Solaris 10: tips and tricks for system administration - Solaris

Solaris 10 5/08 released!

nospam@example.com (Gleb Reys) — Fri, 18 Apr 2008 21:48:29 +0400

As you probably know already, a few days ago the Solaris 10 5/08 update was released.

I've already downloaded the x86 version of it, and will attempt to install this Solaris 10 release on my home VMware Server 2 beta 2 setup.

Personally, I'm interested in seeing these in these new features action:
- CPU caps
- iSNS (iSCSI)
- Locale creator

Here are a few links you might find useful:
- What's new in Solaris 10 5/08
- Solaris 10u5 download page

Nexenta Core Platform 1.0 is here!

nospam@example.com (Gleb Reys) — Tue, 12 Feb 2008 13:29:25 +0300

Just realized that the Nexenta Core Platform 1.0 release has arrived!

Here's a short list of changes and new features:

I've already downloaded the ISO-image, so will be installing it in a virtual machine later today.

- OpenSolaris b82 based (x86, 32bit and 64bit, non-debug)
- Ubuntu/Dapper based
- Project integration: NWS, AVS, COMSTAR, in-kernel CIFS client
- apt-clone: ZFS-integrated safe upgrade via remote APT repository
- Support for in-place (live) and safe upgrades
- Installer: multiple improvements; installs from USB
- Small memory requirement: 256MB
- Nexenta Zones: multiple improvements; integrated automatic Zone upgrades
- CIFS client included in the default installation
- Xen DomU and Xen Dom0 (32bit, [2])
- GRUB-integrated memory test
- Nexenta ISO Builder ([3])
- APT repository - status complete. Stable repository (elate-stable) ready for use

Solaris 10 receives the InfoWorld Technology of the Year Award for 2008

nospam@example.com (Gleb Reys) — Wed, 09 Jan 2008 15:33:56 +0300

I'm really proud for my most favorite operating system: Solaris 10 received the InfoWorld Technology of the Year award for 2008!

Solaris 8 Migration Assistant (Project Etude)

nospam@example.com (Gleb Reys) — Wed, 21 Nov 2007 14:22:56 +0300

I've finally completed my first successful experiment with Solaris 8 Migration Assistant (S8MA) today - a new product from Sun which allows you to run Solaris 8 branded zones. It's a fully and officially supported solution (for an extra price), but you can download the free 90-day trial to play with it and understand how really cool it is.

First of all, just a few words about the niche for this product. Many companies are rather conservative about their Solaris upgrades. Most systems are still running Solaris 8, if not something older. Quite often this is also dictated by third-party software dependencies - products which were bought and configured for Solaris 8, which are now so tightly integrated that there isn't an easy way to migrated them into Solaris 10. Such systems are doomed for slow but very expensive death. Expensive, because with every year the hardware support for servers capable of running Solaris 8 raises again and again.

That's where the Solaris 8 zones come in. It's very easy, really: you create a flar-copy fo your existing physical server under Solaris 8, then create a Solaris 8 zone, import your flar-archive and get a virtual copy of your Solaris 8 environment, with all your processes, programs and startup scripts.

To make things easier, it's even possible to configure your hostid in Solaris 8 zone to match the one of the physical Solaris 8 system, this way no programs running in the zone will even guess that they've been virtualized.

Who knows, maybe I'll tell you more about this technology some other day, but for now - just the simplest list of actions and commands for your S8MA proof of concept:

1. Find and prepare a sparc box with Solaris 10u4. It is important to have the latest Solaris 10 update. Preparations are usually limited to applying a kernel patch, 127111-01 in my case.

2. Download the Solaris 8 Migration Assitant (current version is 1.0) from this location: Solaris 8 Migration Assistant. The 3 packages in archive are dead easy to install using standard pkgadd.

Here are the packages you'll get:

SUNWs8brandr Solaris 8 Migration Assistant: solaris8 brand support (Root)
SUNWs8brandu Solaris 8 Migration Assistant: solaris8 brand support (Usr)
SUNWs8p2v Solaris 8 p2v Tool

3. Make a flar-archive of your Solaris 8 system

Log onto your Solaris 8 box, and run the command. In this and all the following examples, solaris8 is nothing but an arbitrary name I've chosen for my zone. You might as well call it anything you like.

bash-3.00# flarcreate -S -n solaris8 solaris8.flar

4. Create the basic Solaris 8 zone.

Here's how you do it:

bash-3.00# zonecfg -z solaris8
solaris8: No such zone configured
Use 'create' to begin configuring a new zone.
zonecfg:solaris8-system> create -t SUNWsolaris8
zonecfg:solaris8> set zonepath=/export/solaris8
zonecfg:solaris8> add net
zonecfg:solaris8:net> set address=172.21.7.155/24
zonecfg:solaris8:net> set physical=ce0
zonecfg:solaris8:net> end
zonecfg:solaris8> commit
zonecfg:solaris8> exit

Naturally, your IP and network device name will be different. As of now, our zone is fully configured, but not yet installed.

