IPFilter Components / Solaris 10

 For  Solaris 10 8/7 (u4) and higher:

• Commands
  • svcadm: enable/disable ipfilter
  • ipf: manage rulebase
    • -Fa: flush (remove) all rules
    • -f file: load rules from file
  • ipnat: manage Network Access Translation rules
    • -F: flush (remove) all rules
    • -f file: load rules from file
  • ipfstat: show statistics
    • -io: show active rulebase
• Daemons
  • ipmon: monitor logging device
    • -D: daemon mode
    • -s: log to syslog local0 facility
• Files
  • /dev/ipl: device from which you can read log entries
• Kernel module
• ipf
• Links
• FAQ

Solaris 10 networking enhancements by release overview (updated)

Overview of most important changes for networking in solaris 10 releases.
3/5 (base)

• specify source IP by (virtual) interface. Example:

  # ifconfig eri0 usesrc vni0
  The virtual IP vni interface is not associated with any physical hardware and is thus immune to hardware failures. If vni0 has address 10.0.0.1 assigned to it, the system will prefer 10.0.0.1 as the source address for any packets originated by local connections that are sent through eri0.

• RIPv2, BGP, and OSPF through GNU Zebra (adapted for Solaris)
• /usr/lib/mail -> /etc/mail/cf
• routeadm command
• rdisc wrapped into in.routed
• use ifconfig to configure ipforwarding for individual interfaces
• IP quality of service (IPQoS)
• WAN boot installation
• SSH 3.5p1 (adapted for Solaris)
• Stream Control Transmission Protocol (SCTP)

1/6 (u1)

• SMTP over TLS
• source address filtering on multicast traffic
• dladm command for data link (layer 2) configuration, link aggregation (ethernet trunk)
• IGMPv3 and MLDv2 (IPv6) routing support

6/6 (u2)

• IPFilter for IPv6

11/6 (u3)

• Mandatory Access Control (from Trusted Solaris) for networking and other functions
• Set secure by default network profile during installation

8/7 (u4)

• SMF based routing services (svcadm in addition to routeadm)
• merge /etc/inet/ipnodes (for IPv6) into /etc/inet/hosts
• GNU Quagga routing suite replaces GNU Zebra
• Key Management Framework for PKI
• encryption kit included + MD4, MD5, SHA1, and SHA2
• exclusive access to physical network interfaces by non-global zones
• DHCPv6 client
• IPFilter firewall enhancements
  
  • pfil driver/daemon removed (replaced by packet filter hooks)
  • IPv6 support
  • loopback interface support
    

5/9 (u7)

• SHA2 512bit, Diffie-Hellman 4096 bit

10/9 (u8)

• NTP 4.1.2
  

9/10 (u9)

• The client queue runner is now a separate daemon (svc:/network/smtp:sendmail-client). It used to be part of sendmail  (svc:/network/smtp:sendmail).
• The net_access privilege has been added to the basic privilege set. Denying this privilege, cuts network access.

Solaris zones components

Commands

• zoneadm: manage a zone
• zonecfg: configure a zone
• zlogin: login to a zone
  
  
  • -C: console
• ps –z <zone>: list only <zone> processes from global zone

Zone state transitions and associated commands 

• Alternate commands can exist
• A Solaris OS in a zone is only initialised (sysidtool) upon first console login.
• The shutdown commands are executed from within the zone.

Daemons

• zoneadmd: zone manager
• zsched:  scheduler in the zone

Files

• /etc/zones/index: index configured zones (and their state)
• /etc/zones/<zone>.xml: per zone configuration file (from zonecfg)

Links

FAQ
BrandZ FAQ
Zones limitations\
Sun Management Center GUI

inetd and SMF

The internet daemon, , listens on ports for network service requests. When a request arrives it starts the appropriate service. Before Solaris 10 services under control of inetd were configured using the  /etc/inet/inetd.conf file.
In Solaris 10inetd still has the same function, but network services are now configured using SMF (see SMF components).


Runninig inetconv will convert all inetd.conf services to SMF services and enable them. When Solaris 10 boots for the first time it will run inetconv -e.This options does not convert services to SMF, but only enables inetd.conf services that already exist in SMF.

