2015年5月27日 星期三

Solaris 11 快速設定 AMP (Apache, MySQL, PHP)



  • 安裝及檢視AMP Package



root@s11:/# pkg info -r group/feature/amp
          Name: group/feature/amp
       Summary: AMP (Apache, MySQL, PHP) Deployment Kit for Oracle Solaris
   Description: Provides a set of components for deployment of an AMP (Apache,
                MySQL, PHP) stack on Oracle Solaris
      Category: Meta Packages/Group Packages (org.opensolaris.category.2008)
                Web Services/Application and Web Servers (org.opensolaris.category.2008)
         State: Installed
     Publisher: solaris
       Version: 0.5.11
 Build Release: 5.11
        Branch: 0.175.1.0.0.24.0
Packaging Date: September  4, 2012 06:03:28 PM
          Size: 5.46 kB
          FMRI: pkg://solaris/group/feature/amp@0.5.11,5.11-0.175.1.0.0.24.0:20120904T180328Z
root@s11:/#
root@s11:/# svcadm enable apache22r
root@s11:/# svcs | grep apache
online 18:16:02 svc:/network/http:apache22
root@s11:/#cd /var/apache2/2.2/htdocs
root@s11:/# cd /var/apache2
root@s11:/var/apache2/2.2# cd htdocs
root@s11:/var/apache2/2.2/htdocs# ls -al
total 16
drwxr-xr-x 2 root bin 6 May 27 18:21 .
drwxr-xr-x 9 root bin 9 Sep 20 2012 ..
-r--r--r-- 1 root bin 377 Sep 20 2012 favicon.gif
-r--r--r-- 1 root bin 1406 Sep 20 2012 favicon.ico
-r--r--r-- 1 root bin 44 Sep 20 2012 index.html
-rw-r--r-- 1 root root 68 May 27 18:21 phpinfo.php
root@s11:/var/apache2/2.2/htdocs#

  • 開啟瀏覽器測試Apache Server是否OK







  • 建立一個phpinfo.php的檔案,測試PHP是否OK
root@s11:/var/apache2/2.2/htdocs# cat phpinfo.php
<?php

// Show all information, defaults to INFO_ALL
phpinfo();

?>
root@s11:/var/apache2/2.2/htdocs#






  • 設定Mysql

root@s11:/# svcs -a | grep mysql
disabled       17:36:09 svc:/application/database/mysql:version_51
root@s11:/# svcadm enable mysql
root@s11:/# svcs -a | grep mysql
online         18:43:38 svc:/application/database/mysql:version_51

  • 檢查是否有mysql的user 和 group


root@s11:/usr/mysql/5.1/bin# cat /etc/passwd | grep mysql
mysql:x:70:70:MySQL Reserved UID:/:
root@s11:/usr/mysql/5.1/bin# cat /etc/group | grep mysql
mysql::70:

# /usr/bin/mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!


In order to log into MySQL to secure it, we'll need the current
password for the root user.  If you've just installed MySQL, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.


輸入 root 的密碼,如果沒有設定過,直接按 Enter 鍵即可

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.


# 是否設定 root 的密碼

Set root password? [Y/n] y
New password: abc123
Re-enter new password: abc123
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.


移除 anonymous 使用者

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.


# 是否取消 root 遠端登入

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MySQL comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.


# 是否移除 test 資料表

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!


Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.


# 是否重新載入資料表權限

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...



All done!  If you've completed all of the above steps, your MySQL
installation should now be secure.

Thanks for using MySQL!

