toasters June 2005

toasters@lists.teaparty.net

58 participants
56 discussions

SSH access - restricting commands?
by John Stoffel 20 Jun '05

20 Jun '05

Hi all, I'm running 7.0.1R1 on some filers and we need to give access to users to create qtrees. I've written a perl script wrapper around rsh (to be setuid unfortunately), but I was hoping that I could use SSH instead fot access control, especially if I could limit access to just a single command string or two from the client tool Has anyone else up SSH non-password access to just a specific command? The user's should NOT be able to login to the NetApp otherwise, they should only be able to do a limited and sanitized version of 'qtree create /vol/<volume>/<qtree> on the filer(s) we have deployed. Looking on now, I really don't see much explanation of how filer:/vol/root/etc/sshd/... is supposed to help me here with this issue, since I can't find a man page or docs on how to configure the SSHD on the Filter. Or do I just go back to a SETU Thanks, John John Stoffel - Senior Staff Systems Administrator - System LSI Group Toshiba America Electronic Components, Inc. - http://www.toshiba.com/taec john.stoffel(a)taec.toshiba.com - 508-486-1087

2 1

RE: TSM and ndmp - Perf. and qtree
by Iain Barnetson 20 Jun '05

20 Jun '05

Michael, In version 5.3 you can create virtual mappings and backup at the Qtree level that way. Not particularly helpful when you're using version 5.2 I know, but perhaps a move to 5.3 is in order? Iain -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Michael Sent: 20 June 2005 09:21 To: toasters(a)mathworks.com Subject: Re: TSM and ndmp - Perf. and qtree Hi, yes, thats what we wanted, but as I explain in my last mail, my TSM-Admin says that TSM can't backup Qtrees. I can't believe that. Does anybody backup qtree with TSM? thanks Michael "Palmer, Jason" <Jason.Palmer(a)DrKW.com> schrieb: > > Hi Michael, > > I have not seen the NDMP offering from Tivoli, but if it is anything > like that of Legatto I would guess that all you need to do is break > your one volume backup into multiple Qtree backup jobs, by specifying > the path in your backup job configuration as follows - > > from > /vol/<volume name> > > To > /vol/<volume name>/<Qtree 1> > /vol/<volume name>/<Qtree 2> > /vol/<volume name>/<Qtree 3> > > Hope this helps, > > Jason > DrKW Storage Team > > > -----Original Message----- > From: owner-toasters(a)mathworks.com > [mailto:owner-toasters@mathworks.com] On > Behalf Of Michael > Sent: 20 June 2005 08:09 > To: toasters(a)mathworks.com > Subject: TSM and ndmp - Perf. and qtree > > Hi, > > we (try to) backup our filers 940c(6.5.2R1) with ndmp and IBM Tivoli (TSM) > 5.2<Solaris>. We have various Problems. The greatest Volume we backup > is a > ntfs-Volume with 1TB and several qtrees.At the moment we backup the > whole Volume.Performance is very bad (not only on great Volumes, same > Perf.-Problem with small volumes AND direct attached to a device AND using > the dump-command!!)So we wanted to spread the backup, but my > Backup-Admin says TSM cannot backup qtrees???? > > Is anybody out there who has GOOD experience with TSM 5.2 and ndmp? A > new request in my company is to backup 7TB, is there a chance to > realise this with ndmp. (NearStore is not yet a alternative). > > Our filers are via SAN connected to L700-Devices.(IBM-LTO2) > > Thanks > > Michael > > ------ > > > ------------------------------------------------------------------------ -------- > The information contained herein is confidential and is intended > solely for > the > addressee. Access by any other party is unauthorised without the > express written permission of the sender. If you are not the intended > recipient, please > > contact the sender either via the company switchboard on +44 (0)20 > 7623 8000, > or > via e-mail return. If you have received this e-mail in error or wish > to read > our > e-mail disclaimer statement and monitoring policy, please refer to > http://www.drkw.com/disc/email/ or contact the sender. 3166 > ------------------------------------------------------------------------ -------- > > ---------------------------------------------------------------------- This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient. Any review, use, distribution, or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message.

