toasters October 2004

toasters@lists.teaparty.net

66 participants
89 discussions

RE: IPsec NFS to Unix clients
by Muhlestein, Mark 17 Jun '05

17 Jun '05

Gee, 30,000 * 300 is not even 10 million entries! :-) Yes, you are right that this isn't going to work in every case. But I wanted to mention it because it is useful in some situations. As to the MultiStore comment I made, I was thinking of a case where you want to use the same physical filer to serve an unprotected network (such as your normal campus network, it sounds like) and also serve a trusted network (on a different NIC or VLAN, say). As long as there is no way to access a vfiler's IP address using a client on the untrusted network, the vfiler boundary checks will prevent all access from all protocols (including NFS handle spoofing) coming from those untrusted clients. Mark -----Original Message----- From: Brian Parent [mailto:bparent@calvin.ucsd.edu] Sent: Friday, August 20, 2004 2:41 PM To: toasters(a)mathworks.com Subject: Re: IPsec NFS to Unix clients Thanks Mark. We do have CIFS. However, we have >30,000 accounts, and >300 NFS clients. And besides, any account is allowed access from any NFS client. Plus, it doesn't solve the problem of spoofing IPs. We don't have MultiStore, but even if we did, I don't see how it solves the problem of spoofing IPs. Spoofing IPs is painfully simple here, (as at most Universities, I would think) where labs aren't supervised, and network jacks are not physically secured. Re: > Subject: RE: IPsec NFS to Unix clients > Date: Fri, 20 Aug 2004 13:31:42 -0700 > From: "Muhlestein, Mark" <mark.muhlestein(a)netapp.com> > To: "Steve Losen" <scl(a)sasha.acc.virginia.edu>, > "Brian Parent" <bparent(a)calvin.ucsd.edu> > Cc: <toasters(a)mathworks.com> > > Here are a couple of other things you can do to improve NFS security: > > 1. If you have CIFS you might consider using the > nfs.require_valid_mapped_uid option. That allows you to set up the > usermap.cfg file to do things like this: > > # allow the following UIDs NFS access from the specified IP addresses > tom <= 192.168.3.34:tom > jerry <= jerrypc.dorm.foo.edu:jerry > jerry <= lab1.foo.edu:jerry > jerry <= lab2.foo.edu:jerry # etc. > > # allow root from the admin network > Administrator <= 10.10.20.0/24:root > > # prevent all other NFS access > "" <= * > > The nfs.require_valid_mapped_uid option causes the usermap.cfg entries > to be consulted even for access to data on qtrees with UNIX security. > Combined with the normal export controls, this approach works as long as > clients are not allowed to successfully spoof source IP addresses. It is > also more manageable if the number of combinations of users/hosts is not > overly large or dynamic; however I know we have had sites that have used > this type of approach with a script-generated usermap.cfg. > > 2. If you have MultiStore available you can also use that to fence off > NFS access. NFS clients accessing an IP address associated with a vfiler > are not allowed to access storage assigned to another vfiler. This is > enforced at the WAFL layer, so even if clients attempt handle spoofing > the access is denied as long as the potentially rogue clients are not > allowed to access the other vfilers' IP addresses (e.g. different > networks on separate NICs). > > Mark

