toasters November 2004

toasters@lists.teaparty.net

84 participants
93 discussions

RE: IPsec NFS to Unix clients
by Muhlestein, Mark 17 Jun '05

17 Jun '05

Gee, 30,000 * 300 is not even 10 million entries! :-) Yes, you are right that this isn't going to work in every case. But I wanted to mention it because it is useful in some situations. As to the MultiStore comment I made, I was thinking of a case where you want to use the same physical filer to serve an unprotected network (such as your normal campus network, it sounds like) and also serve a trusted network (on a different NIC or VLAN, say). As long as there is no way to access a vfiler's IP address using a client on the untrusted network, the vfiler boundary checks will prevent all access from all protocols (including NFS handle spoofing) coming from those untrusted clients. Mark -----Original Message----- From: Brian Parent [mailto:bparent@calvin.ucsd.edu] Sent: Friday, August 20, 2004 2:41 PM To: toasters(a)mathworks.com Subject: Re: IPsec NFS to Unix clients Thanks Mark. We do have CIFS. However, we have >30,000 accounts, and >300 NFS clients. And besides, any account is allowed access from any NFS client. Plus, it doesn't solve the problem of spoofing IPs. We don't have MultiStore, but even if we did, I don't see how it solves the problem of spoofing IPs. Spoofing IPs is painfully simple here, (as at most Universities, I would think) where labs aren't supervised, and network jacks are not physically secured. Re: > Subject: RE: IPsec NFS to Unix clients > Date: Fri, 20 Aug 2004 13:31:42 -0700 > From: "Muhlestein, Mark" <mark.muhlestein(a)netapp.com> > To: "Steve Losen" <scl(a)sasha.acc.virginia.edu>, > "Brian Parent" <bparent(a)calvin.ucsd.edu> > Cc: <toasters(a)mathworks.com> > > Here are a couple of other things you can do to improve NFS security: > > 1. If you have CIFS you might consider using the > nfs.require_valid_mapped_uid option. That allows you to set up the > usermap.cfg file to do things like this: > > # allow the following UIDs NFS access from the specified IP addresses > tom <= 192.168.3.34:tom > jerry <= jerrypc.dorm.foo.edu:jerry > jerry <= lab1.foo.edu:jerry > jerry <= lab2.foo.edu:jerry # etc. > > # allow root from the admin network > Administrator <= 10.10.20.0/24:root > > # prevent all other NFS access > "" <= * > > The nfs.require_valid_mapped_uid option causes the usermap.cfg entries > to be consulted even for access to data on qtrees with UNIX security. > Combined with the normal export controls, this approach works as long as > clients are not allowed to successfully spoof source IP addresses. It is > also more manageable if the number of combinations of users/hosts is not > overly large or dynamic; however I know we have had sites that have used > this type of approach with a script-generated usermap.cfg. > > 2. If you have MultiStore available you can also use that to fence off > NFS access. NFS clients accessing an IP address associated with a vfiler > are not allowed to access storage assigned to another vfiler. This is > enforced at the WAFL layer, so even if clients attempt handle spoofing > the access is denied as long as the potentially rogue clients are not > allowed to access the other vfilers' IP addresses (e.g. different > networks on separate NICs). > > Mark

2 2

Re: Converting Netcache to Filer
by masterlolo 28 Jan '05

28 Jan '05

Model is C760 (700 series). Netapp system board V. The problem is why the server accept only netcache license and not nfs license ? Thanks, Laurent. ----- Original Message ----- From: "Reeves, Gary" <garyr(a)netapp.com> To: "masterlolo" <masterlolo(a)noos.fr> Sent: Wednesday, September 22, 2004 4:17 PM Subject: RE: Converting Netcache to Filer What Model Appliance ? if 7xx series, tel me what system board version it is. Open the chassis and pull forward, then look on the motherboard at the back and you should see something like "SYSTEM BOARD V or V or VII" let me know what model it is. One you can, another you can with difficulty and one you cant. Regards -----Original Message----- From: masterlolo [mailto:masterlolo@noos.fr] Sent: 22 September 2004 14:34 To: toasters(a)mathworks.com Subject: Re: Converting Netcache to Filer Hi all, I have replace the HS battery, now the system is ok, but after each initialize all disk the server tell me that i must enter a valid license. As if the server do not reconize my valid license for NFS or CIFS !!! but if I enter a license for netcache, the system valid it but the installation is a netcache system !!! Someone can help me about it ? Maybe jumper on motherboard ?? Thanks, Laurent. ----- Original Message ----- From: "masterlolo" <masterlolo(a)noos.fr> To: <toasters(a)mathworks.com> Sent: Saturday, September 18, 2004 11:51 AM Subject: Re: Converting Netcache to Filer > Hi all, > > I have unset netcache by this command : > ok unsetenv netcache > ok setenv netcache? false > > I have check environnement : > ok printenv > Variable Name Value Default Value > netcache? false > > That's ok at this point. > I boot on DATA ONTAP Diskettes, and choose " (4) Initialize all disks " at > the menu : > Zero disks and install a new file system? y > This will erase all the data on the disks, are you sure? y > Zeroing disks takes about 15 minutes..... > > I enter some configuration information (as hostname, ip...) & i am stopped > by " Please enter your license: " > I have tested to enter a valid license for nfs, cifs : " You must enter a > valid system license " > I have tested to enter a valid license for netcache : that's ok (but after I > have a system problem : low battery and the system shutdown !) > So I would like to know if it's right to enter netcache license to convert > netcache in filer ?? > Do must change the netcache firmware to filer firmware ?? > > Thanks for your help, > Laurent. >