2 1

RE: TSM and ndmp - Perf. and qtree
by Palmer, Jason 20 Jun '05

20 Jun '05

Hi Michael, I have not seen the NDMP offering from Tivoli, but if it is anything like that of Legatto I would guess that all you need to do is break your one volume backup into multiple Qtree backup jobs, by specifying the path in your backup job configuration as follows - from /vol/<volume name> To /vol/<volume name>/<Qtree 1> /vol/<volume name>/<Qtree 2> /vol/<volume name>/<Qtree 3> Hope this helps, Jason DrKW Storage Team -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Michael Sent: 20 June 2005 08:09 To: toasters(a)mathworks.com Subject: TSM and ndmp - Perf. and qtree Hi, we (try to) backup our filers 940c(6.5.2R1) with ndmp and IBM Tivoli (TSM) 5.2<Solaris>. We have various Problems. The greatest Volume we backup is a ntfs-Volume with 1TB and several qtrees.At the moment we backup the whole Volume.Performance is very bad (not only on great Volumes, same Perf.-Problem with small volumes AND direct attached to a device AND using the dump-command!!)So we wanted to spread the backup, but my Backup-Admin says TSM cannot backup qtrees???? Is anybody out there who has GOOD experience with TSM 5.2 and ndmp? A new request in my company is to backup 7TB, is there a chance to realise this with ndmp. (NearStore is not yet a alternative). Our filers are via SAN connected to L700-Devices.(IBM-LTO2) Thanks Michael ------ -------------------------------------------------------------------------------- The information contained herein is confidential and is intended solely for the addressee. Access by any other party is unauthorised without the express written permission of the sender. If you are not the intended recipient, please contact the sender either via the company switchboard on +44 (0)20 7623 8000, or via e-mail return. If you have received this e-mail in error or wish to read our e-mail disclaimer statement and monitoring policy, please refer to http://www.drkw.com/disc/email/ or contact the sender. 3166 --------------------------------------------------------------------------------

2 1

TSM and ndmp - Perf. and qtree
by Michael 20 Jun '05

20 Jun '05

Hi, we (try to) backup our filers 940c(6.5.2R1) with ndmp and IBM Tivoli (TSM) 5.2<Solaris>. We have various Problems. The greatest Volume we backup is a ntfs-Volume with 1TB and several qtrees.At the moment we backup the whole Volume.Performance is very bad (not only on great Volumes, same Perf.-Problem with small volumes AND direct attached to a device AND using the dump-command!!)So we wanted to spread the backup, but my Backup-Admin says TSM cannot backup qtrees???? Is anybody out there who has GOOD experience with TSM 5.2 and ndmp? A new request in my company is to backup 7TB, is there a chance to realise this with ndmp. (NearStore is not yet a alternative). Our filers are via SAN connected to L700-Devices.(IBM-LTO2) Thanks Michael

1 0

Get Software from our site
by Templeton I. Mervin, V 19 Jun '05

19 Jun '05

Good day to you sir, Were those farmers practicing shouting next to the police station? If all pulled in one direction, the world would keel over. -Yiddish proverb Get back to you later, Elvis Wayne