2 2

Re: Converting Netcache to Filer
by masterlolo 28 Jan '05

28 Jan '05

Model is C760 (700 series). Netapp system board V. The problem is why the server accept only netcache license and not nfs license ? Thanks, Laurent. ----- Original Message ----- From: "Reeves, Gary" <garyr(a)netapp.com> To: "masterlolo" <masterlolo(a)noos.fr> Sent: Wednesday, September 22, 2004 4:17 PM Subject: RE: Converting Netcache to Filer What Model Appliance ? if 7xx series, tel me what system board version it is. Open the chassis and pull forward, then look on the motherboard at the back and you should see something like "SYSTEM BOARD V or V or VII" let me know what model it is. One you can, another you can with difficulty and one you cant. Regards -----Original Message----- From: masterlolo [mailto:masterlolo@noos.fr] Sent: 22 September 2004 14:34 To: toasters(a)mathworks.com Subject: Re: Converting Netcache to Filer Hi all, I have replace the HS battery, now the system is ok, but after each initialize all disk the server tell me that i must enter a valid license. As if the server do not reconize my valid license for NFS or CIFS !!! but if I enter a license for netcache, the system valid it but the installation is a netcache system !!! Someone can help me about it ? Maybe jumper on motherboard ?? Thanks, Laurent. ----- Original Message ----- From: "masterlolo" <masterlolo(a)noos.fr> To: <toasters(a)mathworks.com> Sent: Saturday, September 18, 2004 11:51 AM Subject: Re: Converting Netcache to Filer > Hi all, > > I have unset netcache by this command : > ok unsetenv netcache > ok setenv netcache? false > > I have check environnement : > ok printenv > Variable Name Value Default Value > netcache? false > > That's ok at this point. > I boot on DATA ONTAP Diskettes, and choose " (4) Initialize all disks " at > the menu : > Zero disks and install a new file system? y > This will erase all the data on the disks, are you sure? y > Zeroing disks takes about 15 minutes..... > > I enter some configuration information (as hostname, ip...) & i am stopped > by " Please enter your license: " > I have tested to enter a valid license for nfs, cifs : " You must enter a > valid system license " > I have tested to enter a valid license for netcache : that's ok (but after I > have a system problem : low battery and the system shutdown !) > So I would like to know if it's right to enter netcache license to convert > netcache in filer ?? > Do must change the netcache firmware to filer firmware ?? > > Thanks for your help, > Laurent. >

2 1

ssh scripts
by Robert Borowicz 02 Nov '04

02 Nov '04

I want to work with our DBA's to put our Oracle instances in Hot Standby to grab snapshots. Anybody got a script they use that utilizes SSH to run the snap command on a filer? Thanks -Rob

8 14

User administration (was ssh scripts)
by Michael Christian 02 Nov '04

02 Nov '04

Next question. I want to automate user administration. The whole 'useradmin useradd' thing with its interactive interface and live password addition (who the heck only lets root set a user's pasword?) is probably not going to work with our 500+ filers. 500xNumberOfAdmins. Yeah, right. The docs point to fairly standard /etc/[passwd,shadow,group] files, but having added a user, I still don't see them on my box. Has anyone automated user management? -MikeC _____ From: Michael Christian Sent: Friday, October 29, 2004 9:08 PM To: 'Potakamuri, Sreenivasa'; Thorsten.Lemke(a)computacenter.com; bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: RE: ssh scripts Nice, that did it. Thanks. User-level auditing will be a godsend. -MikeC _____ From: Potakamuri, Sreenivasa [mailto:Sreenivasa.Potakamuri@netapp.com] Sent: Thursday, October 28, 2004 10:53 PM To: Michael Christian; Thorsten.Lemke(a)computacenter.com; bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: RE: ssh scripts This problem has been fixed in 6.4.5, 6.5.1 and above. Bug number for this problem is 90495. Regards, Sreeni Network Appliance -----Original Message----- From: Michael Christian [mailto:mchristi@yahoo-inc.com] Sent: Thu 10/28/2004 11:07 AM To: Thorsten.Lemke(a)computacenter.com; bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: RE: ssh scripts On a similar note, I've been trying to get user-level auditing working using ssh. When you telnet in, it logs actions under your userid, but when you ssh in, it logs everything as root. (Presumably because sshd is running as root?) Has anyone else had this problem, or know of a workaround? This is 6.5X18 -Mike ***************************************

