toasters

toasters@lists.teaparty.net

2 participants
13517 discussions

RE: Amperage readings for NetApp 740 head and shelves
by Maglinger, Paul 31 Aug '04

31 Aug '04

I will plan for peaks and surges, but the rating listed on the power supply does not represent the starting or running current of the equipment. Our 740 is topped out at 1TB, so we won't be adding any more shelves or drives. The current draw should remain static. -----Original Message----- From: John Stoffel [mailto:stoffel@lucent.com] Sent: Monday, August 30, 2004 14:24 To: Michael Christian Cc: Maglinger, Paul; NetApps list server Subject: RE: Amperage readings for NetApp 740 head and shelves I just want to followup on this Amperage question and how to want to size the PDU to match the current usage of current. Boy, how to word that? In my experience, trying to do this is bad. Use the numbers provided by NetApp and size according to them. Forgetting that you sized things tightly and plugging in one extra thing down the road is sure to lead to problems. John John Stoffel - Senior Unix Systems Administrator - Lucent Technologies stoffel(a)lucent.com - http://www.lucent.com - 978-952-7548

1 0

RE: Amperage readings for NetApp 740 head and shelves
by Michael Christian 30 Aug '04

30 Aug '04

Learned a new factoid last night that you should keep in mind. The power draw will spike when a redundant power supply goes in and out (or up or down). We managed to brown-out a pdu while swapping a bad ps last night. Quick way to crash a filer. -MikeC -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Maglinger, Paul Sent: Friday, August 27, 2004 5:25 AM To: 'NetApps list server' Subject: Amperage readings for NetApp 740 head and shelves My profound thanks to the numerous replies. A little clarification... This was for sizing PDUs (Power Distribution Units for you non-Compaq/HP folks) for the server racks and not for air conditioning. Compiling all the information I went with 2.25A@120VAC for the 740 head and 3.0A@120VAC for the shelves. I think this will get us close enough where we can balance the load sufficiently. Thanks again! > Has anyone taken any amperage readings on their heads and shelves? I see by > the label that the shelves are rated at 5.5A/120VAC 3.2A/240, but I'm > wondering about the actual current draw. I could disconnect one of the > power supplies to get the reading, but this is a production system and don't > want to tempt fate. > > Thanks! > > That that is, is; that that is not, is not; that that is, is not that that > is not; that that is not, is not that that is. Is that not it? It is. > > Paul Maglinger, A+, CA, CCA, CET, MCSE > Systems Administrator Shoe Carnival Inc. (812)867-4674 pmaglinger(a)scvl.com >

2 1

Mass data deletion
by jeff.mery＠ni.com 30 Aug '04

30 Aug '04

Does anyone know of a good way to delete a large amount of data from a filer? We have an F940c with a single 2.5TB volume. One of the qtrees on that volume was used as a temporary data store. It's no longer needed so I need to get rid of the 126GB of data (and ~4 million files). Is there a better/easier/faster way to do this than selecting the folder from the admin share and hitting Shift+Del? It takes an awfully long time for a client to scan the directory tree and start deleting files (even with GbE). BTW.This is a CIFS-only filer. Thanks in advance, Jeff Mery, MCP National Instruments ------------------------------------------------------------------- "Allow me to extol the virtues of the Net Fairy, and of all the fantastic dorks that make the nice packets go from here to there. Amen." TB - Penny Arcade -------------------------------------------------------------------

