Solaris

Sudoers in LDAP

by

In addition to the standard sudoers file, sudo may be configured via LDAP. This can be especially useful for synchronizing sudoers in a large, distributed environment. You need to have LDAP server and client configured, if you do not have already, see my previous posts. LDAP schema extension for sudo is also required on LDAP … Read more

Solaris LDAP client configuration

by
LDAP DIT

LDAP DIT
Oracle Solaris has native LDAP support built in OS, so there is no need to install third-party software to configure Solaris to use LDAP as users/groups and other repository. You can use different ways to do this, and I will describe few of them.

If secure communication is required, and we have Self Signed certificates, we need to install CA certificate on each client.
This can be achieved by import CA certificate to local store with certutil (/usr/sfw/bin/certutil in Solaris 10). First create NSS DB (Don’t enter password. Just hit return)

certutil -N -d /var/ldap
chmod 444 /var/ldap/*

Read more

LDAP server for Solaris and Linux clients

by
LDAP DIT

LDAP-DITFew months ago I received a task to set up LDAP authentication for Solaris 10, Solaris 11 and Linux machines in Customer’s infrastructure. As LDAP server was chosen OpenLDAP 2.4.x in Master-Slave configuration with SSL/TLS support. Servers was installed on Virtual Machines with CentOS 6.7.
I will not describe LDAP installation, because on modern Linuxes it’s simple like:

$ sudo yum install openldap-servers

Read more

Solaris 10 Release and Solaris Cluster 3.x upgrade + patching

by

On the day of writing, the newest version of Solaris 10 is u11 (1/13) and Cluster (for Solaris 10) is 3.3u2.
Cluster 3.2 is still supported by Oracle, but patches are no longer released. Update 11 for Solaris 10 is probably last Release of Solaris 10 and has some new features, which are not available if you only patching a system with Recommended Patches.
Before starting with upgrade it is good to check and fix any issues with current system and environment.
Please check a Cluster status, Quorum device status, running services, zpools, metadevices, metasets, hardware components etc.
If you have any issues, fix them before you start. Plan your Maintenance Window, make backup of your files and configuration.

Read more

BerkeleyDB upgrade

by

During switching LDAP directory to new environment with newer version of OpenLDAP (2.4.25) and new BerkeleyDB (5.1.25), I received following error message:


Program version 5.1 doesn't match environment version 4.7
database ... cannot be opened, err -30969. Restore from backup!
bdb(...): txn_checkpoint interface requires an environment configured for the transaction subsystem
bdb_db_close: database "...": txn_checkpoint failed: Invalid argument (22).
backend_startup_one (type=hdb, suffix="..."): bi_db_open failed! (-30969)
bdb_db_close: database "...": alock_close failed

This means that you need to upgrade BerkeleyDB. Because this is not OpenLDAP specific, but rather BerkeleyDB specific, I decided to describe how to fix this issue. First of all let’s make a backup:

Read more

How to remove dataset from Solaris zone and mount it as lofs

by

Because of building mail system I need to export ZFS filesystem via NFS to other node, where postfix with deliver will save messages to mail boxes. As you can see in this installation transcript I configured whole zpool “studmail” as ZFS dataset for zone st1. Unfortunatelly, you can not simply share ZFS via NFS in non-global zone:

root@st1:~# zfs list
NAME                         USED  AVAIL  REFER  MOUNTPOINT
studmail                     301M  1.78T  28.0K  none
studmail/etc                4.52M  1.78T  4.19M  /data/etc
studmail/studmail            480K  1.78T   417K  /data/studmail
studmail/var                 296M  1.78T   294M  /data/var

root@st1:~# zfs set sharenfs=rw=@192.168.X.X/32,anon=0 studmail/studmail
cannot set property for 'studmail/studmail': 'sharenfs' cannot be set in a non-global zone