Wednesday, July 23, 2008

svcadm disable ssh



What will happen to the existing ssh session?
answer: no problem, it runs as normal.

All new connections will be refused.

see the picture :-)

Some notes


I found this document in Sun Blueprint. It is created by Glen Brunette, one of Sun guys that i admired.
There's 2 things in the document that did not point out, one of them is giving permission to /var/audit/* files, and the other one is stopping cryptoadm by non-root user bring the cryptosvc to maintenance state when try to bring up.

First 'problem' details:
Assuming i am user weehing, and i was assigned "Audit Review" profile. Now i would like to audit user oracle activity, this is the same steps as illustrated in Glen's doc.

[weehing@pw250 ~]$ auditreduce -m AUE_su -r oracle | praudit -s | more
auditreduce: couldn't open:
/etc/security/audit/localhost/files/20080723041356.20080723041357.pw250: Permission denied
auditreduce: couldn't open:
/etc/security/audit/localhost/files/20080723041357.not_terminated.pw250: Permission denied
file,1970-01-01 07:30:00.000 +07:30,
file,2008-07-23 13:55:50.000 +08:00,

[weehing@pw250 ~]$ ls -l /etc/security/audit/localhost/files/*
-rw------- 1 root root 70 Jul 23 12:13 /etc/security/audit/localhost/files/20080723041356.20080723041357.pw250
-rw------- 1 root root 21080 Jul 23 13:58 /etc/security/audit/localhost/files/20080723041357.not_terminated.pw250


To allow weehing to audit oracle's activity, read permission would have to be given to weehing. This can be solved by a change in audit binary file permission, but this can be be another concern.


Second 'problem':

[weehing@pw250 ~]$ roles
roleA
[weehing@pw250 ~]$ profiles -l

Audit Review:
/usr/sbin/auditreduce euid=0
/usr/sbin/auditstat euid=0
/usr/sbin/praudit euid=0
All:
*
[weehing@pw250 ~]$ auths
solaris.audit.read,solaris.device.cdrw,solaris.profmgr.read,solaris.jobs.users,solaris.mail.mailq,solaris.admin.usermgr.read,solaris.admin.logsvc.read,solaris.admin.fsmgr.read,solaris.admin.serialmgr.read,solaris.admin.diskmgr.read,solaris.admin.procmgr.user,solaris.compsys.read,solaris.admin.printer.read,solaris.admin.prodreg.read,solaris.admin.dcmgr.read,solaris.snmp.read,solaris.project.read,solaris.admin.patchmgr.read,solaris.network.hosts.read,solaris.admin.volmgr.read
[weehing@pw250 ~]$ svcs cryptosvc
STATE STIME FMRI
online 17:19:30 svc:/system/cryptosvc:default
[weehing@pw250 ~]$
[weehing@pw250 ~]$ digest -a sha1 /etc/hosts
ee4ef007673a3090a4cc00bdb125ec8c146cf7e4
[weehing@pw250 ~]$
[weehing@pw250 ~]$ cryptoadm stop
cryptoadm: failed to stop cryptographic framework daemon - Not owner.
[weehing@pw250 ~]$ su roles
su: Unknown id: roles
[weehing@pw250 ~]$ su roleA
Password:
$ svcs cryptosvc
STATE STIME FMRI
online 17:19:30 svc:/system/cryptosvc:default
$ cryptoadm stop
$ svcs cryptosvc
STATE STIME FMRI
maintenance 17:34:54 svc:/system/cryptosvc:default
$ digest -a sha1 /etc/hosts
digest: failed to initialize PKCS #11 framework: CKR_GENERAL_ERROR
$ cryptoadm start
$ digest -a sha1 /etc/hosts
ee4ef007673a3090a4cc00bdb125ec8c146cf7e4
$ svcs cryptosvc
STATE STIME FMRI
maintenance 17:34:54 svc:/system/cryptosvc:default <---all gone here until here, though this is not really a issue as digest command still works.
$ svcadm clear svc:/system/cryptosvc:default
svcadm: svc:/system/cryptosvc:default: Permission denied.

How to bring the cryptosvc back to online state??

[root@pw250 patches]$ cryptoadm stop
[root@pw250 patches]$ svcs cryptosvc
STATE STIME FMRI
maintenance 17:34:54 svc:/system/cryptosvc:default
[root@pw250 patches]$ svcadm clear svc:/system/cryptosvc:default
[root@pw250 patches]$ svcs cryptosvc
STATE STIME FMRI
online 17:39:25 svc:/system/cryptosvc:default

Well, this is nothing much, but just some findings for reader who follows Glen's doc and might hit the same things like me.




