How to setup SSH Keys

Note - I have a newer version of this how-to. Please click here 

This is a guide on setting up SSH Keys for a UNIX based account. What are SSH keys you ask? They are means of identifying yourself to an SSH server using public-key cryptography and challenge-response authentication. SSH Keys are considered more secure than using passwords to access systems, because user accounts are authenticated by the server without ever having to send your password over the network. If the passwords are not transmitted then they can't be intercepted.
This guide is not for installing or setting up a SSH server. You must have SSH running on your servers in order to get your SSH keys to work. All the examples are take from a Solaris 10 (SPARC) server. This guide should as work on any UNIX based operating system like Linux, BSD and the Mac.

Create you key pair
The ssh-keygen command will generate a public and private keypair. The keys will be stored at ~/.ssh.The basic command looks like this: ssh-keygen -t [dsa|rsa]  The -t sets the type of keys used. In the example below I create a rsa key pair.

man@earth> ssh-keygen -t rsa
Enter file in which to save the key (/home/man/.ssh/id_rsa): Press [Enter] key
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/man/.ssh/id_rsa.
Your public key has been saved in /home/man/.ssh/id_rsa.pub.
The key fingerprint is:dfhjodfnk
04:be:15:ca:1d:0a:1e:e2:a7:e5:de:98:4f:b1:a6:01

Make sure you don't use a blank passphrase. Doing this is very insecure. Having a blank passphrase defeats the purpose of having having the extra security of a key exchange setup. It is also import to never give out your private key, which also compromises security of your account.

Copy public key
Copy you public key to the authorized_keys file on the remote server.

man@earth> scp ~/.ssh/id_rsa.pub moon:~/.ssh/authorized_keys

If your home directory automounts across a lot of servers. You can copy it over with the cat command.

man@earth> cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

Setup Agent
At this point, when you login you get prompted for a passphase. To stop this from happening you need to setup a SSH agent. Run the command below and type in your passphare when prompted.

man@earth> eval `ssh-agent`
man@earth> ssh-add
Enter passphrase for /home/man/.ssh/id_rsa:
Identity added: /home/vivek/.ssh/id_dsa (/home/man/.ssh/id_rsa)

There are other ways to set up the agent such as using the gnome GUI for example. Unfortunately that only works if your running a gnome desktop. If your a VNC user, you should start your VNC server session after starting your agent in the same terminal. This way all your terminals launched in your VNC session, will use the same agent.

One issue with agents is that sometimes you end up running a lot of agents. Run the command below and kill any agents that you are not using, as a good practice.

man@earth> ps -ef | grep agent

References
g-loaded.eu
Symantec: SSH and ssh-agent

If you have any questions or comments please post below.

Faster Solaris 10 Zone Creation

These are my notes on a faster way creating Solaris 10 zones. If you're not familiar with Solaris 10 zones might I suggest you first read my notes on creating Solaris 10 zones. These notes will go over making a whole root zone with a shared network interface. For the purpose of this guide. We will use the hostname, earth for our Global zone (host). We will create a zone named moon.

Create the zone

root@earth> zonecfg -z moon "create -b; set zonepath=/export/zones/test; set autoboot=true; add net; set physical=e1000g0; set address=10.1.1.232/24; end; verify; commit; exit"

Alternately you can put all the sub-commands into a file.

Install zone

root@earth> zoneadm -z moon  install
A ZFS file system has been created for this zone.
Preparing to install zone moon.
Creating list of files to copy from the global zone.
Copying 82181 files to the zone.
Initializing zone product registry.
Determining zone package initialization order.
Preparing to initialize 783 packages on the zone.
Initialized 783 packages on zone.
Zone moon is initialized.
Installation of 1 packages was skipped.
The file contains a log of the zone installation.

