solaris

How to Manage Password Aging in Solaris, AIX, and Linux

/ Christopher Paquin

LogoIts possible that sometime in your short, meaningless life, you may need to create an account that has a password that is set to never expire. This is somethimes the case with headless accounts and specialty accounts such as the type you might have to setup for monitoring or security scanning. You might also find yourself setting up shared headless accounts that have locked passwords in order to block direct logins. This second scenario can be especially troublesome when this is some sort of application or database user with cron jobs, as even an account without a password and expire and lock. If this occurs all of a users cron jobs will fail. All because the account expired.

So today we are going to configure a user password not to expire.

Lets start with Solaris. First lets unlock the account just in case.

passwd -d username

Now you can turn off password aging for a user with the command below.

passwd -x -1 username

You can then verify your config with the following.

passwd -s dmadmin

The output of the command above should look similar to what I have below. In this example our user id is myuser.

#passwd -s myuser
myuser  PS

Compare what you see above to the output below for our example myuser1, which includes the date that the password was last changed, the minimum number of days between password changes, the maximum number of days required between password changes, and the number of days of warning a user is given before a password expires. Standard system password aging and expiration still applies.

#passwd -s myuser1
myuser1  PS    09/30/13     7    28     7

Now lets move on to Linux. First lets ulock. Then we will configure the password to not expire. Then we can verify our work with the chage -l command.

passwd -u username

chage -m 0 -M 99999 -I -1 -E -1 username

change -l username

So now lets take a visit to AIX land. Remember to not stay long. Again, its always best to make sure that the current password is not locked. Then we configure the password to not expire. Finally we step back and admire our work.

chuser account_locked=false username

chuser maxage=0 username

lsuser -f USERNAME | fgrep expires

Related articles

SuperUser in Linux
How to Unlock an account in Linux
How to Reset a Password on Unix
Much Todo About Linux/RHEL Passwords
Enycrypting Passwords Via SSL for Redhat Kickstart Configuration Files
How to disable an user account in Linux

Sudosh Make Me a Sandwich: Install and Configure Sudosh in Solaris 9/10

/ Christopher Paquin

SandwichWelcome to the way-back machine again. This time we are going to take a look at installing and configuring sudosh on Solaris with the purpose of using sudosh as a replacement for sudo (at least sudo to root). Using sudosh in this manner allows us to still allow users to become root, but also allows us to track each and every command that they run once they become root.

Note that there are a couple of ways to install sudosh: from source or from a package. I chose installing from a native solaris package for a couple of reasons.

  1. I found a package
  2. I would need a C compliler otherwise to compile it
  3. I had many systems on which to install sudosh

So the first think that I did was to install the package. Below I have dropped the package in /tmp and have gunzipped it.

# pkgadd -d ./sudosh2-1.0.2-sol10-sparc-local

Now, lets not be stupid, lets back up the sudoers file first.

# cd /usr/local/etc/

# cp sudoers sudoers.20140114

Now we can run visudo and modify the current sudoers file. First you should add the command alias below as it keeps things neat and simple.

Cmnd_Alias      SUDOSH=/usr/local/bin/sudosh

Now lets referece the alias that we created above in the User Privilege Section. Rinse and repeat for any user or group that is allowed to become root.

systems ALL=(ALL)       SUDOSH

Now we are going to make a modification to /usr/local/etc/sudosh.conf. Note that this step is not required. I am changing the default syslog facility used so that sudosh will log using the same facility as regular auth events.

syslog.priority         = LOG_INFO
syslog.facility         = LOG_AUTH

Now I am modifying my syslog.conf to ensure that all log messages of DEBUG level or higher are forwarded to my remote syslog hosts. This includes my sudosh events which have a priority of INFO. Note that spacing is very important in the solaris syslog.conf

#loghost
*.debug @loghost1
*.debug @loghost2

Since this is Solaris 10, we can restart syslog via svcadm

# svcadm restart svc:/system/system-log:default

 

FYI – Relevant xkcd here

 

Related articles

Sudo
Preparing a SUN/ORACLE Solaris server for SAN access – SAN step 4
Sun First Ever UltraSPARC-based Laptop

Solaris Package Management Cheat Sheet

/ Christopher Paquin / 1 Comment

packageBasic Solaris Package Management Commands

Show description about a package

pkginfo -l <pkg>

Install a package

pkgadd -d <pkg-file>

Remove a package

pkgrm <pkg>

Find package which owns a file

pkgchk -l -p <file>

List files installed by a package

pkgchk -l <pkg>|awk '/^Pathname/ {print $2}'

