toasters

toasters@lists.teaparty.net

1 participants
13515 discussions

disk firmware versions required for 5.1.2
by Daniel Quinlan 10 Nov '98

10 Nov '98

Can someone at NetApp tell me the firmware version required to run 5.1.2 before I upgrade from 5.0 to 5.1.2? I would like to know how much time I need to schedule for the upgrade. (It looks like it would also save me that first reboot, meaning less overall downtime.) This information should really be included with the upgrade notes. I would like to know this for the following systems and disks: F630 SCSI : ST19171W and ST39173WC F630 FC : ST19171FC F540 : ST15150W F330 : ST15230N (It actually looks like I might only need to know about the F630 FC, since it's the only firmware included with 5.1.2. The notes indicate that you end up with version FB37 after an upgrade, so maybe I have to upgrade if I don't have that, but maybe not. Anyway, I'd rather work in the light.) Thanks. - Dan

2 1

Re: nfs (in)security?
by Tom Reingold 10 Nov '98

10 Nov '98

On Tue, 10 Nov 1998 00:07:20 EST, Brian Atkins <brian(a)posthuman.com> wrote: > This does not make a lot of sense to me.. I mean, if some user > on the client has hacked root, then game over man. Who cares > past that. Of course they can su to some user and mess with > their files, root can do just about anything. > > What I want and need to know when designing our nfs system is > whether a normal non-root user, _without hacking root_, can > do any shenanigans via or to nfs. Basically, is adding properly > configured nfs to an already secure system going to be ok > or not ok, and if not ok what can be done about it? I think the premise you offer isn't worth taking as a "given." You can't assume people won't hack root. It's too easy. It's easy not because you run your UNIX systems so badly -- for I have no idea -- but because it's probably easy to drop a Linux system on the wire. Or someone can some evil DNS packet injection. Or someone can write some funnky NFS code on a PC to spoof UIDs etc. Unfortunately, I think all this means you can have NFS or security but you can't have both. Or maybe a better conclusion is that this state of affairs is acceptable, but we should not consider it air-tight, even with the best of our efforts. -- Tom Reingold tommy(a)bell-labs.com http://www.bell-labs.com/~tommy Bell Labs, the Research and Development unit of Lucent Technologies Murray Hill, NJ, 07974-0636 US

1 0

Re: nfs (in)security?
by mds＠ns.gbnet.net 10 Nov '98

10 Nov '98

If you don't force the filer to only allow root to mount areas onto clients (ie force such traffic to come from ports upto 1024, ports which Unix only allows root to bind to normally) then it is possible for a user to write an rpc program to fake NFS traffic. I once saw this demonstrated in college. However, that task is beyond most script-kiddies. For all I know there's now a standard tool though. Most people don't make their NFS servers so trusting. It's not insanely hard to break NFS 'security' though, all you need is to pretend to be a trusted host, say the adminhost, convincingly enough and long enough and you're away. I had great hopes for kerberos enabled NFS at the introductionof NFS3 but that all seems to have died a death, as has using Kerberos in the Windows environment. Everyone I talk to now seems to be talking 'certificates' - as if the rest of kerberos has no value. *sigh*

1 0

Re: Potential user has questions
by Brian Atkins 10 Nov '98

10 Nov '98

"Yoder, Alan" wrote: > > > Right, of course if you misconfig something you open yourself > > to mischief. What I want to get at is whether it is safe to > > have a filer attached to the net-at-large, or whether it needs > > to be firewalled or otherwise protected. Can you elaborate on > > the nfs insecurities you mention? > > A number of NFS systems and tools send passwords in plain text, > and the filer is not an exception. Use a firewall or switched > Ethernet. That bites > > > > > What kind of real-world bandwidth can it put out (F740) ? I > > > > see the transaction specs, but what about sustained mbits > > > > in a web-type environment (3x more reads than writes)? > > > > > > Netapp prefers to measure "response time" vs. "transactions/sec". > > > In other words, a filer might be showing tremendous throughput > > > for one party, while starving out the others (delayed responses). > > > In the real world, you want average response time to be as fast as > > > possible because that is what people notice. Netapp has very > > > impressive throughput and average response time does not degrade > > > dramatically at high loads. > > > > Excellent, but is the filer capable of overloading 100mbit > > ethernet? If so, just how much bandwidth should we spec out > > for it so that it can perform to its max abilities? > > As I remember it, the 740 can saturate at least two 100Mb Ethernet > links. In house, we have our main filers connected via > gigabit uplinks to a backbone, which gets switched down to > 100Mb LANs from there. > > Keep in mind, you need a lot of clients to saturate the filer. > It takes around 50 200MHz PC clients running NetBench to max > it out. A web server with a filer back end won't even make > it sweat, and one 100Mb Ethernet card might be enough. What > kind of uplink to the world will the web server have? > The whole system will be colocated at a facility with multiple OC-3/DS3/T1 links. Same place amazon.com is located at... It will only have about 10 300mhz PII client boxes at first, so this is sounding good. I think we may go with the Cisco FEC multiple 100mbit links instead of gigabit in order to provide some link redundancy. -- The future has arrived; it's just not evenly distributed. -William Gibson ______________________________________________________________________ Visit Hypermart at http://www.hypermart.net for free business hosting!

