Limiting the size of a ZFS filesystem

And here is another quickie:

So, you created a zfs filesystem and realized you forgot to size it, or at least limit how much space in the pool it can use:

# df -h
[...]
storagepool/hosts/scan
                        67G    20K    63G     1%    /export/hosts/scan
storagepool/hosts/scan/local
                        67G    18K    63G     1%    /export/hosts/scan/local
#

Fear not for we have a way around it. Doesn't it look like we want to put a quota on that filesystem? If so, why not use the quota option in the zfs set command?

# zfs set quota=4G storagepool/hosts/scan
# df -h
[...]
storagepool/hosts/scan
                       4.0G    20K   4.0G     1%    /export/hosts/scan
storagepool/hosts/scan/local
                       4.0G    18K   4.0G     1%    /export/hosts/scan/local
#

Note that storagepool/hosts/scan/local, which is inside storagepool/hosts/scan, was also resized.

References

Setting Quotas on ZFS File Systems

Poor Man's LDAP Replication checker (Kerberos Involved!)

Warning: this article is a bit short, perhaps even curt. As such it might brush over too many concepts and assume you know how to setup replication in ldap. You have been warned!

If you are using ldap, you probably want to have more than one ldap server. You know, one dies and the other takes over kinda thing. Now, that involves some means to keep the ldap databases in the different ldap servers in sync. Currently the preferred method is called syncrepl, and you can find info on setting it up online (I might add some thoughts on that later). Problem is you need to make sure they are all in sync.

One way to do so is by monitoring the contextCSN. So if you have two ldap servers, master.domain.com and slave.monetra.com (let's say, as the name implies, we have a master and a slave ldap servers), after you start replication you could go to master and do:

ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base contextCSN
dn: dc=domain,dc=com
contextCSN: 20120113185836.364944Z#000000#000#000000

Then you would go to the slave and run the same command. And then compare the output, namely the funny number after contextCSN:, between the two. If they match, all should be well. If not, time to go check the log files in the two machines; depending on how you set it up, that would mean starting with auth.log and syslog.

Now we know what we need, what if we could make a little script to compare these values between all the ldap servers you have (that are replicating)? Well, we should be able to connect to those ldap servers from any machine that can do so, and query for contextCSN. And then, it is a matter of comparing them. In the following script, let's assume we have 3 ldap servers: one master and two slaves.

#!/bin/bash

# KRB5CCNAME=/tmp/host.tkt
LDAPs=( master.domain.com slave1.domain.com slave2.domain.com )
LDAP_NUMBER=${#LDAPs[@] }
ldap_reply[0]="";

function getLDAPinfo()
{
   local i
   for ((i=0; i < ${LDAP_NUMBER}; i++))
      do
         ldap_reply[$i]=`ldapsearch -z1 -LLLQ -H ldap://${LDAPs[$i]} -s base contextCSN | grep contextCSN | awk '{ print $2 }'`
         echo ${ldap_reply[$i]}
   done
}

function checkSyncStatus()
{
   local i
   local j
   for ((i=0; i < ${LDAP_NUMBER} -1; i++))
      do
         echo -n "$i x "
         for ((j=$i + 1; j < ${LDAP_NUMBER} ; j++))
            do
               echo -n " $j"
               if [[ "${ldap_reply[$i]}" != "${ldap_reply[$j]}" ]]; 
                  echo -n "(Bad)"
               else
                  echo -n "(Ok) "
               fi
         done
         echo
   done
}

echo "Number of LDAP servers: ${LDAP_NUMBER}"
getLDAPinfo
checkSyncStatus

Note the arguments for ldapsearch might change a bit (you might need a -x -Z or whatever; you know what you need to do to run ldapsearch in your environment). If the three machines are in sync, when you run the above code, the output should look something like:

Number of LDAP servers: 3
20120113185836.364944Z#000000#000#000000
20120113185836.364944Z#000000#000#000000
20120113185836.364944Z#000000#000#000000
0 x  1(Ok) 2(Ok)
1 x  2(Ok)

Now, the code is not complete, and that is for a reason. I really wanted to show what it is doing. The echo "Number of LDAPs: ${LDAP_NUMBER}" is there just to verify the number of ldap servers: we have 3 and in the LDAPs array they would be [0], [1], and [2]. It should be commented out/not be there in the production version of the script. The echo statement in getLDAPinfo() is there just to show the output of (and how to get said output) the ldapsearch command so you can see they are all matching; you can also take it off. And the same goes for the echo statements in getLDAPinfo. What they allow is to show which contextCSN values we are comparing, and whether they match ((Ok)) or not. Note we are checking not only the master with each slave but each slave against the others. It is a bit overkill but why not?

As I said, this code is incomplete; what you would need to do, after removing/commenting out the echo statements, is to decide how to use this information. What I have done is when ${ldap_reply[$i]} != ${ldap_reply[$j]}, it then writes down a message saying the contextCSN values for LDAPs[$i] and LDAPs[$j] do not match in an email that is then sent to me. Maybe you want to do something else, but you get the idea.

The only missing step now is to create a cron job to call this script every so often.