Tuesday, July 22, 2008

Permission Denied When Login SMC

Getting permission denied error when login to SMC as root user, check this:

[root@pw250 bin]$ profiles -l root

Web Console Management:
/usr/share/webconsole/private/bin/smcwebstart uid=noaccess,
gid=noaccess,
privs=proc_audit
All:
*

Saturday, July 12, 2008

Rcapd daemon

Found some rcapd info in this doc: Best Practices for Running Oracle Databases in SolarisTM Containers.
--------------------------------------------------------------------------------------
Please note that the rcapd daemon cannot determine which pages of memory are shared
with other processes or which are mapped multiple times within the same process. Hence,
it is not recommended that shared memory-intensive applications, like Oracle databases,
run under projects that use rcapd to limit physical memory usage.
----------------------------------------------------------------------------------------

Friday, July 11, 2008

vmkfstool

Need to use this frequently....

[root@fms rhac4]# vmkfstools -c 4096m -a lsilogic -d thick rhac4_2.vmdk
[root@fms rhac4]# pwd
/vmfs/volumes/dd1/rhac4
[root@fms rhac4]# cd ../rhac3
[root@fms rhac3]# vmkfstools -c 4096m -a lsilogic -d thick rhac3_2.vmdk

Wednesday, July 09, 2008

How to failback a VVR RVG to Original Primary

The scenario is that pw250 was down and pw450 (secondary) takeover as a new primary.

After pw250 is fixed, it's powered-up. And the config error is shown below in red. Pw250 is running as acting secondary.
The procedure show how to do a failback to original primary - pw250.



pw250 -- 192.168.100.118 ---------- this is the original primary
pw450 -- 192.168.100.116 ---------- this is the original secondary
RVG name: PRDvvr
DG name: mxpdbs_dg
App: Oracle 10gR2 DB


[root@pw250 log]$
[root@pw250 log]$
[root@pw250 log]$ vradmin -g mxpdbs_dg repstatus PRDvvr
Replicated Data Set: PRDvvr
Primary:
Host name: 192.168.100.116
RVG name: PRDvvr
DG name: mxpdbs_dg
RVG state: enabled for I/O
Data volumes: 2
VSets: 0
SRL name: vvrsrl
SRL size: 1.00 G
Total secondaries: 1

Primary (acting secondary):
Host name: 192.168.100.118
RVG name: PRDvvr
DG name: mxpdbs_dg
Data status: consistent, behind
Replication status: logging to DCM (needs failback synchronization)
Current mode: asynchronous
Logging to: DCM (contains 17408 Kbytes) (failback logging)
Timestamp Information: N/A

Config Errors:
192.168.100.118: Primary-Primary configuration

[root@pw250 log]$ vradmin -g mxpdbs_dg fbsync
VxVM VVR vradmin ERROR V-5-52-19 Incorrect number of arguments
VxVM VVR vradmin INFO V-5-52-42
Usage: vradmin [-g diskgroup] [-wait] fbsync rvg [cache=cacheobj | cachesize=size]


[root@pw250 log]$ vradmin -g mxpdbs_dg fbsync PRDvvr
[root@pw250 log]$ vradmin -g mxpdbs_dg repstatus PRDvvr
Replicated Data Set: PRDvvr
Primary:
Host name: 192.168.100.116
RVG name: PRDvvr
DG name: mxpdbs_dg
RVG state: enabled for I/O
Data volumes: 2
VSets: 0
SRL name: vvrsrl
SRL size: 1.00 G
Total secondaries: 1

Secondary:
Host name: 192.168.100.118
RVG name: PRDvvr
DG name: mxpdbs_dg
Data status: inconsistent
Replication status: resync in progress (failback synchronization)
Current mode: asynchronous
Logging to: DCM (contains 17408 Kbytes) (failback logging)
Timestamp Information: N/A

[root@pw250 log]$ vradmin -g mxpdbs_dg migrate PRDvvr 192.168.100.118
VxVM VVR vradmin WARNING V-5-52-93 Make sure applications using Primary data volumes are stopped.
vradmin: Continue with migrate (y/n)? y
Message from Primary:
VxVM VVR vxrvg ERROR V-5-1-10128 Operation not allowed with open volumes
VxVM VVR vxrvg ERROR V-5-1-407 Attempting to cleanup after failure ...