2 3

Re: can't see ~snapshot directory
by Mark Muhlestein 10 Nov '98

10 Nov '98

Bridget wrote: >We changed the default due to problems with NT backup software handling >snapshots badly. Actually, that was only one reason. It was also confusing to Office's "find fast", xcopy, explorer, etc. Apart from the option Bridget mentioned, you should understand that you can enter the ~snapsht from any open dialog; you just have to explicitly name it. You can use it anywhere you can specify a path. (Also, ".snapshot" and "~snapshot" are valid names from NT.) Mark Muhlestein -- mmm(a)netapp.com > >> We use NFS and CIFS on our toasters. Since upgrading to 5.1.2, our >> PC clients no longer see the ~snapshot directories. (This is the >> .snapshot directory on unix clients.) >> >> Is there a fix? This is disconcerting. Or should I say broken? >

6 7

RE: Potential user has questions
by Sam Schorr 10 Nov '98

10 Nov '98

Stephen, Actually, that is not quite true even in the case of the filer, unless I have not understood some things about how Network Appliance builds their devices. The ethernet, fddi, gigabit, etc network interfaces are not made by NetApp. It does not seem farfetched to expect Network Appliance to use the same model that has led to open sourcing in other areas. If they have chosen to integrate the drivers directly into ONTap instead of calling the drivers as needed, and if they have not adhered to whatever standards exist for those interfaces, then NetApp has self-created a monopoly. It will go the way of all monopolies - competition will force them out of business or into supporting more flexible configurations. -----Original Message----- From: Stephen C. Losen [mailto:scl@sasha.acc.virginia.edu] Sent: Monday, November 09, 1998 2:53 PM To: Sam Schorr Cc: toasters(a)magic.metawire.com Subject: Re: Potential user has questions > I think the reasoning here is not quite thorough enough. If I buy a Compaq > server and then I install a 3-Com ethernet card, I still expect, and get, > full support from Compaq. This has been the case in the clone, or Intel > world for quite awhile. I know that it is less true the more proprietary > you get, but still is essentially the case, even in the IBM mainframe world > and in the UNIX world. I am now in the middle of an issue between Network > Appliance and Microsoft and I would NEVER buy another filer if NetApp tried > to deflect response to the fact that I use Microsoft products and therefore > I should debug the Microsoft side first. Whether I like it or not, and > whether NetApp likes it or not, multi-vendor environments MUST be supported > - there is no option. There is one BIG difference as far as interface cards go. Any driver code is part of ONTap. If ONTap does not have code to support a particular card, there's absolutely no way the card will work in a filer (unless it is a perfect clone of a card that netapp does support). And there is no way for a card vendor to supply you with a "driver" that will work on a netapp filer. They would have to provide you with a custom version of ONTap. Steve Losen scl(a)virginia.edu phone: 804-924-0640 University of Virginia ITC Unix Support

3 2

RE: Potential user has questions
by Sam Schorr 10 Nov '98

10 Nov '98

Okay, I get your point and it is well taken. The flip side is that there is only competition at the product level, so that there is less incentive for NetApp (or any other vendor in a similar position) to drive costs down. Yes, I know that there are many vendors with competing products (Auspex, EMC, DataDirect, etc), so I guess I'll exit gracefully from this thread with a the admonition "buyer beware". -----Original Message----- From: Rob Windsor [mailto:windsor@adc.com] Sent: Monday, November 09, 1998 4:17 PM To: Sam Schorr Cc: toasters(a)mathworks.com Subject: Re: Potential user has questions On Mon, 09 Nov 1998 13:25:57 PST, Sam Schorr wrote: > I think the reasoning here is not quite thorough enough. If I buy a Compaq > server and then I install a 3-Com ethernet card, I still expect, and get, > full support from Compaq. This has been the case in the clone, or Intel > world for quite awhile. I know that it is less true the more proprietary > you get, but still is essentially the case, even in the IBM mainframe world > and in the UNIX world. I am now in the middle of an issue between Network > Appliance and Microsoft and I would NEVER buy another filer if NetApp tried > to deflect response to the fact that I use Microsoft products and therefore > I should debug the Microsoft side first. Whether I like it or not, and > whether NetApp likes it or not, multi-vendor environments MUST be supported > - there is no option. But Compaq doesn't make software, they didn't write the OS that you are trying to get to talk to that 3-Com ethernet card. Who's responsibility is it to ensure that there are drivers for your OS on that Compaq? 3Com will happily help you out with Microsoft products since the time spent writing/fixing those drivers have a tangible effect on hardware sales. I bet they aren't so quick with others, particularly if you are not on an Intel-based mainboard. Imagine calling 3Com up and asking if they have drivers for their 3c905 running "Network Appliances Data OnTapp v5.x" for the Alpha CPU. So, NetApp should write the driver, you say? The more wizbang cards from Fry's that people want to put in their filers, the more development work that NetApp has to put into "nonstandard" (not OEM'd by them) hardware, and the more expensive the filers get. Afterall, they need to bill the development time back to the customers somehow. That is not what we call a "win win" situation. -- Rob ---------------------------------------- Rob Windsor E-Mail - mailto:windsor@adc.com Senior Unix Systems Administrator Voice - phone:972-680-6919 Computer Services Fax - phone:972-680-0370 Business Broadband Group ADC Telecommunications Richardson, TX 75082