  • 檢視資料庫內容

root@s11:/usr/mysql/5.1/bin#  ./mysqlshow -p
Enter password: 
+--------------------+
|     Databases      |
+--------------------+
| information_schema |
| mysql              |
+--------------------+
root@s11:/usr/mysql/5.1/bin#  ./mysqlshow -pabc123 (abc123為密碼)
+--------------------+
|     Databases      |
+--------------------+
| information_schema |
| mysql              |
+--------------------+


  • 登入Mysql資料庫

root@s11:/usr/mysql/5.1/bin# ./mysql  -u root -pabc123
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 14
Server version: 5.1.37 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
+--------------------+
2 rows in set (0.01 sec)

使用mysql這個資料庫
mysql> use mysql;
Database changed

列出資料庫mysqltable

mysql> show tables;
+---------------------------+
| Tables_in_mysql           |
+---------------------------+
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
| user                      |
+---------------------------+
23 rows in set (0.00 sec)

mysql>quit

2015年5月6日 星期三

Solaris 設定 Audit


  • 顯示可歸屬事項預選類

root@s11:/var/audit# auditconfig -getflags
active user default audit flags = lo(0x1000,0x1000)
configured user default audit flags = lo(0x1000,0x1000)


  • 顯示不可歸屬事項預選類
root@s11:/etc/security# auditconfig -getnaflags
active non-attributable audit flags = lo(0x1000,0x1000)configured non-attributable audit flags = lo(0x1000,0x1000)


  • 顯示Audit策略

root@s11:/etc/security# auditconfig -getpolicy
configured audit policies = cntactive audit policies = cnt


  • 顯示Plugin相關訊息

root@s11:/etc/security# auditconfig -getplugin
Plugin: audit_binfile (active)        Attributes: p_dir=/var/audit;p_fsize=0;p_minfree=1
Plugin: audit_syslog (inactive)        Attributes: p_flags=
Plugin: audit_remote (inactive)        Attributes: p_hosts=;p_retries=3;p_timeout=5


  • 顯示Audit佇列控制

root@s11:/etc/security# auditconfig -getqctrlno configured audit queue hiwater markno configured audit queue lowater markno configured audit queue buffer sizeno configured audit queue delayactive audit queue hiwater mark (records) = 100active audit queue lowater mark (records) = 10active audit queue buffer size (bytes) = 8192active audit queue delay (ticks) = 20root@s11:/etc/security#


  • 顯示User Audit設定
root@s11:/etc/security# who
root       pts/1         5月  5日 18:15  (172.16.37.211)
mds        pts/2         5月  5日 18:49  (172.16.37.211)
root@s11:/etc/security# userattr audit_flags root
lo:no
root@s11:/etc/security# userattr audit_flags mds
root@s11:/etc/security#


  • 驗證Audit是否已啟動


root@s11:/var/audit# auditconfig -getcond
audit condition = auditing

root@s11:/var/audit# audit -v
configuration ok

Audit Flags的定義


Short NameLong NameShort Description
nono_classNull value for turning off event preselection
frfile_readRead of data, open for reading
fwfile_writeWrite of data, open for writing
fafile_attr_accAccess of object attributes: statpathconf
fmfile_attr_modChange of object attributes: chownflock
fcfile_creationCreation of object
fdfile_deletionDeletion of object
clfile_closeclose system call
pcprocessProcess operations: forkexecexit
ntnetworkNetwork events: bindconnectaccept
ipipcSystem V IPC operations
nanon_attribNonattributable events
adadministrativeAdministrative actions
lologin_logoutLogin and logout events
apapplicationApplication-defined event
ioioctlioctl system call
exexecProgram execution
ototherMiscellaneous
allallAll flags set
New audit classes are defined. The ft audit class contains file transfer audit events

建議設定:
To enforce this setting, use the command:
# auditconfig -conf
# auditconfig -setflags lo,ad,ft,ex
# auditconfig -setnaflags lo
# auditconfig -setpolicy cnt,argv,zonename
# auditconfig -setplugin audit_binfile active p_minfree=1
# audit -s
auditconfig -setpolicy cnt,argv,zonename

# rolemod -K audit_flags=lo,ad,ft,ex:no root

PS. 為避免audit log過大難以讀取,設定每小時將目前的audit log關掉,並開啟一個新的audit log檔

# EDITOR=ed crontab -e root << END_CRON

a
0 * * * * /usr/sbin/audit -n
w
q
END_CRON

# chown root:root /var/audit
# chmod 750 /var/audit

查看audit log
# praudit xxxxxxx





開啟及關閉audit

root@s11:~# audit -t    關閉
root@s11:~# auditconfig -getcond
audit condition = noaudit
root@s11:~# audit -s    開啟
root@s11:~# auditconfig -getcond
audit condition = auditing

Clean up the old not_terminated file.
# auditreduce -O system-name old-not-terminated-file
root@s11:/var/audit# auditreduce -O s11 20150505092159.not_terminated.s11.1

DEMO:

建立一個帳號 -  johnny



 撈出關於帳號johnny的audit log













參考資料:
http://www.oracle.com/technetwork/articles/servers-storage-admin/sol-audit-quick-start-1942928.html#Custom


2015年5月5日 星期二

Solaris 11 新建使用者賦與su 權限


  • 一般使用者登入系統,欲切換為root


login as: mds
Using keyboard-interactive authentication.
Password:
Last login: Tue Jan 13 16:21:07 2015 from 172.16.37.211
Oracle Corporation      SunOS 5.11      11.1    May 2014
-bash-4.1$ su -
Password:
Roles can only be assumed by authorized users

  • 先使用root權限登入.
root@LDAPc25:~# usermod -R root mds
UX: usermod: mds is currently logged in, some changes may not take effect until next login. 


  • 下次登入時生效

login as: mds
Using keyboard-interactive authentication.
Password:
Last login: Wed May  6 10:22:15 2015 from 172.16.37.211
Oracle Corporation      SunOS 5.11      11.1    May 2014
-bash-4.1$ su -
Password:
Oracle Corporation      SunOS 5.11      11.1    May 2014
root@LDAPc25:~#

2015年4月15日 星期三

Solaris 11 建立VNIC


  • 檢視目前有up的網卡為net0 及 net4

root@NIASc11:~# dladm show-phys
LINK              MEDIA                STATE      SPEED  DUPLEX    DEVICE
net1              Ethernet             down       0      unknown   igb1
net3              Ethernet             up         1000   full      igb3
net0              Ethernet             up         1000   full      igb0
net2              Ethernet             down       0      unknown   igb2
net4              Ethernet             up         10     full      usbecm2

  • net0目前為Globe-Zone所使用
root@NIASc11:~# ipadm show-addr
ADDROBJ           TYPE     STATE        ADDR
lo0/v4            static   ok           127.0.0.1/8
net0/v4           static   ok           192.168.2.198/24
net4/v4           static   ok           169.254.182.77/24
lo0/v6            static   ok           ::1/128

  • 檢視目前建立及使用的vnic
root@NIASc11:~# dladm show-vnic
LINK                OVER         SPEED  MACADDRESS        MACADDRTYPE       VID
vnic11              net3         1000   2:8:20:d3:46:b9   random            0
WPSc14/vnic11       net3         1000   2:8:20:d3:46:b9   random            0
vnic22              net3         1000   2:8:20:55:8:1a    random            0
wpsm1               net1         0      2:8:20:f6:84:fb   random            0
wpsm3               net2         0      2:8:20:5e:a1:1d   random            0
WPSc14/net0         net0         1000   2:8:20:19:e8:8d   random            0

  • 在net3 網卡建立名為ops1的vnic

root@NIASc11:~# dladm create-vnic -l net3  ops1
root@NIASc11:~# dladm show-vnic
LINK                OVER         SPEED  MACADDRESS        MACADDRTYPE       VID
vnic11              net3         1000   2:8:20:d3:46:b9   random            0
WPSc14/vnic11       net3         1000   2:8:20:d3:46:b9   random            0
vnic22              net3         1000   2:8:20:55:8:1a    random            0
wpsm1               net1         0      2:8:20:f6:84:fb   random            0
wpsm3               net2         0      2:8:20:5e:a1:1d   random            0
WPSc14/net0         net0         1000   2:8:20:19:e8:8d   random            0
ops1                net3         1000   2:8:20:9e:5:3     random            0

查詢IP的來源地,google地圖

http://www.senderbase.org/

2015年3月30日 星期一

建立ZFS 的開機磁區


從光碟機開啟OS於single user mode

ok> boot cdrom -s

SPARC:
# installboot -F zfs /mnt/usr/platform/`uname -i`/lib/fs/zfs/bootblk /dev/rdsk/c1t0d0s0


x86 : Solaris 10 and Solaris 11.0:
# installgrub /boot/grub/stage1 /boot/grub/stage2 /dev/rdsk/c1t1d0s0


 x86 : Solaris 11.1 及後面的版本

# bootadm install-bootloader -P rpool






REF:
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=244078949050375&id=1020196.1&_afrWindowMode=0&_adf.ctrl-state=85rleeh71_4

2015年2月22日 星期日

Oracle SPARC Server T4-4 清除ILOM錯誤訊息

-> shotw faulty
Target             | Property              | Value                          
-------------------+-----------------------+-----------------------------------
/SP/faultmgmt/0    | fru                   | /SYS/PM0
/SP/faultmgmt/0/   | class                 | fault.chassis.voltage.fail  faults/0          |                       |
/SP/faultmgmt/0/   | sunw-msg-id           | SPT-8000-DH faults/0          |                       |
/SP/faultmgmt/0/   | component             | /SYS/PM0 faults/0          |                       |
/SP/faultmgmt/0/   | uuid                  | 89505ca9-38b7-40e9-d5c9-b8b73851a5 faults/0                   | bf
/SP/faultmgmt/0/   | timestamp             | 2015-01-03/19:31:09   faults/0          |                       |
/SP/faultmgmt/0/   | fru_part_number       | 7051795  faults/0          |                       |
/SP/faultmgmt/0/   | fru_rev_level         | 04 faults/0          |                       |
/SP/faultmgmt/0/   | fru_serial_number     | 465769T+1321L90NH5 faults/0          |                       |
/SP/faultmgmt/0/   | fru_manufacturer      | Celestica Holdings PTE LTD  faults/0        |                       |
/SP/faultmgmt/0/   | fru_name              | Proc-Mod,3.0G,T4-4 faults/0          |                       |
/SP/faultmgmt/0/   | system_manufacturer   | Oracle Corporation faults/0          |                       |
/SP/faultmgmt/0/   | system_name           | SPARC T4-4 faults/0          |                       |
/SP/faultmgmt/0/   | system_part_number    | 31747710+1+1 faults/0          |                       |
/SP/faultmgmt/0/   | system_serial_number  | AK00000000 faults/0          |                       |
/SP/faultmgmt/0/   | chassis_manufacturer  | Oracle Corporation faults/0          |                       |
/SP/faultmgmt/0/   | chassis_name          | SPARC T4-4 faults/0          |                       |
/SP/faultmgmt/0/   | chassis_part_number   | 31747710+1+1 faults/0          |                       |
/SP/faultmgmt/0/   | chassis_serial_number | AK00000000 faults/0          |                       |
/SP/faultmgmt/0/   | system_component_manu | Oracle Corporation faults/0          | facturer             | /SP/faultmgmt/0/   | system_component_name | SPARC T4-4 faults/0          |                       |
/SP/faultmgmt/0/   | system_component_part | 31747710+1+1 faults/0          | _number               |
/SP/faultmgmt/0/   | system_component_seri | AK00000000 faults/0          | al_number             |
/SP/faultmgmt/0/   | diagnosis_engine      | fdd 1.0 faults/0          |                       |