Ok, smart guy, you might say, what about the kerberos part you mentioned on the title? Well, if you go back to the script, you will notice a line containing KRB5CCNAME=/tmp/host.tkt commented out. We authenticate ldap access against kerberos. Also, since each machine has its own kerberos principal and keytab, we use it to create a kerberos cache named /tmp/host.tkt:

FQDN=$(hostname -f)
sudo kinit -k -t /etc/krb5.keytab -c /tmp/host.tkt "host/$FQDN@DOMAIN.COM"

which is owned by the root users and used by different services in each ldap/kerberos client. Well, if it is there, we might as well use it, right?

screen + minicom (how to get out of)

So, I did it again. You see, I like to use minicom as a terminal program since it plays nice with my usb-to-serial cables and my serial devices (Sun and AIX workstations, Seagate Dockstar, Pogoplug, routers, switches). And I have used it long enough to remember some of the commands. I also like screen, which allows me to run multiple sessions on different machines and stop and resume them as needed; kinda like running vnc/rdp but in command-line.

The problem begins when I try to use them together. I really should not do that because you can connect to a serial port from screen by doing something like

:screen /dev/ttyUSB0 115200

(some devices I use have their default port speed set to 9600, others like the one in this example to 115200)

But, force of habit (read: lazyness) or distraction (did you see that ant crawling up the wall?) caused me to start minicom right in screen. At first that does not seem to be a bad idea; after all, it would be nice to connect to the console of, say, a Brocade fabric switch, start something there, log out, and then come back to it later. But, problem is that screen and minicom by default use the same CTRL-A sequence to enter commands. So, if I want to send a CTRL-A X (exit) to minicom, screen will think I am talking to it and then lock the screen. Not fun.

Some of you will argue that I could remap the escape sequences for each program so they will not match, but hindsight is 20/20: it does not do me any good once they are already running inside each other. Another option would be to close that screen session, which would quit minicom... but not gracefully. As a result, that serial port (/dev/ttyUSB0 in my case. Yes, it is USB but you know exactly what I am talking about) would not be freed even if I remove the serial-to-USB cable. We need something better.

If we look at the screen man page, we will find the escape sequence CTRL-a a. What it does is send a CTRL-a escape to the screen session, so whatever program running in that session can grab and run away with it. So, what we want to do is probably CTRL-a a x, which should quit minicom. Now, the trick here is speed: you have to press CTRL-a together, then immediately a and then x. It took a while for me because I was either not typing fast enough or just mashing keys together. But, once I got it just right, I was rewarded with the minicom quit dialog box:

+----------------------+
|    Leave Minicom?    |
|     Yes       No     |
+----------------------+

And now I was able to properly quit minicom. Life was good once again.

Do I plan on running minicom inside screen again? Not if I can avoid it. But, if I can't, now I have a way out.

Getting a program/package off the Solaris install CDs

Let's say for whatever reason -- in my case I did a really bare install of Solaris 10 -- you just realized you need a program from the Solaris install CDs/DVDs. How to get it? But, let's make it a bit more challenging: first of all, you can't use Sunfreeware; maybe they just do not have it. Second, the Solaris box you want to put this program in does not have a CD/DVD drive.

Well, we need to start somewhere; how about trying to figure out the name of the package? Yes, you can say some package names reflect the name of the program. But, there are those times the program you want is part of a larger package.

So, we need to cheat.

If you are really luck, you either have or know someone who does have access to another Solaris box which has the program. Then they can use pkgchk ask which package the program in question belongs to. For instance, which package does truss belong to? Let's find out:

# pkgchk -lp `which truss`
Pathname: /usr/bin/truss
Type: linked file
Source of link: ../../usr/lib/isaexec
Referenced by the following packages:
        SUNWtoo        
Current status: installed

#

Ok, we now know truss belong to the package SUNWtoo. Now, we need to get the install CDs and mount them somewhere. I know you can mount them in Solaris (duh!) and in Linux; I have not tried in Windows or OSX. But, let's say you were successful and mounted Disk 1. Now you need to go to the Solaris_10/Product/ directory, where you will find a bunch of directories, each of them has the name of a package. If the package you want is not in this disk, try another one; it better be somewhere, right? In my case, Solaris_10/Product/SUNWtoo is what I want. I tar'ed the package and then copied it to the problematic Solaris box. After untar'ing into the /tmp directory, I then need to install the said package:

# cd /tmp
# tar xf SUNWtoo.tar
# pkgadd -d . SUNWtoo    

Processing package instance  from 

Programming Tools(sparc) 11.10.0,REV=2005.01.21.15.53
Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
Using  as the package base directory.
## Processing package information.
## Processing system information.
   10 package pathnames are already properly installed.
## Verifying package dependencies.
## Verifying disk space requirements.
## Checking for conflicts with packages already installed.
## Checking for setuid/setgid programs.

This package contains scripts which will be executed with super-user
permission during the process of installing this package.

Do you want to continue with the installation of  [y,n,?] y

Installing Programming Tools as 

## Installing part 1 of 1.
1982 blocks
## Executing postinstall script.

Installation of  was successful.
# 

So, is it installed? Let's find out!

