toasters August 2004

toasters@lists.teaparty.net

69 participants
68 discussions

RE: IPsec NFS to Unix clients
by Muhlestein, Mark 17 Jun '05

17 Jun '05

Gee, 30,000 * 300 is not even 10 million entries! :-) Yes, you are right that this isn't going to work in every case. But I wanted to mention it because it is useful in some situations. As to the MultiStore comment I made, I was thinking of a case where you want to use the same physical filer to serve an unprotected network (such as your normal campus network, it sounds like) and also serve a trusted network (on a different NIC or VLAN, say). As long as there is no way to access a vfiler's IP address using a client on the untrusted network, the vfiler boundary checks will prevent all access from all protocols (including NFS handle spoofing) coming from those untrusted clients. Mark -----Original Message----- From: Brian Parent [mailto:bparent@calvin.ucsd.edu] Sent: Friday, August 20, 2004 2:41 PM To: toasters(a)mathworks.com Subject: Re: IPsec NFS to Unix clients Thanks Mark. We do have CIFS. However, we have >30,000 accounts, and >300 NFS clients. And besides, any account is allowed access from any NFS client. Plus, it doesn't solve the problem of spoofing IPs. We don't have MultiStore, but even if we did, I don't see how it solves the problem of spoofing IPs. Spoofing IPs is painfully simple here, (as at most Universities, I would think) where labs aren't supervised, and network jacks are not physically secured. Re: > Subject: RE: IPsec NFS to Unix clients > Date: Fri, 20 Aug 2004 13:31:42 -0700 > From: "Muhlestein, Mark" <mark.muhlestein(a)netapp.com> > To: "Steve Losen" <scl(a)sasha.acc.virginia.edu>, > "Brian Parent" <bparent(a)calvin.ucsd.edu> > Cc: <toasters(a)mathworks.com> > > Here are a couple of other things you can do to improve NFS security: > > 1. If you have CIFS you might consider using the > nfs.require_valid_mapped_uid option. That allows you to set up the > usermap.cfg file to do things like this: > > # allow the following UIDs NFS access from the specified IP addresses > tom <= 192.168.3.34:tom > jerry <= jerrypc.dorm.foo.edu:jerry > jerry <= lab1.foo.edu:jerry > jerry <= lab2.foo.edu:jerry # etc. > > # allow root from the admin network > Administrator <= 10.10.20.0/24:root > > # prevent all other NFS access > "" <= * > > The nfs.require_valid_mapped_uid option causes the usermap.cfg entries > to be consulted even for access to data on qtrees with UNIX security. > Combined with the normal export controls, this approach works as long as > clients are not allowed to successfully spoof source IP addresses. It is > also more manageable if the number of combinations of users/hosts is not > overly large or dynamic; however I know we have had sites that have used > this type of approach with a script-generated usermap.cfg. > > 2. If you have MultiStore available you can also use that to fence off > NFS access. NFS clients accessing an IP address associated with a vfiler > are not allowed to access storage assigned to another vfiler. This is > enforced at the WAFL layer, so even if clients attempt handle spoofing > the access is denied as long as the potentially rogue clients are not > allowed to access the other vfilers' IP addresses (e.g. different > networks on separate NICs). > > Mark

2 2

NFS permissions
by Maglinger, Paul 22 Sep '04

22 Sep '04

The File Access Management Guide says that I can use -anon=root on an exported path and users on any client will be able to access it. When I entered that parameter, I get an error that says, "UID in anon option is not a number". I need to be able to allow any user from any of 6 Unix machines the ability to access this NFS share. What am I missing? Paul Maglinger, A+, CA, CCA, CET, MCSE Systems Administrator Shoe Carnival Inc. (812)867-4674 pmaglinger(a)scvl.com

