/sltftp : A user's home directory typically contains all the files owned by that user. When a user logs in, he will be placed in his home directory and scripts like .cshrc or .profile will be run.

/bin/ftponly : When a user logs in via telnet or at the console, or opens an xterm window in X the users shell program will be run to interpret commands entered. If a user does not have a valid shell program or has one that does nothing (like /bin/false), then that user will not be able to login. This can be useful when creating users who can only read and send email.

"ftp only user account for ftp backup" : The real human-readable name of this user.

sltftp : The login name of this user. This must be unique.

Enter a password for newly created user :( otherwise its remaining blank)

# passwd sltftp

New Password:

Re-enter new Password:

passwd: password successfully changed for sltftp

Verify user creation:

# cat /etc/passwd

root:x:0:0:Super-User:/:/sbin/sh

daemon:x:1:1::/:

bin:x:2:2::/usr/bin:

sys:x:3:3::/:

adm:x:4:4:Admin:/var/adm:

sltftp:x:1000:10: ftp only user account for ftp backup: /export/home/sltftp:/bin/ftponly

1000: The user ID or UID is what the system really uses to enforce permissions on files and processes. If two users have the same UID, they will be able to access each other’s files - so every user should have a unique UID.

Create file /etc/shells ( by default this file not found in system)

# cat /etc/shells

/etc/shells: No such file or directory

Add this line : /bin/ftponly

# vi /etc/shells

/bin/bash

/bin/csh

/bin/gnome-autogen.sh

/bin/hash

/bin/jsh

/bin/ksh

/bin/pfcsh

/bin/pfksh

/bin/pfsh

/bin/remsh

/bin/rksh

/bin/rsh

/bin/sh

/bin/ssh

/bin/tcsh

/bin/zsh

/bin/ftponly

And save it Ece->:wq!

Try to telnet using this user and check the accessibility

Password:

Last login: Wed Jun 26 12

No shell

Connection to host lost.

You can also create /bin/ftponly file and give some echo command with what you want to display when user try to login

Eg:#touch /bin/ftponly>> echo “This account only allows FTP Access!”

After that when users try to login via telnet its shows like this:

Password:

Last login: Wed Jun 26 12

This account only allows FTP Access!

Connection to host lost.

Limiting access rights for ftp user by editing ftpaccess file locate in /etc/ftpd/

#vi ftpaccess

# ident "@(#)ftpaccess 1.2 03/05/14 SMI"

# FTP server configuration file, see ftpaccess(4).

class realusers real *

class guestusers guest *

class anonusers anonymous *

loginfails 3

passwd-check trivial warn

private no

shutdown /etc/ftpd/shutdown.msg

# email user@hostname

# guestuser username

# rhostlookup no

keepalive yes

recvbuf 65536 real,guest,anonymous

sendbuf 65536 real,guest,anonymous

# flush-wait no anonymous

# passive ports 0.0.0.0/0 32768 65535

# timeout data 600

# timeout idle 300

banner /etc/ftpd/banner.msg

greeting brief

message /etc/ftpd/welcome.msg login

message .message cwd=*

readme README* login

readme README* cwd=*

# quota-info *

chmod no anonymous,guest

delete no anonymous,guest

overwrite no anonymous,guest

rename no anonymous,guest

umask no anonymous,guest

compress yes realusers guestusers anonusers

tar yes realusers guestusers anonusers

path-filter anonymous,guest /etc/ftpd/filename.msg ^[[:alnum:]._-]*$ ^[.-]

noretrieve relative class=anonusers /

allow-retrieve relative class=anonusers /pub

upload class=guestusers * * no nodirs

upload class=anonusers * * no nodirs

# upload class=anonusers * /incoming yes ftpadm ftpadm 0440 nodirs

# log commands real,guest,anonymous

# log security real,guest,anonymous

# log transfers real,guest,anonymous inbound,outbound

# xferlog format %T %Xt %R %Xn %XP %Xy %Xf %Xd %Xm %U ftp %Xa %u %Xc %Xs %Xr

# limit-time anonymous 30

# limit anonusers 10 Wk0730-1800 /etc/ftpd/toomany.msg

# limit anonusers 50 SaSu|Any1800-0730 /etc/ftpd/toomany.msg

guestuser sltftp ftptest

log commands anonymous,guest

Save the changers Ece->:wq!

We create this user under guest list:

Define sltftp user as guest:

guestuser sltftp ftptest

create a class for guest user:

The WU FTP server allows you to classify users based on the address they login from and their user type. The three user types are :

Unix - Normal users on your system.

Guest - Unix users who have been classified as guests.

Anonymous - Logins by the anonymous or ftp user, if allowed on your system.

The top section of this page allows you to define named classes, based on user types and source addresses. Every login is classified into the first matching class, so classes should be ordered from the most to least specific. The matching addresses for each class can be full or partial IP addresses, IP networks/netmasks, hostnames, host wildcards (like *.foo.com) or the absolute paths to files containing additional addresses. Any type of address can be preceded with a ! to negate it.

class guestusers guest *

Limiting access rights for guest user:(this will effect to all guest users)

chmod no anonymous,guest

delete no anonymous,guest

overwrite no anonymous,guest

rename no anonymous,guest

umask no anonymous,guest

Put some logging banner to display when logging:

message /etc/ftpd/welcome.msg login

#vi /etc/ftpd/welcome.msg

***************************

Welcome to ftp Sever

Authorized access only!