5. Install the Solaris 8 zone using our flar-archive

bash-3.00# zoneadm -z solaris8 install -u -a /export/solaris8.flar
Log File: /var/tmp/solaris8.install.13597.log
Source: /export/solaris8.flar
Installing: This may take several minutes...
Postprocessing: This may take several minutes...
WARNING: zone did not finish booting.

Result: Installation completed successfully.
Log File: /export/solaris8/root/var/log/solaris8.install.13597.log

In my case the Solaris 8 zone got stuck on sys-unconfig, and so I had to connect to the virtual console of the zone to help it move on:

Here's how you connect to a zone's console:
bash-3.00# zlogin -C solaris8

That's it! The rest was easy - just a few minutes of configuring the network parameters and DNS/NIS settings. Finally, I was able to ssh into the new zone and run uname:

solaris8 #uname -a
SunOS solaris8 5.8 Generic_Virtual sun4u sparc SUNW,Sun-Fire-V490

I liked Solaris 8 Migration Assistant very much. It's an incredibly quick and easy way to have a whole bunch of Solaris 8 systems virtualized and running under on one of the most advanced servers with the most advanced OS - Solaris 10u4.

Announcing a new website: DTrace Scripts

nospam@example.com (Gleb Reys) — Fri, 09 Nov 2007 14:53:56 +0300

Thanks to CurThread.org, I've recently learned about the new online project which just got started: DTrace Scripts. It seems to be a promising project with a constantly expanding collection of DTrace scripts and tips, and it's great to see yet another project aimed at making DTrace more accessible and better known in Unix communities.

Местные новости: ZFS Performance Talk

nospam@example.com (Gleb Reys) — Tue, 03 Apr 2007 12:42:03 +0400

Tim Foster had sent an email to IOSUG mailing list yesterday, that tomorrow, at 7pm, Roch Bourbonnais will present a tech talk on ZFS Performance.

Here's the announcement:

So, amazingly short notice here, but we're going to hold a talk on ZFS Performance this Wednesday.

Roch Bourbonnais, an expert on kernel performance is visiting Dublin on Wednesday and we thought we'd take the opportunity to hear more about ZFS internals & performance from him.

Roch has been examining ZFS in great detail during it's development with a view to it's characteristics on real-world workloads. If you're interested in ZFS, or have heard about it but want to know more, you really should come along on Wednesday.

More information on Roch's background and experiences with ZFS so far at http://blogs.sun.com/roch/

Again, our apologies for the short notice.

All the details are on the official IOSUG8 invitation page.

IOSUG #7 Announcement

nospam@example.com (Gleb Reys) — Thu, 08 Mar 2007 20:05:03 +0300

Yesterday I received an email from Tim Foster, announcing the upcoming IOSUG #7 meeting:

Topic An Introduction to OpenSolaris
Date Tuesday 27th Mar 2007
Time 6:30pm onwards
Location Swift Theatre, Arts Block – TCD, courtesy of Netsoc
http://www.tcd.ie/Maps/tcd_west.html

A linkable version of this announcement:
http://www.opensolaris.org/os/community/os_user_groups/ie-osug/iosug-7/

This month, we're going to hold a presentation on a topic that's
probably a bit overdue for us, but better late than never:

An Introduction to OpenSolaris.

Tim's going to present:

- Why OpenSolaris was started
- How the project is organised
- A short history of the project to date

Fintan Ryan will be presenting:

- Building & installing your own OpenSolaris bits
- How you can start contributing

So, if you're interested in learning more about OpenSolaris, as well as
how to get started hacking on the code, you should definitely come
along.

We also have a have a slot for our monthly run-down of OpenSolaris
highlights since our last meeting in February, however, we don't yet
have someone to present this.

It doesn't take long to put together these highlights, and it should
only take about 5 minutes to present to the group – if you're interested
in doing this, please let us know, volunteers are always welcome!

Feel free to forward this announcement. As always, if you've ideas for
future talks, or feel like presenting something yourself, we're open to
all suggestions, just send us email.

ZFS administration guide: now in Russian

nospam@example.com (Gleb Reys) — Wed, 07 Mar 2007 01:43:04 +0300

At last, I see some real progress with available translations of excellent Solaris docs!