3 2

newbook
by nmdf＠hotmail.com 31 Aug '04

31 Aug '04

New book Thank you for being a Priority Club member of www.PAPAMEDIA.com. Following are the newest titles we have added to our website. Please click on the titles that interest you or visit www.PAPAMEDIA.com for more information. THE DA VINCI CODE Author: Dan Brown Format: Paperback ISBN: 0385504209 Price: $ 8.90 Sales Rank: 1 WHO MOVED MY CHEESE? Author: Spencer Johnson Format: Paperback ISBN: 0399144463 Price: $ 4.24 Sales Rank: 2 FISH! Author: Stephen C. Lundin Format: Paperback ISBN: 0786866020 Price: $ 4.40 Sales Rank: 3 RICH DAD, POOR DAD Author: Robert T. Kiyosaki Format: Paperback ISBN: 0446677450 Price: $ 7.00 Sales Rank: 4 THE POWER OF NOW Author: Eckhart Tolle Format: Paperback ISBN: 1577311523 Price: $ 8.25 Sales Rank: 5 THE TIPPING POINT Author: Malcolm Gladwell Format: Paperback ISBN: 0316346624 Price: $ 7.56 Sales Rank: 6 FISH! TALES Author: Stephen C. Lundin Format: Paperback ISBN: 0786868686 Price: $ 5.88 Sales Rank: 7 STILLNESS SPEAKS Author: Eckhart Tolle Format: Paperback ISBN: 157731400X Price: $ 7.50 Sales Rank: 8 FISH! STICKS Author: Stephen C. Lundin Format: Paperback ISBN: 0786868163 Price: $ 5.89 Sales Rank: 9 THE 21 INDISPENSABLE QUALITIES OF A LEADER Author: John C. Maxwell Format: Paperback ISBN: 0785274405 Price: $ 6.99 Sales Rank: 10 WHALE DONE! Author: Ken Blanchard Format: Paperback ISBN: 074323538X Price: $ 5.50 Sales Rank: 11 PRACTICING THE POWER OF NOW Author: Eckhart Tolle Format: Paperback ISBN: 1577311957 Price: $ 7.79 Sales Rank: 12 BRINGING DOWN THE HOUSE Author: Ben Mezrich Format: Paperback ISBN: 0743249992 Price: $ 6.00 Sales Rank: 13 FIRST, BREAK ALL THE RULES Author: Marcus Buckingham, Curt Coffman Format: Paperback ISBN: 0684852861 Price: $ 10.90 Sales Rank: 14 FISH! FOR LIFE Author: Stephen C. Lundin, John Christensen, Harry Paul Format: Paperback ISBN: 1401300715 Price: $ 7.90 Sales Rank: 15 THE WEDDING Author: Nicholas Sparks Format: Paperback ISBN: 0446693332 Price: $ 6.82 Sales Rank: 16 MEIN KAMPF Author: Adolf Hitler Format: Paperback ISBN: 0395925037 Price: $ 11.92 Sales Rank: 17 TUESDAYS WITH MORRIE Author: Mitch Albom, Stacy Creamer Format: Paperback ISBN: 076790592X Price: $ 5.95 Sales Rank: 18 BRICK LANE Author: Monica Ali Format: Paperback ISBN: 0743243315 Price: $ 6.99 Sales Rank: 19 BRICK LANE Author: Monica Ali Format: Paperback ISBN: 0743243307 Price: $ 13.20 Sales Rank: 20 THE 22 IMMUTABLE LAWS OF BRANDING Author: Al Ries, Laura Ries Format: Paperback ISBN: 0060007737 Price: $ 8.50 Sales Rank: 21 HOW TO WIN FRIENDS AND INFLUENCE PEOPLE Author: Dale Carnegie Format: Paperback ISBN: 0671723650 