***************************

Save it:Ece->:wq!

No need to restart the ftp server for effect the changes

To restart ftp process :

#svcadm restart svc:/network/ftp:default

Done! J

Now check ftp user

C:\Windows\system32\ftp 172.16.0.3

Connected to 172.16.0.3.

220 NTU-DR-EMS FTP server ready.

User (172.16.0.3:(none)): sltftp

331 Password required for sltftp.

Password:

230 User sltftp logged in. Access restrictions apply.

Try to upload some files:

ftp> mput

Local files C:\Users\Daraka\Desktop\test.txt

mput C:\Users\Daraka\Desktop\test.txt?

200 PORT command successful.

553 test.txt: Permission denied on server. (Upload)

You can only able to download from the server

Display/Add/Delete/Modify ARP entries in Solaris 10 ARP Table

noreply@blogger.com (Anonymous) — Thu, 16 May 2013 08:51:00 +0000

Display/Add/Delete/modifyARP entries in Solaris 10 ARP Table

arp - address resolution display and control

SYNOPSIS

arp hostname

arp -a [-n]

arp -d hostname

arp -f filename

arp -s hostname ether_address [temp] [pub] [trail]

[permanent]

Show ARP Table:

# arp -a

Net to Media Table: IPv4

Device IP Address Mask Flags Phys Addr

------ -------------------- --------------- -------- ---------------

igb0 224.0.1.1 255.255.255.255 01:00:7e:00:01:01

igb0 172.16.0.254 255.255.255.255 00:00:3e:00:01:64

igb0 172.16.0.8 255.255.255.255 00:60:89:14:a2:28

igb0 172.16.0.2 255.255.255.255 00:21:98:d2:88:8c

igb0 172.16.0.251 255.255.255.255 o 00:1s:2f:3f:52:58

igb0 172.16.0.12 255.255.255.255 o a4:96:4c:b8:69:61

igb0 172.16.0.11 255.255.255.255 o 00:23:32:ec:ca:63

Delete an ARP entry:

# arp –d 172.16.0.2

Add Static entry to routing table:

# arp -s 172.16.0.2 00:18:4d:f8:a4:6e

How to view history of user access logs /system uptime and administration information on Solaris 10

noreply@blogger.com (Anonymous) — Tue, 08 Jan 2013 11:06:00 +0000

View history of user access logs:

We can use last command for that,

The last command looks in the /var/adm/wtmpx file, which records all logins and logouts, for information about a user, a terminal, or any group of users and terminals.

SYNOPSIS

last [-a] [-n number | -number] [-f filename] [name | tty]

The following options are supported:

-a

Displays the hostname in the last column.

-f filename

Uses filename as the name of the accounting file instead of /var/adm/wtmpx.

-n number|-number

limits the number of entries displayed to that specified by number. These options are identical; the -number option is provided as a transition tool only and is removed in future releases.

Eg:

#last –a

It will logs all logs in to wtmpx file...

You can view the file by using following command

#/usr/lib/acct/fwtmp </var/adm/wtmpx

slt sshd 2444 7 0000 0000 1357634943 531781 0 10 172.16.0.8 Tue Jan 8 14:19:03 2013

slt ts/3 pts/3 2451 7 0000 0000 1357634943 549757 0 10 172.16.0.8 Tue Jan 8 14:19:03 2013

eci ftp ftp2512 2512 7 0000 0000 1357635001 0 0 11 172.16.0.4 Tue Jan 8 14:20:01 2013

eci ftp ftp2512 2512 8 0000 0000 1357635001 0 0 11 172.16.0.4 Tue Jan 8 14:20:01 2013

eci ftp ftp2610 2610 7 0000 0000 1357635300 0 0 11 172.16.0.4 Tue Jan 8 14:25:00 2013

eci ftp ftp2610 2610 8 0000 0000 1357635301 0 0 11 172.16.0.4 Tue Jan 8 14:25:01 2013

eci ftp ftp2689 2689 7 0000 0000 1357635600 0 0 11 172.16.0.4 Tue Jan 8 14:30:00 2013

eci ftp ftp2689 2689 8 0000 0000 1357635600 0 0 11 172.16.0.4 Tue Jan 8 14:30:00 2013

eci ftp ftp2813 2813 7 0000 0000 1357635901 0 0 11 172.16.0.4 Tue Jan 8 14:35:01 2013

eci ftp ftp2813 2813 8 0000 0000 1357635901 0 0 11 172.16.0.4 Tue Jan 8 14:35:01 2013

eci ftp ftp2907 2907 7 0000 0000 1357636201 0 0 11 172.16.0.4 Tue Jan 8 14:40:01 2013

fwtmp reads from the standard input and writes to the standard output, converting binary records of the type found in /var/adm/wtmpx to formatted ASCII records. We can’t view properly this kind of files (wtmpx) using cat commands.