4 3

RE: Tape Devices and Backups.
by Maxwell Reid 28 Aug '04

28 Aug '04

We've been using the Smell Powervault 127T LTO recently... They aren't the best put together units I've seen, but after getting a couple replacements =) They seem to work pretty well... basically clones of the IBM Ultrium (I think they are just rebranded.) Regards, Max -----Original Message----- From: James Brigman To: toasters(a)mathworks.com Sent: 8/28/2004 6:01 AM Subject: RE: Tape Devices and Backups. Jamie, et. al; My comments apply to the Powervault 120T, the "shoebox" shaped systems. That particular system looks like this: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=39978&item=511879 7946&rd=1 Example of a system I'm not talking about: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=3756&item=5119064 428 Best of luck on your quest for a better backup solution. Many of us have been in the same position you find yourself in. Just be careful and do lots of research. Those unfortunate enough to have ever used the "Exabyte 120" can all (without exception) tell some horror stories that involve lots of weekend work. JKB -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of James Brigman Sent: Saturday, August 28, 2004 7:14 AM To: toasters(a)mathworks.com Subject: RE: Tape Devices and Backups. Jamie; The Powervaults are small, and once upon a time, we had some trouble with one we had. There was some mechanical part that had to be replaced and after that it worked fine. The design of the Powervault is a bit bizarre. Remember the PowerEdge 4x00's? It's got that same "tubular box" shape, which really isn't a very good shape for working with. It severely limited the number of tapes the Powervaults could handle, and there's no expansion of the unit (tape capacity) once you buy it. If I remember correctly, you get 4 or 5 tapes plus a cleaning tape and you're done. Also note: the powervault does not have any barcode read capability. There may have been a version somewhere that did, but I never saw one. Check up on support: we got rid of ours over a year ago, but if you can buy support, they might not be too bad. If you can get a StorageTek L20, that's going to be a better unit for you. I saw one on ebay two weeks ago with an LTO tape drive installed for about $5k. StorageTek support is expensive, but their products and service are excellent. The L20's have barcode reading capability built in. JKB -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Rogers, Jamie Sent: Friday, August 27, 2004 4:50 PM To: 'toasters(a)mathworks.com' Subject: Tape Devices and Backups. I am outgrowing my existing DLT autoloader which is connected to a sun workstation from which I rsh to do my dumps. I am considering purchasing either new or used an LTO. I'm running ONTAP 6.3.1 om my 760, I presently only have 1TB raw but expect that to increase in the near future. Cost is an issue, I am on a very tight budget so used equipment is pretty much my only option. Has anyone used a Dell powervault LTO with their filers or via rsh? Any other suggestions? I see a lot of these on ebay and I'm wondering why? Thanks, Jamie This electronic message, along with any attachments, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any proprietary information or intellectual property contained in this transmission remains the sole and exclusive property of Marshall & Swift or Marshall & Swift/Boeckh. No right to use any products or services described in this transmission is valid without an executed and paid license agreement. If you received this in error, please reply to advise the sender and delete the material from any computer.

1 0

Tape Devices and Backups.
by Rogers, Jamie 28 Aug '04

28 Aug '04

I am outgrowing my existing DLT autoloader which is connected to a sun workstation from which I rsh to do my dumps. I am considering purchasing either new or used an LTO. I'm running ONTAP 6.3.1 om my 760, I presently only have 1TB raw but expect that to increase in the near future. Cost is an issue, I am on a very tight budget so used equipment is pretty much my only option. Has anyone used a Dell powervault LTO with their filers or via rsh? Any other suggestions? I see a lot of these on ebay and I'm wondering why? Thanks, Jamie

