A Sysadmin's Notes

Wednesday, November 6, 2013

Replace drives on a StoreEdge 6130 & 6140

These are my notes on how to replace a hard drive for a StorEdge 6130 and 6140.

Add disk space from 6130 or 6140 array (host initiator already exists)

1. Log onto the host and note the existing disks with “format”.

2. Log onto the StorageTek Common Array Manager via web browser. URL – https://server:6789 root login.

3. Expand the 6130 or 6140 array, based on the system requiring space.

4. Click on the Volumes tab and click on New.

5. Select the Storage Pool. Click Next.

6. Select “Storage Selected Automatically by CAM”

7. Name the new volume and complete the Size section as needed. Click Next.

8. Select “Map to an Existing Host/Host Group or the Default Storage Domain. Click Next.

9. Select the host. Click Next.

10. Review the information. Click Finish. Configuration will take a minute or two.

11. Repeat step 4 thru 10, if additional disk space is required.

12. Log onto the host and note the existing disks.

13. If the newly created disk(s) are not listed, run “devfsadm” or “cfgadm –al”.

14. Create a new zpool with “zpool create ”

15. Create a filesystem on the new zpool with “zfs create /file system”

16. Set a mount point for the new file system “zfs set mountpoint=

Download Java in MOS

Oracle offers patches for their software products through My Oracle Support (MOS). The issue is the way Oracle handles Java patches. If you don't have a software contact, then Oracle will not let you directly download the latest Java patch. This can be extremely frustrating, given the fact that the patch is part of both the CPU patchset and 10 Recommend patchset, for Solaris 10. Also if you have a Premier Hardware Support contract, then you get software support for the Solaris operating system. So why Oracle makes it hard is beyond me.

If you don't have a Software support contract then you can't download Java as a Java patch. You can however download a Java patch as system patch. It is actually the same patch ether way. So what matters is the approach you use to get the patch. Follow the steps below to download the latest Java patch as a system patch.

Fig. 1 - Patch Search

Steps
1) Login to MOS.

2) Go to the Patches and Upgrade tab.

3) Choose the Product or Family (Advanced).
At this point you should be at figure 1.

Fig. 2 - Example of processor types

4) For the Product field input Solaris Operating System.

5) For the Release drop down menu. Pick the Solaris Operating system version you need.
Look at figure 2 as an example.

6) For the next drop down choose Platform.

Fig. 3 - Example of finished search fields

7) For the next drop down pick the Solaris Operating system processor type you need.

8) Then choose Description.

9) type in javase in the last box.

10) Check the Exclude Superseded patches.

At this point your search should look like figure 3.

I hope this helps you out.
You can also use this method to download other patches form Oracle such as OpenSSL.
If you have any comments please post them below.

Friday, November 1, 2013

Show Faulted Hardware in ILOM

Here, I will go over my notes on how to identify and clear hardware faults, in an ILOM (Integrated Lights Out Manager). On this page I will use the example of a chassis fan module error. If you follow my notes and the error clears Then you didn't have a real issue. On the other hand, If after following my notes you can't clear the error. Then you have a real hardware issue. You can't clear errors if the error is still an issue.

This is how you login to the command line interface for the ILOM.

man@earth> ssh root@ilom

The command below is one way to show system faults. The only target you should see is shell. If you see anything other then shell it is a fault. In the example below, the ILOM shows a bad system fan. Shown as 0 (/SYS/FMO).

--> show /SP/faultmgmt

/SP/faultmgmt
     Targets:
          shell
          0 (/SYS/FM0)

      Properties:

      Commands:
          cd
          show

Using the show faulty command is anther way to see the system faults. This command shows a lot more detail. If you have a support contract with Oracle, you will want to paste the output of this command into the ticket, you submit to MOS. The show faulty command can be used without any paths, which will be extra useful if are coming in from a chassis ILOM.

The command below shows the event log, which will also contain the system hardware errors.

--> show /SP/logs/event/list

To clear the hardware fault from the logs run the command below.

--> show /SP/logs/event/ clear=true

Run this command to clear the fan error.

--> set /SYS/FM0 clear_fault_action=true

Try to clear the hardware fault. If the hardware is really having an issue, the hardware fault will come back. In about a minute or less. If you can't clear the error and you have a support contract then this is when you summit your ticket.

If you have any questions or I missed something let me know.

Friday, October 25, 2013

Installing Firefox on Solaris (Update II)

This part three of my "How to Install Firefox" series of posts. Please read the other Firefox posts linked to at the bottom of this post, for additional information. This post is an update on the Firefox situation on Solaris.

The Oracle Security Blog, posted on October 13, 2013, the long awaited patch for Firefox. You will need a MOS (My Oracle Support) login to download the patches though. Patch 145080-13 for SPARC and patch 145081-12 for X86 will upgrade Firefox to 10.0.12 ESR. This is pathetic considering that at the time I'm writing this, Firefox is at version 24.0. Mozilla doesn't even support Firefox 10 ESR anymore. So why is Oracle giving us this now? Most operating systems are using Firefox 17 ESR right now and they will soon be moving to version 24 ESR. On top of that, Oracle's security blog also doesn't address any of the security vulnerabilities for 2013.