We can also convert wtmpx file in to readable txt file format using following command:

# /usr/lib/acct/fwtmp < /var/adm/wtmpx >>wtmpx.txt

The information of system up-time:

#/usr/lib/acct/fwtmp < /var/adm/utmpx

nms ts/1 pts/7 19444 8 0000 0000 1329833595 0 0 12 50.17.3.155 Tue Feb 21 19:43:15 2012

nms ts/4 pts/4 7475 8 0000 0000 1339405255 125196 0 0 Mon Jun 11 14:30:55 2012

nms tt/4 pts/1 19453 8 0000 0000 1329825282 0 0 12 50.17.3.155 Tue Feb 21 17:24:42 2012

slt ts/8 pts/8 4367 8 0000 0000 1352283236 747674 0 0 Wed Nov 7 15:43:56 2012

How to open live-updating log in terminal

noreply@blogger.com (Anonymous) — Tue, 06 Nov 2012 08:51:00 +0000

tail [options]

#tail -f [your log file]

It's updating live feed in the terminal

#tail -f /var/adm/messages
Nov 6 13:38:50 NTU-HQ-GLOBAL dhcpd: [ID 702911 local0.info] DHCPREQUEST for 50.200.0.144 (172.16.0.2) from 00:c0:89:15:10:28 via 50.200.0.1
Nov 6 13:38:50 NTU-HQ-GLOBAL dhcpd: [ID 702911 local0.info] DHCPACK on 50.200.0.144 to 00:c0:89:15:10:28 via 50.200.0.1
Nov 6 13:40:00 NTU-HQ-GLOBAL sendmail[7308]: [ID 702911 mail.crit] My unqualified host name (NTU-HQ-GLOBAL) unknown; sleeping for retry
Nov 6 13:40:00 NTU-HQ-GLOBAL sendmail[7313]: [ID 702911 mail.crit] My unqualified host name (NTU-HQ-GLOBAL) unknown; sleeping for retry

Create new empty files using "touch" command

noreply@blogger.com (Anonymous) — Thu, 04 Oct 2012 08:19:00 +0000

The touch Command

The touch command is use to create new empty files.

It’s also use to change file access and modification times

touch's syntax :

#touch
[option] file_name

Using touch command can create any number of files simultaneously.

Eg:

#touchfile1.txt file2.sql file3.bat

Find command in solaris 10 (Eg:Find some content inside files under some directory)

noreply@blogger.com (Anonymous) — Mon, 01 Oct 2012 09:14:00 +0000

Find some content inside files and it will gives the files that content is available:

# find /usr/local/etc/ -type f-exec grep -l "00:C0:89:14:9F:6C" {} \;

/usr/local/etc/dhcplog.txt

/usr/local/etc/subnetfiles/50.200.0.0-19-server2

/usr/local/etc/ :Location that you want to dind

Use “.” To find in current directory

Eg: # find . -type f -exec grep -l "00:C0:89:14:9F:6C"{} \;

00:C0:89:14:9F:6C: The phrase that you want to find inside the file

-type type of file:

d - Directory

f - File

l - Link

# find/usr/local/etc/ -exec grep -ls 50.200.0 {} \;

/usr/local/etc/dhcpd.conf

/usr/local/etc/dhcplog.txt

/usr/local/etc/dhcpd.conf_subnet

/usr/local/etc/subnetfiles/50.200.0.0-19-server2

Search some files that have not been accessed for a specific time period and removing those Files

The following command is for removes all files in /home/bacup direc-

tory named my.bac or *.log that have not been accessed for a week:

# find /home/bacup $ -namemy.bac -o -name '*.log' $ \ -atime +7 -exec rm {} \;

Find all text files in the /user/local directory using the command, the -print option is used to display the results to standard out.

# find /user/local -name "*.txt"-print

/var/sadm/pkg/SUNWmozilla/save/pspool/SUNWmozilla/reloc/sfw/lib/mozilla/chrome/installed-chrome.txt

/var/sadm/pkg/SUNWlibusb/install/thirdpartylicensereadme.txt

Find files larger than 1 Gigabyte the commaand below may be used, notice unlike Linux, (Solaris 10 does not support the M(Megabyte) or G(Gigabyte) options)

c option for bytes.

#find / -size +1000000000c –print

The -exec flag may be used to apply a command to each of the files which have been found.

({}) represents the name of each file found.

(\;)end of the command.

# find /usr/local/etc/ -name "*.txt" -print -exec wc -l {} \;

Find the file named readme.txt and view the content:

#find / -name "readme.txt" -exec cat {} \;

Installing Cacti on Solaris 10 (PART-2)

noreply@blogger.com (Anonymous) — Fri, 28 Sep 2012 07:22:00 +0000

Install Cacti:

You can download latest version of cacti from http://cactiusers.org/ website

Eg: cacti-plugin-0.8.7g-PA-v2.9.tar

Unzip file and rename it to cacti.

Copy cacti folder into /htdocs directory

Eg:

bash-3.2#mvcacti-0.8.7i-PIA cacti

bash-3.2#cp–R cacti /usr/local/apache2/htdocs

Change appropriate access permissions
Setup databases for cacti:

Create the MySQL database:

bash-3.2# mysqladmin --user=rootcreate cacti

Import the default cacti database:

bash-3.2# mysql cacti < cacti.sql

Optional: Create a MySQL username and password for Cacti.

bash-3.2# mysql --user=root mysql

mysql> GRANT ALL ON cacti.* TO cactiuser@localhost IDENTIFIED BY 'somepassword';

mysql> flush privileges;

Edit include/config.php and specify the database type, name, host, user and password for your Cacti configuration.