2 2

×Ô¶¯»¯ÅúÁ¿´«Õæ[Èº]·¢ºÍ½ÓÊÕÈí¼þ
by oysoft＠yeboss.com 28 Aug '04

28 Aug '04

1 0

Automatic NFS export on vol create
by Chris Thompson 27 Aug '04

27 Aug '04

I have been caught out by one aspect of the changed NFS export implementation in ONTAP 6.5.x (specifically, 6.5.1R1P6), that might have had serious security implications. When a volume is created, say /vol/test, it is now autmatically NFS exported with a rule /vol/test -rw,nosuid i.e. read-write to the world. As a volume starts off with just a root-owned top-level directory, and there's no "root=" clause, this isn't _exactly_ a security exposure staight away, but of course it becomes one as soon as more interesting data is installed there. Having noticed that at the time, I did exportfs -io rw=[a-testing-host],root=[a-testing-host] /vol/test and continued with my tests (which involved restoring bits of other filing systems into /vol/test). What I hadn't realised was that the original "vol create test" had not only exported the volume, it had added a line to /etc/exports. So the next time the filer was rebooted, the unrestricted export came back... which, of course, I didn't notice for some time. Has anyone else been caught out like this? Does anyone else think that these automatic NFS exports shouldn't be happening at all? -- Chris Thompson University of Cambridge Computing Service, Email: cet1(a)ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH, Phone: +44 1223 334715 United Kingdom.

13 17

RE: Automatic NFS export on vol create
by John Clear 27 Aug '04

27 Aug '04

We eval'ed one of the Quantum Guardian/SnapServer boxes awhile back. While there was a command line, you had to do everything from the GUI, and even though it was Linux underneath, you couldn't use all the standard options in the export file through the GUI. We ended up sending it back and continuing to buy NetApps. It was the old 'good, cheap, fast' pick at most two. NetApp is good and fast, but not cheap. The Quantum thing wasn't that cheap, and wasn't any good, and was too broken to test fast. Flat text files are good. If NetApp wants to make everything into a database, at least have an option to populate the database from a text file. Having `exportfs -a` read /etc/exports and create /etc/exports.db is fine, but I want to be able to edit a text file. We keep quotas, exports and a few other of the config files under RCS on all our filers, so any automatic 'helpful' changes will be lost at the next check-out. John -----Original Message----- From: Mike Sphar [mailto:mike.sphar@Remedy.COM] Sent: Wednesday, August 18, 2004 12:09 PM To: toasters(a)mathworks.com Subject: RE: Automatic NFS export on vol create Speaking purely for myself, as a long-time Sysadmin, the fact that so much of Netapp's config is stored in text files was a *big* advantage to me. Databases always seem like a good idea until they get corrupted, or the front-end administration tools fail because of bad data. (Anyone else ever adminned AIX? Hell, just the other day I had to spend a fair amount of time trying to repair a corrupted registry on a Windows box.)

4 3

RE: Mass data deletion
by jeff.mery＠ni.com 27 Aug '04

27 Aug '04

I noticed that but it doesn't appear to allow directory deletetions. There also doesn't appear to be any help for this command like many of the priv set advanced commands. It didn't like "rm -rf /vol/vol0/foo" or any other variation I could try. Jeff Mery, MCP National Instruments ------------------------------------------------------------------- "Allow me to extol the virtues of the Net Fairy, and of all the fantastic dorks that make the nice packets go from here to there. Amen." TB - Penny Arcade ------------------------------------------------------------------- _____ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of rbaus(a)swbell.net Sent: Friday, August 27, 2004 10:33 AM To: toasters(a)mathworks.com Subject: Re: Mass data deletion There is a "rm" command in the "advanced" set of commands. -Rob jeff.mery(a)ni.com wrote: Does anyone know of a good way to delete a large amount of data from a filer? We have an F940c with a single 2.5TB volume. One of the qtrees on that volume was used as a temporary data store. Its no longer needed so I need to get rid of the 126GB of data (and ~4 million files). Is there a better/easier/faster way to do this than selecting the folder from the admin share and hitting Shift+Del? It takes an awfully long time for a client to scan the directory tree and start deleting files (even with GbE). BTWThis is a CIFS-only filer.

