Reimporting Tapes into NetBackup.

These are my notes on reimporting old tapes. These tapes were shipped off site after NetBackup vaulted the tapes. They are still listed in NetBackup as vaulted. In order to reuse these tapes, they will need to be expired. The steps list below will allow you to reuse the tapes.

Steps
1) Put the old tapes into the MAP.

2) In NetBackup run, inventory tape.

3) Run the command below to expire the tape.
Syntax: bpexpdate -m -d 0 -force

root@earth> bpexpdate -m E00154 -d 0 -force

On UNIX and Linux systems, the directory path to this command is /usr/openv/netbackup/bin/admincmd/
On Windows systems, the directory path to this command is \NetBackup\bin\admincmd\

4) Back in the GUI refresh your display.

5) Check to see if the imported tapes are in the scratch volume pool. Make sure all the details match the existing tapes in the library.

Reference
bpexpdate man page at Symantec.

Check for a blank SSH key passphrase

I found out one of my co-workers was not using a passphrase to secure his SSH keys. This is very insecure way to do business. Many people leave passphrase blank because they do not know how to setup a SSH agent, or can't be bothered with setting up the SSH agent. If you don't know to set up a SSH agent refer to my How to setup SSH Keys post. I came up with a way to check all the accounts on the servers I manage. I wanted to know how many other people where not practicing good security. I have tested this script on Solaris 10, Red Hat Linux (RHEL 5) and SuSe (SLES 11.2).

What the script does.
The script mounts the share that all the users home directories auto-mount from.  This way the user needs not to be logged in for me to check there keys. I then copy all the names of the users home directories into a file. The script checks then checks for the word  ENCRYPTED in the id_rsa file. If the word ENCRYPTED is in the file then the passphrase is set. The temp files are then removed and the share unmounted.

This my script I came up with.

#!/bin/bash
# This script is for checking for a blank passphrase. Meaning no passphrase
to secure your SSH file.
# Script most be run as root.
# Example: sudo ./check-sshkeys

mount share:/vol/home /mnt
ls /mnt >/tmp/ls
for s in `cat /tmp/ls`
do echo -e "\e[1m User $s \033[0m "
if ls /mnt/$s/.ssh/id_rsa 2>/dev/null
        then grep ENCRYPTED /mnt/$s/.ssh/id_rsa || echo -e "No RSA
passphrase"
        else echo "RSA key not found"
fi
if ls /mnt/$s/.ssh/id_dsa 2>/dev/null
        then grep ENCRYPTED /mnt/$s/.ssh/id_dsa || echo -e "No DSA
passphrase"
        else echo "DSA key not found"
fi
done
rm /tmp/ls
umount /mnt

Draw backs
Now there are ways that a user can get around this, like putting the word ENCRYPTED in the right file. But most users will not do this, so this should still work for most users. The script above will need to be modified in order to check users who don't have their home directories auto-mounted.

I can't take all the credit for this, I had some help. Below I have posted the link to the forum were I  asked for help on this script.

Ref:
Is there a way to check a users SSH key to see if the passphrase is blank

Using SCP on Windows Command Prompt

In this post, I show how to move files between a Windows machine and a UNIX machine, using the command line. When I say a UNIX machine, I mean all UNIX based operating systems such as UNIX, Linux, FreeBSD and Mac OS. In this post I will be using the free PuTTY utility called PSCP.

As you know SSH is not supported in Windows, you will need to download a 3rd party program.
The People who make PuTTY, which gives SSH terminal emulation on Windows machines, has a program called PSCP. PSCP gives you the ability to use SCP or SFTP form the Windows command prompt.

You could use a GUI program that lets you SCP or SFTP the files. The issue with this approach is that an application with a GUI has limitations. If you use a command line tool, like PSCP, to move the files then you can also put it in a script. A script that can be used by the Windows Task manager or the UNIX crontab. PSCP is free and doesn't need to be installed.

Download pscp from  PuTTY download page.