# pkginfo -x SUNWtoo
SUNWtoo  Programming Tools
         (sparc) 11.10.0,REV=2005.01.21.15.53
# which truss
/usr/bin/truss
# 

ZFSing around (or, using ZFS under Solaris)

ZFS is a different file system than the old UFS. Best way to describe it is to think on it as a file system with LVM built on it. If you know LVM, you will understand what I am trying to say and recognize a lot of things here. If not, I promise that soon I will try to talk about it and compare ZFS, Linux LVM, and AIX LVM. For now, accept my simplistic explanation:

Logical Volume Manager, or LVM, is a way the separate the physical storage (think hard drives and networks drives and such things) from the storage seen by the user. In other words, what the users see is a pseudo disk (or logical volume if we are to use its terminology) of sorts which can be made of a collection of other disks, raid arrays, or just partitions of those disks. Now, while Linux LVM provides the logical disk which is then formatted and partitioned as they were normal disks, in ZFS these two steps are done become just one.

I think this will make sense using an example: in this Solaris 10 machine, we have two 73GB SCA hard drives. One of which, c0t0d0 (yes, Sun likes to call their drives differently than everybody else. We will talk about that in some other episode. For now, it suffices to say that d0 is the SCSI disk with SCSI ID 0), was formated as ZFS during the installation of the operating system and currently looks like this:

# df -h
Filesystem             size   used  avail capacity  Mounted on
boot/ROOT/root          67G   6.8G    40G    15%    /
/devices                 0K     0K     0K     0%    /devices
ctfs                     0K     0K     0K     0%    /system/contract
proc                     0K     0K     0K     0%    /proc
mnttab                   0K     0K     0K     0%    /etc/mnttab
swap                   1.9G   1.4M   1.9G     1%    /etc/svc/volatile
objfs                    0K     0K     0K     0%    /system/object
sharefs                  0K     0K     0K     0%    /etc/dfs/sharetab
fd                       0K     0K     0K     0%    /dev/fd
boot/ROOT/root/var      67G   727M    40G     2%    /var
swap                   1.9G    32K   1.9G     1%    /tmp
swap                   1.9G    40K   1.9G     1%    /var/run
boot                    67G   176K    40G     1%    /boot
boot/export             67G    20K    40G     1%    /export
boot/export/home        67G    15G    40G    28%    /export/home
# 

Then we have c0t1d0, also a 73GB HD that we plan to add to the hard drive. For this machine, I would like to have the following layout:

/
/var
/tmp
/export/home   (accounts)
/export/hosts  (virtual hosts, in case we have them)
/export/images (as this may end up being a netboot/jumpstart server)

Each of those would reside in a separate partition. Some of that has already been taken care of by Solaris' default install, but we are left with /export/hosts and /export, which will be run off c0t1d0. Before ZFS, we would divide the hard drive using format into two partitions and would edit /etc/vfstab to mount the two partitions at boot time:

# cat /etc/vfstab                      
#device         device          mount           FS      fsck    mount   mount
#to mount       to fsck         point           type    pass    at boot options
#
fd      -       /dev/fd fd      -       no      -
/proc   -       /proc   proc    -       no      -
/dev/zvol/dsk/boot/swap -       -       swap    -       no      -
/devices        -       /devices        devfs   -       no      -
sharefs -       /etc/dfs/sharetab       sharefs -       no      -
ctfs    -       /system/contract        ctfs    -       no      -
objfs   -       /system/object  objfs   -       no      -
swap    -       /tmp    tmpfs   -       yes     -
/dev/dsk/c0t1d0s4     /dev/rdsk/c0t1d0s4      /export/hosts        ufs     2       yes     -
/dev/dsk/c0t1d0s6     /dev/rdsk/c0t1d0s6      /export/images       ufs     2       yes     -
# 

but, in ZFS things are a bit different. First we need to create the pseudo disk mentioned above. In ZFS terminology that is called a pool; I guess they want to remind us that you usually create it by adding disks to it. So we create the pool, which shall be named storagepool. By now you may have realized that boot is the name of the pool created during the installation of the operating system.

# zpool create  storagepool c0t1d0
# df -h
Filesystem             size   used  avail capacity  Mounted on
boot/ROOT/root          67G   6.8G    40G    15%    /
/devices                 0K     0K     0K     0%    /devices
ctfs                     0K     0K     0K     0%    /system/contract
proc                     0K     0K     0K     0%    /proc
mnttab                   0K     0K     0K     0%    /etc/mnttab
swap                   1.9G   1.4M   1.9G     1%    /etc/svc/volatile
objfs                    0K     0K     0K     0%    /system/object
sharefs                  0K     0K     0K     0%    /etc/dfs/sharetab
fd                       0K     0K     0K     0%    /dev/fd
boot/ROOT/root/var      67G   727M    40G     2%    /var
swap                   1.9G    32K   1.9G     1%    /tmp
swap                   1.9G    40K   1.9G     1%    /var/run
boot                    67G   176K    40G     1%    /boot
boot/export             67G    20K    40G     1%    /export
boot/export/home        67G    15G    40G    28%    /export/home
storagepool             67G    19K    67G     1%    /storagepool
#

You may have noticed that the pool we created, storagepool is also a filesystem: as soon as we created the pool, it becomes a filesystem mounted under /storagepool. That is different than what is done under Linux LVM, where you would first create the pool, then partition and format that pool into the partitions you are going to use, and then mount them using /etc/fstab (the Linux equivalent to /etc/vfstab and mount -a. In Solaris and ZFS, on the other hand, that is done with just one command. I mean, we did not even have to edit /etc/vfstab. The current list of ZFS mountpoints defined can be seen using zfs filelist:

# zfs list
NAME                 USED  AVAIL  REFER  MOUNTPOINT
boot                26.5G  40.5G   176K  /boot
boot/ROOT           7.46G  40.5G    18K  legacy
boot/ROOT/root      7.46G  40.5G  6.75G  /
boot/ROOT/root/var   727M  40.5G   727M  /var
boot/dump           2.00G  40.5G  2.00G  -
boot/export         15.0G  40.5G    20K  /export
boot/export/home    15.0G  40.5G  15.0G  /export/home
boot/swap              2G  42.5G    16K  -
storagepool         89.5K  66.9G     1K  /storagepool
# 

If you remember, from storagepool we will be creating /export/hosts. That is done as follows:

# zfs create storagepool/hosts
# df -h
Filesystem             size   used  avail capacity  Mounted on
boot/ROOT/root          67G   6.8G    40G    15%    /
/devices                 0K     0K     0K     0%    /devices
ctfs                     0K     0K     0K     0%    /system/contract
proc                     0K     0K     0K     0%    /proc
mnttab                   0K     0K     0K     0%    /etc/mnttab
swap                   1.9G   1.4M   1.9G     1%    /etc/svc/volatile
objfs                    0K     0K     0K     0%    /system/object
sharefs                  0K     0K     0K     0%    /etc/dfs/sharetab
fd                       0K     0K     0K     0%    /dev/fd
boot/ROOT/root/var      67G   727M    40G     2%    /var
swap                   1.9G    32K   1.9G     1%    /tmp
swap                   1.9G    40K   1.9G     1%    /var/run
boot                    67G   176K    40G     1%    /boot
boot/export             67G    20K    40G     1%    /export
boot/export/home        67G    15G    40G    28%    /export/home
storagepool             67G    19K    67G     1%    /storagepool
storagepool/hosts       67G    18K    67G     1%    /storagepool/hosts
#

If we just leave at that, a mount point, /storagepool/hosts, is created. But, we really do not want that. We want to mount storagepool/hosts in /export/hosts, and mount we shall.

# zfs set mountpoint=/export/hosts storagepool/hosts
# 

Now, it seems to be mounted where we want

# df -h
Filesystem             size   used  avail capacity  Mounted on
boot/ROOT/root          67G   6.8G    40G    15%    /
/devices                 0K     0K     0K     0%    /devices
ctfs                     0K     0K     0K     0%    /system/contract
proc                     0K     0K     0K     0%    /proc
mnttab                   0K     0K     0K     0%    /etc/mnttab
swap                   1.9G   1.4M   1.9G     1%    /etc/svc/volatile
objfs                    0K     0K     0K     0%    /system/object
sharefs                  0K     0K     0K     0%    /etc/dfs/sharetab
fd                       0K     0K     0K     0%    /dev/fd
boot/ROOT/root/var      67G   727M    40G     2%    /var
swap                   1.9G    32K   1.9G     1%    /tmp
swap                   1.9G    40K   1.9G     1%    /var/run
boot                    67G   176K    40G     1%    /boot
boot/export             67G    20K    40G     1%    /export
boot/export/home        67G    15G    40G    28%    /export/home
storagepool             67G    19K    67G     1%    /storagepool
storagepool/hosts       67G    18K    67G     1%    /export/hosts
#

Neat, huh? There is more we can do, like establish quotas and such stuff. But that will be for another episode.

Some parting thoughts

Remember that Sun call boot and storagepool pools. Even though we've only used one disk per pool, we could have used more. For instance, we could have grouped them together like in Linux LVM,

# zpool create  anotherpool c0t0d0 c0t1d0
# 

or, we could have made a pool where one of the disks mirrors the other, as in a raid 1

# zpool create  anotherpool mirror c0t0d0 c0t1d0
# 

Another option is instead of doing a mirror is to create a raid 5 (Sun claims it is a variation of raid 5, bigger, faster, better) using the raidz option and at least 3 drives (min for such raid),

# zpool create  anotherpool raidz c0t0d0 c0t1d0 c0t2d0
# 

We could also create hotspares for those arrays; check the man page for zpool for more info on that. I hope that will make you think on what ZFS can do and why I think it is rather neat.

Of Macs and serial ports

My trusty iBook, as all Macintosh computers manufactured in the last few years, have no serial port. That has never stopped me from doing work as I had a Linux laptop, a Dell Latitude D600, which I would bring whenever I needed to talk to a Cisco switch or use as console for a Unix workstation (say, Sun Solaris or IBM AIX box).

But, then, the Dell laptop died. And I needed to configure a cisco switch from scratch... at least configure it enough so I could then telnet to it. To do that I needed to connect the famous Cisco blue console cable to the Mac. I needed a usb-to-serial cable.