1 0

Tracing NFS getattr() calls to a file
by John Stoffel 27 Aug '04

27 Aug '04

Hi folks, I'm running into a strange problem here, where my users are beating up on an F740 running 6.4.5 (just upgraded, they did the same when it was running 5.3.7RxDy) with a ton of getattr() NFSv3 calls. The load suddenly shoots upto 7,000 nfs ops/sec, the system is using 30-50% of it's CPU, but it's barely touching the disks. The clients are all Solaris 5.x, mostly 5.7 or 5.8 with some 5.6 and 5.9 through in. I've used the netapp-top command to find the client(s) with the most nfs opertations. I'm root on all of these clients (if not, I turn off access by that client. :-) so I can get on there and do what I want, but it's not easy. I pretty much know that my users are using ClearCase and clearmake to build software, but tracking down which process/user is beating on the filesystem is making me crazy. I've tried running ethereal (version 0.8.11) on the client system(s) to look at the packets, but I'm only seeing that a bunch of calls are happening, but not which file(s) they are pointing to. Using lsof doesn't help either, since the file(s) aren't open in any manner, and since I could easily just miss which one they are looking at. We've done some simple truss -a -f on a test build, but that doesn't seem to stress out the system in the same way that my users are doing things. Really frustrating. Any suggestions or hints would be appreciated. Putting a sniffer in line with the client(s) isn't really possible since I don't have one available nor do I want to lug it all over the building to various client systems. Thanks, John John Stoffel - Senior Unix Systems Administrator - Lucent Technologies stoffel(a)lucent.com - http://www.lucent.com - 978-952-7548

5 9

1
by Password 27 Aug '04

27 Aug '04

1 0

Amperage readings for NetApp 740 head and shelves
by Maglinger, Paul 27 Aug '04

27 Aug '04

My profound thanks to the numerous replies. A little clarification... This was for sizing PDUs (Power Distribution Units for you non-Compaq/HP folks) for the server racks and not for air conditioning. Compiling all the information I went with 2.25A@120VAC for the 740 head and 3.0A@120VAC for the shelves. I think this will get us close enough where we can balance the load sufficiently. Thanks again! > Has anyone taken any amperage readings on their heads and shelves? I see by > the label that the shelves are rated at 5.5A/120VAC 3.2A/240, but I'm > wondering about the actual current draw. I could disconnect one of the > power supplies to get the reading, but this is a production system and don't > want to tempt fate. > > Thanks! > > That that is, is; that that is not, is not; that that is, is not that that > is not; that that is not, is not that that is. Is that not it? It is. > > Paul Maglinger, A+, CA, CCA, CET, MCSE > Systems Administrator Shoe Carnival Inc. (812)867-4674 pmaglinger(a)scvl.com >

1 0

RE: Amperage readings for NetApp 740 head and shelves
by Timothy Naple 27 Aug '04

27 Aug '04

Paul, What model shelves and disks are you running on the F740? I would be happy to plug in your exact configuration and take an accurate measurement for you. Thank you, Tim Timothy Naple tnaple(a)berkcom.com 510-644-1599 VOICE 510-644-1598 FAX 888-812-9040 TOLL-FREE Berkeley Communications Corporation 2990 San Pablo Avenue Berkeley, CA 94702 http://www.berkcom.com -----Original Message----- From: Maglinger, Paul [mailto:PMAGLINGER@scvl.com] Sent: Wednesday, August 25, 2004 9:27 AM To: 'NetApps list server' Subject: Amperage readings for NetApp 740 head and shelves Has anyone taken any amperage readings on their heads and shelves? I see by the label that the shelves are rated at 5.5A/120VAC 3.2A/240, but I'm wondering about the actual current draw. I could disconnect one of the power supplies to get the reading, but this is a production system and don't want to tempt fate. Thanks! That that is, is; that that is not, is not; that that is, is not that that is not; that that is not, is not that that is. Is that not it? It is. Paul Maglinger, A+, CA, CCA, CET, MCSE Systems Administrator Shoe Carnival Inc. (812)867-4674 pmaglinger(a)scvl.com