List files in package file

pkgchk -l -d <pkg-file>|awk '/^Pathname/ {print $2}'

List all installed packages

pkginfo

Verify integrity of installed files from a package

pkgchk <pkg>

Verify integrity of install files from all packages

pkginfo|awk '{print $2}'|xargs pkgchk

Solaris: How to Resize a Swap Partition….on a disk without any free slices

/ Christopher Paquin / 1 Comment

First lets detach the swap partition (submirror) on the secondary disk. Where d1 is the metadevice and d21 is the submirror

#metadetach d1 d21
d1: submirror d21 is detached

metaclear d21
d21: Concat/Stripe is cleared

Now lets format Secondary Disk (c1t1d1 in this example)

Below is the partition table of the disk that I am working with. Slice one will be resized using unallocated disk space. Add 1 to the last cylinder of slice 7 to determine your starting cylinder. In this case my new starting cylinder is 2691.

Total disk cylinders available: 14087 + 2 (reserved cylinders)
Part Tag Flag Cylinders Size Blocks
0 root wm 0 - 824 4.00GB (825/0/0) 8395200
1 swap wu 825 - 1031 1.00GB (207/0/0) 2106432
2 backup wm 0 - 14086 68.35GB (14087/0/0) 143349312
3 unassigned wm 1032 - 1038 34.78MB (7/0/0) 71232
4 var wm 1039 - 1657 3.00GB (619/0/0) 6298944
5 home wm 1658 - 2070 2.00GB (413/0/0) 4202688
6 stand wm 2071 - 2277 1.00GB (207/0/0) 2106432
7 stand wm 2278 - 2690 2.00GB (413/0/0) 4202688

Now resize the partition
In this case I am going to use the rest of the disk, which according to the information for partition two, ends @ cylinder 14087. Subtract 2691 from 14087, to determine how many cylinders your slice is going to be.

Enter partition id tag[swap]:
Enter partition permission flags[wu]:
Enter new starting cyl[825]: 2691
Enter partition size[2106432b, 207c, 1028.53mb, 1.00gb]: 11396c

Now save this new partition scheme

Enter table name (remember quotes): my_table

Then label your disk. As you can see below, my swap partition is now huge.

Part Tag Flag Cylinders Size Blocks
0 root wm 0 - 824 4.00GB (825/0/0) 8395200
1 swap wu 2691 - 14086 55.30GB (11396/0/0) 115965696
2 backup wm 0 - 14086 68.35GB (14087/0/0) 143349312
3 unassigned wm 1032 - 1038 34.78MB (7/0/0) 71232
4 var wm 1039 - 1657 3.00GB (619/0/0) 6298944
5 home wm 1658 - 2070 2.00GB (413/0/0) 4202688
6 stand wm 2071 - 2277 1.00GB (207/0/0) 2106432
7 stand wm 2278 - 2690 2.00GB (413/0/0) 4202688
Now lets Swap the Swap


First, reinitialize swap submirror.
metainit d21
d21: Concat/Stripe is setup

Add swap to new submirror

\swap -a /dev/md/dsk/d21

View swap

swap -l
swapfile dev swaplo blocks free
/dev/md/dsk/d1 85,1 16 2106416 2106416
/dev/md/dsk/d21 85,21 16 115965680 115965680

Remove the metadevice from swap

swap -d /dev/md/dsk/d1

Verify that previous step worked

swap -l
swapfile dev swaplo blocks free
/dev/md/dsk/d21 85,21 16 115965680 115965680

Clear Metadevice/Mirror

metaclear d1
Mirror is cleared
Clear Metadevice/submirror
metaclear d11
d11: Concat/Stripe is cleared

Format Primary Disk (c1t1d0 in this example)

Select a predefined table

partition> select
0. original
1. my_table
Specify table (enter its number)[0]: 1
View the partition table, and make sure it looks right.

Total disk cylinders available: 14087 + 2 (reserved cylinders)

Part Tag Flag Cylinders Size Blocks
0 root wm 0 - 824 4.00GB (825/0/0) 8395200
1 swap wu 2691 - 14086 55.30GB (11396/0/0) 115965696
2 backup wm 0 - 14086 68.35GB (14087/0/0) 143349312
3 unassigned wm 1032 - 1038 34.78MB (7/0/0) 71232
4 var wm 1039 - 1657 3.00GB (619/0/0) 6298944
5 home wm 1658 - 2070 2.00GB (413/0/0) 4202688
6 stand wm 2071 - 2277 1.00GB (207/0/0) 2106432
7 stand wm 2278 - 2690 2.00GB (413/0/0) 4202688

Label disk
partition> label
Ready to label disk, continue? y

Put things back the way they were.

Reinitialize the swap submirror on the primary disk

metainit d11
d11: Concat/Stripe is setup

Reinitialize Metadevice Mirror

metainit d1
d1: Mirror is setup

Add the metadevice to swap
swap -a /dev/md/dsk/d1

… and verify that it took

swap -l
swapfile dev swaplo blocks free
/dev/md/dsk/d21 85,21 16 115965680 115965680
/dev/md/dsk/d1 85,1 16 115965680 115965680

Remove the submirror that you added to swap in the step above

swap -d /dev/md/dsk/d21

Reattach Submirror d21 to Mirror d1

metattach d1 d21
d1: submirror d21 is attached

Redefine dump device

dumpadm -d swap
Dump content: kernel pages
Dump device: /dev/md/dsk/d1 (swap)
Savecore directory: /var/crash/blahblah
Savecore enabled: yes

Related articles

SwapFaq’s
Repartitioning a Linux Cloud Server
HomeLab: Cisco Switch Boot Alternate IOS Image
Solaris 9 Scan for New SAN Luns & and Vertias Volume Manager Quick Start

Solaris Soft and Hard Limits

/ Christopher Paquin / Leave a comment

Handle_2

Hard limits are a kernel-configurable item, and users can’t exceed them. Soft limits are the user defaults, and users can change that using the ulimit program or the limit/unlimit builtins.

Basically, soft limits can be changed to anything up to the hard limit. Think of soft limits as the warning barrier. When a user reaches the soft limit they will get an warning message but are still allowed to use more space up to the hard limit.

Also, you can configure the system to set expiration times for users who have exceeded their soft limit. You can set both soft and hard limits. The system will not allow a user to exceed his or her hard limit. However, a system administrator may  set a soft limit (sometimes referred to as a quota), which the user can temporarily exceed. The soft limit must be less than the hard limit.

Use ulimit -a to check soft limits, and ulimit -Ha to check hard limits. These values will display as open files.

You can set these values by placing the following entries in /etc/system.

This will require a reboot

[code language=”css”]
set
rlim_fd_max=8192
set rlim_fd_cur=256
[/code]

Note that rlim_fd_max is the hard limit, and rlim_fd_cur is the current limit (or soft limit)

Sun 5220 Console and ILOM How To

/ Christopher Paquin / Leave a comment

solaris_logo

As far as I know this documentation is specific to Sun T5150s and Sun T5250s. However some of the information below may also pertain to other Sun systems running ILOM.

ILOM Commands

To power on the host, type:

start /SYS

To power off the host, type:

stop /SYS

To reset the host, type:

reset /SYS

How to set the system not to auto boot the OS

Example:

-> set /HOST/bootmode script=”setenv auto-boot? false”

Press Enter and then type:

-> reset /SYS

Accessing the Console from ILOM

start /SP/console

Configuring a Static IP Address Using CLI and Ethernet

Log in to the ILOM using Secure Shell (SSH) over the network, or
by connecting a terminal to the serial port. To establish a Secure Shell (SSH)
connection to the CLI, type the appropriate connection command in the
SSH application. For example, to connect to the ILOM with an IP address
of 129.144.82.20, type the following command:

# ssh -l root 129.144.82.20

Type the following command to set the working directory.

cd /SP/network

Type the following commands to specify a static Ethernet
configuration.

Note – The following values are samples only. You must specify the IP
address, netmask, and gateway appropriate for your ILOM and network
configuration.

set pendingipaddress=129.144.82.26
set pendingipnetmask=255.255.255.0
set pendingipgateway=129.144.82.254
set pendingipdiscovery=static
set commitpending=true

Solaris HBA Notes

/ Christopher Paquin / Leave a comment

Below is a cheat sheet that I put together of commands that are helpful for managing HBAs on Solaris.

Helpful Commands

  • luxadm probe
  • luxadm -e port
  • devfsadm

More Helpful Commands

  • To show Sun/Qlogic HBA’s:

luxadm qlgc

  • To show all vendor HBA’s — see sample output below:

luxadm fcode_download -p

Found Path to 0 FC100/S Cards

Complete

Found Path to 5 FC100/P, ISP2200, ISP23xx Devices

Opening Device: /devices/pci@9,600000/SUNW,qlc@2/fp@0,0:devctl

Detected FCode Version:       ISP2200 FC-AL Host Adapter Driver: 1.14 01/11/20

Opening Device: /devices/pci@8,700000/SUNW,qlc@5,1/fp@0,0:devctl

Detected FCode Version:       ISP2312 Host Adapter Driver: 1.14.09 03/08/04

Opening Device: /devices/pci@8,700000/SUNW,qlc@3,1/fp@0,0:devctl

Detected FCode Version:       ISP2312 Host Adapter Driver: 1.14.09 03/08/04

Opening Device: /devices/pci@8,700000/SUNW,qlc@3/fp@0,0:devctl

Detected FCode Version:       ISP2312 Host Adapter Driver: 1.14.09 03/08/04

Opening Device: /devices/pci@8,700000/SUNW,qlc@5/fp@0,0:devctl

Detected FCode Version:       ISP2312 Host Adapter Driver: 1.14.09 03/08/04

Complete

  • Another Method of doing the same thing as above:

prtpicl -v > filename

  • To show link status of card:

luxadm -e port

  • See WWNS:

To see the WWN’s (using address given to you from previous commands), it is
the last one that specifies it is a HBA, so the port WWN here is 210000e08b100d16

# luxadm -e dump_map /devices/pci@1f,0/pci@1/SUNW,qlc@1/fp@0,0:devctl

Pos Port_ID Hard_Addr Port WWN Node WWN Type

0 10600 0 224100015d210900 220000015d210900 0x1f (Unknown Type)

1 10700 0 210000e08b103417 200000e08b103417 0x1f (Unknown Type)

2 10800 0 210000e08b100d16 200000e08b100d16 0x1f (Unknown Type,Host Bus Adapter

Configuring storage online

  • List unconfigured disks

cfgadm -al

Ap_Id Type Receptacle Occupant Condition

c0 scsi-bus connected configured unknown

c0::dsk/c0t0d0 disk connected configured unknown

c0::dsk/c0t2d0 CD-ROM connected configured unknown

c1 fc-fabric connected unconfigured unknown

c1::210000e08b103417 unknown connected unconfigured unknown

c1::224100015d210900 unknown connected unconfigured unknown

c2 fc-fabric connected unconfigured unknown

c2::210100e08b303417 unknown connected unconfigured unknown

c2::223100015d210900 unknown connected unconfigured unknown

So we can see that c1 and c2 are both unconfigured disks, so we now run the command below to configure them.

# cfgadm -f -c configure c1 c2

You can now run devfsadm.

Example cfgadm -al

c1                             fc-private

c1::21000020379cb9bb           disk         connected    configured   unknown

c4                             fc-fabric    connected    unconfigured unknown

c5                             fc           connected    unconfigured unknown

C1 is a 280r internal controller
C4 is a HBA attached to a switch with no targets
C5 is a HBA that has nothing connected

More Good Stuff

1) The command cfgadm -al

2) look for the fc-fabric

c2                             fc-fabric    connected

c3                             fc-fabric    connected

3) and then cfgadm -cconfigure c2 c3

4) Now you see the LUN

A Magical File – Check it Out

/kernel/drv/sd.conf

Checking IO on Fibre Cards

iostat -xcn 5

San Foundation Kit

You get this from Sun, install it after you install the drivers
There is no SAN foundation kit for Solaris 10. Installing the SAN foundation
kit will do bad things. It’s only for Solaris 8 and Solaris 9.

Get the WWN

 Method 1:

 

$ luxadm probe
$ luxadm -e port

$ luxadm -e dump_map <xyz> where xyz= your connected port.

Method 2:

bash-2.03# cat /var/adm/messages | grep -i WWN

Sep 20 18:23:28 alautpnc003 qlc: [ID 657001 kern.info] Qlogic qlc(0) WWPN=210000e08b934ead : WWNN=200000e08b934ead

Sep 20 18:23:39 alautpnc003 qlc: [ID 657001 kern.info] Qlogic qlc(1) WWPN=210100e08bb34ead : WWNN=200100e08bb34ead

Method 3:

#modinfo | grep SunFC

46 10274e94 20010 172 1 fcp (SunFC FCP v20050926-1.86)

47 10269923 8204 – 1 fctl (SunFC Transport v20050926-1.36)

51 1028b850 15e28 171 1 fp (SunFC Port v20050926-1.53)

53 10300f09 c5024 175 1 qlc (SunFC Qlogic FCA v20051013-2.08)

Method 4:

cfgadm -o show_FCP_dev -al

Method 5:

prtconf -pv | grep -i wwn | grep -i port