Price: $ 4.45 Sales Rank: 22 THE CURIOUS INCIDENT OF THE DOG IN THE NIGHT-TIME Author: Mark Haddon Format: Paperback ISBN: 1400032717 Price: $ 6.59 Sales Rank: 23 THE WEDDING Author: Nicholas Sparks Format: Paperback ISBN: 0446532452 Price: $ 8.25 Sales Rank: 24 THE PRESENT Author: Spencer Johnson Format: Paperback ISBN: 0385509308 Price: $ 2.39 Sales Rank: 25 THE NAMESAKE Author: Jhumpa Lahiri Format: Paperback ISBN: 0395927218 Price: $ 12.56 Sales Rank: 26 THE ONE MINUTE SALES PERSON Author: Spencer Johnson Format: Paperback ISBN: 0060514922 Price: $ 5.15 Sales Rank: 27 CRACKING THE GRE 2004 Author: Princeton Review Format: Paperback with CD-ROM ISBN: 0375763228 Price: $ 13.22 Sales Rank: 28 THE ART OF DEALING WITH PEOPLE Author: Les Giblin Format: Paperback ISBN: 0937539589 Price: $ 4.95 Sales Rank: 29 CO-ACTIVE COACHING Author: Laura Whitworth, Henry House, Phil Sandahl, Henry Kimsey-House Format: Hardcover ISBN: 0891061231 Price: $ 28.56 Sales Rank: 30 THE BOOKSELLER OF KABUL Author: Asne Seierstad Format: Paperback ISBN: 0316734500 Price: $ 11.75 Sales Rank: 31 THE 22 IMMUTABLE LAWS OF MARKETING Author: Al Ries, Jack Trout Format: Paperback ISBN: 0887306667 Price: $ 6.31 Sales Rank: 32 THE ROAD LESS TRAVELED Author: M. Peck Format: Paperback ISBN: 0743243153 Price: $ 4.55 Sales Rank: 33 HOLY FOOLS Author: Joanne Harris Format: Paperback ISBN: 0060559128 Price: $ 5.85 Sales Rank: 34 A QUESTION OF BLOOD Author: Ian Rankin Format: Paperback ISBN: 0316095648 Price: $ 9.98 Sales Rank: 35 TODAY MATTERS Author: John C. Maxwell Format: Paperback ISBN: 0446529583 Price: $ 13.85 Sales Rank: 36 DUDE, WHERE'S MY COUNTRY? Author: Michael Moore Format: Paperback ISBN: 0446532231 Price: $ 9.39 Sales Rank: 37 THE QUICK AND EASY WAY TO EFFECTIVE SPEAKING Author: Dale Carnegie Format: Paperback ISBN: 0671724002 Price: $ 3.80 Sales Rank: 38 THE PROPHET Author: Kahlil Gibran Format: Paperback ISBN: 0394404289 Price: $ 2.95 Sales Rank: 39 SELF MATTERS Author: Phillip McGraw Format: Paperback ISBN: 0743227255 Price: $ 4.60 Sales Rank: 40 You are receiving this newsletter because you were made a Priority Club member upon completing a purchase from Papa Media, either on our website or through an online marketplace like Ebay. With your Priority Club membership you are eligible for discounts on every purchase and quicker customer service. However, if you wish to unsubscribe from the Priority Club and free newsletter, just login to your account on our website and click on the Unsubscribe link. ------------------------------------------- http://www.PAPAMEDIA.com Thousands of items, at least 40% below Amazon and Barnes & Noble.