$database_type = "mysql";

$database_default = "cacti";

$database_hostname = "localhost";

$database_username = "cactiuser";

$database_password = "cacti";

Set the appropriate permissions on cacti's directories for graph and log. You should execute these commands from inside cacti's directory to change the permissions.

bash-3.2# chown -R cactiuser rra/log/

Add a line to your /etc/crontab file similar to: for 5 minute cron intervals

If you are going to edit crontab using command shell:(solaris 10)

bash-3.2# export EDITOR=vi

bash-3.2# crontab –e

0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/local/php/bin/php /usr/local/apache2/htdocs/cacti/poller.php --force >/dev/null 2>&1

(for wethermap):(solaris 10)

0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/local/php/bin/php /var/apache2/htdocs/cacti/plugins/weathermap/weathermap-cacti-rebuild.php

01:Go to your browser and your local host or your cacti installed matching IP

http://172.16.0.1/cacti

http://127.0.0.1/cacti

02: Select new install if you are installing cacti at first time:

03:If you setup and install all necessary packages that need to run Cacti in this window it will indicate all the paths in green color:

if it's indicated in red color please check the paths and correct them or check in you install all the necessary plugging and running them perfectly.

04: Login by default username and password admin:admin:

05: It will force you to change default password for admin login:

We can use Plugin Architecture (PIA) for installing additional useful plugins with Cacti.

There are two ways of install the Plugin Architecture. The first way is by using the patch files.

A patch file contains the difference between the original files and the “new” files, which makes them very small as they only contain exactly what we need to make the changes.

The other way is by using the pre-patched full files. These files are the full install of the necessary files.

Using the Pre-Patched Files

Copy the files from the “files-0.8.7g” directory to your Cacti install directory, overriding any files if you are prompted.

Edit “include/config.php” and specify the database type, name, host, user and password for your Cacti configuration.

$database_type = "mysql";

$database_default = "cacti";

$database_hostname = "localhost";

$database_username = "cactiuser";

$database_password = "cactiuser";

/* load up old style plugins here */

$plugins = array();

//$plugins[] = 'thold';

/*

   Edit this to point to the default URL of your Cacti install

   ex: if your cacti install as at http://serverip/cacti/ this

   would be set to /cacti/

*/

$url_path = "/cacti/";

/* Default session name - Session name must contain alpha characters */

#$cacti_session_name = "Cacti";

Installing Plugins:

You can download plugin and add them under the folder plugins and add the plugin name in include/config.php

Eg:

$plugins = array();

$plugins[] = 'thold';

$plugins[] = 'watermark';

$plugins[] = 'realtime';

then you can manage plugins through cacti.

Managing Plugins

To provide access to Plugin Management go to User Management and select the user in question. The Realm Permission tab will shows like this

Finally you can install/unstill/active/inactive those plugins:

01:You can install that plugin

02: Deactivate plugin

03:Activate plugin

04: Uninstall plugin

Installing Cacti on Solaris 10 (PART-1)

noreply@blogger.com (Anonymous) — Thu, 27 Sep 2012 08:36:00 +0000

Installing Cacti on Solaris 10

Install Solaris 10 sparc in sun server:

Software Requirements:

Required packages for solaris 10 sparc x64(according to your system) can freely download from http://unixpackages.com/ or http://sunfreeware.com/ . (it’s better download new versions.)

libiconv		freetds
libintl		libssh2
libidn		gd
openssl		jpeg
curl		openldap
expat		mysql
fontconfig		libpng
zlib		xpm
freetype		sasl
db		libxml2
openldap		flex
autoconf		gcc
automake		libtool
bash-3		make
bison		sed
Perl		libgcc
RRDtool		libsigsegv
libxml2		m4
NET-SNMP		re2c
ncuser		xrender
MySQL		pango
libart_lgpl		PHP
cairo		Apache 2
libart_lgpl

Installing packages:

bash-3.2#gunzip gcc-3.4.6-sol10-x86-local.tar.gz

bash-3.2#pkgadd –d gcc-3.4.6-sol10-x86-local

The following packages are available:

1 SMCgcc gcc

(sparc) 3.4.6

Select package(s) you wish to process (or 'all' to process

all packages). (default: all) [?,??,q]:all

gunzip –d ;-d means default installation

Default installation directry is : /usr/local/

Preparing the system—basic prerequisites

In order to install and run Cacti, we need to make sure that all Cacti system requirements are met. Here I’ll describe main requirement that want to have in OS to run Cacti.

Web server

Cacti is built as a web interface, a web server is needed. This can be Apache httpd or Microsoft's Internet Information Server (IIS) if installing on Windows, but in fact, any PHP-capable web server can be used to run the web interface. For the Solaris I prefer Apache as a web server.

Configure apache 2:

bash-3.2# vi /usr/local/apache2/conf/httpd.conf

# ServerRoot: The top of the directory tree under which the server's

# configuration, error, and log files are kept.

ServerRoot "/usr/local/apache2"

# If you wish httpd to run as a different user or group, you must run

User daemon

Group daemon

# ServerAdmin: Your address, where problems with the server should be

# e-mailed. This address appears on some server-generated pages, such

# as error documents. e.g. admin@your-domain.com

ServerAdmin you@example.com

# ServerName gives the name and port that the server uses to identify itself.

# This can often be determined automatically, but we recommend you specify

# it explicitly to prevent problems during startup.

# If your host doesn't have a registered DNS name, enter its IP address here.

ServerName 172.16.26.160:80

# DocumentRoot: The directory out of which you will serve your

# documents. By default, all requests are taken from this directory, but

# symbolic links and aliases may be used to point to other locations.

DocumentRoot "/var/apache2/htdocs"

Use your normal procedure for starting the Apache server, e.g.:

bash-3.2#/usr/local/apache2/bin/apachectl start

bash-3.2#service httpd restart

NET-SNMP package

The NET-SNMP package provides the SNMP binaries used by Cacti and supports SNMPv1, SNMPv2c, and SNMPv3.