3 2

RE: ssh scripts
by Michael Christian 30 Oct '04

30 Oct '04

Nice, that did it. Thanks. User-level auditing will be a godsend. -MikeC _____ From: Potakamuri, Sreenivasa [mailto:Sreenivasa.Potakamuri@netapp.com] Sent: Thursday, October 28, 2004 10:53 PM To: Michael Christian; Thorsten.Lemke(a)computacenter.com; bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: RE: ssh scripts This problem has been fixed in 6.4.5, 6.5.1 and above. Bug number for this problem is 90495. Regards, Sreeni Network Appliance -----Original Message----- From: Michael Christian [mailto:mchristi@yahoo-inc.com] Sent: Thu 10/28/2004 11:07 AM To: Thorsten.Lemke(a)computacenter.com; bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: RE: ssh scripts On a similar note, I've been trying to get user-level auditing working using ssh. When you telnet in, it logs actions under your userid, but when you ssh in, it logs everything as root. (Presumably because sshd is running as root?) Has anyone else had this problem, or know of a workaround? This is 6.5X18 -Mike -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Thorsten.Lemke(a)computacenter.com Sent: Thursday, October 28, 2004 1:36 AM To: bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: Re: ssh scripts You need to create a proper directory structure in your filers' /etc first to access it via ssh without a password: Create /etc/sshd/<username>/.ssh/authorized_keys and paste the public key of the accessing host in that file. <username> has to be the user on the remote host that is used to transmit the ssh command. I did not find a way to make SecureAdmin or ONTAP create that file automatically yet... With the option "ssh.pubkey_auth.enable" activated, the user now authenticates without a password. Thorsten Brian Parent <bparent(a)calvin.ucsd.edu>@mathworks.com on 28.10.2004 01:07:57 Sent by: owner-toasters(a)mathworks.com To: Netapp <toasters(a)mathworks.com> cc: Subject: Re: ssh scripts ------------------------------------------------------------------------ -- Can anyone on this list confirm whether ssh can be used in place of rsh (after purchasing SecureAdmin ofcourse), without requiring the use of a password? It appears to be the case, based on the existence of the options "ssh.pubkey_auth.enable" as well as "ssh.passwd_auth.enable" on my DOT 6.4.5 systems. I'd just like to make sure before buying the SecureAdmin software because I'd rather not bother if I have to stuff the password into an expect script somewhere. Re: > Date: Wed, 27 Oct 2004 21:07:52 +0200 > From: Stefan Funke <bundy(a)arcor-ip.de> > To: Robert Borowicz <rbaus(a)swbell.net> > Cc: Netapp <toasters(a)mathworks.com> > Subject: Re: ssh scripts > > Quoting message received from Robert Borowicz: > > > I want to work with our DBA's to put our Oracle instances in Hot > > Standby to grab snapshots. Anybody got a script they use that utilizes > > SSH to run the snap command on a filer? > > http://www.netapp.com/tech_library/3130.html > > show it to your dba's and replace rsh with ssh. COMPUTACENTER (UK) LTD The contents of this e-mail are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use it, or disclose it to anyone else. If you received it in error please notify us immediately and then destroy it. Computacenter information is available from http://www.computacenter.com This footnote also confirms that this email message has been swept for the presence of computer viruses. ************************************************************************ ***************************************************

1 0

NetApp Disk Shelves on Linux
by Ben Rockwood 29 Oct '04

29 Oct '04

Hello Toasters. I started a paper a long while back that outlines and gave examples for utilizing old NetApp Filers and NetCache gear on Linux systems. I just found it half completed yesterday. I can't recall why I never finished it, but I guess I didn't think anyone was interesed. Anyway, I've clean it up and made it avalible. If you have old F700/F800 gear just sitting around you can use a spare X86 system with Linux and the parts from the NetApp you already have to build all sorts of interesting storage solutions for mail servers, file servers, directory servers or any other storage you need but don't have budget for. Take your investment and put it back to use. The paper is here: http://www.cuddletech.com/articles/netapp/netapp-evms.html You can see how I use one of my old FC9 shelves here: http://www.cuddletech.com/a64/ And even how I used a shelf together with a spare Brocade Silkworm 2800 to build a "no-cost" SAN for my internal testing purposes!: http://www.cuddletech.com/cuddle-san.jpeg (In this picture you can see an F840 I use for iSCSI and OnTap testing, an F5 load balancer which is balancing Solaris Zones on my Ultra2, and a Brocade Silkworm 2800 using QuickLoop to attach an FC8 shelf to 2 Sun Workstations providing SAN storage) Hope this is useful to someone. benr.