1 0

Lotus Notes & backups
by George Kahler 26 Aug '04

26 Aug '04

Hi does anyone have any recommendations on backup strategies in regards to Notes on Solaris and the transaction logs and data on the filer ? Snapshots seen to be the natural choice, however, what recovery tools are available to facilitate the restores ? NetBackup does not presently support backing up over nfs. Thanks, George ------------------------------------------------------------------------------- George Kahler e-mail: george(a)yorku.ca Sr. Systems Administrator humans: (416) 736-2100 x.22699 Computing and Network Services machines: (416) 736-5830 Ontario, Canada, M3J-1P3

1 0

Amperage readings for NetApp 740 head and shelves
by Maglinger, Paul 25 Aug '04

25 Aug '04

Has anyone taken any amperage readings on their heads and shelves? I see by the label that the shelves are rated at 5.5A/120VAC 3.2A/240, but I'm wondering about the actual current draw. I could disconnect one of the power supplies to get the reading, but this is a production system and don't want to tempt fate. Thanks! That that is, is; that that is not, is not; that that is, is not that that is not; that that is not, is not that that is. Is that not it? It is. Paul Maglinger, A+, CA, CCA, CET, MCSE Systems Administrator Shoe Carnival Inc. (812)867-4674 pmaglinger(a)scvl.com

1 0

urgent genuine business relationship
by mimico2004 24 Aug '04

24 Aug '04

MIM COMPANY 26 NNPC ROAD EJIGBO LAGOS NIGERIA TEL:234-8033-924567 EMAIL:mimico@libero.it magnus_asu(a)yahoo.com Dear Sir Permit me to introduce our company to you as the name implies above. Mimco is a newly etablished company to Export Agricultural and palm produce including sea foods unbehalf of CO-OPERATIVE FARMERS in the rural communities We have the following products in stock for Export 1. 100 tones of palm kernel seeds 2. 30 toneas of tropical raw natural honey 3. 100 tones of beeswax We are making preperation to receive dry crey fish/shrimes to our stock. As a newly established we encourage our customers to make travelling arrangement to come to Nigeria for inspection, confirmation and shipment of the products , this measure is taken to safeguard the products and the interest of the customers against any form of fraudulent acts. W e are looking for serious buyers our prices are affordable if you can handle this business please contact me as a matter of urgent Thanks Yours in Faith Magnus Asquo Export Director

1 0

Urgent Enquiry
by Tatsushi Yo 24 Aug '04

24 Aug '04

Ref: ZA-296-ENQR / YOKOHAMA I work for Yokozuna Financial Consultancy that is in the middle of a very important enquiry. I am getting in touch with you on behalf of our client, which is a top Japanese Bank (Yokohama Bank).We are conducting a search for any next of kin for a particular investor who has passed on. Please do you have any relatives who have lived in Japan for the last 30 years or more. Also are you aware of any relatives who might have been into real estate or a huge investor in Energy. We understand that this might be all too sudden for you, however we will appreciate that you get back to us even if no one of the above description is known to you. This will help us put an end to this matter. The reason we are getting in touch with you is because you share the same name with the individual. Please can you send us a mail indicating if you know any one with the above description? Also If no one of such description is known to you kindly send us a mail stating that, as this Will assit us stop further communication with you. Can you please send your reply to Tatsushi Yo as I am in charge of this enquiry. Please kindly get in touch by email to this enquiry, as this will enable us stop further communication with you. Thanks Tatsushi Yo *********************************************************************As a management consultancy firm we can help you answer the question below if Japan has been of any interest to you. WHY INVEST IN JAPAN ? There is tremendous investment opportunity in Japan, provided one takes the time to dig through the superficial media hype and colored analyses. While there is no shortage of accounts of what is happening in Japan, there is a dearth of relevant facts, considered interpretations, and clear-headed analysis of developments and events that answer key questions about your investments in Japan. Moreover, even in the age of instant communications and the Internet, the majority of information that is being discounted in Japan's financial markets is simply not available in English. We try to solve these problems with our vast knowledge and 20 years experience.

