Showing posts with label solaris. Show all posts
Showing posts with label solaris. Show all posts

13 September 2011

What did you do on 9/11?

I was teaching a Solaris security course that day, with some NATO people in the class.
I remember meeting my colleague Guido in the corridor saying "World War III just started".
I told the class the news and went on with the course.
Next morning, Raoul, manager of Sun Education Belgium, had a minute of silence for everybody.
One of the British officers told another NATO attendee he should not be wearing a US Army T-shirt, because he was exposing himself as a target.

0 comments
Labels: , , , ,

27 November 2010

IPFilter Components / Solaris 10

 For  Solaris 10 8/7 (u4) and higher:

  • Commands
    • svcadm: enable/disable ipfilter
    • ipf: manage rulebase
      • -Fa: flush (remove) all rules
      • -f file: load rules from file
    • ipnat: manage Network Access Translation rules
      • -F: flush (remove) all rules
      • -f file: load rules from file
    • ipfstat: show statistics
      • -io: show active rulebase
  • Daemons
    • ipmon: monitor logging device
      • -D: daemon mode
      • -s: log to syslog local0 facility
  • Files
    • /dev/ipl: device from which you can read log entries
  • Kernel module
    • ipf
  • Links

0 comments
Labels: , , ,

20 November 2010

Solaris Bookmarks (updated)

 Oracle

 Information

Software

0 comments
Labels: , , ,

Solaris 11 express released

Oracle has made the first release of Solaris 11 Express available for download. The final release will be somewhere next year. It is the first major Solaris release under the governance of Oracle. You can download the OS for free (and for testing). Take care: the default download is a text based installer, scroll down to get a GUI based installer.

New feature digest:

  • Image Packaging System (IPS)
    • A new software package system
    • Repositories (depot servers) providing packages over the network
      • mirrors
      • can assist in network install (Automated Installer)
    • Automatic updates
    • legacy solaris packages (pkg) supported
  • Distribution constructor builds an OS image from a manifest (descriptor file). Images can be
    • directly installed on client
    • ISO image
    • VM image
  • Boot environments: streamlined Live Upgrade using ZFS snapshots
  • ZFS
    • ZFS boot/root environment
    • deduplication: detect duplicate data and store single copy
    • encrypted datasets
  • security
    • root is a role now
    • labeling extensions
      • apply labels to IPSec
      • apply labels to ZFS datasets
      • require an extra password to access a labeled resource
  • bash is the default user shell, ksh the default system shell
  • optional graphical boot screen
  • CUPS printing service is the default printing service
    • printer discovery
  • Open Sound System API support (Boomer)
  • Linux removable media management replaces the volume manager (vold)
  • Command assistant: full text search tool to get information on Solaris commands
  • git is bundled (distributed version control system for development)
  • Networking enhancements

0 comments
Labels: , ,

Solaris 11 networking enhancements

As of Solaris 11 Express 2010.11 these enhancements are included:

  • Network automagic (NWAM): dynamically configure fixed or wireless network depending on discovery and profiles
    Network automagic
  • sockets no longer use STREAMS
  • Solaris can work as a (L2) bridge (IETF TRILL)
  • unified handling of different types of network interfaces (project Clearview)
    • dladm extended (project Brussels)
    • virtual interfaces, IP tunnels and IPMP can now be accessed as generic IP interfaces. They can now be sniffed (e.g. lo0, traffic between zones...) , asssigned as an exlusive stack to a zone...
  • use virtual network interfaces (VNIC), virtual switches (etherstubs) and virtual routers, bridges and servers (zones) to siumulate an entire network on a single system (project Crossbow)
    • zones can exclusivly own an IP stack without a dedicated physical interface (NIC)
  • Link protection: limit ability of NIC to send spoofed packets
  • VRRP  (Virtual Router Redundancy protocol)
Earlier Solaris 10 networking enhancements.