1 0

RE: IPsec NFS to Unix clients
by Muhlestein, Mark 17 Jun '05

17 Jun '05

Gee, 30,000 * 300 is not even 10 million entries! :-) Yes, you are right that this isn't going to work in every case. But I wanted to mention it because it is useful in some situations. As to the MultiStore comment I made, I was thinking of a case where you want to use the same physical filer to serve an unprotected network (such as your normal campus network, it sounds like) and also serve a trusted network (on a different NIC or VLAN, say). As long as there is no way to access a vfiler's IP address using a client on the untrusted network, the vfiler boundary checks will prevent all access from all protocols (including NFS handle spoofing) coming from those untrusted clients. Mark -----Original Message----- From: Brian Parent [mailto:bparent@calvin.ucsd.edu] Sent: Friday, August 20, 2004 2:41 PM To: toasters(a)mathworks.com Subject: Re: IPsec NFS to Unix clients Thanks Mark. We do have CIFS. However, we have >30,000 accounts, and >300 NFS clients. And besides, any account is allowed access from any NFS client. Plus, it doesn't solve the problem of spoofing IPs. We don't have MultiStore, but even if we did, I don't see how it solves the problem of spoofing IPs. Spoofing IPs is painfully simple here, (as at most Universities, I would think) where labs aren't supervised, and network jacks are not physically secured. Re: > Subject: RE: IPsec NFS to Unix clients > Date: Fri, 20 Aug 2004 13:31:42 -0700 > From: "Muhlestein, Mark" <mark.muhlestein(a)netapp.com> > To: "Steve Losen" <scl(a)sasha.acc.virginia.edu>, > "Brian Parent" <bparent(a)calvin.ucsd.edu> > Cc: <toasters(a)mathworks.com> > > Here are a couple of other things you can do to improve NFS security: > > 1. If you have CIFS you might consider using the > nfs.require_valid_mapped_uid option. That allows you to set up the > usermap.cfg file to do things like this: > > # allow the following UIDs NFS access from the specified IP addresses > tom <= 192.168.3.34:tom > jerry <= jerrypc.dorm.foo.edu:jerry > jerry <= lab1.foo.edu:jerry > jerry <= lab2.foo.edu:jerry # etc. > > # allow root from the admin network > Administrator <= 10.10.20.0/24:root > > # prevent all other NFS access > "" <= * > > The nfs.require_valid_mapped_uid option causes the usermap.cfg entries > to be consulted even for access to data on qtrees with UNIX security. > Combined with the normal export controls, this approach works as long as > clients are not allowed to successfully spoof source IP addresses. It is > also more manageable if the number of combinations of users/hosts is not > overly large or dynamic; however I know we have had sites that have used > this type of approach with a script-generated usermap.cfg. > > 2. If you have MultiStore available you can also use that to fence off > NFS access. NFS clients accessing an IP address associated with a vfiler > are not allowed to access storage assigned to another vfiler. This is > enforced at the WAFL layer, so even if clients attempt handle spoofing > the access is denied as long as the potentially rogue clients are not > allowed to access the other vfilers' IP addresses (e.g. different > networks on separate NICs). > > Mark