The NET-SNMP package also provides the SNMP daemon for UNIX.

*Note: The snmpd.conf file for Sun's agent is in the /etc/sma/snmp/ directory. This is the one you will want to edit to suit your needs.

bash-3.2# vi /etc/snmp/conf/snmpd.conf

--- Make sure Sun's Agent is enabled ---

bash-3.00# svcadm enable snmpdx

bash-3.00# svcadm enable dmi

bash-3.00# svcadm enable sma

Checking snmp is working properly:

bash-3.00# snmpwalk -v 1 -c localhost

bash-3.00# snmpget -v 1 -c localhostsysDescr.0

Change the content of the snmpd.conf file

MySQL database

Cacti use the freely available MySQL database engine as its database server and it is also available on Solaris. For best performance, MySQL version 5 should be used.

Installation

Removing older versions of MySQL on Solaris

# groupadd mysql
# useradd -g mysql -d /export/home/mysql -s /usr/bin/bash mysql
# passwd mysql
# cd /usr/local/mysql
# chown -R mysql:mysql .
# chgrp -R mysql:mysql .
# ln /usr/bin/hostname /usr/local/bin/hostname

#/usr/local/mysql/bin/mysql_install_db --user=mysql
Installing MySQL system tables...
090211 14:30:35 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
090211 14:30:35 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
OK
Filling help tables...
090211 14:30:35 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
090211 14:30:35 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
OK

To start mysqld at boot time you have to copy
support-files/mysql.server to the right place for your system /etc/init.d/

PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL root USER !

To do so, start the server, then issue the following commands:

/usr/local/mysql/bin/mysqladmin -u root password 'new-password'
/usr/local/mysql/bin/mysqladmin -u root -h vmsol01 password 'new-password'

Alternatively you can run:

/usr/local/mysql/bin/mysql_secure_installation

which will also give you the option of removing the test
databases and anonymous user created by default. This is
strongly recommended for production servers.

See the manual for more instructions.

You can start the MySQL daemon with:

cd /usr/local/mysql ; /usr/local/mysql/bin/mysqld_safe &

You can test the MySQL daemon with mysql-test-run.pl

cd mysql-test ; perl mysql-test-run.pl

Please report any problems with the /usr/local/mysql/bin/mysqlbug script!

The latest information about MySQL is available on the web at
http://www.mysql.com

Support MySQL by buying support/licenses at http://shop.mysql.com/

# cp /usr/local/mysql/share/mysql/mysql.server /etc/init.d/mysql
# ln -s /etc/init.d/mysql /etc/rc3.d/S99mysql
# ln -s /etc/init.d/mysql /etc/rc0.d/K00mysql
# /etc/init.d/mysql start

#/usr/local/mysql/bin/mysqladmin -u root password 'password'

Check for MySQL packages installed and remove them.

# pkginfo | grepmysql

The following packages SUNWmysqlr, SUNWmysqlt, SUNWmysqlu were found and removed.

# pkgrm SUNWmysqlr # pkgrm SUNWmysqlt # pkgrm SUNWmysqlu

1. Create mysql user and group

#groupadd mysql
#useradd -g mysqlmysql

2. Extract and install the package

#gunzip -d mysql-x.x.x-solaris10-sparc-64bit.pkg.gz
#pkgadd -dmysql-5 x.x.x -solaris10-sparc-64bit.pkg

You will be asked to create installation directory. Answer with yes to continue installation. The installation process will put the files on /opt/my sql/mysql or /usr/local/mysql/.

3. You will need to do these commands to change file/folders permission

#chown -R mysql:mysql /usr/local/mysql/
#chmod -R 550 /usr/local/mysql/
Or:
#chown -R mysql:mysql /opt/mysql/mysql
#chown -R mysql:mysql /var/lib/mysql
#chmod -R 550 /opt/mysql/mysql

4. Coppy configuration file into required location

bash-3.2# pwd
/usr/local/mysql/share/mysql/
bash-3.2# cp my-medium.cnf /etc/my.cnf
bash-3.2#vi /etc/my.cnf

And edit required configurations...

5. Binary files will be located in /opt/mysql/mysql/bin after installation. Install mysql database with this command

#/opt/mysql/mysql/bin/mysql_install_db
or:
##/usr/local/mysql/bin/mysql_install_db

6. Usually, we start the server with this command

#/opt/mysql/mysql/bin/mysqld_safe –user=mysql &
or
#/usr/local/mysql/bin/mysqld_safe –user=mysql &

or try
#/usr/local/mysql/bin/mysql –user=mysql &
or
#/usr/local/mysql/bin/mysqld –user=mysql&

But, MySQL 5.1.33 has a bug on this. Here the bug is: Installation process put data files on /var/lib/mysql, while default mysqld_safe command will look forward to /opt/mysql/mysql/data/. We can fix this by adding –datadir option. To start the server, the complete command will be like this

#/opt/mysql/mysql/bin/mysqld_safe –user=mysql –datadir=/var/lib/mysql &
Or
#/usr/local/mysql/bin/mysqld_safe–user=mysql –datadir=/var/lib/mysql &

7. Don’t forget to create mysql root password

#/opt/mysql/mysql/bin/mysqladmin -u root password ‘your new password’

Or
#usr/local/mysql/bin/mysqladmin-u root password ‘your new password’