1 0

RE: 760 specs
by Michael Christian 20 Aug '04

20 Aug '04

Wow, that link is pure gold. I thought they were hiding the end-of-lifed configs. Thanks, Stephane. _____ From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Stephane Sent: Friday, August 20, 2004 3:53 AM Cc: toasters(a)mathworks.com Subject: Re: 760 specs depends on your shelfs i think mk2 can be up to 4 or 8 according the LRC/ESH module have a look here : http://now.netapp.com/NOW/knowledge/docs/hardware/NetApp/syscfg/ choose your ontapp version then select your filer and select disk shelves you probably can read : << Note: When the disk shelf has LRCs, the maximum number of disk shelves per loop is four. >> -> understand "8 shelves otherwise"... as i read it from another machine/ontapp page << Note: When the disk shelf has ESHs, the maximum number of disk shelves per loop is six and the first shelf in the loop must have optical modules. >> Michael Christian wrote: Anyone know how many mk2 shelves you can throw on a 760? Thanks, -MikeC

1 0

Awful ufsrestore performance reading from DLT7000 on F810 (update)
by Chris Thompson 20 Aug '04

20 Aug '04

You may recall I raised this on toasters in early March this year. A quick recap: We ufsdump some Solaris partitions onto a DLT7000 attached to an F810. They are blocked at 63KB and write performance is not bad (though not quite as good as the dumps/restores of the F810 itself). But ufsrestore from this drive reads at 10% or less of that rate. Tests showed this problem was not specific to ufsrestore, but seemed always to occur when reading via the rmt(8) interface. But it didn't use to happen, back when this was Solaris 8 and ONTAP 6.2.2 on an F740, as opposed to Solaris 9 and ONTAP 6.4.3P2 on an F810 - so what changed? I've now repeated the experiments with ONTAP 6.5.1R1P6, and get the same results. But, I now have a workround! It turns out that if you stuff more than one "R" (read) command into the rmt(8) connection before waiting for the results of the first one then you can keep the tape moving. Keeping just one extra read pending all the time gives almost the full advantage, and gets ufsdump-type speeds. So I can run a (Perl) program using that algorithm to pull the whole dump file onto local disc on the Solaris hosts, and then ufsrestore from that. (Luckily, space isn't a significant problem here.) One needs to be careful about subsequent tape positioning because of the extra read(s) past end-of-file that have been done. I still don't know the answer to "what changed?", though. Here's an idea that _didn't_ work. I thought: as ONTAP restore reads the tape at a decent rate, why don't I apply it to the Solaris dumps and then move the results from the filer to the Solaris local discs? After all, if Solaris ufsrestore can read ONTAP dumps (modulo occasional problems that have been discussed in other threads over the years), then why shouldn't ONTAP restore be able to read Solaris dumps? So give it a try: filer> restore rfD nrst0a /vol/test/solaris-test RESTORE: tape file #1 on device nrst0a. RESTORE: Unsupported dump format. RESTORE: Could not initialize media. RESTORE: RESTORE IS ABORTED Oh well, it was a good idea while it lasted ... :-) Chris Thompson University of Cambridge Computing Service, Email: cet1(a)ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH, Phone: +44 1223 334715 United Kingdom.