-> satrt /sp/faultmgmt/shell
Are you sure you want to start /SP/faultmgmt/shell (y/n)? y

faultmgmtsp> fmadm faulty
------------------- ------------------------------------ -------------- --------
Time                UUID                                 msgid          Severity
------------------- ------------------------------------ -------------- --------
2015-01-03/19:31:09 89505ca9-38b7-40e9-d5c9-b8b73851a5bf     SPT-8000-DH    Critical

Fault class : fault.chassis.voltage.fail

FRU         : /SYS/PM0
              (Part Number: 7051795)
              (Serial Number: 465769T+1321L90NH5)

Description : A chassis voltage supply is operating outside of the
              allowable range.

Response    : The system will be powered off.  The chassis-wide service
              required LED will be illuminated.

Impact      : The system is not usable until repaired.  ILOM will not allow
              the system to be powered on until repaired.

Action      : Please refer to the associated reference document at
              http://support.oracle.com/msg/SPT-8000-DH for the latest
              service procedures and policies regarding this diagnosis.

faultmgmtsp> fmadm repair  89505ca9-38b7-40e9-d5c9-b8b73851a5bf 
No faults found
faultmgmtsp> exit

-> exit

2015年1月21日 星期三

Solaris 11 Boot Environments 開機環境



root@solaris:~# beadm list
BE                                Active         Mountpoint     Space    Policy      Created
--                                   ------           ----------           -----          ------   -------
solaris                           -                  -                       446.12M  static         2014-09-05 01:21
solaris-backup-1           -                  -                       35.05M    static         2014-09-11 22:27
solaris11                       NR              /                       3.35G       static         2014-09-11 22:36
solaris11-backup-1       -                  -                       70.0K       static         2014-10-06 17:25

在Active這個欄位:
R:表示重新開機會啟動的環境
N:表示目前啟動的開機環境


EX1:變更下次開機環境,由solaris11變更為solaris

BE                                Active         Mountpoint     Space    Policy      Created
--                                   ------           ----------           -----          ------   -------
solaris                           R                 -                       446.12M  static         2014-09-05 01:21
solaris-backup-1           -                  -                       35.05M    static         2014-09-11 22:27
solaris11                       N                /                        3.35G       static         2014-09-11 22:36
solaris11-backup-1       -                  -                       70.0K       static         2014-10-06 17:25


EX3:新建一個開機環境,建立一個開機環境為fortest
root@solaris:~# beadm create fortest
root@solaris:~# beadm list
BE                                Active         Mountpoint     Space    Policy      Created
--                                   ------           ----------           -----          ------   -------
fortest                           -                  -                        72.0K      static 2015-01-22 17:11


solaris                           R                 -                       446.12M  static         2014-09-05 01:21
solaris-backup-1           -                  -                       35.05M    static         2014-09-11 22:27
solaris11                       N                /                        3.35G       static         2014-09-11 22:36
solaris11-backup-1       -                  -                       70.0K       static         2014-10-06 17:25

EX3:刪除一個開機環境,將solaris11-backup-1此開機環境刪除

root@solaris:~# beadm destroy solaris11-backup-1
Are you sure you want to destroy solaris11-backup-1?  This action cannot be undone(y/[n]): y


root@solaris:~# beadm list
BE                                Active         Mountpoint     Space    Policy      Created
--                                   ------           ----------           -----          ------   -------
fortest                           -                  -                        72.0K      static 2015-01-22 17:11

solaris                           R                 -                       446.12M  static         2014-09-05 01:21
solaris11                       N                /                        3.35G       static         2014-09-11 22:36
solaris11-backup-1       -                  -                       70.0K       static         2014-10-06 17:25