After you download PSCP move it to your My  Documents folder. As the program doesn't need to be installed, It is ready to use as soon as you download it. All you need to do, to use PSCP is follow the examples below.

Run the command as shown below to move files from the Windows machine to a UNIX machine

Command Prompt

C:\> pscp.exe files man@earth:/path

Run the command as shown below to move files form a UNIX machine to a Windows machine.

Command Prompt

C:\> pscp.exe man@earth:/path/files  C:/path/

In the example above, man is the user name and earth is the name of the UNIX server. The user name can be left off if the user account in Windows have the same name as the user account on the UNIX server. I would highly recommend that you use the same user name on both systems.

Some options
If you want to force the use of ether SCP or SFTP add -scp or -sftp right after pscp.exe. If you want to use a SSH agent to manage you SSH Keys add the -agent option. I will go more into how to use SSH Key with PSCP in a future post.

Draw Back
In the method I shown here, you must start the SCP or SFTP session from the Windows machine. The Windows machine can't accept incoming requests, because there is no SSH sever running on the the Windows machine.

References
PuTTY documention

Set the Default Route on Solaris

Every once in awhile you need to change the default route for a server in Solaris. Follow the steps below are my notes on how to do that.




Run the route add command

root@earth> route add default 10.10.0.1

To make the default route persistent, you will need to update or create the /etc/defaultrouter file.

root@earth> echo 10.10.0.1   >  /etc/defaultrouter

Solaris Zones
If you need to do this on a Solaris zone then it depends how the zone has it's network interfaces configured. If the interfaces are configure as IP-Exclusive then the zone is configure the same way are the global zone. The same way a show above, so run the commands above for the zone. If the zone shares there interfaces with the global zone then you have to use the zonecfg command.

Run the command below to find out if the zone uses ip-exclusive or shared interfaces.

root@earth> svcadm list -cv

ID NAME	STATUS	PATH	BRAND	IP
global	running	/	native	shared
moon	running	/export/zones/moon	native	shared

The example above shows the zone moon as having shared interfaces.

Follow the steps below to change the default route on a zone with shared interfaces.

root@earth> zonecfg -z moon
zonecfg:moon> select net address=10.10.0.20
zonecfg:moon:net> set defrouter=10.10.0.1
zonecfg:moon:net> end
zonecfg:moon> verify
zonecfg:moon> commit
zonecfg:moon> exit

You will need to restart the zone to get the new default route.

If you need to also change your ip address then refer to my other post.
How-to change the IP address on a Solaris server

Links to other sites with similar info
Set the Default Route on Solaris
Solaris: How do I setup a default static route / static router IP address?


I hope this helps. Please leave a comment below if you have comments or questions.

My BASH profile

These are notes on how I like to have my command prompt set up. I'm a BASH user so I will be updating the .profile and the .bashrc files. Both files are located in the users home directory.


This what my prompt looks like. It is a two line prompt, I find that it helps break up the commands from the output. The second line also gives more room for long commands and helps prevent the line from wrapping over top of the prompt.

earth:~

man@earth
< 

The basic bash prompt don't look all the great, as seen below. To get it look like the example above run the command below.

bash

bash$

export PS1="\[\e]2;\h:\w \a\[\e[0;31m\]\u\[\e[0m\]@\e[0;32m\h\e[0;34m\]\n<\[\e[0m\] "

Below I have posted my .profile file.

earth:~

man@earth
< more .profile

PATH=/usr/xpg4/bin:/usr/bin:/bin:/usr/sbin:/usr/local/sbin:/usr/openwin/bin:/usr/local/bin:/usr/ucb:/etc:/usr/X11/bin:/sbin:/usr/openv/netbackup:/usr/openv/netbackup/bin:/usr/openv/netbackup/bin/admincmd:/usr/openv/netbackup/bin/goodies:/usr/openv/volmgr/bin:/usr/sfw/bin/:$HOME