2 comments
Labels: , , ,

3 November 2010

Solaris 10 networking enhancements by release overview (updated)

Overview of most important changes for networking in solaris 10 releases.
3/5 (base)

  • specify source IP by (virtual) interface. Example:
    # ifconfig eri0 usesrc vni0
    The virtual IP vni interface is not associated with any physical hardware and is thus immune to hardware failures. If vni0 has address 10.0.0.1 assigned to it, the system will prefer 10.0.0.1 as the source address for any packets originated by local connections that are sent through eri0.
  • RIPv2, BGP, and OSPF through GNU Zebra (adapted for Solaris)
  • /usr/lib/mail -> /etc/mail/cf
  • routeadm command
  • rdisc wrapped into in.routed
  • use ifconfig to configure ipforwarding for individual interfaces
  • IP quality of service (IPQoS)
  • WAN boot installation
  • SSH 3.5p1 (adapted for Solaris)
  • Stream Control Transmission Protocol (SCTP)
1/6 (u1)

  • SMTP over TLS
  • source address filtering on multicast traffic
  • dladm command for data link (layer 2) configuration, link aggregation (ethernet trunk)
  • IGMPv3 and MLDv2 (IPv6) routing support
6/6 (u2)
  • IPFilter for IPv6
11/6 (u3)
  • Mandatory Access Control (from Trusted Solaris) for networking and other functions
  • Set secure by default network profile during installation
8/7 (u4)
  • SMF based routing services (svcadm in addition to routeadm)
  • merge /etc/inet/ipnodes (for IPv6) into /etc/inet/hosts
  • GNU Quagga routing suite replaces GNU Zebra
  • Key Management Framework for PKI
  • encryption kit included + MD4, MD5, SHA1, and SHA2
  • exclusive access to physical network interfaces by non-global zones
  • DHCPv6 client
  • IPFilter firewall enhancements
    • pfil driver/daemon removed (replaced by packet filter hooks)
    • IPv6 support
    • loopback interface support
5/9 (u7)
  • SHA2 512bit, Diffie-Hellman 4096 bit
10/9 (u8)
  • NTP 4.1.2
9/10 (u9)
  • The client queue runner is now a separate daemon (svc:/network/smtp:sendmail-client). It used to be part of sendmail  (svc:/network/smtp:sendmail).
  • The net_access privilege has been added to the basic privilege set. Denying this privilege, cuts network access.

0 comments
Labels: , , ,

26 April 2010

ZFS Commands


0 comments
Labels: , ,

20 April 2010

Oracle free software reality check

Policy shifts, almost 3 months after Oracle acquired Sun:

  • Oracle has blocked access to Solaris security patches for people without a support contract.
  • Oracle has stopped shipping free OpenSolaris CD’s.
  • Oracle is discontinuing the open and free Sun Identity Manager.
  • Oracle has made the MS Office ODF 1.2 plugin paying (with a minimum of $9000 for 100 users).

0 comments
Labels: , , , , , , ,

15 April 2010

Solaris disk layout


On a SPARC system

  • VTOC is in cylinder 0, sector 0 and can contain 8 slices

    • slice 2 by convention represents the entire disk
  • the primary boot block is in cylinder 0, sectors 1-15
  • A file system can start on cylinder 0, sector 16
On x86 the situation is a bit more complicated:

If Solaris is installed on cylinder 1 (typical) disk cylinder 1 = Solaris (relative) cylinder 0.
Solaris x86 VTOC supports 16 slices:
  • 0-7: like SPARC slices
  • 8: boot slice (relative cylinder 0)
  • 9: on IDE/SATA disks default alternate slice (relative cylinder 1 and 2)
  • 10-15: unused

0 comments
Labels: , , ,

Register a Solaris system for patch updates

You can bring a Solaris automatically up to date with the latest recommended or security (if you do not have a support contract) patches.

You can do this using

  • a graphical tool: /usr/bin/updatemanager
  • a command line tool: /usr/sbin/smpatch

updatemanager will guide you through a series of screens to register yourself and your system. Even if you use the graphical tool to register, you can use the command line interface later on to keep your system up to date.