1 0

RE: Amperage readings for NetApp 740 head and shelves
by Maglinger, Paul 31 Aug '04

31 Aug '04

I will plan for peaks and surges, but the rating listed on the power supply does not represent the starting or running current of the equipment. Our 740 is topped out at 1TB, so we won't be adding any more shelves or drives. The current draw should remain static. -----Original Message----- From: John Stoffel [mailto:stoffel@lucent.com] Sent: Monday, August 30, 2004 14:24 To: Michael Christian Cc: Maglinger, Paul; NetApps list server Subject: RE: Amperage readings for NetApp 740 head and shelves I just want to followup on this Amperage question and how to want to size the PDU to match the current usage of current. Boy, how to word that? In my experience, trying to do this is bad. Use the numbers provided by NetApp and size according to them. Forgetting that you sized things tightly and plugging in one extra thing down the road is sure to lead to problems. John John Stoffel - Senior Unix Systems Administrator - Lucent Technologies stoffel(a)lucent.com - http://www.lucent.com - 978-952-7548

1 0

RE: Amperage readings for NetApp 740 head and shelves
by Michael Christian 30 Aug '04

30 Aug '04

Learned a new factoid last night that you should keep in mind. The power draw will spike when a redundant power supply goes in and out (or up or down). We managed to brown-out a pdu while swapping a bad ps last night. Quick way to crash a filer. -MikeC -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Maglinger, Paul Sent: Friday, August 27, 2004 5:25 AM To: 'NetApps list server' Subject: Amperage readings for NetApp 740 head and shelves My profound thanks to the numerous replies. A little clarification... This was for sizing PDUs (Power Distribution Units for you non-Compaq/HP folks) for the server racks and not for air conditioning. Compiling all the information I went with 2.25A@120VAC for the 740 head and 3.0A@120VAC for the shelves. I think this will get us close enough where we can balance the load sufficiently. Thanks again! > Has anyone taken any amperage readings on their heads and shelves? I see by > the label that the shelves are rated at 5.5A/120VAC 3.2A/240, but I'm > wondering about the actual current draw. I could disconnect one of the > power supplies to get the reading, but this is a production system and don't > want to tempt fate. > > Thanks! > > That that is, is; that that is not, is not; that that is, is not that that > is not; that that is not, is not that that is. Is that not it? It is. > > Paul Maglinger, A+, CA, CCA, CET, MCSE > Systems Administrator Shoe Carnival Inc. (812)867-4674 pmaglinger(a)scvl.com >

2 1

Mass data deletion
by jeff.mery＠ni.com 30 Aug '04

30 Aug '04

Does anyone know of a good way to delete a large amount of data from a filer? We have an F940c with a single 2.5TB volume. One of the qtrees on that volume was used as a temporary data store. It's no longer needed so I need to get rid of the 126GB of data (and ~4 million files). Is there a better/easier/faster way to do this than selecting the folder from the admin share and hitting Shift+Del? It takes an awfully long time for a client to scan the directory tree and start deleting files (even with GbE). BTW.This is a CIFS-only filer. Thanks in advance, Jeff Mery, MCP National Instruments ------------------------------------------------------------------- "Allow me to extol the virtues of the Net Fairy, and of all the fantastic dorks that make the nice packets go from here to there. Amen." TB - Penny Arcade -------------------------------------------------------------------