2 2

F825 scsi transport errors
by devnull＠adc.idt.com 16 Jun '05

16 Jun '05

I am seeing a bunch of these errors in my messages file Wed Jun 15 15:42:35 EST [scsi.cmd.transportError:error]: Device 8a.29: Transport error during execution of command: HA status 0x9: cdb 0x28:07819108:0008. Wed Jun 15 15:42:35 EST [scsi.cmd.retrySuccess:info]: Device 8a.29: request successful after retry #1: cdb 0x28:07819108:0008. The device 8a.29 is a 72G FC hard drive in a DS-14 Shelf(not MK2), it is not the only device that is seeing this error, a few other hard drives are also reporting this error. All the drives reporting the error are in the same shelf. I have 2 shelves on this filer and they are connected to one dual channel FC card in a redundant loop fashion. If you look at 8a.17, it has about 1200 Loss of sync count on it. I am not sure why the filer has not started using "8b.17" instead(and that I will know that this might be a cable problem or port on card problem) If the problems continue with 8b.17, that would be indicative of a problem with the hard drive electrical contacts or the shelf. Any thoughts ? Filer> fcstat link_stats Loop Link Underrun Loss of Invalid Frame In Frame Out ID Failure count sync CRC count count count count count 8a.29 5 6 11 0 50707676 90150230 8a.28 0 13 0 0 403142256 861951762 8a.27 0 0 2 0 2990027 2668141 8a.26 0 0 2 0 9082 9078 8a.25 0 56 0 0 355574676 1322428194 8a.24 0 99 3 0 359416275 1322571091 8a.23 0 100 0 0 360773680 1329183182 8a.22 0 0 0 0 7625 7625 8a.21 0 103 9 0 357740467 1326091355 8a.20 0 97 0 0 312139583 1120155801 8a.19 0 9 1 0 5198806 6652372 8a.18 0 1 2 0 9078863 7176071 8a.17 0 0 1196 0 21113226 120996952 8a.16 0 0 27 3 134144213 618879531 8a.45 0 0 9 0 3278706 3280636 8a.44 0 0 10 0 1496012 859502 8a.43 0 0 0 0 529038 502216 8a.42 0 0 1 0 172523534 850902550 8a.41 0 0 0 0 792454 444308 8a.40 0 0 9 5 27529984 132506842 8a.39 0 0 3 0 145441751 719150297 8a.38 0 0 3 1 171861672 850048068 8a.37 0 0 5 1 171799244 849465448 8a.36 0 0 3 1 172307043 849408939 8a.35 0 0 5 1 171828425 849442631 8a.34 0 0 5 14 171060731 849927835 8a.33 0 0 10 0 9064 9068 8a.32 0 0 7 0 29133347 135203123 8a.ha 4 484 1 25 14222732146 3614609352 Loop Link Underrun Loss of Invalid Frame In Frame Out ID Failure count sync CRC count count count count count 8b.16 2 0 7 0 27269445 122723901 8b.17 0 0 1 0 129436413 620075451 8b.18 0 0 0 0 355738315 1322772943 8b.19 0 0 2 0 367098577 1330378723 8b.20 0 0 1 0 52197238 208888734 8b.21 0 0 2 0 6903081 3234401 8b.22 0 0 0 0 17996706 18006888 8b.23 0 0 4 0 3922623 575217 8b.24 0 0 4 0 5160927 6612953 8b.25 0 0 0 0 9076262 7176226 8b.26 0 0 0 0 364796982 1329307992 8b.27 0 0 1 0 361740576 1326995766 8b.28 0 0 3 0 9155 9089 8b.29 0 0 5 0 308849035 1120301901 8b.32 0 0 11 0 146661640 720366350 8b.33 0 0 0 0 181037871 861216087 8b.34 0 0 0 0 2293590 3440934 8b.35 0 0 2 0 1503138 2998230 8b.36 0 0 1 0 984366 2509556 8b.37 0 0 4 0 1503671 2996067 8b.38 0 0 1 0 1503562 3002116 8b.39 0 0 2 0 27978729 134437937 8b.40 0 0 5 0 145948085 721301831 8b.41 0 0 0 0 172626088 853051146 8b.42 0 0 0 0 984286 2508390 8b.43 0 0 0 0 173013430 853277534 8b.44 0 0 0 0 207459905 786015867 8b.45 0 0 6 0 18050232 18060380 8b.ha 0 0 1 0 12502097306 3132163798 /dev/null devnull(a)adc.idt.com

2 2

questions about Snapmirroring LUNs
by Rob Winters 16 Jun '05

16 Jun '05

I'm going through the Online Backup and Recovery Guide, and trying to grok the ins and outs of SnapMirror and LUNs. I have a purely procedural question: If I have a source volume full o' LUNs, do I have to define the LUNs on the destination filer, or will the LUNs and their structure "appear" once the mirror is up. They are essentially files, so I would think the latter, but that's a guess. Once they do appear (or are populated), can I map them to a FC or iSCSI service on the destination filer (albeit read/only)? I also have a utility question: If the LUNs are used for file systems as opposed to database, then the NetApp isn't going to understand the internal structure of that file system, so any given mirrored file-system-in-a-LUN is essentially not synced, and therefore in a "crash-compatible" state, right? And if backed up via NDMP, it would just be a "data blob", right? Is there a product or a feature that will get the NetApp to look inside that LUN, and recognize and deal smartly with, say, a NTFS file system inside of the LUN? Thanks! /// Rob -- Rob Winters, CISSP SAIC, NASA Headquarters ISEM Contract e-mail: Rob.Winters(a)nasa.gov pager: robwinters(a)skytel.com office: (202)651-8591

1 0

X1027 copper gigabit ethernet pci
by Leeds, Daniel 15 Jun '05

15 Jun '05

Who makes this card? Ie who did netapp oem it from?

2 1

automatic "Performance" email
by Charles Bartels 14 Jun '05

14 Jun '05

Hi, Since installing ONTAP 7.0.1R1 I've been receiving 1MB "PERFORMANCE DATA" emails from the filer, along with the weekly system notification. The email consists of hourly stats and is cryptic at best. Is there a setting to stop these emails from being sent to the "autosupport.to" list? (which is what I assume is happening.) -C.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters June 2005