Here’s the procedure to register without using the graphical updatemanager tool.

  1. Register for a Sun Online account on the web. This is a common account for accessing SunSolve, Sun developer connection…
  2. Prepare a registration file and fill in your user name, password, system and optionally other information like contract number and proxy. You can use /usr/lib/breg/data/RegistrationProfile.properties  as a template.
  3. Register your system

 # sconadm –a –r <yourRegistrationFile>

Here’s a Sunsolve howto on this topic.

0 comments
Labels: , , , ,

14 October 2009

Solaris zones components

Commands
  • zoneadm: manage a zone
  • zonecfg: configure a zone
  • zlogin: login to a zone

    • -C: console
  • ps –z <zone>: list only <zone> processes from global zone
Zone state transitions and associated commandsimage 
  • Alternate commands can exist
  • A Solaris OS in a zone is only initialised (sysidtool) upon first console login.
  • The shutdown commands are executed from within the zone.
Daemons
  • zoneadmd: zone manager
  • zsched:  scheduler in the zone
Files
  • /etc/zones/index: index configured zones (and their state)
  • /etc/zones/<zone>.xml: per zone configuration file (from zonecfg)
Links
FAQ
BrandZ FAQ
Zones limitations\
Sun Management Center GUI

0 comments
Labels: , , ,

13 October 2009

Add an external USB disk to solaris (x86)

These are the steps I took to add an external USB disk to my x86 Solaris station, partition it and put ufs filesystems on it.

  • Tell the removable volume manager to leave USB disks alone

    • edit /etc/vold.conf

      # commented the following line
      # use rmdisk drive /dev/rdsk/c*s2 dev_rmdisk.so rmdisk%d

    • Activate the configuration change

      # svcadm refresh volfs


  • attach the USB drive
  • lookup the USB device name

    # rmformat
    Looking for devices...
         1. Volmgt Node: /vol/dev/aliases/cdrom0
            Logical Node: /dev/rdsk/c0t0d0s2
            Physical Node: /pci@0,0/pci-ide@6/ide@0/sd@0,0
            Connected Device: LITE-ON  DVD SOHD-16P9S   F3S2
            Device Type: DVD Reader
         2. Logical Node: /dev/rdsk/c2t0d0p0
            Physical Node: /pci@0,0/pci108e,5347@2,1/storage@4/disk@0,0
            Connected Device: ST316021 2A               0000
            Device Type: Removable

  • Solaris x86: create a Solaris fdisk partition on the device

    # fdisk -B /dev/rdsk/c2t0d0p0

  • Partition the drive. The format expert option is needed for the drive to show up:

    # format -e
    Searching for disks...done

    AVAILABLE DISK SELECTIONS:
           0. c1t0d0 <DEFAULT cyl 9726 alt 2 hd 255 sec 63>
              /pci@0,0/pci108e,5347@7/disk@0,0
          1 . c2t0d0 <DEFAULT cyl 19454 alt 2 hd 255 sec 63>
              /pci@0,0/pci108e,5347@2,1/storage@4/disk@0,0
    Specify disk (enter its number): 1
    ...

  • Now partition the drive.

    • Solaris x86: keep clear of cylinder0. It is in slice 8 and reserved for the VTOC and booting (grub).

  • create a file system on your partition(s) (I ignored the warning)

    # newfs /dev/rdsk/c2t0d0s0
    Warning: setting rpm to 60
    newfs: construct a new file system /dev/rdsk/c2t0d0s0: (y/n)? y
    ...