1 0

RE: IPsec NFS to Unix clients
by Muhlestein, Mark 20 Aug '04

20 Aug '04

Here are a couple of other things you can do to improve NFS security: 1. If you have CIFS you might consider using the nfs.require_valid_mapped_uid option. That allows you to set up the usermap.cfg file to do things like this: # allow the following UIDs NFS access from the specified IP addresses tom <= 192.168.3.34:tom jerry <= jerrypc.dorm.foo.edu:jerry jerry <= lab1.foo.edu:jerry jerry <= lab2.foo.edu:jerry # etc. # allow root from the admin network Administrator <= 10.10.20.0/24:root # prevent all other NFS access "" <= * The nfs.require_valid_mapped_uid option causes the usermap.cfg entries to be consulted even for access to data on qtrees with UNIX security. Combined with the normal export controls, this approach works as long as clients are not allowed to successfully spoof source IP addresses. It is also more manageable if the number of combinations of users/hosts is not overly large or dynamic; however I know we have had sites that have used this type of approach with a script-generated usermap.cfg. 2. If you have MultiStore available you can also use that to fence off NFS access. NFS clients accessing an IP address associated with a vfiler are not allowed to access storage assigned to another vfiler. This is enforced at the WAFL layer, so even if clients attempt handle spoofing the access is denied as long as the potentially rogue clients are not allowed to access the other vfilers' IP addresses (e.g. different networks on separate NICs). Mark -----Original Message----- From: Steve Losen [mailto:scl@sasha.acc.virginia.edu] Sent: Friday, August 20, 2004 7:08 AM To: Brian Parent Cc: toasters(a)mathworks.com Subject: Re: IPsec NFS to Unix clients > Has anyone else come up with some alternate means by which to secure > NFS exported data, where the server is a NetApp filer? (For years I've > been losing the battle to get the physical network secure, using > locking wall jacks in our public access labs.) I've been using NetApp > file servers since 1995, and have been generally happy, but this security > problem is making me seriously reconsider. We came up with a pretty ugly hack to prevent folks from installing impostor NFS clients on a physically insecure network, such as in a student Unix lab. We were aware of the risk, but were finally motivated to do something when some little bastard (ahem, student) replaced a lab machine with his Linux laptop, so he was able to NFS mount the home directories, and because he had root on his laptop, he could su to any user and have read/write access to their home directory. So here is what we did. We export to a netgroup. We discovered that once a NFS client has an NFS mount, it doesn't matter if you remove the NFS client from the netgroup map. NFS keeps working fine. So we removed all the lab machines from the netgroup. We wrote a little client/server application in perl that temporarily puts the NFS client in the netgroup. The NFS client connects to the NIS master and identifies itself with a "secret handshake" The NIS master adds the NFS client to the netgroup map and the NFS client mounts the home directory volume. Then the NIS master removes the NFS client from the netgroup map. The NIS master has a list of machines that are allowed to be added to the netgroup. This prevents the attack we experienced. Physical access to the network is not enough any more. You also need to know the "secret handshake" to get added to the netgroup map, and only root has access to that file. (If someone gets root on a lab machine, then they don't need an impostor machine.) This is certainly far from perfect. There is no protection against a man in the middle attack. I suppose someone could put a Linux box with two ethernet interfaces between the lab machine and the ethernet switch. The Linux box could be programmed to pass through network packets, except that it would intercept NFS packets and modify them. Perhaps the uid field could be changed. That way the hacker could make NFS requests as himself on the lab machine, but his Linux box would change the uid field to another user. Does NFS have any protection against this sort of tampering? IPsec would prevent this, of course. There is also a brief window of vulnerability while the lab machine is in the netgroup. Perhaps with some determined trial and error a hacker could quickly slip in an impostor machine and mount the volume during this window. But he would need to power cycle the lab machine to make it boot and he would need to slip in the impostor at just the moment that the lab machine was in the netgroup. Not easy, but certainly possible. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support

2 1

reliability of 15k vs 10k
by Michael Christian 20 Aug '04

20 Aug '04

Does anyone have a good feel for the reliability of the 15k drives vs 10k? We haven't really used the 15k's much yet, but the prices seem to be coming into line... Thanks, -MikeC