For instance, ZFS administration guide in Russian was posted on the OpenSolaris/G11 (Globalization) Consolidation page just a few days ago.

It really is great to see great translations like this completed. Well done, guys!

IOSUG #6: February OpenSolaris News

nospam@example.com (Gleb Reys) — Thu, 22 Feb 2007 14:33:25 +0300

Last Tuesday, the 6th meeting of Irish Open Solaris User Group was held, and it's a real shame I couldn't come. Obviously, I don't regret this just because of the free beers and pizza (but this was a GREAT idea, Tim!), it's just that I always like the great presentations you get to see at such meetings.

So far, there are only slides with OpenSolaris news for February'07, made by Tim Foster himself. Tim has done it again: he improved his presentations! Now every piece of news has a link for you to follow and read more on the subject. Thanks a lot, Tim!

John Rice presented a talk on Java-GNOME bindings, but there are no slides for this yet. As soon as they are ready - wait for a message on Tim's blog or on the official IOSUG page.

Large vulnerability in.telnetd in Solaris 10

nospam@example.com (Gleb Reys) — Wed, 14 Feb 2007 02:05:04 +0300

Last weekend, a telnet vulnerability in Solaris 10 was found. Within hours, the fix was integrated into OpenSolaris, and on Monday we saw the first patches available and a Sun document on how to fix it.

Attention: this vulnerability is indeed very serious. It allows remote systems gain root access to Solaris 10 box under certain circumstances.

The keywords in this sentence are "vulnerability - very serious" and "under certain circumstances". While I've seen many posts and articles focusing readers' attention on the seriousness of this vulnerability, I would like to draw your attention to few facts describing the "under certain circumstances" bit of this warning:

1) This vulnerability affects certain releases of Solaris 10 (s10u1 and s10u2) and OpenSolaris/Nevada only. Solaris 9 and older Solaris releases are not affected. Solaris 10 Update 3 is not affected (it has only SSH enabled by default, so telnet service is disabled in default installation)
2) This vulnerability will not allow remote root logins using telnet in your typical out-of-box Solaris installation. What I'm saying is that this exploit will not help hackers gain root access to your system, even if you have telnet enabled on your Solaris 10 box, unless you have implicitly commented out the

CONSOLE=/dev/console

line in your /etc/default/login file.
UPDATE: unfortunately, this does not mean hackers can't use other accounts to access your system without password. Using this vulnerability, the will be able to successfully log into your system as bin, adm, sys or lp. Surely, they're not as dangerous as remote root logins, but still harmful enough.

Possible ways for you to fix this problem:
1. Disable telnet to root for non CONSOLE logins (if that was for some reason enabled by commenting the line out)
2. Disable telnet service

svcadm disable svc:/network/telnet:default

3. Apply relevant patch:
T-Patch (ISR) is found here: http://sunsolve.sun.com/tpatches
alternatively, just patch the in.telnetd:
Patch for SPARC: 120068-02.
Patch for x86: 120069-02.

Interesting info on how this vulnerability was fixed by Sun:

Alan Hargreaves gives a full history of events in his the in.telnetd vulnerability exploit post.

Dan McDonald explains how he had learned about the vulnerability and how the fix was written and put back into the OpenSolaris source tree: How OpenSolaris Did Its Job

Interesting Solaris blogs

nospam@example.com (Gleb Reys) — Wed, 17 Jan 2007 12:34:19 +0300

I wonder if someone would be kind enough to share his most interesting Solaris blogs?

Here is a partial list of what I regularly read, maybe you'll like some of it:

In Russian:

Ruslan Valiev - Designerus

In English:

Ilya Voronin - CurThread.org

Robert Milkowski - Milek's Blog

James Dickens - Unix Admin Corner

Bill Rushmore - Developer's Quarterdeck Log

Ben Rockwood - Cuddletech: use UNIX or die

Derek Crudgington - A look into Solaris

Well, that seems to be all I read. Surely, there are hundreds more on blogs.sun.com and OpenSolaris.org blogs, so I enjoy opening main pages of these resources now and then just to selectively read the most interesting posts (I also find weekly lists of posts on OpenSolaris to be particularly useful).

Если вы знаете какие-то ещё интересные блоги - пожалуйста прошу оставлять ссылки в комментариях. Буду рад расширить свой список!

Sun ships Solaris 10 and Sun Studio 11 DVD for free

nospam@example.com (Gleb Reys) — Tue, 16 Jan 2007 12:39:00 +0300

Once again, Sun is giving Solaris 10 away. This time around, you can order a DVD edition of Solaris 10 and Sun Studio 11, and what's really cool is that both x86 and Sparc editions of Solaris 10 OS are included.