Check the zone (Optional)

root@earth> zoneadm list -cv
ID NAME     STATUS      PATH                            BRAND      IP
0   global        running        /                                 native          shared
-    moon        installed       /export/zones/moon     native          shared

Make an answer file
You must create the sysidcfg configuration file and put it in the zone's /etc directory. For example: /export/zones/moon/root/etc/. This must be done after the zone install but before the you boot the zone. Below is an example of a sysiccfg that worked for my setup.

system_locale=en_US
timezone=US/Eastern
terminal=vt100
timeserver=localhost
root_password=$1$w/3YH4kq$R3Tk2lHWRIL2FiiJ2eJqQ1
network_interface=PRIMARY {hostname=moon
                     default_route=NONE
                     ip_address=10.1.1.232
                     netmask=255.255.254.0
                     protocol_ipv6=no}
nfs4_domain=sun
security_policy=NONE
name_service=NONE


Get remote console on the zone
Run this command in a different terminal.

root@earth> zlogin -C moon

Note -C option gives you a persistent console. To get back to the global zone type .~

Boot the zone

root@earth> zoneadm -z moon boot

After you run the command above, look at the other terminal where you ran zlogin. You should see the zone booting up. After the zone boots up, you should see a login prompt. If instead the setup process starts up, then there is an error with the sysidcfg file. I that case you will have to delete you zone. Check out my notes on how to uninstall and delete a zone. If there are no issues then your done.

I hope this was helpful to someone. If you have any questions or comments please post them below.

Related posts on this blog:
Creating Solaris 10 zones
Uninstall and delete a zone

Java PATH need to run the ILOM Remote console

From time to time there is something you only set once. For example Oracle's Integrated Lights Out Manager (ILOM) has a web interface. Which has remote console feature. This feature uses Java running in a web browser. The first time it asks for the path to launch the program . Below I have displayed  the path the Java needs for the remote console feature.


For UNIX & Linux computers:  /usr/bin/javaws
For Windows computers: C:\Program Files\Java\jre\bin\javaws 

I hope this helps someone.

Free System Administration Training

I recently attended some free online training from Oracle. Oracle called the training event Virtual SysAdmin Day.  I thought the training was really good. So I'm posting links to the training so maybe you can also benefit from the training as well.

Link to training from the Oracle Virtual SysAdmin Day.
http://www.oracle.com/us/dm/11551-wwmk13049569mpp141c003-oem-1980042.html

Solaris resources
https://blogs.oracle.com/solaris/
http://www.youtube.com/oraclesolaris

Oracle Linux resources
https://blogs.oracle.com/linux/
http://www.youtube.com/oraclelinuxchannel

Oracle Virtualization  resources
https://blogs.oracle.com/virtualization/
http://www.youtube.com/user/OracleVirtualization


I hope someone finds this useful.

Adding, Deleting or Changing a Group in UNIX

This is a little how to on creating, deleting or modifying a group on a UNIX based computer.

root@earth> /usr/sbin/groupadd -g # groupname
If you us -g the option, you will be able to set the GID for the group. If the GID is not set then the OS will choose one.

To delete a group.
root@earth> /usr/sbin/groupdel groupname

To change a group
root@earth> /usr/sbin/groupdel -g # -n newgroupname groupname
Use the -g option to change the group gid and use -n to change the name of the group.

Use these commands only for local accounts. If a network nameservice or directory server is running then use that service instead.

Getting NetBackup 7.5 files for install

We just upgraded our NetBackup from 7.1 to 7.5. These are my notes on upgrading our UNIX and Linux clients.

Go to https://fileconnect.symantec.com and download the required files. You will need to enter a serial number to get access to the files. As seen to the right.

After you download the files you will have to join them together before you can do a install.


Unix joining instructions:
cat "NB_CLT_7.5.0.4-tar-split.1of3" "NB_CLT_7.5.0.4-tar-split.2of3" "NB_CLT_7.5.0.4-tar-split.3of3" > "NB_CLT_7.5.0.4.tar"

now you are ready to begin the install.

Installing Sudo on Solaris 10

These are the notes on installing sudo on Solaris 10. In order to install sudo you will also need to install some dependencies. I have listed the needed packages below.

Packages

Package Name	Application	Description
SMCsudo	sudo	Provides limited super user privileges
SMClintl	libintl	GNU locale utilities, libintl.so.2
SMCliconv	libiconv	GNU iconv library, libiconv.so.2
SMCzlib	zlib	Zlib data compression library, libz.so.1
SMClgcc	libgcc	The GNU Compiler Collection, libgcc_s.so.1

Installing the packages
mv filename /tmp
cd /tmp
gunzip filename
pkgadd -d filename
Links to where you can get the packages.
www.sufreeware.com
  unixpackages.com paid site, the paid version of sunfreeware.