1 0

IPsec NFS to Unix clients
by Brian Parent 20 Aug '04

20 Aug '04

If anyone has been able to get IPsec protected NFS working between a NetApp filer and a Unix machine, I'd love to hear about it. I can get it to work using a Solaris 8 box as both the server and the client, but when I try to use a NetApp (6.4.4R1) as the server, no luck. I opened a case (697672), but was told that the only clients supported are windows 2K and later. This doc reinforces that: http://now.netapp.com/NOW/knowledge/docs/ontap/rel65/html/ontap/nag/ipsec2.… Towards the end of the page, under the section: About the Network Appliance IPsec implementation ... Only clients running Windows 2000 or greater are supported for IPsec connections. An RFE is filed: http://now.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=130292 though the page is pretty useless, as it only says "Bug information not available". I enabled "watching" for that RFE, but haven't heard anything back since April, 2004. I've also tried using kerberos to secure the NFS exported data, but the way we share the data between heterogeneous platforms, it means that unless we can get all of our supported clients to use kerberized NFS, then it doesn't help to do any subset. At this point, MacOS X is holding us back. I'm praying that Tiger (10.4?) release will address the issue, but I'm not holding my breath. Even if they do, another hurdle is CAP. We re-export NFS mounted data via CAP to MacOS 9 boxes. Getting CAP to track kerberos credentials is not something we're willing to invest time in. Has anyone else come up with some alternate means by which to secure NFS exported data, where the server is a NetApp filer? (For years I've been losing the battle to get the physical network secure, using locking wall jacks in our public access labs.) I've been using NetApp file servers since 1995, and have been generally happy, but this security problem is making me seriously reconsider.

3 4

RE: Number of Disks on a F720
by Stephenson, Burke T. GD 20 Aug '04

20 Aug '04

We had up to 4-6 DS8/9 shelves on a F720 at one time. The limitation that we ran into was the .5TB limitation. I am not sure what the actual disk limitation is, or if there even is one. Burke -----Original Message----- From: Paul McGuinness (ext. 771) [mailto:Paul.McGuinness@fineos.com] Sent: Friday, August 20, 2004 9:54 AM To: toasters(a)mathworks.com Subject: Number of Disks on a F720 Hi, I have an F720 filer (Release 6.3.1) with 2 FC9 shelves and 1 DS14 shelf - both fully populated. My question is can I add another shelf to this or am I maxed out? Any thoughts on this much appreciated Paul ********************************************************************** The information contained in this e-mail is confidential, may be privileged and is intended only for the user of the recipient named above. If you are not the intended recipient or a representative of the intended recipient, you have received this e-mail in error and must not copy, use or disclose the contents of this e-mail to anybody else. If you have received this e-mail in error, please notify the sender immediately by return e-mail and permanently delete the copy you received. This e-mail has been swept for computer viruses. However, you should carry out your own virus checks. Registered in Ireland, No. 205721. http://www.FINEOS.com **********************************************************************

2 1

760 specs
by Michael Christian 20 Aug '04

20 Aug '04

Anyone know how many mk2 shelves you can throw on a 760? Thanks, -MikeC

2 1

RE: Number of Disks on a F720
by Timothy Naple 20 Aug '04

20 Aug '04

Paul, What size disks are you running? Tim -----Original Message----- From: Paul McGuinness (ext. 771) [mailto:Paul.McGuinness@fineos.com] Sent: Friday, August 20, 2004 1:54 AM To: toasters(a)mathworks.com Subject: Number of Disks on a F720 Hi, I have an F720 filer (Release 6.3.1) with 2 FC9 shelves and 1 DS14 shelf - both fully populated. My question is can I add another shelf to this or am I maxed out? Any thoughts on this much appreciated Paul ********************************************************************** The information contained in this e-mail is confidential, may be privileged and is intended only for the user of the recipient named above. If you are not the intended recipient or a representative of the intended recipient, you have received this e-mail in error and must not copy, use or disclose the contents of this e-mail to anybody else. If you have received this e-mail in error, please notify the sender immediately by return e-mail and permanently delete the copy you received. This e-mail has been swept for computer viruses. However, you should carry out your own virus checks. Registered in Ireland, No. 205721. http://www.FINEOS.com **********************************************************************

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters