Solaris Unlimited: Root Mirroring – Solaris Volume Manager

Solaris Unlimited: Root Mirroring – Solaris Volume Manager:

HOWTO: Mirrored root disk on Solaris

0. Partition the first disk # format c0t0d0 Use the partition tool (=> "p <enter>, p <enter>"!) to setup the slices. We assume the following slice setup afterwards: # Tag Flag Cylinders Size Blocks - ---------- ---- ------------- -------- -------------------- 0 root wm 0 - 812 400.15MB (813/0/0) 819504 1 swap wu 813 - 1333 256.43MB (521/0/0) 525168 2 backup wm 0 - 17659 8.49GB (17660/0/0) 17801280 3 unassigned wm 1334 - 1354 10.34MB (21/0/0) 21168 4 var wm 1355 - 8522 3.45GB (7168/0/0) 7225344 5 usr wm 8523 - 14764 3.00GB (6242/0/0) 6291936 6 unassigned wm 14765 - 16845 1.00GB (2081/0/0) 2097648 7 home wm 16846 - 17659 400.15MB (813/0/0) 819504 1. Copy the partition table of the first disk to its future mirror disk # prtvtoc /dev/rdsk/c0t0d0s2 fmthard -s - /dev/rdsk/c0t1d0s2 2. Create at least two state database replicas on each disk # metadb -a -f -c 2 c0t0d0s3 c0t1d0s3 Check the state of all replicas with metadb: # metadb Notes: A state database replica contains configuration and state information about the meta devices. Make sure that always at least 50% of the replicas are active! 3. Create the root slice mirror and its first submirror # metainit -f d10 1 1 c0t0d0s0 # metainit -f d20 1 1 c0t1d0s0 # metainit d30 -m d10 Run metaroot to prepare /etc/vfstab and /etc/system (do this only for the root slice!): # metaroot d30 4. Create the swap slice mirror and its first submirror # metainit -f d11 1 1 c0t0d0s1 # metainit -f d21 1 1 c0t1d0s1 # metainit d31 -m d11 5. Create the var slice mirror and its first submirror # metainit -f d14 1 1 c0t0d0s4 # metainit -f d24 1 1 c0t1d0s4 # metainit d34 -m d14 6. Create the usr slice mirror and its first submirror # metainit -f d15 1 1 c0t0d0s5 # metainit -f d25 1 1 c0t1d0s5 # metainit d35 -m d15 7. Create the unassigned slice mirror and its first submirror # metainit -f d16 1 1 c0t0d0s6 # metainit -f d26 1 1 c0t1d0s6 # metainit d36 -m d16 8. Create the home slice mirror and its first submirror # metainit -f d17 1 1 c0t0d0s7 # metainit -f d27 1 1 c0t1d0s7 # metainit d37 -m d17 9. Edit /etc/vfstab to mount all mirrors after boot, including mirrored swap /etc/vfstab before changes: fd - /dev/fd fd - no - /proc - /proc proc - no - /dev/dsk/c0t0d0s1 - - swap - no - /dev/md/dsk/d30 /dev/md/rdsk/d30 / ufs 1 no logging /dev/dsk/c0t0d0s5 /dev/rdsk/c0t0d0s5 /usr ufs 1 no ro,logging /dev/dsk/c0t0d0s4 /dev/rdsk/c0t0d0s4 /var ufs 1 no nosuid,logging /dev/dsk/c0t0d0s7 /dev/rdsk/c0t0d0s7 /home ufs 2 yes nosuid,logging /dev/dsk/c0t0d0s6 /dev/rdsk/c0t0d0s6 /opt ufs 2 yes nosuid,logging swap - /tmp tmpfs - yes - /etc/vfstab after changes: fd - /dev/fd fd - no - /proc - /proc proc - no - /dev/md/dsk/d31 - - swap - no - /dev/md/dsk/d30 /dev/md/rdsk/d30 / ufs 1 no logging /dev/md/dsk/d35 /dev/md/rdsk/d35 /usr ufs 1 no ro,logging /dev/md/dsk/d34 /dev/md/rdsk/d34 /var ufs 1 no nosuid,logging /dev/md/dsk/d37 /dev/md/rdsk/d37 /home ufs 2 yes nosuid,logging /dev/md/dsk/d36 /dev/md/rdsk/d36 /opt ufs 2 yes nosuid,logging swap - /tmp tmpfs - yes - Notes: The entry for the root device (/) has already been altered by the metaroot command we executed before. 10. Reboot the system # lockfs -fa && init 6 11. Attach the second submirrors to all mirrors # metattach d30 d20 # metattach d31 d21 # metattach d34 d24 # metattach d35 d25 # metattach d36 d26 # metattach d37 d27 Notes: This will finally cause the data from the boot disk to be synchronized with the mirror drive. You can use metastat to track the mirroring progress. 12. Change the crash dump device to the swap metadevice # dumpadm -d `swap -l tail -1 awk '{print $1}' 13. Make the mirror disk bootable # installboot /usr/platform/`uname -i`/lib/fs/ufs/bootblk /dev/rdsk/c0t1d0s0 Notes: This will install a boot block to the second disk. 14. Determine the physical device path of the mirror disk # ls -l /dev/dsk/c0t1d0s0 ... /dev/dsk/c0t1d0s0 -> ../../devices/pci@1f,4000/scsi@3/sd@1,0:a 15. Create a device alias for the mirror disk # eeprom "nvramrc=devalias mirror /pci@1f,4000/scsi@3/disk@1,0" # eeprom "use-nvramrc?=true" Add the mirror device alias to the Open Boot parameter boot-device to prepare the case of a problem with the primary boot device. # eeprom "boot-device=disk mirror cdrom net" You can also configure the device alias and boot-device list from the Open Boot Prompt (OBP a.k.a. ok prompt): ok nvalias mirror /pci@1f,4000/scsi@3/disk@1,0 ok use-nvramrc?=true ok boot-device=disk mirror cdrom net Notes: From the OBP, you can use boot mirror to boot from the mirror disk. On my test system, I had to replace sd@1,0:a with disk@1,0. Use devalias on the OBP prompt to determine the correct device path.

How To Update Kernel Patch in Solaris.

                                How To Update Kernal Patch in Solaris.

1.Take the backup from below files

  @ifconfig -a

  @uname -a

  @cat /etc/vfstab

  @df -h | wc -l

  @df -h

  @netstat -rn

  @backup filesystem

  @if it s in SVM --->metastat -p,metastat,metadb -i

  @Remove the root mirror (Edit the vfstab,system,dumpadm.conf file of secondary disk)

  @Check the current patch version

2.before patching you need to do in sanitory reboot in console (#init 6)

3.init 0--> why here init 0 means.If the server may happen not booted in single usermode

            we can go to alternate boot disk 1

4.OK> boot -s

it will ask the maintenance root passwd--> entire the root passwd

You will get the # prompt

make sure you should be in single user mode...Not in run level 3. 

 #who -r --> to check the run level

5.GO to te path where you downloaded cd /var/tmp/10_recommdended

6. ./installpatchset --s10 patchset

7.Once done down the machine in to OBP using #init 0 or restart the server using #init 6

8.Do the reconfiguration boot using --> #boot -r

9.Once box comes up check uname -a it will show the latest kernel level

10.If u had any problem after patching .U have to remove the new patch

    patchrm <newpatch>  & boot the system.

11. Get Validation from the Respective Application Team 

Recovery SMF depository in Solaris 10

                     Recovery SMF depository in Solaris 10

To Recover the SMF depository use below command:-
  #/lib/svc/bin/restore_depository
1.it will ask which option want restore like
2.You have type -->boot,manifest,-seed-,quit
3.select  your requirement
4.after it will get restart system automatically

How to reduce the Security risk in Solaris

                   How to reduce the Security risk in Solaris  - Generic OS Hardening steps

1.Apply recommendation patch cluster bundle regularly.
  It's very impartant bug fixes & security fix patches
2.Disable unused services which will make high risk
  like no longer used such NFS,NIS,Apache,sendmail,SNMP,Printer,Internet based services
3.disable inet services and use ssh for remote login and file server.
  It's better not to use telnet,ftp,rlogin services
4.There many parameters in solaris kernal which can be turned to increase the security
  Network parameters can be tuned using -->ndd command
  Other kernel parameters can modified using-->/etc/system file.
5.Network tweaks:-
  @ Disable IP forwarding on OS
  @ Protect against SYN floods attacks
  @ Reduce ARP timeouts
6.Restrict root to login only via console
  @ remove un-used users
  @ Restrict cron access from normal users and disable.rhosts
7.set warning banners in /etc/motd & /etc/issue
8.Increase the level of logging in system accounting,process accounting,kernal level auditing
9.create /etc/ftpd/ftpusers to restrict ftp to all users
10.Remove the group writable from all files in /etc
  # chmod -R g-w /etc
11.Disble un-used SMF services using -->svcadm command
12.use Solaris sercrity Toolkit (JASS)
13.Be caution with removable media devices.Stop "vold" if possible

14.Restrict access to TCP based network services by using TCP wrappers

Solaris administrator Day to Day activities

                                  Solaris administrator Day to Day activities
             
1. Check the status of all the servers (Health check)
   @Cpu,Memory ,processes,services & diskspace
2.Performance monitoring cpu & swap memory
3.File system usage monitoring & extension
4.User credentials and logons maintenance
5.Troubleshooting like server crash ,reboots,hardware problems
6.Network problem on the server.
7.Managing & configuration of SVM & Maintaining SVM Filesystem.
8. Managing zones creation deletion extension etc.
9. Doing Patch Management to the server.
10. Noramly general request Extending the file system & creating new mount point user administration.
11. If incident happens like server rebooted by itself any harware component failed
    raise Change Management  and Working with H/W vendor till close Change management.
12. Check the backup report (scheduled by crontab and ctrl-m)
   @ In my company Veritas netbackup 6.5 using for Backup
   @ Backup types will be BCV/Snap/Tape/D2D
   @ If any client backup fails i have to re-run if its hot backup
   @ otherwise inform the database or application team to re-run the bakup

Jump start installation step by step on Solaris 10

                  Jump start installation step by step
     
Introduction

The Solaris 10 Operating System offers an automatic installation process,
Solaris JumpStart software. The Solaris JumpStart procedure enables you to install the Solaris
OS automatically and configure it differently,
depending on the characteristics of client systems.
These identifying characteristics are used to select the correct configuration for each client system.

The following tasks are required to configure a single JumpStart server to provide
Basic software installation services using the JumpStart procedures:
1.Spool the operating system image.
2.Edit the sysidcfg file.
3.Edit the profile and rules.
4.Run the check script.
5.Run the add_install_client script.
6.Boot the client.

Basically work like this:-
1.Jumpstart reads the rules .ok file
2.Jumpstart finds the profile in rules.ok and use it for installation
3.Rules doesn't match ,regular interactive installation will occurs.

This document is a quick revision sheet, please refer to the sun documation regarding on how to install, configure and implement Solaris Jumpstart

Create the directory structure	mkdir -p /export/jumpstart/Solaris_8 mkdir /export/jumpstart/Solaris_10 mkdir /export/jumpstart/config mkdir /export/jumpstart/boot
Share out directories	# edit the /etc/dfs/dfstab file share -F nfs -o ro,anon=0 /export/jumpstart/
Create Install server	# Obtain the Solaris 8 CD's setup-install-server /export/jumpstart/Solaris_8 # Obtain the Solaris 10 CD's or DVD setup-install-server /export/jumpstart/Solaris_10
Add additional software	# Solaris normally comes on multiple CD's add-to-install-server /export/jumpstart/Solaris_8 # Solaris normally comes on multiple CD's add-to-install-server /export/jumpstart/Solaris_10
Copy the configuration and example scripts	The samples can be find in and should be copied to /export/jumpstart/config <your configured path>/Misc/jumpstart_sample
Create boot Servers	# If additonal boot servers are required setup-install-server -b /export/jumpstart/boot
Setup automatic system config	create the sysidcfg information in the /export/jumpstart/config directory (can use sysidconfig from other servers) Example sysidcfg file --------------------------------------------------------------------------------------- timezone=GB timeserver=localhost network_interface=primary {netmask=255.255.240.0 protocol_ipv6=no} terminal=vt100 security_policy=NONE name_service=NONE
Create profiles	# There are various examples on the CD's (directory) # profile keywords profile values # ----------------- -----------------   install_type initial_install   system_type standalone   partitioning default   filesys c0t0d0s0 4000 /   filesys c0t0d0s1 1000 swap   filesys c0t0d0s3 1000 /var   cluster SUNWcuser   cluster SUNWCacc   package SUNWman delete see link for more profile exmaples, you have used the SUNWcall cluster package for everything
Create Begin & Finish scripts	The scripts can be shell, perl, etc
Create rules file	The rules are based on keywords with values, begin script, profile, finish script hostname vclus1   -   cluster_profile  -
Check rules file	# Run the check script within the config directory, a file will be created called "rules.ok" check
Setup clients	# add_install_client is in Solaris_10/Tools directory ./add_install_client -e 8:0:20:7a:22:7e  -i 192.168.0.1 -t jump1:/export/jumpstart/Solaris_10/Tools/Boot -p jump1:/export/jumpstart/config -c jump1:/export/jumpstart/config -s jump1:/export/jumpstart/Solaris_10 newserver1 sun4u -e client ethernet address -i IP address of client -t install boot image path -p Profile Server:<path to sysidcfg file > -c Configuration Server:<custom jumpstart directory > -s Install Server:<OS Location> you could have obmitted the -e and -i options if you add them to /etc/ethers and /etc/hosts files Other useful options --------------------------------------------------------------------- -d specify as a DHCP client
check boot server	## to make sure that a boot server is on the network, yo can use the command rpcinfo -b bootparam 1

Jumpstart Process

Jumpstart Server/Client Process

Client sends a RARP for its IP address  The Boot Server responds via RARPD (in.rarpd) with the IP address in /etc/ethers or the ethers NIS/NIS+ map depending on the ethers setting in /etc/nsswitch.conf The client sends a tftp request for a bootimage The server starts in.tftp from inetd and sends the small net kernel image The client then starts bootparams client and requests boot info The server responds with the clients entry from /etc/bootparams The client NFS mount it’s root partition from the install server The client then mounts the configuration server (/jumpstart) and runs “sysidtool”.  It then mounts the install image and runs Suninstall to begin the install process.

Daemons used

Daemons Used

mountd nfsd rpc.bootparamd in.rarpd in.tftpd rpld (x86)

Files Used

Files Used

/tftpboot /rplboot /etc/inetd.conf /etc/ethers /etc/hosts /etc/bootparams

SVM Failed disk replacement on Solaris

                     SVM Failed disk replacement on Solaris
             
1.Take backup below file output:-
  a.metastat -p
  b.metastat -t
  c.metadb -i
  d.echo|fromat
  e.iostat -En
  f.ifconfig -a
2.Identify the failed disk by following commands:-
   #iostat -en
    — - errors —
    s/w h/w trn tot device
     6 50 0 6 c1t2d0

    #echo|format
    Indentifying the logs(/var/adm/message) & dmesg
3.detach the failed disk submirror
   #metadetach d0 d20
4.clear the submirror -->metaclear d20
5.delete the statedata base replica of failed disk
   #metadb -d -f c1t2d0s3
6.Remove hard drive from the tree in the sequence
  Incase the SCSI/SAS disk
  #cfgadm -al--->c0::dsk/c1t2d0 disk connected configured unknown
  #cfgadm -c unconfigure c0::dsk/c1t2d0)--->c1::dsk/c1t2d0 disk connected unconfigured unknown
  #cfgadm -z remove_device c0::dsk/c1t2d0 (for data disk only)

  In case of FCAL Sun 280R, V880, V490, V880, V890
  command sequence to replace the disks
  #luxadm -e port
  #luxadm probe(to display paths)
  #luxadm remove_device_F /dev/rdsk/c#t#d#s2
  #devfsadm -v -Cc disk (where:C=cleans dir:c=specify disk)
  #luxadm insert_device (optional)
7.Remove the disk from server
8.Insert the new disk
9.Configure the new disk
  #cfgadm -c configure c1:dsk/c1t2d0

Verify the device connected in device tree.-->cfgadm -al
10.Check the status in server by applying:
   #echo|format or #iostat -en
   if not visible
   #devfsadm -C -C disks
     or
   #devfsadm -c configure
11.Check the vtoc table for root disk and replaced disk if not same do below
   prtvtoc /dev/rdsk/c1t2d1s2 |fmthard -s - /dev/rdsk/c1t2d0s2
12.create the statedata base on replaced disk
   metadb -afc 3 /dev/dsk/c1t2d0s3
13.Reattach the mirror and wait until all mirrors will sycned
   #metainit d2 1 1 c1t2d0s0
   #metatttach d5 d2
   #metastat -ac or metastat -t to check the sycning status
 
14.safe to run metadevadm command to update the new ID
   #metadevadm -u
   #metadevadm -u /dev/dsk/c1t2d0