Note - Mozilla doesn't offer Firefox install packages for Solaris.

Current Mozilla supported versions

Firefox 17.0.9 ESR
Firefox 24.0
Firefox 24.0 ESR

Now on the install on Firefox.
The package Solaris uses for the Firefox install is SUNWfirefox. Run the command below to make sure that package is installed. There may be other Firefox related packages, that's OK.

root@earth> pkginfo -l | grep firefox
PKGINST: SUNWfirefox
PKGINST: SUNWfirefoxl10n-es-ES
PKGINST: SUNWfirefox-devel

If the package is not installed then you will have to install it. Unfortunately it installs Firefox 3, so you need to patch it right away. As I mentioned above the patch will update Firefox to 10.0.12. If this is the 1st patch to be applied to Firefox it may take some time, this is normal. In the example below we are installing the SPARC patch.

root@earth> mv 145080-13 /tmp
root@earth> unzip 145080-13
root@earth> pkgadd 145080-13

And you're done. Test the application. If your previous version of Firefox was not part of a package, but instead was install using a tar file then you will have to delete it from the server. I have instructions on how to do that in my 1st post on how to install Firefox.

Info
I have removed Firefox from my server at work because I don't think it is secure on Solaris 10. I am instead using Firefox on Linux server, until Oracle gets their act together. I have heard that Oracle will be releasing FireFox 17 ESR soon. The only problem is, Firefox is only coming to Solaris 11 and not Solaris 10. You can still get Firefox at SunFreeware.com or UNIXpackages.com, which are the same people. The only issue with getting Firefox from there site is that it is not actually from them. They go out of there way to say this on there site and I quote; "They are the ONLY packages in our repository that are not compiled by us, and were contributed by External Offshore developers in East Asia".

Links to my other Firefox install posts
Installing Firefox on Solaris
Installing Firefox on Solaris (Update)
Installing Firefox on Solaris (Update III)

If you have any comments or question please post them below.

Thursday, October 24, 2013

Access the Java Control Panel

Finding the Java Control Panel in Windows is easy. Now try finding it on a UNIX based system, not so easy. Below are my notes on accessing the Java Control Panel for both Oracle Java and IBM Java.

Sun/Oracle
/usr/java/jdk1.7.0_21/bin/ControlPanel

IBM
/usr/bin/java -viewer

If you have something to please post a comment below.

Wednesday, October 23, 2013

Checking for HTTP

I often need to check what version of Apache HTTP server is running in our environment. I also need to check for what modules are installed. The examples are form a Solaris 10 server and can be applied to any UNIX based operating system, like Linux.

The command below is the basic command for checking the HTTP version.

man@earth> httpd -v

It is best to run the find command. This way you can find any instaces on HTTP as well as any embedded versions that may be hiding on the server.

root@earth> find / -name httpd -type f 2>/dev/null
/usr/local/apache2/bin/httpd

Then to check the version run the following command.

man@earth> /usr/local/apache2/bin/httpd -v
Server version: Apache/2.2.25 (Unix)
Server built: Jul 31 2013 23:39:37

Below is the command for checking what modules are installed.

man@earth> httpd -M

Other sites with info on this.
www.cyberciti.biz
nixcraft.com

Related posts
Version index

Tuesday, October 22, 2013

Get the OpenSSL version

I often have to check which versions of applications we have installed our servers. Below I have post the method of checking the version of OpenSSL installed on a server. The command below should work with any UNIX based operating system. I might even work on Windows.

man@earth> openssl version -a

To find the non system or embedded versions you will have to run the find command. Shown below.

root@earth> find / -name openssl -type f 2>/dev/null

I hope this helps someone

Monday, October 21, 2013

My BASH Promt

Below are my notes on how I like my BASH prompt setup. This prompt has two lines which I find helps to break up the commands from the output. The second line also gives more room for long commands and helps prevent the line from wrapping over top of the prompt. I also update the title bar on the terminal or xterm with the hostname and current working directory. I find this helpful because this way I will always know who I am on the system, what server I'm logged into and what directory I'm in without typing any commands.

earth:~

man@earth
<

Cut and paste the line below into your terminal or add in to your .profile file. If you like my prompt.
export PS1="\[\e]2;\h:\w \a\[\e[0;31m\]\u\[\e[0m\]@\e[0;32m\h\e[0;34m\]\n<\[\e[0m\] "

If you have any suggestions or questions post them below.

Friday, September 6, 2013

How to setup SSH Keys

Note - I have a newer version of this how-to. Please click here

This is a guide on setting up SSH Keys for a UNIX based account. What are SSH keys you ask? They are means of identifying yourself to an SSH server using public-key cryptography and challenge-response authentication. SSH Keys are considered more secure than using passwords to access systems, because user accounts are authenticated by the server without ever having to send your password over the network. If the passwords are not transmitted then they can't be intercepted.
This guide is not for installing or setting up a SSH server. You must have SSH running on your servers in order to get your SSH keys to work. All the examples are take from a Solaris 10 (SPARC) server. This guide should as work on any UNIX based operating system like Linux, BSD and the Mac.