4 3

RE: Tape Devices and Backups.
by Maxwell Reid 28 Aug '04

28 Aug '04

We've been using the Smell Powervault 127T LTO recently... They aren't the best put together units I've seen, but after getting a couple replacements =) They seem to work pretty well... basically clones of the IBM Ultrium (I think they are just rebranded.) Regards, Max -----Original Message----- From: James Brigman To: toasters(a)mathworks.com Sent: 8/28/2004 6:01 AM Subject: RE: Tape Devices and Backups. Jamie, et. al; My comments apply to the Powervault 120T, the "shoebox" shaped systems. That particular system looks like this: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=39978&item=511879 7946&rd=1 Example of a system I'm not talking about: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=3756&item=5119064 428 Best of luck on your quest for a better backup solution. Many of us have been in the same position you find yourself in. Just be careful and do lots of research. Those unfortunate enough to have ever used the "Exabyte 120" can all (without exception) tell some horror stories that involve lots of weekend work. JKB -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of James Brigman Sent: Saturday, August 28, 2004 7:14 AM To: toasters(a)mathworks.com Subject: RE: Tape Devices and Backups. Jamie; The Powervaults are small, and once upon a time, we had some trouble with one we had. There was some mechanical part that had to be replaced and after that it worked fine. The design of the Powervault is a bit bizarre. Remember the PowerEdge 4x00's? It's got that same "tubular box" shape, which really isn't a very good shape for working with. It severely limited the number of tapes the Powervaults could handle, and there's no expansion of the unit (tape capacity) once you buy it. If I remember correctly, you get 4 or 5 tapes plus a cleaning tape and you're done. Also note: the powervault does not have any barcode read capability. There may have been a version somewhere that did, but I never saw one. Check up on support: we got rid of ours over a year ago, but if you can buy support, they might not be too bad. If you can get a StorageTek L20, that's going to be a better unit for you. I saw one on ebay two weeks ago with an LTO tape drive installed for about $5k. StorageTek support is expensive, but their products and service are excellent. The L20's have barcode reading capability built in. JKB -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Rogers, Jamie Sent: Friday, August 27, 2004 4:50 PM To: 'toasters(a)mathworks.com' Subject: Tape Devices and Backups. I am outgrowing my existing DLT autoloader which is connected to a sun workstation from which I rsh to do my dumps. I am considering purchasing either new or used an LTO. I'm running ONTAP 6.3.1 om my 760, I presently only have 1TB raw but expect that to increase in the near future. Cost is an issue, I am on a very tight budget so used equipment is pretty much my only option. Has anyone used a Dell powervault LTO with their filers or via rsh? Any other suggestions? I see a lot of these on ebay and I'm wondering why? Thanks, Jamie This electronic message, along with any attachments, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any proprietary information or intellectual property contained in this transmission remains the sole and exclusive property of Marshall & Swift or Marshall & Swift/Boeckh. No right to use any products or services described in this transmission is valid without an executed and paid license agreement. If you received this in error, please reply to advise the sender and delete the material from any computer.

1 0

Tape Devices and Backups.
by Rogers, Jamie 28 Aug '04

28 Aug '04

I am outgrowing my existing DLT autoloader which is connected to a sun workstation from which I rsh to do my dumps. I am considering purchasing either new or used an LTO. I'm running ONTAP 6.3.1 om my 760, I presently only have 1TB raw but expect that to increase in the near future. Cost is an issue, I am on a very tight budget so used equipment is pretty much my only option. Has anyone used a Dell powervault LTO with their filers or via rsh? Any other suggestions? I see a lot of these on ebay and I'm wondering why? Thanks, Jamie

2 2

×Ô¶¯»¯ÅúÁ¿´«Õæ[Èº]·¢ºÍ½ÓÊÕÈí¼þ
by oysoft＠yeboss.com 28 Aug '04

28 Aug '04

1 0

Automatic NFS export on vol create
by Chris Thompson 27 Aug '04

27 Aug '04

I have been caught out by one aspect of the changed NFS export implementation in ONTAP 6.5.x (specifically, 6.5.1R1P6), that might have had serious security implications. When a volume is created, say /vol/test, it is now autmatically NFS exported with a rule /vol/test -rw,nosuid i.e. read-write to the world. As a volume starts off with just a root-owned top-level directory, and there's no "root=" clause, this isn't _exactly_ a security exposure staight away, but of course it becomes one as soon as more interesting data is installed there. Having noticed that at the time, I did exportfs -io rw=[a-testing-host],root=[a-testing-host] /vol/test and continued with my tests (which involved restoring bits of other filing systems into /vol/test). What I hadn't realised was that the original "vol create test" had not only exported the volume, it had added a line to /etc/exports. So the next time the filer was rebooted, the unrestricted export came back... which, of course, I didn't notice for some time. Has anyone else been caught out like this? Does anyone else think that these automatic NFS exports shouldn't be happening at all? -- Chris Thompson University of Cambridge Computing Service, Email: cet1(a)ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH, Phone: +44 1223 334715 United Kingdom.

13 17

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters August 2004