#mysqladmin -u root -h 'hostname' password 'new-password'

Next command is optional

#cp support-files/mysql.server/etc/init.d/mysql.server

PHP

Cacti is built with the PHP programming language and therefore needs PHP to be installed on the system. Most UNIX distributions already have a base PHP environment installed, but we might need additional packages for Cacti to function properly. (LDAP, SNMP, and MySQL extensions should be installed)

1. Stop apache server:

bash-3.2#/usr/local/apache2/bin/apachectlstop

2. Setup your php.ini

bash-3.2#cp /usr/local/php/doc/php/php.ini-development /usr/local/lib/php.ini

You may edit your .ini file to set PHP options. If you prefer having php.ini in another location, use --with-config-file-path=/some/path in step

3. Edit your httpd.conf to load the PHP module. (Mention only edited points)

bash-3.2#vi /usr/local/apache2/conf/httpd.conf

# LoadModule foo_module modules/mod_foo.so

LoadModule php5_module modules/libphp5.so

# DirectoryIndex: sets the file that Apache will serve if a directory

# is requested.

DirectoryIndex index.html index.php

# TypesConfig points to the file containing the list of mappings from

# filename extension to MIME-type.

TypesConfig conf/mime.types

# AddType allows you to add to or override the MIME configuration

# file specified in TypesConfig for specific file types.

#AddType application/x-gzip .tgz

# AddEncoding allows you to have certain browsers uncompress

# information on the fly. Note: Not all browsers support this.

#AddEncoding x-compress .Z

#AddEncoding x-gzip .gz .tgz

# If the AddEncoding directives above are commented-out, then you

# probably should define those extensions to indicate media types:

AddType application/x-compress .Z

AddType application/x-gzip .gz .tgz

# AddHandler allows you to map certain file extensions to "handlers":

# actions unrelated to filetype. These can be either built into the server

# or added with the Action directive (see below)

# To use CGI scripts outside of ScriptAliased directories:

# (You will also need to add "ExecCGI" to the "Options" directive.)

#AddHandler cgi-script .cgi

AddHandler php5-script .php

# For type maps (negotiated resources):

#AddHandler type-map var

# Filters allow you to process content before it is sent to the client.

# To parse .shtml files for server-side includes (SSI):

# (You will also need to add "Includes" to the "Options" directive.)

#AddType text/html .shtml

AddType text/html .php

#AddOutputFilter INCLUDES .shtml

4. Start apache server:

bash-3.2#/usr/local/apache2/bin/apachectlstart

5. Checking php is working properly.

Copy index.php into htdocs folder with proper access permissions and open your browse http://172.16.26.15/index.php

index.php…

 <html>

<head>
        <title>PHP Test</title>
        <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
</head>
<body>
        <h1>PHP Test</h1>
        <p>
        <b>An Example of PHP in Action</b><br />
                <?php echo "The Current Date and Time is: <br>";
                        echo date("g:i A l, F j Y.");?>
        </p>
        <h2>PHP Information</h2>
        <p>
                <?php phpinfo(); ?>
        </p>
</body>
</html>

Installing Cacti on Solaris 10 (PART-1)

How to Capture Network Packets in Solaris

noreply@blogger.com (Anonymous) — Mon, 24 Sep 2012 10:57:00 +0000

How to Capture Network Packets in Solaris

# snoop -h

snoop: illegal option -- h

Usage: snoop

[ -a ] # Listen to packets on audio

[ -d device ] # Listen on interface named device

[ -s snaplen ] # Truncate packets

[ -c count ] # Quit after count packets

[ -P ] # Turn OFF promiscuous mode

[ -D ] # Report dropped packets

[ -S ] # Report packet size

[ -i file ] # Read previously captured packets

[ -o file ] # Capture packets in file

[ -n file ] # Load addr-to-name table from file

[ -N ] # Create addr-to-name table

[ -t r|a|d ] # Time: Relative, Absolute or Delta

[ -v ] # Verbose packet display

[ -V ] # Show all summary lines

[ -p first[,last] ] # Select packet(s) to display

[ -x offset[,length] ] # Hex dump from offset for length

[ -C ] # Print packet filter code

[ -q ] # Suppress printing packet count

[ -r ] # Do not resolve address to name

[ filter expression ]

Example:

snoop -o saved host fred

snoop -i saved -tr -v -p19

Show DHCP packets :

# snoop |grep -i dhcp

Using device igb0 (promiscuous mode)

50.17.0.1 -> NTU-HQ-GLOBAL DHCP/BOOTP DHCPDISCOVER

NTU-HQ-GLOBAL -> 50.17.0.1 DHCP/BOOTP DHCPOFFER

50.17.0.1 -> NTU-HQ-GLOBAL DHCP/BOOTP DHCPDISCOVER

Show UDP packets :

# snoop |grep -i udp

Using device igb0 (promiscuous mode)

172.16.0.1 -> 50.200.0.229 UDP D=1728 S=37628 LEN=32

172.16.0.1 -> 50.17.0.41 UDP D=1728 S=37628 LEN=32

172.16.0.1 -> 50.210.0.214 UDP D=1728 S=37628 LEN=32

Verbose packet display:

# snoop -v

ETHER: ----- Ether Header -----

ETHER:

ETHER: Packet 182 arrived at 15:37:15.74365

ETHER: Packet size = 66 bytes

ETHER: Destination = 0:0:5e:0:1:64, U.S. Department of Defense (IANA)