1 0

Private investigation
by clifford.barckley＠virgilio.it 29 Oct '04

29 Oct '04

I am contacting you on behalf of MADEWELL Consultants:Private Investigators and Security Consultants. My name is Clifford Barckley.We are conducting a standard process investigation on behalf of Union Bank of Switzerland, the international Banking conglomerate. This investigation involves a client who shares the same surname with you and also the circumstances surrounding investments made by this client at the union Bank,the Private Banking arm of Union Bank of Switzerland. The Union Bank Private Banking client died intestate and nominated no successor in title over the investments made with the Bank. The essence of this communication with you is to request you provide us information/comments on any or all of the four issues: 1-Are you aware of any relative/relation who shares your same surname whose last known contact address was Brussels Belgium? 2-Are you aware of any investment of considerable value made by such a person at the Private Banking Division of Union Bank of Switzerland? 3-Born on the 1st of June 1927 4-Can you establish beyond reasonable doubt your eligibility to assume status of successor in title to the deceased? It is pertinent that you inform us ASAP whether or not you are familiar with this personality that we may put an end to this communication with you and our inquiries surrounding this personality. You must appreciate that we are constrained from providing you with more detailed information at this point.Please respond to this mail as soon as possible to afford us the opportunity to close this investigation. Thank you for accommodating our enquiry. Clifford Barckley For:Madewell Consultants

1 0

Linux Administration Course
by app_tech_100＠yahoo.com 29 Oct '04

29 Oct '04

Applied Technology Research Center. Linux and Unix Fundamentals (LPI 101/102) - 40 Hours Course in Karachi, Pakistan. Please call coordination for details and registeration on 92-333-2335380 or Khawar Nehal on 92-21-4980523, 92-300-9284698

1 0

RE: ssh scripts
by Potakamuri, Sreenivasa 29 Oct '04

29 Oct '04

This problem has been fixed in 6.4.5, 6.5.1 and above. Bug number for this problem is 90495. Regards, Sreeni Network Appliance -----Original Message----- From: Michael Christian [mailto:mchristi@yahoo-inc.com] Sent: Thu 10/28/2004 11:07 AM To: Thorsten.Lemke(a)computacenter.com; bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: RE: ssh scripts On a similar note, I've been trying to get user-level auditing working using ssh. When you telnet in, it logs actions under your userid, but when you ssh in, it logs everything as root. (Presumably because sshd is running as root?) Has anyone else had this problem, or know of a workaround? This is 6.5X18 -Mike -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Thorsten.Lemke(a)computacenter.com Sent: Thursday, October 28, 2004 1:36 AM To: bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: Re: ssh scripts You need to create a proper directory structure in your filers' /etc first to access it via ssh without a password: Create /etc/sshd/<username>/.ssh/authorized_keys and paste the public key of the accessing host in that file. <username> has to be the user on the remote host that is used to transmit the ssh command. I did not find a way to make SecureAdmin or ONTAP create that file automatically yet... With the option "ssh.pubkey_auth.enable" activated, the user now authenticates without a password. Thorsten Brian Parent <bparent(a)calvin.ucsd.edu>@mathworks.com on 28.10.2004 01:07:57 Sent by: owner-toasters(a)mathworks.com To: Netapp <toasters(a)mathworks.com> cc: Subject: Re: ssh scripts ------------------------------------------------------------------------ -- Can anyone on this list confirm whether ssh can be used in place of rsh (after purchasing SecureAdmin ofcourse), without requiring the use of a password? It appears to be the case, based on the existence of the options "ssh.pubkey_auth.enable" as well as "ssh.passwd_auth.enable" on my DOT 6.4.5 systems. I'd just like to make sure before buying the SecureAdmin software because I'd rather not bother if I have to stuff the password into an expect script somewhere. Re: > Date: Wed, 27 Oct 2004 21:07:52 +0200 > From: Stefan Funke <bundy(a)arcor-ip.de> > To: Robert Borowicz <rbaus(a)swbell.net> > Cc: Netapp <toasters(a)mathworks.com> > Subject: Re: ssh scripts > > Quoting message received from Robert Borowicz: > > > I want to work with our DBA's to put our Oracle instances in Hot > > Standby to grab snapshots. Anybody got a script they use that utilizes > > SSH to run the snap command on a filer? > > http://www.netapp.com/tech_library/3130.html > > show it to your dba's and replace rsh with ssh. COMPUTACENTER (UK) LTD The contents of this e-mail are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use it, or disclose it to anyone else. If you received it in error please notify us immediately and then destroy it. Computacenter information is available from http://www.computacenter.com This footnote also confirms that this email message has been swept for the presence of computer viruses. ************************************************************************ ***************************************************

