2016年1月13日 星期三

VMware Workstation 設定綁定的實體網卡



由Edit -> Virtual Network Editor->Add Network 
選擇網卡(在此使用USB無線網卡)


在VM的設定選定綁定的網卡







2016年1月7日 星期四

Reset MySQL root 密碼


先將mysql 關閉
[root@centos ~]# service mysqld stop
Stopping mysqld:                                           [  OK  ]
[root@centos ~]#
[root@centos ~]# mysqld_safe --skip-grant-tables &
Starting mysqld daemon with databases from /var/lib/mysql
[root@centos ~]# mysql -u root
mysql> use mysql;
mysql> UPDATE user SET Password=PASSWORD("password") WHERE User='root';
mysql> flush privileges;
mysql> quit


Solaris 11 OS 由光碟機開機,mount ZFS



使用光碟機開機
設備Oracle T3-2   Solaris 11.2 光碟片


OK boot dvdrom


root@solaris:/root# df -h
Filesystem             Size   Used  Available Capacity  Mounted on
/devices/ramdisk-root:a
                       248M   216M        32M    88%    /
/devices                 0K     0K         0K     0%    /devices
略 
略
略
/dev/dsk/c2t7d0s2      731M   731M         0K   100%    /media/Oracle_Solaris-11_2-Text-SPARC


root@solaris:/root# mount /dev/dsk/c0t5000CCA01297BDE0d0s0 /mnt
Apr 16 03:28:28 solaris ufs: NOTICE: mount: not a UFS magic number (0x0)
mount: /dev/dsk/c0t5000CCA01297BDE0d0s0 is not this fstype


root@solaris:/etc# df -h
Filesystem             Size   Used  Available Capacity  Mounted on
/devices/ramdisk-root:a
                       248M   216M        32M    88%    /
/devices                 0K     0K         0K     0%    /devices
略 
略
略
/dev/dsk/c2t7d0s2      731M   731M         0K   100%    /media/Oracle_Solaris-11_2-Text-SPARC
rpool/export           274G    32K       109G     1%    /a/export
rpool/export/home      274G    32K       109G     1%    /a/export/home
rpool/export/home/mds
                       274G    67K       109G     1%    /a/export/home/mds
rpool                  274G    78K       109G     1%    /a/rpool
rpool/LDAPc25          274G    34K       109G     1%    /a/rpool/ldap
rpool/WPSc14           274G    34K       109G     1%    /a/rpool/wall
rpool/ldadc25-clone    274G    35K       109G     1%    /a/rpool/ldap-clone
root@solaris:/etc#

ZFS boot disk 更換成較大容量的硬碟


在有些時候我們需要更換開機硬碟,或是既有硬碟容量太小,欲更換成較大的硬碟,ZFS 與過去UFS的做法有些不同,UFS常用的方法為ufsdump 跟ufsrestore方式,而ZFS使用mirror操作,更為快速及方便。

使用設備Oracle SPARC T3-2,開機硬碟為146GB硬碟,欲改成300GB硬碟


檢視目前機器內的硬碟: 
AVAILABLE DISK SELECTIONS:
       0. c0t5000C5000EBDE997d0 <SUN146G cyl 14087 alt 2 hd 24 sec 848>
          /scsi_vhci/disk@g5000c5000ebde997/dev/chassis//SYS/SASBP/HDD0/disk
       1. c0t5000C50039BD744Bd0 <SEAGATE-ST930003SSUN300G-0B70 cyl 46873 alt 2 hd 20      sec 625> /scsi_vhci/disk@g5000c50039bd744b/dev/chassis//SYS/SASBP/HDD1/disk


檢示zpool 狀態
# zpool statu tus -v
  pool: rpool
 state: ONLINE
  scan: resilvered 70.0G in 0h18m with 0 errors on Tue Oct 27 13:08:53 2015
config:

        NAME                       STATE     READ WRITE CKSUM
        rpool                      ONLINE       0     0     0
          c0t5000C5000EBDE997d0s6  ONLINE       0     0     0

檢示磁區狀態  (現為146GB)
# df -h
Filesystem             Size   Used  Available Capacity  Mounted on
rpool/ROOT/solaris     134G   2.1G        62G     4%    /
/devices                 0K     0K         0K     0%    /devices
略


將第二顆硬碟(300GB)與開機硬碟mirror
# zpool attach -f rpool c0t5000C5000EBDE997d0s6 c0t5000C50039BD744