2015年1月14日 星期三

Solaris 壓力測試使用SUN VTS

# unzip p18688458_7018_SOLARIS64.zip
# cd VTS7.0ps18.2_sparc_singlesystem

# pkgadd -d .

The following packages are available:
  1  SUNWvts       SunVTS Framework
                   (sparc) 7.0,REV=2008.02.15.13.31
  2  SUNWvtsmn     SunVTS Man Pages
                   (sparc) 7.0,REV=2008.02.07.18.38
  3  SUNWvtsr      SunVTS Framework (Root)
                   (sparc) 7.0,REV=2008.02.07.18.38
  4  SUNWvtss      SunVTS Server and BUI
                   (sparc) 7.0,REV=2008.02.07.18.38
  5  SUNWvtsts     SunVTS Core Installation Tests
                   (sparc) 7.0,REV=2008.02.15.13.31

Select package(s) you wish to process (or 'all' to process
all packages). (default: all) [?,??,q]: all

# cd /usr/sunvts/bin
# ./runvts
Testing in Online Stress Mode -low

# ./startsunvts






2015年1月13日 星期二

How to Reconfigure a Zone to Use a VNIC


How to Reconfigure a Zone to Use a VNIC

This procedure refers to the second zone in the virtual network. The zone already exists, but its current configuration prevents it from becoming a part of the virtual network. Specifically, the zone's IP type is a shared type and its current interface is net0. Both of these configurations must be changed.
  1. Become an administrator.
  2. Create the VNIC.
    global# dladm create-vnic [-v vid] -l datalink vnic
    where vid refers to the VLAN ID that you assign to the VNIC. Specify the VLAN ID only if you want to create the VNIC as a VLAN.
    Do not configure the VNIC's interface yet. You will perform this step later in this procedure.
  3. Change the zone's IP type from shared to exclusive.
    global# zonecfg -z zone
    zonecfg:zone1> set ip-type=exclusive
    zonecfg:zone1>
  4. Change the zone's interface to use a VNIC.
    zonecfg:zone1> remove net physical=NIC
    zonecfg:zone1> add net
    zonecfg:zone1:net> set physical=vnic
    zonecfg:zone1:net> end
    zonecfg:zone1>
  5. Verify and commit the changes you have implemented and then exit the zone.
    zonecfg:zone1 verify
    zonecfg:zone1> commit
    zonecfg:zone1> exit
    global#
  6. Reboot the zone.
    global# zoneadm -z zone reboot
  7. Log in to the zone.
    global# zlogin zone
  8. Configure the VNIC with a valid IP address.
    If you are assigning a static address to the VNIC, you would type the following:
    zone# ipadm create-addr -a address interface
    where address can use CIDR notation.
  9. From the global zone, add the address information to the /etc/hosts file.
Example 2-3 Reconfiguring a Zone Configuration to Use a VNIC
In this example, zone2 already exists as a shared zone. The zone also uses the primary interface of the system rather than a virtual link. You need to modify zone2 to use vnic2. To use vnic2zone2's IP type must first be changed to exclusive. Note that some of the output is truncated to focus on the relevant information that relates to virtual networks.

global# dladm create-vnic -l net0 vnic2

global# zonecfg -z zone2
zonecfg:zone1> set ip-type=exclusive
zonecfg:zone1> remove net physical=net0
zonecfg:zone1> add net
zonecfg:zone1:net> set physical=vnic2
zonecfg:zone1:net> end
zonecfg:zone1> verify
zonecfg:zone1> commit
zonecfg:zone1> exit
global# zoneadm -z zone2 reboot

global# zlogin zone2
zone2# ipadm create-ip vnic2
zone2# ipadm create-addr -a 192.168.3.85/24 vnic2
ipadm: vnic2/v4

zone2# exit

global# vi /etc/hosts
#
::1             localhost
127.0.0.1       localhost
192.168.3.70    loghost   #For net0
192.168.3.80    zone1   #using vnic1
192.168.3.85    zone2   #using vnic2

參考資料
https://docs.oracle.com/cd/E26502_01/html/E28992/ggiyq.html#gicom