  • Add the file system to /etc/vfstab

    ...
    /dev/dsk/c2t0d0s0       /dev/rdsk/c2t0d0s0      / stuff      ufs     1       yes

  • mount the file system
# mount /stuff

0 comments
Labels: , , ,

12 October 2009

Command line SunSolve registration

Before you can use smpatch you need to register your system with SunSolve.
After installing you are prompted for installation when you log in to the desktop.
If you did not do this, you can register from the Applications>Utilities>Update Manager GUI program.
Both utilities also allow you to create a sunsolve user account if you did not have one yet.
If you only want to register your system from the commandline, here's the procedure

# cp /usr/lib/breg/data/RegistrationProfile.properties /tmp
# vi /tmp/RegistrationProfile.properties
userName=jan
password=xxx
# sconadm register -a -r /tmp/RegistrationProfile.properties
# rm /tmp/RegistrationProfile.properties

0 comments
Labels: , , ,

11 October 2009

Solaris Role Based Access Control (RBAC) components

 

Files, relations and informative commands

image

  • An execution profile record belongs to the rights profile that is in its first (name) field.
  • Default rights profiles and authorisations are in /etc/security/policy.conf

Configuration commands

  • usermod/rolemod
  • useradd/roleadd
  • userdel/roledel
    • -R roles (only for usermod/useradd)
    • -P rights profiles
    • -A authorisations

0 comments
Labels: , ,

9 October 2009

Service Management Facility (SMF) components

In SMF, service instances are identified by a Fault Management Resource Indicator. The structure of an FMRI is <prefix>:/<class>/<service>:<instance>Example: svc:/system/cron:default
Prefixes:

  • svc: SMF managed services
  • lrc: legacy run command, pre Solaris 10 style services
  • file: for expressing dependencies on files

Commands

  • svcs: services information.
    • svcs [FMRI|pattern]: list services, pattern can be a part of an FMRI and can include wildcards (example: “*nfs*”)
      • -a: all - include disabled services
      • -d: dependencies - show services this service depends upon
      • -D: dependents - show services that depend on this service
      • -xv: which services are in maintenance mode (not running) and why (v = verbose)
      • -p: list associated processes
  • svcprop <FMRI>: list service properties
    • -p <[group/]property> : list only these properties

      # svcprop –p start/exec cron
      /lib/svc/method/svc-cron

  • svcadm: Service administration (management)
    • svcadm enable <FMRI>: start (and monitor)
      • -t: temporary - the service will not be restarted after reboot
    • svcadm disable <FMRI>: stop
      • -t: temporary - the service will still be restarted on reboot
    • svcadm restart: stop, then start
    • svcadm refresh: reread configuration (after svccfg)
    • svcadm clear: clear maintenance mode, ask the service monitor to start a service after an error condition is resolved
    • svcadm milestone FMRI: go to milestone (does not change run level)
      • -d: set milestone as default target for system boots (initial default: all)
  • svccfg: service configuration
    • svccfg import <file>: import an xml service manifest in the binary service repository
    • svccfg export <FMRI>: write an xml service manifest to standard output
    • svccfg delete <FMRI>: remove a service definition from the binary service reporitory
    • svccfg extract > site.xml: extract current services state (enabled/disabled…) to a file
    • svccfg apply <file>: apply state (enabled/disabled…) of services in file
    • svccfg –s <FMRI> setprop <some/property> = value: set property
    • svccfg: interactive mode
      # svccfg
      svc:> list
      system/console-login
      system/device/local
      …
      svc:> select cron
      svc:/system/cron> listprop *
      usr dependency start/user astring root
      …
      svc:/system/cron> setprop start/user = astring: sys
      svc:/system/cron> quit
  • /usr/svc/bin/restore_repository: restore (corrupt) binary repository from automatic backup

Daemons

  • /lib/svc/bin/svc.configd: performs the actions scheduled by configuration commands like svccfg
  • /lib/svc/bin/svc.startd: monitors and restarts services