檢視mirror進度,須等兩顆資料同步後100%再行拆開
# zpool status -v
  pool: rpool
 state: DEGRADED
status: One or more devices is currently being resilvered.  The pool will
        continue to function in a degraded state.
action: Wait for the resilver to complete.
  scan: resilver in progress since Tue Oct 27 14:44:52 2015
    4.10G scanned out of 70.0G at 45.2M/s, 0h24m to go
    4.10G resilvered, 5.86% done
config:

        NAME                         STATE     READ WRITE CKSUM
        rpool                        DEGRADED     0     0     0
          mirror-0                   DEGRADED     0     0     0
            c0t5000C5000EBDE997d0s6  ONLINE       0     0     0
            c0t5000C50039BD744Bd0s6  DEGRADED     0     0     0  (resilvering)

device details:

        c0t5000C50039BD744Bd0s6    DEGRADED       scrub/resilver needed
        status: ZFS detected errors on this device.
                The device is missing some data that is recoverable.
           see: http://support.oracle.com/msg/ZFS-8000-QJ for recovery


errors: No known data errors

Mirror 完成
# zpool status -v
  pool: rpool
 state: ONLINE
  scan: resilvered 70.0G in 0h18m with 0 errors on Tue Oct 27 15:03:07 2015
config:

        NAME                         STATE     READ WRITE CKSUM
        rpool                        ONLINE       0     0     0
          mirror-0                   ONLINE       0     0     0
            c0t5000C5000EBDE997d0s6  ONLINE       0     0     0
            c0t5000C50039BD744Bd0s6  ONLINE       0     0     0

errors: No known data errors

建立第二顆硬碟(300GB)開機磁區
# installboot -F zfs /usr/platform/`uname -i`/lib/fs/zfs/bootblk /dev/rdsk/c0t5000C50039BD744Bd0s6
WARNING: target device /dev/rdsk/c0t5000C50039BD744Bd0s6 has a versioned bootblock but no versioning information was provided.
bootblock version installed on /dev/rdsk/c0t5000C50039BD744Bd0s6 is more recent or identical
Use -F to override or install without the -u option

要從第二顆硬碟開機,先將系統下至OK Mode
# init 0

設定好裝置別名,方便開機使用,第一顆命名為rootdisk,第二顆命名為rootmir
{0} ok devalias
screen                   /pci@400/pci@1/pci@0/pci@0/pci@0/display@0
mouse                    /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/device@4/mouse@1
rootdisk                 /pci@400/pci@2/pci@0/pci@e/scsi@0/disk@w5000c5000ebde995,0:g
rootmir                  /pci@400/pci@2/pci@0/pci@e/scsi@0/disk@5000c50039bd7449,0:g

由第二顆開啟(300GB)
{0} ok boot rootmir
Boot device: /pci@400/pci@2/pci@0/pci@e/scsi@0/disk@5000c50039bd7449,0:g  File and args:

檢視zpool狀態
# zfspool status -v
  pool: rpool
 state: ONLINE
  scan: resilvered 70.0G in 0h18m with 0 errors on Tue Oct 27 15:03:07 2015
config:

        NAME                         STATE     READ WRITE CKSUM
        rpool                        ONLINE       0     0     0
          mirror-0                   ONLINE       0     0     0
            c0t5000C5000EBDE997d0s6  ONLINE       0     0     0
            c0t5000C50039BD744Bd0s6  ONLINE       0     0     0

將第一顆硬碟(146GB)從rpool 移除
# zpool detach rpool c0t5000C5000EBDE997d0s6

檢視zpool狀態
# zpolol stat -vatus -v
  pool: rpool
 state: ONLINE
  scan: resilvered 70.0G in 0h18m with 0 errors on Tue Oct 27 15:03:07 2015
config:

        NAME                       STATE     READ WRITE CKSUM
        rpool                      ONLINE       0     0     0
          c0t5000C50039BD744Bd0s6  ONLINE       0     0     0

errors: No known data errors

檢示磁區狀態  (變成300GB大小了)
# df -h
Filesystem             Size   Used  Available Capacity  Mounted on
rpool/ROOT/solaris     275G   2.1G       202G     2%    /
略


2015年5月27日 星期三

Solaris 11 快速設定 AMP (Apache, MySQL, PHP)