Add Zone Function to Solaris 10 Core build

These are my notes on adding the zone functionality to Solaris. Solaris 10 comes with six Software Groups. The Software Groups are, from lowest to highest, Reduced network Support, Core System Support, End User, Developer, Entire and Entire Plus OEM.

I installed Solaris 10 at the Core level. When I tried to install a zone it couldn't find the zonecfg command. This is because the packages needed to support zones are not install at this level. Below are the packages I install to in order to get zone functionality on my Solaris 10 server.

SUNWzoneu
SUNWzoner
SUNWpoolr
SUNWluzone
SUNWluu
SUNWlur
SUNWlucfg

Bash Shortcut keys

I found this little reference chart on the short cut keys in BASH. These short cut keys allow for command line editing. I for example use Ctrl + A all the time to edit the line.

Ctrl + A	Go to the beginning of the line you are currently typing on
Ctrl + E	Go to the end of the line you are currently typing on
Ctrl + L	Clears the Screen, similar to the clear command
Ctrl + U	Clears the line before the cursor position. If you are at the end of the line, clears the entire line.
Ctrl + H	Same as backspace
Ctrl + R	Let’s you search through previously used commands
Ctrl + C	Kill whatever you are running
Ctrl + D	Exit the current shell
Ctrl + Z	Puts whatever you are running into a suspended background process. fg restores it.
Ctrl + W	Delete the word before the cursor
Ctrl + K	Clear the line after the cursor
Ctrl + X	Then Backspace clear the line before the cursor
Ctrl + T	Swap the last two characters before the cursor
Esc + L	Changes to upper case
Esc + U	Changes to lower case
Esc + T	Swap the last two words before the cursor
Alt + F	Move cursor forward one word on the current line
Alt + B	Move cursor backward one word on the current line
Tab	Auto-complete files and folder names

Referance:
http://www.howtogeek.com/howto/ubuntu/keyboard-shortcuts-for-bash-command-shell-for-ubuntu-debian-suse-redhat-linux-etc/
I found this chart at the link above.

Mount an ISO in Solaris 10

Sometime I run into an issue were I need to install a program and the only installer I can find is on a CD or DVD. Unfortunately most servers don't have CD/DVD players. I can usually download the media, in the form of an ISO from the vender website. Then the issue is how do I get the application out of the ISO if you don't have a CD or DVD drive. Luckily for me, most UNIX based Operating Systems can mount a ISO. In much the same way you would mount an NFS (Network File System) or other external volumes, like a CD/DVD drive. As the title suggests this How-to will focus on doing this on a Solaris 10 server.

Mounting an ISO

# lofiadm -a /path/to/cd.iso
/dev/lofi/1
Now you can mount the ISO. # mount -o ro -F hsfs /dev/lofi/1 /mnt

Unmount and detach the images

# umount /mnt
# lofiadm -d /dev/lofi/1
Useful links
http://www.cyberciti.biz/faq/howto-mount-sun-solaris-cd-iso-image/
http://bradthemad.org/tech/notes/solaris_mount_iso.php

Make Firefox load ILOM pages, Part III

This yet anther way to make Firefox load the ILOM web interface properly. Posted below is a script my co-worker wrote. Basically it adds the content to the userContent.css file via this script. This way you don't have to edit the file manually, like you had to in my other post "Make Firefaox load ILOM pages".




export PROFILE_IDZ=$(grep Path= $HOME/.mozilla/firefox/profiles.ini | awk -F={`print $2`})
export FILE4FIXZ-"~/.mozilla/firefox/${PROFILE_IDZ}/chrome"

mkdir -p ${FILE4FIXZ}
touch ${FILE4FIXZ}/userContent.css

echo "@media print {" > ${FILE4FIXZ}/userContent.css
echo "}" >> ${FILE4FIXZ}/userContent.css
echo " " >>  ${FILE4FIXZ}/userContent.css
echo "@namespace url (https:www.w3.org/1999/xhtml);" >>  ${FILE4FIXZ}/userContent.css
echo "#mainpage { visibility: visible !important; }" >>  ${FILE4FIXZ}/userContent.css

cat  ${FILE4FIXZ}/userContent.css

If you have comments please post below.