Not knowing where to find one of those usb-to-serial cables, I decided to try one of my favorite places: geeks.com. I not only found it but here is a picture of the cable:

Clicking on the image *should* lead you to the link for the cable. After I received it, I connected it to the Mac. The laptop was aware of the device, even recognizing its chipset. But, it would not be available for use. Here is what I mean:

Mireille:~ dalek$ ls /dev/tty.*
/dev/tty.Bluetooth-Modem                /dev/tty.Nokia6103-NokiaPCSuite-1
/dev/tty.Bluetooth-PDA-Sync             /dev/tty.modem
/dev/tty.Nokia6103-Dial-upnetwor-2
Mireille:~ dalek$ 

Clearly, I need a driver for it. Examining the information shown by the machine about the driver, we see the chipset is made by prolific. After a bit of searching online, I found the manufacturer's site and downloaded the drivers from its site. Do note in that page that they also have drivers for Windows and even Linux. I do not know if Linux would ever need such a driver; finding that out is for a different episode. Anyway, after installing it, we had to reboot the laptop. After that, it was time to connect the usb-to-serial cable and find out if it was seen as a device we could use. Can you spot the new entry?

Mireille:~ dalek$ ls /dev/tty.*
/dev/tty.Bluetooth-Modem                /dev/tty.Nokia6103-NokiaPCSuite-1
/dev/tty.Bluetooth-PDA-Sync             /dev/tty.modem
/dev/tty.Nokia6103-Dial-upnetwor-2      /dev/tty.usbserial
Mireille:~ dalek$ 

Now we have a device, tty.usbserial, we can try it out. We could install minicom using fink, but we can be a bit lazy and use, of all things, screen. Believe it or not, screen can also be used to connect to a terminal device. So, if you type something like

Mireille:~ dalek$ screen /dev/tty.usbserial 9600

you would be telling screen to connect to our usb-to-serial cable, identified as tty.usbserial, at 9600baud which happens to be the default port speed for a Cisco switch. Neat, huh?

Backing up 2: TSM

TSM is IBM's backup solution. It is a really nice setup when you have a large mixed network whose workstations and server you want to backup. As in many backup packages, we have two parts: server and client. All the important configuration details -- when to backup and what -- is stored in the server; the client does not know much about besides how to authenticate and such stuff. The best way to have it working is when the server contacts each client at the scheduled time and start pulling the files out. This way the server can keep a grip on the load while there is not much work to be done in the client.

In this installment we will talk about the client, which in TSMese is known as a node.

Client setup and install

First thing we need to do is to install the TSM client in the machine we want to backup. The client is freely available at the IBM website. You probably want to get the latest version. Also do notice they have clients for OSX, Linux, Windows, and Solaris, just to name a few operating systems. Installation varies with the client OS. In the case of Linux, you would download and install a few rpms, so you may want to make sure you know how to install an rpm. The proper thing to do is to read up on it, say, its manpage. The quick-and dirty way is to try something like this:

# rpm -i package.rpm

and hope it will work. YMMV. The ones you really really need to install are the ones for the TSM B/A client and the API. During install they may ask for a library they depend on; just go and get it and make it happy. If you install it in a Linux or Solaris box, the packages will be placed in /opt/tivoli/tsm/client/.

Once you have the packages installed, you need to configure the client. Before we continue, we are assuming that we are back in our favorite kitcar company, Cannelloni LLC, and want to backup the fileserver, obelix. The TSM server is assurancetourix.cannelloni.com. So, we should by now have told the TSM server that obelix is a new node and associated a schedule with this node. The client configuration file is called dsm.sys and is usually found in /opt/tivoli/tsm/client/ba/bin. A typical dsm.sys file looks like something like this:

************************************************************************
* IBM Tivoli Storage Manager                                           *
*                                                                      *
* Sample Client System Options file for UNIX (dsm.sys.smp)             *
************************************************************************

*  This file contains the minimum options required to get started
*  using ITSM.  Copy dsm.sys.smp to dsm.sys.  In the dsm.sys file,
*  enter the appropriate values for each option listed below and
*  remove the leading asterisk (*) for each one.

*  If your client node communicates with multiple ITSM servers, be
*  sure to add a stanza, beginning with the SERVERNAME option, for
*  each additional server.

************************************************************************

SErvername  tsm
   COMMmethod         TCPip
   TCPPort            1609
   TCPServeraddress   backup.cannelloni.com
   passwordaccess     generate
   nodename           obelix
   managedservices    schedule
   memoryefficientbackup yes

where:

• SErvername Name of the TSM server
• TCPServeraddress FQDN (or IP) for the TSM server. We would think that is a bit important so the client knows where to find the TSM server (and probably to know which servers it should accept commands from).
• nodename The name of this node as defined in the TSM server. You can call it anything you want. It can be the FQDN of this machine or some silly name. TSM does not care while you use the right one. That also means you can backup to one machine and restore to another machine and TSM will not be any wiser; it only cares about authentication. Note: In this example, the true name of this machine is assurancetourix.cannelloni.com. backup.cannelloni.com is a CNAME we created to make it easier to find it. Also, it sounds very official and functional.
• COMMmethod Which protocols we will use to talk to the TSM server.
• TCPPort This is the port the TSM client will open in obelix so the server can connect and talk to it. We may have to be sure the firewall in obelix has that port open (per COMMmethod, for tcp traffic only, not udp).
• managedservices

  can be used to tell the client which tasks it should run. If you leave it blank, it will run a webserver that will allow others to connect to this machine to run the TSM client. By saying schedule we tell it only to run the scheduler.

Running the client

If this is the first time the tsm client is run in this machine, obelix, we need to do a full backup. That is done by issuing the command

# dsmc incr

and waiting for a while. A long while depending on how much stuff you have. To give you an idea, backing up some 300GB took about 8h in a connection that was supposed to be gigabit all the way between TSM client and server. So, either run this in the background and go dome something fun in the outside or use the time to read up on stuff you have been avoiding.