1 0

RE: ssh scripts
by Michael Christian 28 Oct '04

28 Oct '04

On a similar note, I've been trying to get user-level auditing working using ssh. When you telnet in, it logs actions under your userid, but when you ssh in, it logs everything as root. (Presumably because sshd is running as root?) Has anyone else had this problem, or know of a workaround? This is 6.5X18 -Mike -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Thorsten.Lemke(a)computacenter.com Sent: Thursday, October 28, 2004 1:36 AM To: bparent(a)calvin.ucsd.edu Cc: toasters(a)mathworks.com Subject: Re: ssh scripts You need to create a proper directory structure in your filers' /etc first to access it via ssh without a password: Create /etc/sshd/<username>/.ssh/authorized_keys and paste the public key of the accessing host in that file. <username> has to be the user on the remote host that is used to transmit the ssh command. I did not find a way to make SecureAdmin or ONTAP create that file automatically yet... With the option "ssh.pubkey_auth.enable" activated, the user now authenticates without a password. Thorsten Brian Parent <bparent(a)calvin.ucsd.edu>@mathworks.com on 28.10.2004 01:07:57 Sent by: owner-toasters(a)mathworks.com To: Netapp <toasters(a)mathworks.com> cc: Subject: Re: ssh scripts ------------------------------------------------------------------------ -- Can anyone on this list confirm whether ssh can be used in place of rsh (after purchasing SecureAdmin ofcourse), without requiring the use of a password? It appears to be the case, based on the existence of the options "ssh.pubkey_auth.enable" as well as "ssh.passwd_auth.enable" on my DOT 6.4.5 systems. I'd just like to make sure before buying the SecureAdmin software because I'd rather not bother if I have to stuff the password into an expect script somewhere. Re: > Date: Wed, 27 Oct 2004 21:07:52 +0200 > From: Stefan Funke <bundy(a)arcor-ip.de> > To: Robert Borowicz <rbaus(a)swbell.net> > Cc: Netapp <toasters(a)mathworks.com> > Subject: Re: ssh scripts > > Quoting message received from Robert Borowicz: > > > I want to work with our DBA's to put our Oracle instances in Hot > > Standby to grab snapshots. Anybody got a script they use that utilizes > > SSH to run the snap command on a filer? > > http://www.netapp.com/tech_library/3130.html > > show it to your dba's and replace rsh with ssh. COMPUTACENTER (UK) LTD The contents of this e-mail are intended for the named addressee only. It contains information which may be confidential and which may also be privileged. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use it, or disclose it to anyone else. If you received it in error please notify us immediately and then destroy it. Computacenter information is available from http://www.computacenter.com This footnote also confirms that this email message has been swept for the presence of computer viruses. ************************************************************************ ***************************************************

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters October 2004