Files

  • /var/svc/manifest/<class>/<service>.xml: manifest for <service> of <class>
    • example: /var/svc/manifest/system/cron.xml
    • stores service definition
    • managed using SMF commands
  • /var/svc/profile/<profile>.xml: predefined service (enabled/disabled…) configurations.
    Profiles automatically applied after OS install/upgrade:
    • generic.xml: OS profile
    • site.xml: site specific profile
  • /etc/svc/repository.db: binary service repository
  • /lib/svc/method: directory with start, stop, restart scripts. Manifests refer to these scripts
    • example: /lib/svc/method/svc-cron
    • scripts are similar to legacy /etc/init.d scripts
  • /var/svc/log/<class>-<service>:<instance>.log
    • per <service> <instance> log
    • example: /var/svc/log/system-cron:default.log
  • /etc/svc/volatile/class>-<service>:<instance>.log
    • logs before the single user milestone is reached '(only root mounted)
    • example: /etc/svc/volatile/system-zones:default.log

    GUI

    • smc
    • webmin

    Links

    0 comments
    Labels: , , ,

    8 October 2009

    Solaris patch access

    While the Solaris OS is free, support comes at a cost. The exact policy is not very stable.
    Currently, even to access the recommended patches you need a support contract. When a new Solaris update is released (roughly twice a year), it is freely downloadable and will include all recommended patches.
    Only a limited number of patches are free (like patches to the patch tools). Since Sun was acquired by Oracle free access to security patches has stopped. Here are the links to see all Solaris patches since the last update (takes a while to load):

    For SPARC-based systems:
    http://sunsolve.sun.com/show.do?target=patches/zos-s10
    For x86–based systems:
    http://sunsolve.sun.com/show.do?target=patches/zos-x10
    The non-free patches have the ic_key_2 symbol at the left.

    0 comments
    Labels: , ,

    7 October 2009

    Solaris Live upgrade/patch resources

    0 comments
    Labels: , , ,

    5 October 2009

    Solaris version numbering

    SunOS
    		Solaris
    		Flavour
    SunOS 4
    		Solaris 1 (retroactive name)
    		BSD (Berkeley)
    SunOS 5.0
    		Solaris 2.0
    		SVR4 (System five)
    SunOS 5.1
    		Solaris 2.1
    		SVR4 (System five)
    …
    		…
    		…
    SunOS 5.6
    		Solaris 2.6

    SunOS 5.7
    		Solaris 7

    SunOS 5.8
    		Solaris 8

    …
    		…

    To get the SunOS release number:
    $ uname –r
    5.10
    To get the update within a release:
    $ cat /etc/release
    Solaris 10 5/09 s10s_u7wos_08 SPARC
    …
    This is Solaris 10 update 7, released 5/2009
    Solaris user commands are typically in /usr/bin.
    You find other flavours  of these commands (if different) in
    • /usr/ucb (Berkeley)
    • /usr/xpg4/bin (X/Open Portability Guide v4 compliant)

    0 comments
    Labels: , , , ,

    3 May 2009

    routing components / Solaris 10

    • Commands
      • route: manage routing table
      • netstat -rn: view routing table
      • routeadm: enable/disable routing services
      • svcadm: enable/disable routing services (in addition to routeadm from Solaris 10 8/7)
        • route
        • ipv4-forwarding
      • traceroute: test and show route to system
    • Daemons
      • /usr/sbin/in.routed
        • RIPv1
        • RIPv2
        • RDISC
    • Files
      • /etc/defaultrouter: default route for static routing
      • /etc/gateways: in.routed configuration file
      • /etc/routing.conf: routeadm persistent state. From Solaris 10 8/7 this information moves to SMF.
      • /etc/inet/static.routes: route command persistent state (subject to change)

    0 comments
    Labels: , , , , , ,

    IPMP components / Solaris 10

    • Commands
      • ifconfig: configure interfaces
      • if_mpadm: change interface state
        • -d detach
        • -r reattach
    • Daemons (SMF network/initial)
      • /usr/lib/inet/in.mpathd
        • -a alert to syslog daemon.error (undocumented)
    • Files
      • /etc/default/mpathd: boot time defaults
      • /etc/hostname.interface: per interface configuration file for ifconfig

    0 comments
    Labels: , , ,
    Subscribe to: Posts (Atom)