Once that is finished and there are no errors or funny business, we then start the normal incremental backup, which is done by typing

# dsmc sched &

Of course the next step would be to write a startup script to run that command whenever the node boots up.

Restoring

Bare Metal Restore

The case of the SunPCI 2 card

I have sunpci 2 pro card. Ok, I have a sunpci 1, a sunpci 2, and a sunpci 2 pro cards. Why, you would ask. Well, I thought the idea was clever: make a PC in a card (the predecessor of the blades?) and slap it inside a computer. The hardware approach has its benefits -- what would be better emulator than a complete computer? -- compared to emulated ones, specially if the host hardware is completely different. Many manufacturers have done similar things one time or another, but the tendency now if of course software-based emulation since modern machines seem to have the horsepower to make it work. Still I like to have that card as it has its own serial, parallel, VGA, ethernet, and usb ports.

And, as it turns out, its own IDE port.

Come again? Yes, it has an IDE port. I've always looked at the card during the boot process, and when checking its cmos, that it did check for IDE drives. But, it did not have a place to connect the cable to it. Well, there is an place on the board that does not have a connector in it. Upon checking it, I realize it has 40 pins. Hmmm, what if it was an IDE connector? After all, if you boot the card it seems to have everything it needs to use an IDE disk.

So I soldered a connector on it and then installed the card in a Ultra 60 running Solaris 10. I then boot the machine up as it was, just to make sure I did not screw anything up. So far so good. I then connected a 4.3GB IDE Hard drive I had doing nothing to it and rebooted. As you can see from the attached screen captures, the hard drive was seen by the card.

It would probably be a good time to find a way to mount a drive in the case; if you opened it you will remember that it really does not have much free space. For now I will leave it in one of the empty 3 1/2" drive bays; I may later make a bracket to put the drive somewhere else. Now the big question in my mind is can I boot the sunpci card off the ide hard drive? I don't know yet, but it would sure open a lot of nice possibilities. First we need to answer a few other questions. If I install, say, XP in the card, would it see the hard drive and be able to format and mount it? Also, would it be any limitations on the size of the hard drive or which devices I can slap to the ide cable? How about a cd burner or dvd player? Finally, would it be possible to slap a cdrom to that cable and install the OS off it (as opposite from the U60's dvd player)?

Commands I need to remember

This will be a bit of a work-in-progress post. The idea is that I sometimes find neat commands I really should know because, let's be quite honest, they can save a lot of time and aggravation. I am going to make this a series of articles -- one specifically for linux, another for OSX, another for Solaris, another for Windows, one for generic unix stuff, and whatever else I can think of -- to keep things organized in my demented mind. So, let's start with linux:

Boot> linux dd

This is entered when you boot the machine up, whether by a CD or its own hard drive or whatever. You know, when the machine asks you if you want to change the boot options. I used that during a centos install and booting a (once again) centos liveCD distro. What it does is ask you during the boot process to insert a disk/cd/floppy/whatever with extra drivers it needs to know about. Made setting up a certain supermicro's onboard SATA raid controller possible right at boot time, because centos 4.4 was not aware of that raid controller.

Finding OS Version

I do not know about you but every so often I need to find out which version of OS I am running. Originally I thought all Linuces were the same, but I was wrong. In fact, that is the reason I started writing that down. Then, I decided to expand for the different unices and other operating systems I mess with. So, we have.

• Redhat (RHES4 box in this example):

  $ cat /etc/redhat-release
  Red Hat Enterprise Linux ES release 4 (Nahant)
  $

• ubuntu

  raub@keg:~$ ls /etc/issue*
  /etc/issue  /etc/issue.net
  raub@keg:~$ cat /etc/issue
  Ubuntu 7.04 \n \l
  
  raub@keg:~$ cat /etc/issue.net 
  Ubuntu 7.04
  raub@keg:~$ cat /etc/issue.net 
  Ubuntu 7.04
  raub@keg:~$ lsb_release -a
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description:    Ubuntu 7.04
  Release:        7.04
  Codename:       feisty
  raub@keg:~$ cat /etc/lsb-release
  DISTRIB_ID=Ubuntu
  DISTRIB_RELEASE=7.04
  DISTRIB_CODENAME=feisty
  DISTRIB_DESCRIPTION="Ubuntu 7.04"
  raub@keg:~$ 

• AIX

  $ oslevel
  5.3.0.0
  $ oslevel -r
  5300-05
  $ 

• Solaris

boot {disk, cdrom, net} {-r}

open boot command to start the boot process. Normally you have the machine configured such that when it turns on it knows where to boot from, but if you are doing things to the machine and want to specify which device to boot from, you would use this command. I am not going to go over all its details but it suffice to say if you type disk it would boot off its default disk. The same goes for cdrom. Now, the -r option is used to tell it to scan for new hardware devices, which is important if you added/removed devices and drives and little cards from the machine.

Where does the scripts to strt files during the startup hide?

• Redhat

  /etc/rc.d/init.d/ssh

• BSD, Debian

  /etc/init.d/ssh

pkgadd

pkgadd is one of the most common ways to install packages in a Solaris box. It is similar in certain ways to rpm in Linux. Incidentally, if you want something more on the lines of apt-get, you want to look into pkg-get, which I shall talk about later on. But, for now, we spend a bit of time with pkgadd.