All you have to do is simply fill in the fre Solaris 10 and Sun Studio 11 Media Kit DVD form. I've already done this and expect the DVD to be delivered in 10 business days or so.

OSalt: Open Source as alternative

nospam@example.com (Gleb Reys) — Wed, 03 Jan 2007 17:25:50 +0300

At last, the year of 2007 is here! I would like to wish you a very successful year, and to welcome you once again.

Recently I have mentioned a wonderful website called The Linux Equivalent Project.

Turns out, it's not as unique as I thought! I've just stumbled across another one, which covers a bigger market share - open source software - and also has a deeper structure of its sections: OSalt. Too bad they've got so much advertisement on every page ;)

Alas, some of the open source alternatives are fairly remote compared to the original software they're attributed to (for instance, VirtualDub is said to be an alternative to Adobe Premiere). One more rather upsetting thing is that the accent of this project is on open source solutions, which are not necessarily available for Unix platform.

This project obviously needs more work - for instance, the only Adobe Camera RAW alternative there is ufRAW, while I'm sure there are many more. I personally like Raw Therapee, but it's a binary distribution at the moment, so that probably explains why it's not listed in the current version of the OSalt.

In any case, I think it's a rather interesting website well worth a few minutes of your time: OSalt.

Sun Cluster 3.2 is available for download

nospam@example.com (Gleb Reys) — Wed, 20 Dec 2006 13:40:02 +0300

I've just read at Ilya Voronin's blog (blog.curthread.org), that for all the Sun Cluster fans, today is definitely a lucky day, because the new version of Sun Cluster - 3.2 - is already available for download.

By the way, looks like from this version on the clustering solution from Sun is called Solaris Cluster, and includes the following components:
- Sun Cluster
- Sun Cluster Geographic Edition
- Sun Cluster Agents

To my shame and regret, I haven't got a chance to acquire any useful experience with Sun Cluster. In my company I'm working with Veritas Cluster Server, because it's a historical thing. But I have some theoretical knowledge of Sun Cluster, and would really like to give it a try some day.

Anyway. Here are just some of the Sun Cluster 3.2 features:

New command line interface
In new Sun Cluster version, you have separate commands for each type of cluster object, and all of them try to have similar names for command line options where possible. Alsom, both short and long names for each option are supported.

SMF support
Sun Cluster is now tightly integrated with SMF, and easily supports controlling SMF-managed services as Sun Cluster resources.

Sun Cluster Quorum Server
For any scenarios requiring quorum, you no longer have to use shared storage. Sun Cluster supports using a separate Solaris server running quorum-server module. All the atomic reservations will be done over TCP/IP.

Such an approach allows you to reduce the time needed for failing over from one cluster node to another.

Extended Solaris Zones support
Sun Cluster supports now a plethora of services running within non-global zones.

ZFS support
Starting from this Sun Cluster version, ZFS is fully supported as a local highly available filesystem (HA FS).

Multi-Terabyte Disk and EFI (Extensible Firmware Interface) labels
A quite traditional update for many other packages - full support of disks with capacity over 1Tb and new EFI disk labels.

Better support of Veritas products
In particular, components of Veritas Veritas Storage Foundation 5.0 for SPARC are supported, as well as VxVM 4.1 for x86/x64 (in case you didn't know, Veritas products of these versions are already Solaris 10 aware).

Live Upgrade
Now you can use Live Upgrade to update your OS with Sun Cluster on top ot if. From documentation I can see that Live Upgrade supports SVM only at the moment, not VxVM.

Command Logging
You can have all the cluster management commands logged now - this is good for both diagnostics and for reproduction of your cluster environment in a new configuration.

You can download Sun Cluster 3.2 here: Sun Cluster 3.2 download.

Also, you might like reading a Sun Cluster blog - Sun Cluster Oasis. And, as always. for more information you can consult the Sun Cluster section of docs.sun.com: Sun Cluster 3.2 Documentation.

Free equivalents to Windows software

nospam@example.com (Gleb Reys) — Tue, 19 Dec 2006 03:01:03 +0300

I've just learned through Lifehacker about a great page: The Linux Equivalent Project. Actually, it's a pretty impressive index of free open-source software, which will work on Solaris, Linux, or any other UNIX OS.

What I really like about this list is that you're given names of software products Windows, and they a few of open-source equivalents. Very useful, especially for all the beginners who are just switching to Solaris.

If you miss some particular software in Solaris world, please have a look: LinuxEq.com