Create you key pair
The ssh-keygen command will generate a public and private keypair. The keys will be stored at ~/.ssh.The basic command looks like this: ssh-keygen -t [dsa|rsa] The -t sets the type of keys used. In the example below I create a rsa key pair.

man@earth> ssh-keygen -t rsa
Enter file in which to save the key (/home/man/.ssh/id_rsa): Press [Enter] key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/man/.ssh/id_rsa.
Your public key has been saved in /home/man/.ssh/id_rsa.pub.
The key fingerprint is:dfhjodfnk
04:be:15:ca:1d:0a:1e:e2:a7:e5:de:98:4f:b1:a6:01

Make sure you don't use a blank passphrase. Doing this is very insecure. Having a blank passphrase defeats the purpose of having having the extra security of a key exchange setup. It is also import to never give out your private key, which also compromises security of your account.

Copy public key
Copy you public key to the authorized_keys file on the remote server.

man@earth> scp ~/.ssh/id_rsa.pub moon:~/.ssh/authorized_keys

If your home directory automounts across a lot of servers. You can copy it over with the cat command.

man@earth> cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

Setup Agent
At this point, when you login you get prompted for a passphase. To stop this from happening you need to setup a SSH agent. Run the command below and type in your passphare when prompted.

man@earth> eval `ssh-agent`
man@earth> ssh-add
Enter passphrase for /home/man/.ssh/id_rsa:
Identity added: /home/vivek/.ssh/id_dsa (/home/man/.ssh/id_rsa)

There are other ways to set up the agent such as using the gnome GUI for example. Unfortunately that only works if your running a gnome desktop. If your a VNC user, you should start your VNC server session after starting your agent in the same terminal. This way all your terminals launched in your VNC session, will use the same agent.

One issue with agents is that sometimes you end up running a lot of agents. Run the command below and kill any agents that you are not using, as a good practice.

man@earth> ps -ef | grep agent

References
g-loaded.eu
Symantec: SSH and ssh-agent

If you have any questions or comments please post below.

Thursday, September 5, 2013

Faster Solaris 10 Zone Creation

These are my notes on a faster way creating Solaris 10 zones. If you're not familiar with Solaris 10 zones might I suggest you first read my notes on creating Solaris 10 zones. These notes will go over making a whole root zone with a shared network interface. For the purpose of this guide. We will use the hostname, earth for our Global zone (host). We will create a zone named moon.

Create the zone

root@earth> zonecfg -z moon "create -b; set zonepath=/export/zones/test; set autoboot=true; add net; set physical=e1000g0; set address=10.1.1.232/24; end; verify; commit; exit"

Alternately you can put all the sub-commands into a file.

Install zone

root@earth> zoneadm -z moon install
A ZFS file system has been created for this zone.
Preparing to install zone moon.
Creating list of files to copy from the global zone.
Copying 82181 files to the zone.
Initializing zone product registry.
Determining zone package initialization order.
Preparing to initialize 783 packages on the zone.
Initialized 783 packages on zone.
Zone moon is initialized.
Installation of 1 packages was skipped.
The file contains a log of the zone installation.

Check the zone (Optional)

root@earth> zoneadm list -cv
ID NAME STATUS PATH BRAND IP
0 global running / native shared
- moon installed /export/zones/moon native shared

Make an answer file
You must create the sysidcfg configuration file and put it in the zone's /etc directory. For example: /export/zones/moon/root/etc/. This must be done after the zone install but before the you boot the zone. Below is an example of a sysiccfg that worked for my setup.


system_locale=en_US

timezone=US/Eastern

terminal=vt100

timeserver=localhost

root_password=$1$w/3YH4kq$R3Tk2lHWRIL2FiiJ2eJqQ1

network_interface=PRIMARY {hostname=moon

                    
                        default_route=NONE

                    
                        ip_address=10.1.1.232

                    
                        netmask=255.255.254.0

                    
                        protocol_ipv6=no}

nfs4_domain=sun

security_policy=NONE

name_service=NONE

Get remote console on the zone
Run this command in a different terminal.

root@earth> zlogin -C moon

Note -C option gives you a persistent console. To get back to the global zone type .~

Boot the zone

root@earth> zoneadm -z moon boot

After you run the command above, look at the other terminal where you ran zlogin. You should see the zone booting up. After the zone boots up, you should see a login prompt. If instead the setup process starts up, then there is an error with the sysidcfg file. I that case you will have to delete you zone. Check out my notes on how to uninstall and delete a zone. If there are no issues then your done.

I hope this was helpful to someone. If you have any questions or comments please post them below.

Related posts on this blog:
Creating Solaris 10 zones
Uninstall and delete a zone

Thursday, August 1, 2013

Java PATH need to run the ILOM Remote console

From time to time there is something you only set once. For example Oracle's Integrated Lights Out Manager (ILOM) has a web interface. Which has remote console feature. This feature uses Java running in a web browser. The first time it asks for the path to launch the program . Below I have displayed the path the Java needs for the remote console feature.

For UNIX & Linux computers: /usr/bin/javaws
For Windows computers: C:\Program Files\Java\jre\bin\javaws

I hope this helps someone.