Let's say, for the sake of argument, that you decided to get a sunpci 2 pro card for your trusty Solaris box. So, after you install the card and reboot the machine (we will talk about the entire process in another blog entry), you go to the sun website and get the file SUNWspci2.3.2.tar.Z.

raub@nassau-25>ls
SUNWspci2.3.2.tar.Z
raub@nassau-26>

Then you untar/uncompress the file:

raub@nassau-26>zcat SUNWspci2.3.2.tar.Z | tar xf -
raub@nassau-27>ls
SUNWspci2  SUNWspci2.3.2.tar.Z
raub@nassau-28>

As you can see, you ended up with a new directory, SUNWspci2. Now the next step is to run pkgadd itself:

root@nassau-19>pkgadd -d .

The following packages are available:
 1  SUNWspci2     SunPCi II
                  (sparc) 2.3.2

Select package(s) you wish to process (or 'all' to process
all packages). (default: all) [?,??,q]:
[...]

You will notice that I entered a dot (.) as the name of the package. What that means is every package in the current directory. I could specify which package but I am lazy. Also, I am given the option of which packages to install anyway. As you probably guesses, -i stands for install package.

After careful consideration, I decided not to include AIX in this entry; since it is so different from the other Unix flavours, I've decided to make its own entry. Keep an eye for it!

Terrible tales of NIS, NFS, and automounting - II

Maps, Matey!

On the last installment we began to setup the NIS server for Cannelloni Inc, a performance kitcar manufacturing company. Now that we have the domain name defined and a home for the NIS maps we are going to use, how about creating some maps? We will go over that by first working on the NIS server, by creating and exporting the maps, and then reading them in the client.

Server setup

Ok, we need to create the NIS maps, but what are those maps anyway? Well, maps are the files NIS uses to keep the information it needs and passes around. Think of them as plain text databases where each entry is a pair (as in first column is defined by the remaining columns). I guess the best way to explain them is to show how they compare to some of the files used by Linux/Unix:

Maps	Equivalent unix file	Comments
hosts.byname, hosts.byaddr	/etc/hosts	Maps IP addresses to host names
passwd.byname, passwd.byuid	/etc/passwd	Maps UIDs to usernames (and passwords)
group.byname, group.bygid	/etc/group	Maps Group IDs to group names

So, our /etc/src/auto.home would look something like this:

bob            -nosuid,intr    obelix.cannelloni.com:/export/home/bob
thetick        -nosuid,intr    obelix.cannelloni.com:/export/home/thetick
heathcliff     -nosuid,intr    obelix.cannelloni.com:/export/home/heathcliff
mccoy          -nosuid,intr    obelix.cannelloni.com:/export/home/mccoy

and so on.

The netgroup map, which we chose (when we edited the /var/yp/Makefile, remember?) to be stored in /var/yp/, is like the groups file but can be used to group not only users but also any combination of users, domains, and hosts. We have two printers, falbala and bonemine, so we create a group for them which will be called printers. So far, our /var/yp/netgroup file looks like this:

openwheel (assurancetourix,,) (alambix,,) (caiousbonus,,) (petisuix,,)
printers  (falbala,,) (bonemine,,)

Remember that once you ad a Linux box as a NIS client you should run /usr/sbin/gdm-restart so the login window knows of the changes and maps. For some reason, ssh and the text-based login screen have no problems being updated, but gdm does. Perhaps it is buffering the user data.

For Linux, create an /etc/exports file that looks like this:

/home/sunpci/linux 192.168.0.11(rw,no_root_squash)

For Solaris, set up your /etc/dfs/dfstab this way:

share -F nfs -o rw=@192.168.0.11/32,root=@192.168.0.11/32 /home/sunpci/linux

Once you have finished with /etc/exportfs, you need to make the changes take place by typing

Linux:

# exportfs -a

Solaris:

# share all

Terrible tales of NIS, NFS, and automounting

NFS and NIS have been around for a while, way before someone decided to network two Windows boxes. They have a lot of neat features.

The Network Information Service (NIS) is a directory service protocol created by Sun. It is not as elegant as, say, LDAP with Kerberos, but can get the work done if due care is taken to keep it as safe as possible.

I am going to present the steps necessary to setup a NFS/NIS system that would server a bunch of users and the unix boxes they connect to. Originally I was going to make this fit one single post but I realized that it (hopefully) would be easier if I broke down into sessions and dealt with just one aspect at a time. I will also create a fake company so it has that professional look to it. Sounds like a plan? Great! Let's get busy then. In this example, we work at Cannelloni LLC, a performance kitcar manufacturing company. It is primarily a Linux shop all the way to the desktops. Recently it has grown enough to need a centralized directory service and file sharing systems. Since we are talking about NIS, Cannelloni chose to use NIS for now. Later on the show we will talk about NIS limitations.