2 1

RE: Simulation jobs peaking filer CPU & CP
by Hill, Aaron 29 Nov '04

29 Nov '04

80K is a lot of NFS ops to say the least. I wasn't awareYou may be at the limits of the device, but we won't know for sure until we see a few statistics. Questions; What is disk utilization during this period? I assume your sysstat is indicating at least one disk is at 100% What size raid groups do you have on your volumes? Please capture a statit output? Rsh <filer> "priv set advanced;statit -b" , leave for a period while the utilization is known to be high. Rsh <filer> "priv set advanced;statit -e" > output.log (capturing output to a file). Let have a look at that output and see if you are bound on one or a few disks in a raid group, or whether you are just asking too much of the filer. There are a few other things in the statit that will be useful. You may have to look at splitting the workload across volumes or even into other filers. --Aaron -----Original Message----- From: cisco joe [mailto:ciscojoe305@yahoo.com] Sent: Tuesday, 30 November 2004 2:45 AM To: toasters(a)mathworks.com Subject: Simulation jobs peaking filer CPU & CP All, We have some issues with LSF simulation jobs writing to filers(FAS960) .. Filer's CPU peaking to 100% and NFS goes beyond 80K and CP back to back happening when users executes LSF regress simulations jobs...These jobs has heavy writes to filer and even read also high.. Because of this huge writes filer is going to hung state where simple ls or df from NFS is hanging ..Even telnet or rsh to filer will take long time ... If anybody has any workaround pls let me know Any suggestions is highly helpful Thanks Joe __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo ************** IMPORTANT MESSAGE ************** This e-mail message is intended only for the addressee(s) and contains information which may be confidential. If you are not the intended recipient please advise the sender by return email, do not use or disclose the contents, and delete the message and any attachments from your system. Unless specifically indicated, this email does not constitute formal advice or commitment by the sender or the Commonwealth Bank of Australia (ABN 48 123 123 124) or its subsidiaries. We can be contacted through our web site: commbank.com.au. If you no longer wish to receive commercial electronic messages from us, please reply to this e-mail by typing Unsubscribe in the subject line. ***************************************************************

1 0

Simulation jobs peaking filer CPU & CP
by cisco joe 29 Nov '04

29 Nov '04

All, We have some issues with LSF simulation jobs writing to filers(FAS960) .. Filer's CPU peaking to 100% and NFS goes beyond 80K and CP back to back happening when users executes LSF regress simulations jobs...These jobs has heavy writes to filer and even read also high.. Because of this huge writes filer is going to hung state where simple ls or df from NFS is hanging ..Even telnet or rsh to filer will take long time ... If anybody has any workaround pls let me know Any suggestions is highly helpful Thanks Joe __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo

1 0

RE: is toaster down ?
by Kevin Davis 29 Nov '04

29 Nov '04

> toaster news are down ? No, Stephane, the list is working. It hasn't seen a lot of activity lately, though. *------------------------------------------*-----------------------* | Kevin Davis (UNIX Sysadmin) | Natick, Massachusetts | | 508.647.7660 | 01760-2098 | | mailto:kevin.davis@mathworks.com *-----------------------* | http://www.mathworks.com <http://www.mathworks.com/> | | *------------------------------------------*-----------------------* ________________________________ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Stephane Bentebba Sent: Wednesday, November 24, 2004 8:43 AM To: toasters Subject: is toaster down ? toaster news are down ? i no more receive mail from this list -- Stéphane Bentebba Technicien de Maintenance Tél.: +33 (0)1.41.73.20.16 Fax.: +33 (0)1.41.73.20.08 support(a)fps.fr www.fps.fr <http://www.fps.fr> <http://www.fps.fr> FPS France Parc d'affaire Silic 43, rue de la Grosse Pierre BP 40160 94533 RUNGIS Cedex