MANPATH=/usr/share/man:/usr/dt/man:/usr/openwin/share/man:/usr/X11/man:/usr/man:/usr/sfw/man:/usr/local/man:

EDITOR=/usr/bin/vi
TMOUT=0
TIMEOUT=0

#alias xterm="xterm -sl 1000 &"
#export PS1="\[\e]2;\h:\w \a\[\e[0;31m\]\u@\e[0;32m\h\e[0;34m\]>\[\e[0m\] "
export PS1="\[\e]2;\h:\w \a\[\e[0;31m\]\u\[\e[0m\]@\e[0;32m\h\e[0;34m\]\n<\[\e[0m\] "

The PATH statement is used to store the paths of the commands you want to use. This way you don't need to provide the full path for each command you want to run. The MANPATH statement is basically the same thing, but used to help you access the man pages.

How to get an ILOM Commmnad Line Console

I had an issue the other day on an Oracle x86 blade server. I wanted to access the the system command line system console on a x86 blade. There are two ways to access the console on a ILOM. You can use the Java web console or the command line console. Now on the SPARC systems could always use both consoles, but the x86 servers could only use the Java web console.  So we where forced to web console on the x86 servers. I could just use the ILOM's Java web console, but not all servers have a web browser and Java installed. Below, I have posted my notes on how to make the command line console work for the x86 ILOM.

Run the eeprom command to see your current settings.  If the console setting is set to text then you must change it to ttya.

root@earth> eeprom
ata-dma-enabled=1
atapi-cd-dma-enabled=0
ttyb-rts-dtr-off=false
ttyb-ignore-cd=true
ttya-rts-dtr-off=false
ttya-ignore-cd=true
ttyb-mode=9600,8,n,1,-
ttya-mode=9600,8,n,1,-
lba-access-ok=1
prealloc-chunk-size=0x2000
keyboard-layout=US-English
console=text

Change the setting with the command below.

root@earth> eeprom console=ttya

The server must be rebooted for the change to take affect.

After the reboot test to see if it works.

root@earth> ssh root@ILOM
-> start /SP/console

Reference
Document ID 1448462.1 on the Oracle Support Site.
My Oracle Support
 

Installing Firefox on Solaris (Update III)

These are my updated notes on how to install Firefox on a Solaris 10 server. In this installment, I will go over two different ways to install Firefox. I will be using the files found at the Mozilla website, which just started hosting these files. To check out my previous posts on installing Firefox please check out at the bottom of this post.

The files on the Mozilla site, are the same files that can be found at Sunfreeware.com or UNIXpackages.com. The only issue with getting Firefox from this site is that it is not actually from them. They go out of there way to say this on there site and I quote; "They are the ONLY packages in our repository that are not compiled by us, and were contributed by External Offshore developers in East Asia". The README file on the site says that they where contributed by Oracle Solaris Desktop Beijing Team. I checked with the local Oracle reps in the area and they can't confirm that install files are from Oracle. Anyway if this is not an issue for you then follow the instructions below to install Firefox.

Get the Files
Use the links below to download the files needed for this how to.
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/24.0esr/contrib/solaris_pkgadd/
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/24.0esr/contrib/solaris_tarball/

We will use the files below to install Firefox.
firefox-24.1.1esr.en-US.solaris-10-fcs-sparc.tar.bz2
firefox-24.1.1esr.en-US.solaris-10-fcs-sparc-pkg.bz2

Install Firefox from a tar file.
One advantage of installing Firefox with a tar file is that you can install Firefox almost anywhere.  Run the following commands to install Firefox.

root@earth> mv firefox-* /usr/lib/
root@earth> cd /usr/lib
root@earth> bzip2 -cd firefox-24.1.0esr.en-US.solaris-10-fcs-sparc.tar.bz2 | tar xvf - root@earth> ln -s /usr/lib/firefox/firefox /usr/bin/firefox

Start Firefox.

root@earth> firefox

Install Firefox from a package.