Layout

I would start this mess with the main/master NIS server because I want to have the authentication side of the business out of the way. First of all, we need a NIS domain name. This really needs not to have anything to do with the DNS domain, but should make sense to you. Think of it as a logical group or unit. You talked to your boss and after a few beers it was decided to divide the current network mess into the following groups:

• Management
• Office
• Accounting
• HR
• Development
• Production

Probably you could have come up with better names, but that is what you get by trying to work drunk. You can always change them later. If nothing else, just to piss off accounting. Since doing every single group would bore me to death, we will assume that development decides to take the lead. If it works there, the same concept will be generalized across the entire company. So, development choses idefix (it is not very powerful but that really does not matter) as its NIS server; another machine, obelix, which has a nice hotswappable RAID 5 will be the fileserver which will export fileshares through NFS.

First, we start by finding out a bit about the company's network and which part of it belongs to development. Careful research indicates the entire company is behind a router, so it has only a handful of public IPs (webserver, mail, and so on) while the LAN uses the private network 192.168.10.0 (it is a small company). The IPs assigned to development are 192.168.10.100 to 192.168.10.120, and all the IPs have not been assigned yet. This is very important to know because we can limit which machines can see the NIS maps. How do we do that? Well, we are getting a bit ahead; let's first create a place to save all the configuration files we will be creating.

We Need a Home

NIS stores a lot of important stuff in general in /var/yp Go take a look at it; it should look kinda like this:

dalek@idefix-> ls /var/yp
binding  Makefile  nicknames
dalek@idefix->

Kinda boring I know but we are just starting with it. The Makefile you see there is used to generate the NIS maps. By default it will use /etc/passwd, /etc/shadow, /etc/group and a lot of other files that are in /etc. I honestly do not like that. /etc for me is kinda of an important directory and I would rather have its contents not being passwd all over the universe. Instead, I prefer to feed NIS my own passwd, group, and any other map I want to share. Not only that makes it a bit safer but also easier to manage/move around as everything is contained in a single location you can simply tar and move to the next machine. So, we need to do some editing in Makefile. So, I create two directories: /var/yp/src and /var/yp/src/pw. Then, I edit the Makefile as follows (you will need to search within that file for those definitions):

• Linux

  # YPSRCDIR = /etc
  YPSRCDIR = /var/yp/src
  # YPPWDDIR = /etc
  YPPWDDIR = /var/yp/src/pwd
  

• Solaris

  # DIR =/etc
  DIR =/var/yp/src
  # PWDIR =/etc
  PWDIR =/var/yp/src/pwd

The next step is to create those directories and make sure they can only be read/accessed by root, specially /var/yp/src/pwd as it will host the password file that will be shared through NIS. Next we will create a file called securenets in /var/yp which will tell which machines can see these maps:

dalek@idefix-> cat /var/yp/securenets
# /var/yp/securenets
# Restrict access to the NIS maps to the machines defined in this file
#
# allow connections from local host -- necessary
host 127.0.0.1
# same as 255.255.255.255 127.0.0.1
#
# allow connections from any host on the development network
host 192.168.10.100  # asterix
host 192.168.10.101  # obelix
host 192.168.10.102  # idefix
host 192.168.10.103  # panoramix
host 192.168.10.104  # abraracourcix
host 192.168.10.105  # bonemine
host 192.168.10.106  # agecanonix
host 192.168.10.107  # assurancetourix
host 192.168.10.108  # cetautomatix
host 192.168.10.109  # ordralfabetix
host 192.168.10.110  # lelosubmarine
host 192.168.10.111  # falbala
host 192.168.10.112  # aplusbegalix
host 192.168.10.113  # amerix
host 192.168.10.114  # caiusbonus
host 192.168.10.115  # caiusmalosinus
host 192.168.10.115  # tragicomix
host 192.168.10.116  # alambix
host 192.168.10.117  # petisuix
host 192.168.10.118  # jolitorax
host 192.168.10.119  # beaufix
host 192.168.10.120  # barberouge
dalek@idefix->

Do notice we chose to specify each host in /var/yp/securenets. Since the number of machines in this list is not a power of 2, we could not use IP of the first machine and a carefully chosen subnet mask to cover them all. Also, spelling out every machine we plan on using allows us to later on comment out the ones we do not need.

A Domain by Any Name

Now that we have that taken care of, we need to come up with a name for our NIS domain. Since this name does not need to be remotely related to our DNS domain, we will call it development as it is the NIS domain for the development group. I know, I know, I am very original...

Ok, you ask, now how to make NIS know we chose a NIS domain name? Well, the domain name is stored in /etc/defaultdomain (for solaris) or /etc/domainname (for Linux). If you write the domain name you want to use in that file (i.e. there is just one single line in the file and all it has is your domain name, in this case, development) and reboot, idefix will then know the name of the domain. You can check it by using the command domainname as follows:

dalek@idefix>cat /etc/defaultdomain
development
dalek@idefix>

Now, before you go rebooting the machine, let's see if we can change its domain name without rebooting, shall we? In both Solaris and Linux, you can set the runtime domain name to development by saying

dalek@idefix>domainname development
dalek@idefix>

How about checking it?

dalek@idefix>domainname
development
dalek@idefix>

Of course, since we had already defined the domain name in /etc/defaultdomain (Solaris) or /etc/domainname, we could have said

• Solaris

  dalek@idefix>domainname `cat /etc/defaultdomain`

• Linux

  dalek@idefix>domainname `cat /etc/domainname`

Do note the back quotes; they are rather important.

Ok, I am going to take a break for now. Next time we will talk about the wonderful world of maps. Stay tuned!