1 0

Re: Email Marketing Campaigns --- 1 year for $500
by Invenio Sales 29 Nov '04

29 Nov '04

Do you believe in the saying, "Persistence pays"? We do, and so we're writing you this letter. We're a marketing firm who excels in setting qualified sales appointments and sales support for small and midsize companies. We succeed where others fail because of our persistence. Email Marketing Campaigns --- Starting at $500 - 12 months of broadcasting - Email Ads (We provide effective text only sales letters) - We provide your targeted list (Call us to ask how targeted they are!) - We firewall your company's name by only sharing your identity with prospects who ARE interested in your services - We'll maintain Can-Spam compliancy (we'll remove all removal requests from list before each new broadcast) - We forward all leads to you via email Lets not waste any time in getting you digitally bonded with your prospects. Your future profits and our own depend upon it. Regards, Matt LaClear Marketing Director 517-214-8061 inveniosales(a)550access.com (Select Target)*(Adjust Stance)*(Swing Full, Controlled and HARD)*(Follow Through) = Success ___________________________________________________________________________ _______________________________________________ This is an advertisement from Invenio Sales. To be removed fom our list simply hit reply and type "remove" in the subject line. To be removed via US Mail write the advertiser at 2107 Ferrol St, Lansing, MI 48910

1 0

RE: Group Policy Software Installations
by Allendörfer, Carsten 28 Nov '04

28 Nov '04

We are using exactly the same setup in our environment. We have GPO's applied to machines where the MSI-files are located on a filer. What you need to be aware of: - the filer needs to have Kerberos enabled - if it is a ntfs qtree the machine accounts need to have read access - probably "Domain Computers":Read - the NetApp needs to have a valid user mapping from the Windows machine account to a valid Unix id. We have the default Unix user set to: wafl.default_unix_user nobody and have a entry for nobody in /etc/passwd nobody:*:65534:65534:Guest for NT:/root:/bin/sh I don't believe that we have configured anything else to get the software installation working - but I could be wrong - that was some years ago... If it doesn't work set the options cifs.trace_login to on and watch the console for mapping errors. Carsten ________________________________ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Steve Evans Sent: Wednesday, November 24, 2004 12:48 PM To: toasters(a)mathworks.com Subject: RE: Group Policy Software Installations Sorry, I'm applying the GPO to workstations to install certain software. The software package (the msi) is being housed on the Filer. When you assign the software to a machine it tries to connect with the machine credentials and fails. Steve Evans SDSU Foundation ________________________________ From: SKIP HOFMANN [mailto:SKIP.HOFMANN@ttisg.com] Sent: Wednesday, November 24, 2004 11:06 AM To: Steve Evans; toasters(a)mathworks.com Subject: RE: Group Policy Software Installations What kind of GPO would you want to assign to a filer? Is the filer part of the domain? ________________________________ From: Steve Evans [mailto:sevans@foundation.sdsu.edu] Sent: Wednesday, November 24, 2004 10:21 AM To: toasters(a)mathworks.com Subject: Group Policy Software Installations Where trying to deploy a piece of software via Group Policy. If we assign it to the user it works fine, but if we assign it to the machine it can't find the source on the Filer. If we move the installation package to a Win2k3 machine we can assign it to the machine. Anyone know how to fix this with Filers? Steve Evans SDSU Foundation

1 0

filer-mrtg
by Patrick Kerrigan 26 Nov '04

26 Nov '04

Has anyone successfully installed filer-mrtg on redhat 9.0? I was getting the following error - *PROBLEM: rateup died from Signal 11. *I then tried using a newer version of rateup and the CPU would peg at 99% without any errors. Any suggestions?? Does anyone wish to share their cfgs? Any help would be much appreciated. Thanks, Patrick -- Patrick Kerrigan c.o.r.e. feature animation 461 king street west toronto, on m5v 1k7 416.977.3939

1 0

SEC: Unclassified Subscribe
by Teoh, Zenn MR 26 Nov '04

26 Nov '04

Zenn Teoh Storage Engineer Project Office - Infrastructure Department of Defence Ph: (02) 6265-8489 Fax: (02) 6265-8924 E-mail: zenn.teoh(a)defence.gov.au <mailto:zenn.teoh@defence.gov.au>

1 0

RE: Group Policy Software Installations
by Steve Evans 25 Nov '04

25 Nov '04

No. Steve Evans SDSU Foundation -----Original Message----- From: Alfred Lim [mailto:just4alf@hotmail.com] Sent: Thursday, November 25, 2004 5:12 AM To: Steve Evans; toasters(a)mathworks.com Subject: Re: Group Policy Software Installations Are you referring to SMS? ----- Original Message ----- From: "Steve Evans" <sevans(a)foundation.sdsu.edu> To: <toasters(a)mathworks.com> Sent: Thursday, November 25, 2004 7:22 AM Subject: RE: Group Policy Software Installations > Kerberos. > > > Steve Evans > SDSU Foundation > > -----Original Message----- > From: Luke Howard [mailto:lukeh@padl.com] > Sent: Wednesday, November 24, 2004 2:59 PM > To: Steve Evans > Cc: toasters(a)mathworks.com > Subject: RE: Group Policy Software Installations > > >>Sorry, I'm applying the GPO to workstations to install certain >>software. The software package (the msi) is being housed on the Filer. > >>When you assign the software to a machine it tries to connect with the > machine credentials and fails. > > Is it connecting using Kerberos or NTLM? > > -- Luke > > -- >

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters November 2004