ETHER: Source = 0:21:28:d2:88:8c,

ETHER: Ethertype = 0800 (IP)

^CETHER:

IP: ----- IP Header -----

IP:

IP: Version = 4

IP: Header length = 20 bytes

IP: Type of service = 0x00

IP: xxx. .... = 0 (precedence)

IP: ...0 .... = normal delay

IP: .... 0... = normal throughput

IP: .... .0.. = normal reliability

IP: .... ..0. = not ECN capable transport

IP: .... ...0 = no ECN congestion experienced

IP: Total length = 52 bytes

IP: Identification = 36051

IP: Flags = 0x4

IP: .1.. .... = do not fragment

IP: ..0. .... = last fragment

IP: Fragment offset = 0 bytes

IP: Time to live = 255 seconds/hops

IP: Protocol = 17 (UDP)

IP: Header checksum = 0000

IP: Source address = 172.16.0.1, 172.16.0.1

IP: Destination address = 50.78.0.6, 50.78.0.6

IP: No options

IP:

UDP: ----- UDP Header -----

UDP:

UDP: Source port = 37628

UDP: Destination port = 1728

UDP: Length = 32

UDP: Checksum = DE96

UDP:

Display information on host 172.16.0.1 using summary verbose mode:

# snoop -V 172.16.0.1

To enable data captures from the snoop output without losing packets (while writing to the screen)by sending the snoop output to a file (snooper) :

# snoop -o/tmp/snooper -V 172.16.0.1

Show broadcast packets:

# snoop -d igb0 broadcast

Using device igb0 (promiscuous mode)

50.17.0.1 -> (broadcast) ARP C Who is 172.16.0.8, sys13 ?

How to traceroute in Solaris 10

noreply@blogger.com (Anonymous) — Mon, 24 Sep 2012 09:11:00 +0000

traceroute

It will print the route packets take to network host

# traceroute

Usage: traceroute [-adFIlnSvx] [-A address_family] [-c traffic_class]

[-f first_hop] [-g gateway [-g gateway ...]| -r] [-i iface]

[-L flow_label] [-m max_hop] [-P pause_sec] [-p port] [-Q max_timeout]

[-q nqueries] [-s src_addr] [-t tos] [-w wait_time] host [packetlen]

Some output symbol descriptions:

! the ttl (hop limit) value in the received packet is <= 1.
!H host unreachable.: # traceroute 5 8.8.8.8

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 40 byte packets

1 172.16.0.250 (172.16.0.250) 0.679 ms !H * 0.594 ms !H
!X communication administratively prohibited.
ICMP (ICMP6) unreachable code N.

!F The associated gateway is broken.
!N network unreachable.
!P protocol unreachable.
!S source route failed. It is likely that the gateway does not support source routing.
!T unreachable for the specified TOS (type-of-service).
!U source host isolated or precedence problem.
!A host unreachable for a reason other than lack of an entry in the routing table.
!B packet too big.
!E destination is not a neighbor.
!R unrecognized next header.


# traceroute 50.200.0.144
traceroute to 50.200.0.144 (50.200.0.144), 30 hops max, 40 byte packets
1 172.16.0.250 (172.16.0.250) 0.457 ms 0.285 ms 0.320 ms
2 50.200.0.144 (50.200.0.144) 1.593 ms 1.475 ms 1.549 ms

Install Webmin in solaris 10

noreply@blogger.com (Anonymous) — Wed, 12 Sep 2012 06:45:00 +0000

What is Webmin…?

Webmin is a web-based interface for system administration for Unix, and it will help administrators to handle so many applications that are running on Unix systems and the system (OS) very easily(eg: mysql, logs, DHCP servers, apache server, setup user accounts, DNS, file sharing and many more).

Default webmin is built in to Solaris 10 under /usr/sfw/webmin directory.

What you want to do is setup webmin and enables webmin service.

Enter a port for the web server. 10000 is the default port

# /usr/sfw/lib/webmin/setup.sh

# /usr/sfw/bin/webminsetup

root

Web server port (default 10000):

10000

Use SSL? [y,n,?,q] ?

To respond in the affirmative, enter y, yes, Y, or YES. To respond in

the negative, enter n, no, N, or NO.

Use SSL? [y,n,?,q] y

***********************************************************************

* Welcome to the Webmin setup script, version 1.170 *

***********************************************************************

Webmin is a web-based interface that allows Unix-like operating

systems and common Unix services to be easily administered.

Installing Webmin in /usr/sfw/lib/webmin ...

***********************************************************************

Webmin uses separate directories for configuration files and log files.

Unless you want to run multiple versions of Webmin at the same time

you can just accept the defaults.

Config file directory [/etc/webmin]: Found existing Webmin configuration in /etc/webmin

Creating start and stop scripts..

..done

Updating config files..

..done

Changing ownership and permissions ..

..done

Running postinstall scripts ..

..done

Attempting to start Webmin mini web server..

..done

***********************************************************************

Webmin has been installed and started successfully. Use your web

browser to go to

https://MEN-TM:10000/

and login with the name and password you entered previously.

Because Webmin uses SSL for encryption only, the certificate

it uses is not signed by one of the recognized CAs such as

Verisign. When you first connect to the Webmin server, your

browser will ask you if you want to accept the certificate

presented, as it does not recognize the CA. Say yes.S

Then enable the webmin service

# svcadm enablewebmin

First download relevant webmin package (webmin-1.590.pkg.gz) from http://www.webmin.com/download.html

If your server having internet access:

#wgethttp://prdownloads.sourceforge.net/webadmin/webmin-1.590.pkg.gz

#su

Untar the webmin package

gunzip webmin-1.590.pkg.gz

pkgadd -dwebmin-1.590.pkg WSwebmin

go to

#cd /usr/sfw/lib/webmin

Run the setup script

#./setup.sh

Enter a port for the web server. 10000 is the default port.