  • 安裝及檢視AMP Package



root@s11:/# pkg info -r group/feature/amp
          Name: group/feature/amp
       Summary: AMP (Apache, MySQL, PHP) Deployment Kit for Oracle Solaris
   Description: Provides a set of components for deployment of an AMP (Apache,
                MySQL, PHP) stack on Oracle Solaris
      Category: Meta Packages/Group Packages (org.opensolaris.category.2008)
                Web Services/Application and Web Servers (org.opensolaris.category.2008)
         State: Installed
     Publisher: solaris
       Version: 0.5.11
 Build Release: 5.11
        Branch: 0.175.1.0.0.24.0
Packaging Date: September  4, 2012 06:03:28 PM
          Size: 5.46 kB
          FMRI: pkg://solaris/group/feature/amp@0.5.11,5.11-0.175.1.0.0.24.0:20120904T180328Z
root@s11:/#
root@s11:/# svcadm enable apache22r
root@s11:/# svcs | grep apache
online 18:16:02 svc:/network/http:apache22
root@s11:/#cd /var/apache2/2.2/htdocs
root@s11:/# cd /var/apache2
root@s11:/var/apache2/2.2# cd htdocs
root@s11:/var/apache2/2.2/htdocs# ls -al
total 16
drwxr-xr-x 2 root bin 6 May 27 18:21 .
drwxr-xr-x 9 root bin 9 Sep 20 2012 ..
-r--r--r-- 1 root bin 377 Sep 20 2012 favicon.gif
-r--r--r-- 1 root bin 1406 Sep 20 2012 favicon.ico
-r--r--r-- 1 root bin 44 Sep 20 2012 index.html
-rw-r--r-- 1 root root 68 May 27 18:21 phpinfo.php
root@s11:/var/apache2/2.2/htdocs#

  • 開啟瀏覽器測試Apache Server是否OK







  • 建立一個phpinfo.php的檔案,測試PHP是否OK
root@s11:/var/apache2/2.2/htdocs# cat phpinfo.php
<?php

// Show all information, defaults to INFO_ALL
phpinfo();

?>
root@s11:/var/apache2/2.2/htdocs#






  • 設定Mysql

root@s11:/# svcs -a | grep mysql
disabled       17:36:09 svc:/application/database/mysql:version_51
root@s11:/# svcadm enable mysql
root@s11:/# svcs -a | grep mysql
online         18:43:38 svc:/application/database/mysql:version_51

  • 檢查是否有mysql的user 和 group


root@s11:/usr/mysql/5.1/bin# cat /etc/passwd | grep mysql
mysql:x:70:70:MySQL Reserved UID:/:
root@s11:/usr/mysql/5.1/bin# cat /etc/group | grep mysql
mysql::70:

# /usr/bin/mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!


In order to log into MySQL to secure it, we'll need the current
password for the root user.  If you've just installed MySQL, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.


# 輸入 root 的密碼,如果沒有設定過,直接按 Enter 鍵即可

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.


# 是否設定 root 的密碼

Set root password? [Y/n] y
New password: abc123
Re-enter new password: abc123
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.


# 移除 anonymous 使用者

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.


# 是否取消 root 遠端登入

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MySQL comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.


# 是否移除 test 資料表

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!


Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.


# 是否重新載入資料表權限

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...



All done!  If you've completed all of the above steps, your MySQL
installation should now be secure.

Thanks for using MySQL!

  • 檢視資料庫內容

root@s11:/usr/mysql/5.1/bin#  ./mysqlshow -p
Enter password: 
+--------------------+
|     Databases      |
+--------------------+
| information_schema |
| mysql              |
+--------------------+
root@s11:/usr/mysql/5.1/bin#  ./mysqlshow -pabc123 (abc123為密碼)
+--------------------+
|     Databases      |
+--------------------+
| information_schema |
| mysql              |
+--------------------+


  • 登入Mysql資料庫

root@s11:/usr/mysql/5.1/bin# ./mysql  -u root -pabc123
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 14
Server version: 5.1.37 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
+--------------------+
2 rows in set (0.01 sec)

使用mysql這個資料庫
mysql> use mysql;
Database changed

列出資料庫mysql的table

mysql> show tables;
+---------------------------+
| Tables_in_mysql           |
+---------------------------+
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
| user                      |
+---------------------------+
23 rows in set (0.00 sec)

mysql>quit

2015年5月6日 星期三

Solaris 設定 Audit


  • 顯示可歸屬事項預選類

root@s11:/var/audit# auditconfig -getflags
active user default audit flags = lo(0x1000,0x1000)
configured user default audit flags = lo(0x1000,0x1000)


  • 顯示不可歸屬事項預選類
root@s11:/etc/security# auditconfig -getnaflags
active non-attributable audit flags = lo(0x1000,0x1000)configured non-attributable audit flags = lo(0x1000,0x1000)


  • 顯示Audit策略

root@s11:/etc/security# auditconfig -getpolicy
configured audit policies = cntactive audit policies = cnt