root@earth> bzip2 -d firefox-24.0esr.en-US.solaris-10-fcs-sparc-pkg.bz2
root@earth> pkgadd -d ./firefox-24.0esr.en-US.solaris-10-fcs-sparc-pkg

The following packages are available:
   1  SFWatk           ATK - Accesibility Toolkit Libraries
                       (sparc) 1.24.0,REV=110.0.4.2009.02.26.22.56
   2  SFWcairo        Vector graphics library
                       (sparc) 1.8.4,REV=110.0.4.2009.02.26.23.05
   3  SFWfirefox     Mozilla Firefox Web browser
                       (sparc) 24.1.0esr,REV=110.0.4.2013.10.24.13.53
   4  SFWglib2       Low level core compatibility library for GTK+ and GNOME
                      (sparc) 2.18.3,REV=110.0.4.2009.02.27.14.31
   5  SFWgtk2        GTK+ - GIMP Toolkit Library for creation of graphical user interfaces
                      (sparc) 2.14.5,REV=110.0.4.2011.05.26.09.57
   6  SFWpango      Library for layout and rendering of internationalized text
                      (sparc) 1.22.3,REV=110.0.4.2009.02.26.23.21
   7  SFWpixman    Vector graphics library
                      (sparc) 0.12.0,REV=110.0.4.2009.02.26.23.01

Select package(s) you wish to process (or 'all' to process
all packages). (default: all) [?,??,q]:

You can install all the packages listed above or just the Firefox package (SFWfirefox). Firefox will be installed at /opt/sfw/lib/firefox. The install process will link the Firefox exacuteable to /usr/local/bin/firefox. Start firefox as shown below.

root@earth> firefox

If Firefox doesn't start then I would make sure that /usr/local/bin in your path.

My Other Firefox posts.
Installing Firefox on a Solaris server
Installing Firefox on Solaris (Update)
Installing Firefox on Solaris (Update II)

Firefox won't run

This is quick fix for getting Firefox to run, when it says it is already running. How this only seems to happen if you have your home directory mounted across all your computers. The picture below is the error you normally get when your have this problem.

One way to fix this is to delete the lock file.

root@earth> rm ~/.mozzilla/firefox/*.default/lock

You can also use profiles to get past this error. I would suggest you create a different profile for each computer you use Firefox on. Run the command below to get the Pop-up GUI for selecting the profile, as show below. From here you can create a profile to use, if you need one.

root@earth> firefox -p

If you already have profile, then run the command firefox -p with the profiles name at the end.

root@earth> firefox -p profilename

Please feel free to add an comments below If I have missed something.

Replace drives on a StoreEdge 6130 & 6140

These are my notes on how to replace a hard drive for a StorEdge 6130 and 6140.

Add disk space from 6130 or 6140 array (host initiator already exists)

1.      Log onto the host and note the existing disks with “format”.

2.      Log onto the StorageTek Common Array Manager via web browser.  URL – https://server:6789   root login.

3.      Expand the 6130 or 6140 array, based on the system requiring space.

4.      Click on the Volumes tab and click on New.

5.      Select the Storage Pool. Click Next.

6.      Select “Storage Selected Automatically by CAM”

7.      Name the new volume and complete the Size section as needed.  Click Next.

8.      Select “Map to an Existing Host/Host Group or the Default Storage Domain.  Click Next.

9.      Select the host.  Click Next.

10.  Review the information.  Click Finish.  Configuration will take a minute or two.

11.  Repeat step 4 thru 10, if additional disk space is required.

12.  Log onto the host and note the existing disks.

13.  If the newly created disk(s) are not listed, run “devfsadm” or “cfgadm –al”.

14.  Create a new zpool with “zpool create   ”

15.  Create a filesystem on the new zpool with  “zfs create /file system”

16.  Set a mount point for the new file system “zfs set mountpoint=

Download Java in MOS

Oracle offers patches for their software products through My Oracle Support (MOS). The issue is the way Oracle handles Java patches. If you don't have a software contact, then Oracle will not let you directly download the latest Java patch. This can be extremely frustrating, given the fact that the patch is part of both the CPU patchset and 10 Recommend patchset, for Solaris 10. Also if you have a Premier Hardware Support contract, then you get software support for the Solaris operating system. So why Oracle makes it hard is beyond me.