<***********At this stage, go to pw450 and shutdown all applications and unmount the filesystems)************>

[root@pw250 log]$ vradmin -g mxpdbs_dg migrate PRDvvr 192.168.100.118
VxVM VVR vradmin WARNING V-5-52-93 Make sure applications using Primary data volumes are stopped.
vradmin: Continue with migrate (y/n)? y

[root@pw250 log]$ vradmin -g mxpdbs_dg repstatus PRDvvr
Replicated Data Set: PRDvvr
Primary:
Host name: 192.168.100.118
RVG name: PRDvvr
DG name: mxpdbs_dg
RVG state: enabled for I/O
Data volumes: 2
VSets: 0
SRL name: vvrsrl
SRL size: 5.00 G
Total secondaries: 1

Secondary:
Host name: 192.168.100.116
RVG name: PRDvvr
DG name: mxpdbs_dg
Data status: consistent, up-to-date
Replication status: replicating (connected)
Current mode: synchronous
Logging to: SRL
Timestamp Information: N/A


[root@pw250 log]$ mount -F vxfs /dev/vx/dsk/mxpdbs_dg/mxpdbs_vol01 /app/oracle
[root@pw250 log]$ ls -ld /app/oracle
drwxr-xr-x 8 oracle oinstall 1024 Jul 9 17:42 /app/oracle/
[root@pw250 log]$ mount -F vxfs /dev/vx/dsk/mxpdbs_dg/mxpdbs_vol02 /flasharea/
[root@pw250 log]$ su - oracle
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
[oracle@pw250 ~]$ sqlplus / as sysdba

SQL*Plus: Release 10.2.0.1.0 - Production on Wed Jul 9 18:57:03 2008

Copyright (c) 1982, 2005, Oracle. All rights reserved.

Connected to an idle instance.

SQL> startup
ORACLE instance started.

Total System Global Area 2550136832 bytes
Fixed Size 1980808 bytes
Variable Size 536872568 bytes
Database Buffers 1996488704 bytes
Redo Buffers 14794752 bytes
Database mounted.
Database opened.
SQL> select * from testt;

A
--------------------
2
288
3333
from450

SQL> exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options

Edit listener.ora and anything that's required, and start up the listener.

[oracle@pw250 admin]$ lsnrctl start

LSNRCTL for Solaris: Version 10.2.0.1.0 - Production on 09-JUL-2008 18:58:35

Copyright (c) 1991, 2005, Oracle. All rights reserved.

Starting /app/oracle/product/10.2.0/dbhome/bin/tnslsnr: please wait...

TNSLSNR for Solaris: Version 10.2.0.1.0 - Production
System parameter file is /app/oracle/product/10.2.0/dbhome/network/admin/listener.ora
Log messages written to /app/oracle/product/10.2.0/dbhome/network/log/listener.log
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=pw250)(PORT=1521)))

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Solaris: Version 10.2.0.1.0 - Production
Start Date 09-JUL-2008 18:58:37
Uptime 0 days 0 hr. 0 min. 0 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File /app/oracle/product/10.2.0/dbhome/network/admin/listener.ora
Listener Log File /app/oracle/product/10.2.0/dbhome/network/log/listener.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=pw250)(PORT=1521)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
The command completed successfully
[oracle@pw250 admin]$
[oracle@pw250 admin]$ lsnrctl status

LSNRCTL for Solaris: Version 10.2.0.1.0 - Production on 09-JUL-2008 18:59:27

Copyright (c) 1991, 2005, Oracle. All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Solaris: Version 10.2.0.1.0 - Production
Start Date 09-JUL-2008 18:58:37
Uptime 0 days 0 hr. 0 min. 50 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File /app/oracle/product/10.2.0/dbhome/network/admin/listener.ora
Listener Log File /app/oracle/product/10.2.0/dbhome/network/log/listener.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=pw250)(PORT=1521)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "ooo" has 1 instance(s).
Instance "ooo", status READY, has 1 handler(s) for this service...
Service "oooXDB" has 1 instance(s).
Instance "ooo", status READY, has 1 handler(s) for this service...
Service "ooo_XPT" has 1 instance(s).
Instance "ooo", status READY, has 1 handler(s) for this service...
The command completed successfully

Thursday, July 03, 2008

Oracle RAC TAF Tnsnames.ora client entry

This is the entry that works for me..

XXX =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = 202.188.88.10)(PORT = 1521))
(ADDRESS = (PROTOCOL = TCP)(HOST = 202.188.88.11)(PORT = 1521))
(FAILOVER = on)
(LOAD_BALANCE = on)
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = xxx)
(FAILOVER_MODE =
(TYPE = SELECT)
(METHOD = PRECONNECT)
(RETRIES = 180)
(DELAY = 5)
)
)
)