  • 顯示Plugin相關訊息

root@s11:/etc/security# auditconfig -getplugin
Plugin: audit_binfile (active)        Attributes: p_dir=/var/audit;p_fsize=0;p_minfree=1
Plugin: audit_syslog (inactive)        Attributes: p_flags=
Plugin: audit_remote (inactive)        Attributes: p_hosts=;p_retries=3;p_timeout=5


  • 顯示Audit佇列控制

root@s11:/etc/security# auditconfig -getqctrlno configured audit queue hiwater markno configured audit queue lowater markno configured audit queue buffer sizeno configured audit queue delayactive audit queue hiwater mark (records) = 100active audit queue lowater mark (records) = 10active audit queue buffer size (bytes) = 8192active audit queue delay (ticks) = 20root@s11:/etc/security#


  • 顯示User Audit設定
root@s11:/etc/security# who
root       pts/1         5月  5日 18:15  (172.16.37.211)
mds        pts/2         5月  5日 18:49  (172.16.37.211)
root@s11:/etc/security# userattr audit_flags root
lo:no
root@s11:/etc/security# userattr audit_flags mds
root@s11:/etc/security#


  • 驗證Audit是否已啟動


root@s11:/var/audit# auditconfig -getcond
audit condition = auditing

root@s11:/var/audit# audit -v
configuration ok

Audit Flags的定義


Short NameLong NameShort Description
nono_classNull value for turning off event preselection
frfile_readRead of data, open for reading
fwfile_writeWrite of data, open for writing
fafile_attr_accAccess of object attributes: stat, pathconf
fmfile_attr_modChange of object attributes: chown, flock
fcfile_creationCreation of object
fdfile_deletionDeletion of object
clfile_closeclose system call
pcprocessProcess operations: fork, exec, exit
ntnetworkNetwork events: bind, connect, accept
ipipcSystem V IPC operations
nanon_attribNonattributable events
adadministrativeAdministrative actions
lologin_logoutLogin and logout events
apapplicationApplication-defined event
ioioctlioctl system call
exexecProgram execution
ototherMiscellaneous
allallAll flags set
New audit classes are defined. The ft audit class contains file transfer audit events

建議設定:
To enforce this setting, use the command:
# auditconfig -conf
# auditconfig -setflags lo,ad,ft,ex
# auditconfig -setnaflags lo
# auditconfig -setpolicy cnt,argv,zonename
# auditconfig -setplugin audit_binfile active p_minfree=1
# audit -s
auditconfig -setpolicy cnt,argv,zonename

# rolemod -K audit_flags=lo,ad,ft,ex:no root

PS. 為避免audit log過大難以讀取,設定每小時將目前的audit log關掉,並開啟一個新的audit log檔

# EDITOR=ed crontab -e root << END_CRON
$ 
a
0 * * * * /usr/sbin/audit -n
w
q
END_CRON

# chown root:root /var/audit
# chmod 750 /var/audit

查看audit log
# praudit xxxxxxx





開啟及關閉audit

root@s11:~# audit -t    關閉
root@s11:~# auditconfig -getcond
audit condition = noaudit
root@s11:~# audit -s    開啟
root@s11:~# auditconfig -getcond
audit condition = auditing

Clean up the old not_terminated file.
# auditreduce -O system-name old-not-terminated-file
root@s11:/var/audit# auditreduce -O s11 20150505092159.not_terminated.s11.1

DEMO:

建立一個帳號 -  johnny



 撈出關於帳號johnny的audit log













參考資料:
http://www.oracle.com/technetwork/articles/servers-storage-admin/sol-audit-quick-start-1942928.html#Custom


2015年5月5日 星期二

Solaris 11 新建使用者賦與su 權限


  • 一般使用者登入系統,欲切換為root


login as: mds
Using keyboard-interactive authentication.
Password:
Last login: Tue Jan 13 16:21:07 2015 from 172.16.37.211
Oracle Corporation      SunOS 5.11      11.1    May 2014
-bash-4.1$ su -
Password:
Roles can only be assumed by authorized users

  • 先使用root權限登入.
root@LDAPc25:~# usermod -R root mds
UX: usermod: mds is currently logged in, some changes may not take effect until next login. 


  • 下次登入時生效

login as: mds
Using keyboard-interactive authentication.
Password:
Last login: Wed May  6 10:22:15 2015 from 172.16.37.211
Oracle Corporation      SunOS 5.11      11.1    May 2014
-bash-4.1$ su -
Password:
Oracle Corporation      SunOS 5.11      11.1    May 2014
root@LDAPc25:~#