If you don't have a Software support contract then you can't download Java as a Java patch. You can however download a Java patch as system patch. It is actually the same patch ether way. So what matters is the approach you use to get the patch. Follow the steps below to download the latest Java patch as a system patch.

Fig. 1 - Patch Search

Steps
1) Login  to MOS.

2) Go to the Patches and Upgrade tab.

3) Choose the Product or Family (Advanced).
At this point you should be at figure 1.

Fig. 2 - Example of processor types

4) For the Product field input Solaris Operating System.

5) For the Release drop down menu. Pick the Solaris Operating system version you need.
Look at figure 2 as an example.

6) For the next drop down choose Platform.

Fig. 3 - Example of finished search fields

7) For the next drop down pick the Solaris Operating system processor  type you need.

8) Then choose Description.

9) type in javase in the last box.

10) Check the Exclude Superseded patches. 

At this point your search should look like figure 3.

I hope this helps you out.
You can also use this method to download other patches form Oracle such as OpenSSL.
If you have any comments please post them below.

Show Faulted Hardware in ILOM

Here, I will go over my notes on how to identify and clear hardware faults, in an ILOM (Integrated Lights Out Manager). On this page I will use the example of a chassis fan module error. If you follow my notes and the error clears Then you didn't have a real issue. On the other hand, If after following my notes you can't clear the error. Then you have a real hardware issue. You can't clear errors if the error is still an issue.

This is how you login to the command line interface for the ILOM.

man@earth> ssh root@ilom

The command below is one way to show system faults. The only target you should see is shell. If you see anything other then shell it is a fault. In the example below, the ILOM shows a bad system fan. Shown as 0 (/SYS/FMO).

--> show /SP/faultmgmt

/SP/faultmgmt
     Targets:
          shell
          0 (/SYS/FM0)

      Properties:

      Commands:
          cd
          show

Using the show faulty command is anther way to see the system faults. This command shows a lot more detail. If you have a support contract with Oracle, you will want to paste the output of this command into the ticket, you submit to MOS. The show faulty command can be used without any paths, which will be extra useful if are coming in from a chassis ILOM.

--> show faulty
Target                    | Property                   | Value
-----------------------+--------------------------+---------------------------------
/SP/faultmgmt/0    | fru                            | /SYS/FM0
/SP/faultmgmt/0/   | class                         | fault.chassis.device.fan.fail
faults/0                  |                                  |
/SP/faultmgmt/0/   | sunw-msg-id            | SPX86-8X00-33
faults/0                  |                                  |
/SP/faultmgmt/0/   | component               | /SYS/FM0
faults/0                   |                                 |
/SP/faultmgmt/0/   | uuid                          | 8692c3e4-G481-635e-f8e2-f3f215d1
faults/0                   |                                 | 13f0
/SP/faultmgmt/0/   | timestamp                | 2013-10-02/12:10:43
faults/0                   |                                 |
/SP/faultmgmt/0/   | detector                   | /SYS/FM0/ERR
faults/0                   |                                  |
/SP/faultmgmt/0/   | product_serial_number | 1203FMM107
faults/0                   |                                  |

The command below shows the event log, which will also contain the system hardware errors.

--> show /SP/logs/event/list

To clear the hardware fault from the logs run the command below.

--> show /SP/logs/event/ clear=true

Run this command to clear the fan error.

--> set /SYS/FM0 clear_fault_action=true

Try to clear the hardware fault. If the hardware is really having an issue, the hardware fault will come back. In about a minute or less. If you can't clear the error and you have a support contract then this is when you summit your ticket.

If you have any questions or I missed something let me know.