The installation will be made to /opt/webmin , you should now be able to login to Webmin at the

URL http://localhost:10000/With the administration username root and your current root password.

Sample DHCP server configure in Webmin:

Continuous ping in solaris 10

noreply@blogger.com (Anonymous) — Thu, 06 Sep 2012 12:30:00 +0000

usage: ping host [timeout]
usage: ping -s [-l | U] [adLnRrv] [-A addr_family] [-c traffic_class]
[-g gateway [-g gateway ...]] [-F flow_label] [-I interval]
[-i interface] [-P tos] [-p port] [-t ttl] host [data_size] [npackets]

-s : Send one datagram per second and collect statistics.

Put a Continuous ping:

# ping -s 50.17.0.1
PING 50.17.0.1 (50.17.0.1): 56 data bytes
64 bytes from 50.17.0.1: icmp_seq=0. time=1.22 ms
64 bytes from 50.17.0.1: icmp_seq=1. time=26.5 ms
64 bytes from 50.17.0.1: icmp_seq=2. time=8.13 ms
64 bytes from 50.17.0.1: icmp_seq=3. time=64.1 ms
64 bytes from 50.17.0.1: icmp_seq=4. time=30.7 ms
64 bytes from 50.17.0.1: icmp_seq=5. time=33.9 ms
64 bytes from 50.17.0.1: icmp_seq=6. time=1.03 ms
64 bytes from 50.17.0.1: icmp_seq=7. time=1.14 ms

64 bytes from 50.17.0.1: icmp_seq=26. time=1.27 ms

64 bytes from 50.17.0.1: icmp_seq=27. time=0.994 ms

----50.17.0.1 PING Statistics----

28 packets transmitted, 28 packets received, 0% packet loss

round-trip (ms) min/avg/max/stddev = 0.989/19.27/64.1/18.9

Put a Continuous ping with specific data size :

# ping -s 50.17.0.1 200

PING 50.17.0.1: 200 data bytes

208 bytes from 50.17.0.1: icmp_seq=0. time=1.35 ms

208 bytes from 50.17.0.1: icmp_seq=1. time=27.1 ms

208 bytes from 50.17.0.1: icmp_seq=2. time=22.1 ms

----50.17.0.1 PING Statistics----

3 packets transmitted, 3 packets received, 0% packet loss

round-trip (ms) min/avg/max/stddev = 1.35/16.9/27.1/14.

Mount unmount portable usb DVD/HDD drive in Solaris 10(Sparc server)

noreply@blogger.com (Anonymous) — Wed, 05 Sep 2012 06:22:00 +0000

Assuming system disabled the automount option.

How to check auto Mount is disable or not:

Check whether volfs is running or not..

# svcs -a|grep volfs

disabled Jun_06 svc:/system/filesystem/volfs:default

if it is disabled, enable it for enable auto-mounting option.

# svcadm enable volfs

If the usb flash is recognize by the system it will be mount and you can see the
status with

# rmformat

rmformat:The rmformat utility is used to format, label, partition,and perform other miscellaneous functions on removable, rewritable media that include floppy drives, and the PCMCIA memory and ata cards.

mount, umount: - mount or unmount file systems and remote resources

eg: mount [-F FSType] [generic_options] [-o specific_options] [-O] special

mount_point

bash-3.2# mount -F hsfs -o ro /dev/dsk/c0t0d0s0 /cdrom/unnamed_cdrom

bash-3.2#umount /dev/dsk/c0t0d0s0

[-F FSType]

Used to specify the FSType on which to operate. The FSType must be specified or

must be determinable from /etc/vfstab, or by consulting /etc/default/fs or

/etc/dfs/fstypes.

ro | rw Specify read-only or read-write. The default is rw.

/dev/dsk/c0t0d0s0 : :mount device

/cdrom/unnamed_cdrom :mount location

To find under what names file systems are mounted: use the
bash-3.2#df -k

The df utility displays the amount of disk space occupied by mounted or unmounted file systems, the amount of used and available space, and how much of the file system's total capacity has been used.

-k
Prints the allocation in kbytes. The output consists of one line of information for each specified file system.This information includes the file system name, the total space allocated in the file system, the amount of space allocated to existing files, the total amount of space available for the creation of new files by unprivileged users, and the percentage of normally.

VI Editor Quick Reference

noreply@blogger.com (Anonymous) — Tue, 28 Aug 2012 04:48:00 +0000

Mostly use commands:Create new file name perlFile.pl or open existing file named perlFile.pl.

#vi perlFile.pl

press letter "i" in the keybord for write to the file

Write what eve you want...

If you want to delete a character under cursor: move pointer on top to the letter, press <Esc> and press letter "x".

To delete character before cursor: move pointer before the letter , press <Esc> and press letter "X".

To delete a line: move the pointer to anywhere in the line , press <Esc> and press the letter "dd".
Delete everything in the file: Press <Ese> ":1,$d" and press <Enter>

Save the file : Press <Ese> "wq!" and press <Enter>
Quite without saving :Press <Ese> "q!" and press <Enter>