In the SMF manifest files for network services, you can see that SMF delegates management to inetd. Here are some lines from /var/svc/manifest/network/ftp.xml (S10u7):

       <restarter>
                <service_fmri value='svc:/network/inetd:default' />
      </restarter>

inetadm will list all services under inetd control. It has options that allow you to do things similar to svcadm and svccfg.

Service Management Facility (SMF) components

In SMF, service instances are identified by a Fault Management Resource Indicator. The structure of an FMRI is <prefix>:/<class>/<service>:<instance>Example: svc:/system/cron:default
Prefixes:

• svc: SMF managed services
• lrc: legacy run command, pre Solaris 10 style services
• file: for expressing dependencies on files

Commands

• svcs: services information.
  • svcs [FMRI|pattern]: list services, pattern can be a part of an FMRI and can include wildcards (example: “*nfs*”)
    • -a: all - include disabled services
    • -d: dependencies - show services this service depends upon
    • -D: dependents - show services that depend on this service
    • -xv: which services are in maintenance mode (not running) and why (v = verbose)
    • -p: list associated processes
• svcprop <FMRI>: list service properties
  • -p <[group/]property> : list only these properties

    # svcprop –p start/exec cron
/lib/svc/method/svc-cron

• svcadm: Service administration (management)
  
  • svcadm enable <FMRI>: start (and monitor)
    
    • -t: temporary - the service will not be restarted after reboot
  • svcadm disable <FMRI>: stop
    
    • -t: temporary - the service will still be restarted on reboot
  • svcadm restart: stop, then start
  • svcadm refresh: reread configuration (after svccfg)
  • svcadm clear: clear maintenance mode, ask the service monitor to start a service after an error condition is resolved
  • svcadm milestone FMRI: go to milestone (does not change run level)
    
    • -d: set milestone as default target for system boots (initial default: all)
• svccfg: service configuration
  • svccfg import <file>: import an xml service manifest in the binary service repository
  • svccfg export <FMRI>: write an xml service manifest to standard output
  • svccfg delete <FMRI>: remove a service definition from the binary service reporitory
  • svccfg extract > site.xml: extract current services state (enabled/disabled…) to a file
  • svccfg apply <file>: apply state (enabled/disabled…) of services in file
  • svccfg –s <FMRI> setprop <some/property> = value: set property
  • svccfg: interactive mode

    # svccfg
svc:> list
system/console-login
system/device/local
…
svc:> select cron
svc:/system/cron> listprop *
usr dependency start/user astring root
…
svc:/system/cron> setprop start/user = astring: sys
svc:/system/cron> quit
    

• /usr/svc/bin/restore_repository: restore (corrupt) binary repository from automatic backup

Daemons

• /lib/svc/bin/svc.configd: performs the actions scheduled by configuration commands like svccfg
• /lib/svc/bin/svc.startd: monitors and restarts services

Files

• /var/svc/manifest/<class>/<service>.xml: manifest for <service> of <class>
  
  • example: /var/svc/manifest/system/cron.xml
  • stores service definition
  • managed using SMF commands
• /var/svc/profile/<profile>.xml: predefined service (enabled/disabled…) configurations.
  Profiles automatically applied after OS install/upgrade:
  • generic.xml: OS profile
  • site.xml: site specific profile
• /etc/svc/repository.db: binary service repository
• /lib/svc/method: directory with start, stop, restart scripts. Manifests refer to these scripts
  
  • example: /lib/svc/method/svc-cron
  • scripts are similar to legacy /etc/init.d scripts
• /var/svc/log/<class>-<service>:<instance>.log
  
  • per <service> <instance> log
  • example: /var/svc/log/system-cron:default.log
• /etc/svc/volatile/class>-<service>:<instance>.log
  • logs before the single user milestone is reached '(only root mounted)
  • example: /etc/svc/volatile/system-zones:default.log

GUI

• smc
• webmin

Links

• inetd and SMF
• Bigadmin: SMF Service developer introduction.
• SMF manifest cheat sheet
• OpenSolaris SMF FAQ