1 0

RE: Potential user has questions
by Sam Schorr 10 Nov '98

10 Nov '98

I think the reasoning here is not quite thorough enough. If I buy a Compaq server and then I install a 3-Com ethernet card, I still expect, and get, full support from Compaq. This has been the case in the clone, or Intel world for quite awhile. I know that it is less true the more proprietary you get, but still is essentially the case, even in the IBM mainframe world and in the UNIX world. I am now in the middle of an issue between Network Appliance and Microsoft and I would NEVER buy another filer if NetApp tried to deflect response to the fact that I use Microsoft products and therefore I should debug the Microsoft side first. Whether I like it or not, and whether NetApp likes it or not, multi-vendor environments MUST be supported - there is no option. Sam Schorr Homestead Technologies (650) 549-3152 New Phone Number!! fax: (650) 364-7329 sschorr(a)homestead.com Don't just build a home page...build a Homestead!! http://www.homestead.com -----Original Message----- From: marc_merlin(a)magic.metawire.com [mailto:marc_merlin@magic.metawire.com] Sent: Monday, November 09, 1998 9:32 AM To: toasters(a)magic.metawire.com Subject: Re: Potential user has questions On 6 Nov 1998 17:44:48 -0800, Brian Atkins <brian(a)posthuman.com> wrote: >> > Can we use third party drives/shelves/canisters/mem? >> >> They would not be supported. > >Need some clarification: so if we had a problem with our >filer, would we still be able to get support/warranty >service? I understand that if the problem was traced to >third party parts we would be on our own at that point- >but before that determination would we still get help? Note that this is not an official answer, but just a guess using common sense. Picture one of your systems showing random failures. You call netapp, you spend a long time with their tech support engineers, they start guessing at what the failure is, they ship you replacement parts, etc, etc... In the end, you guys figure out that all your problems came from the substandard memory you bought yourself. Of course, you handle the memory part yourself. However, does this make sense for Netapp? They spent time and money trying to help you when in fact your failures where not due to their hardware... So I'm almost certain that no, just like other companies, Netapp won't support your hardware if you put in some parts that don't come from them. Marc -- "Microsoft is to software what McDonalds is to gourmet cooking" Home page: http://marc.merlins.org/ (friendly to non IE browsers) Finger marc(a)merlins.org for PGP key and other contact information

3 2

Re: Potential user has questions
by sthaug＠nethelp.no 09 Nov '98

09 Nov '98

> You could put some cheesse-ball 10/100 ethernet card in your filer. > But do you really expect to be able to get decent performance out of it? > Tell me there is no difference between a $30 Netgear 10/100 card and the > $200 Zynx that NetApp uses (or used to use). As long as they both use the same Digital 21140 Ethernet controller, I expect basically the same performance. My ttcp measurements seem to bear this out. I'm not saying that the controller is the only interesting part of an Ethernet card - just saying that even inexpensive Ethernet cards can have excellent performance. (Btw, Netgear has recently changed to a different Ethernet controller.) Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Re: Potential user has questions
by Tom Reingold 09 Nov '98

09 Nov '98

On Mon, 09 Nov 1998 13:25:57 PST, Sam Schorr <sschorr(a)homestead.com> wrote: > I think the reasoning here is not quite thorough enough. If I buy a Compaq > server and then I install a 3-Com ethernet card, I still expect, and get, > full support from Compaq. This has been the case in the clone, or Intel > world for quite awhile. I know that it is less true the more proprietary > you get, but still is essentially the case, even in the IBM mainframe world > and in the UNIX world. I am now in the middle of an issue between Network > Appliance and Microsoft and I would NEVER buy another filer if NetApp tried > to deflect response to the fact that I use Microsoft products and therefore > I should debug the Microsoft side first. Whether I like it or not, and > whether NetApp likes it or not, multi-vendor environments MUST be supported > - there is no option. I agree, in general. I think netapp's position is somewhat justified, because they can claim -- and I take it on face value -- that they stress disks more than other vendors. Therefore, they claim, they have to test each model disk and even each firmware revision before quality assuring it. In theory, any generic disk should work, but there's enough "practice" out there to show that different disks stand up to various stresses differently. I can accept this, but I'm not sure why this also applies to memory. And I guess I can accept it with scsi boards and ethernet boards, but I'm not entirely happy about it. It seems to me they could QA more add-ons than the ones they sell. -- Tom Reingold tommy(a)bell-labs.com http://www.bell-labs.com/~tommy Bell Labs, the Research and Development unit of Lucent Technologies Murray Hill, NJ, 07974-0636 US

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters