toasters

toasters@lists.teaparty.net

13531 discussions

Security best practice question
by Stephen C. Losen 30 Mar '09

30 Mar '09

Hello toasters, Our Oracle admins are replacing their old FC SAN storage and are considering going with NetApp and NFS. But they are concerned about security. They are really attracted to flex clone because they would like to instantly replicate a database on a secure, firewalled Oracle server, run a job to sanitize the clone and then serve the sanitized DB from a less secure Oracle server in a DMZ. They are concerned that if the DMZ server were hacked, could it be leveraged to gain unauthorized NFS access, perhaps by hijacking an IP address? I have suggested that they set up two separate private data Ethernets, one for the secure servers and one for the DMZ servers. Use two different address blocks (subnets) and plug the netapp into both networks with two different ethernet ports. That way the netapp would never send data exported to the secure servers out the interface for the DMZ servers. Am I on the right track here? Is this "secure enough"? Is there an easier way? We don't have any Kerberos infrastructure and we can't sacrifice performance, so I think NFSv4 is out. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support

3 2

ESX utilty problem
by steve klise 27 Mar '09

27 Mar '09

I have an ESX 3.5 release 2 5 ESX servers in HA, DRS, etc 1 HA 3070 (filer1 filer2) 1 HA 6030 (filer3 filer4) For naming purposes, filers are called filer1, 2, etc with my favorite password all head have the same password The utilty runs, excpet for what is noted below: I have Datastores from 2 filers that are part of 2 different Netapp clusters. FIler1 (from the 3070) and Filer 3 (from the 6030). WHen I run the -- secure --access I get this.. [root@ESXSERVER netapp_esx_host_utilities_5_0R2]# /opt/netapp/santools/config_hba --configure --secure --access filer1:ilovemyfilers --access filer2:ilovemyfilers --access FILER3:ilovemyfilers --access filer4:ilovemyfilers Secure connection enabled Checking for installed HBAs.......................................DONE Verifying firewall ports are open.................................DONE Determining NetApp storage systems OS versions....................FAILED Setting HBA timeout setting for qla2300_707_vmw...................DONE Updating BOOT RAM disk............................................DONE For the HBA settings to take effect, please Reboot now. WARNING: The script was unable to determine the OS version of the following NetApp storage system(s). The script could not determine the correct settings for your configuration. One possible cause is SSL might not be configured properly. Please login to your NetApp storage controller and run 'secureadmin setup ssl'. Once you have verified SSL is configured properly, run the following commands to ensure the correct settings are being used: /opt/netapp/santools/config_hba --configure --secure --access <controller>:<password> Any help is greatly appreciated. -- View this message in context: http://www.nabble.com/ESX-utilty-problem-tp22709305p22709305.html Sent from the Network Appliance - Toasters mailing list archive at Nabble.com.

3 3

Re: Question regarding power controls for DS14 shelves in NetApp cabinets
by Sto Rage© 27 Mar '09

27 Mar '09

On Fri, Mar 27, 2009 at 11:17 AM, Young, Darren <darren.young(a)chicagobooth.edu> wrote: > Do you have L6's from the shelves themselves? > The L6 connections are for the cabinets themselves and are connected to a large UPS that powers the entire data center. So what I am hearing from you guys is to install an IP addressable power outlets for these L6 connectors. I haven't seen any that do this for L6 out lets. I think NetApp should look at providing IP addressable PDU within their cabinets. -Sto Rage

2 1

Re: Security best practice question
by Fox, Adam 27 Mar '09

27 Mar '09

Sounds like a solid plan. Plus since ONTAP-NFS sees the clone as a separate volume you only need to export the clone to the less secure network. If you really want to split it security-wise, you could implement multistore and assign the clone to a vfiler which is managed administratively like a separate box and gives you an even bigger firewall. I think that may be overkill, but it's there if you want it. -- Adam Fox ------------------------ Typed with my thumbs on a very small keyboard. ----- Original Message ----- From: Stephen C. Losen <scl(a)sasha.acc.virginia.edu> To: toasters(a)mathworks.com <toasters(a)mathworks.com> Sent: Fri Mar 27 10:04:56 2009 Subject: Security best practice question Hello toasters, Our Oracle admins are replacing their old FC SAN storage and are considering going with NetApp and NFS. But they are concerned about security. They are really attracted to flex clone because they would like to instantly replicate a database on a secure, firewalled Oracle server, run a job to sanitize the clone and then serve the sanitized DB from a less secure Oracle server in a DMZ. They are concerned that if the DMZ server were hacked, could it be leveraged to gain unauthorized NFS access, perhaps by hijacking an IP address? I have suggested that they set up two separate private data Ethernets, one for the secure servers and one for the DMZ servers. Use two different address blocks (subnets) and plug the netapp into both networks with two different ethernet ports. That way the netapp would never send data exported to the secure servers out the interface for the DMZ servers. Am I on the right track here? Is this "secure enough"? Is there an easier way? We don't have any Kerberos infrastructure and we can't sacrifice performance, so I think NFSv4 is out. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support

2 1

OSSV & Hyper-V?
by Nicholas Bernstein 20 Mar '09

20 Mar '09

Hi all, I was wondering if anyone knew of a solution similar to OSSV for vmware for hyper-v. I know, it's a long shot, but I've got a student asking about it. I couldn't find anything about an ossv solution for it. Anyone know of something on its way? Thanks! Nick

3 2

Running a snapmirror over an stunnel
by George T Chen 20 Mar '09

20 Mar '09

Has anyone been able to get a snapmirror running across an stunnel, and have it run at normal speeds (10, 20, 30 MB/s)? I can get it functional, but the speeds I'm getting are in the 40KB/s range.

1 0

FCP Partner Path Misconfigured - Host I/O access through a non-primary and non-optimal path was detected.
by Linux Admin 18 Mar '09

18 Mar '09

Hello Toasters. I am receiving the following message from auto support: FCP Partner Path Misconfigured - Host I/O access through a non-primary and non-optimal path was detected. I have a single cluster acting in single fabric mode and it is wired up in the following way. Each host has an i-group on each node of the cluster for. Each of the netapp node is connected to sw1 and sw2 and hosts also has a path to sw1 and sw2. Why would the host access luns on N2 via partner node N1 --------------- --------------- { n1 } { n2 } | \ / | | \ / | | \ / | | \ / | --------------- --------------- { s1 } { s2 } \ / \ / --------------- { host }

6 9

Monitor a loop's utilization
by Romeo Theriault 18 Mar '09

18 Mar '09

Hello, I'm interested in monitoring our filers fiber channel loops (to the shelves) performance. I'd like to be able to see what the utilization of a particular (2g) loop to some of our disk shelves is. But more generally I'd like to just be able to monitor all of the loops utilization over time. I've looked through the stats command and the snmp mib but am not finding what I'm looking for but I may just be looking for the wrong thing. Is it possible to monitor the loop utilization and if so how? Thank for any help on this. -- Romeo Theriault System Administrator Information Technology Services

1 0

scrub disks (how to)
by Chaim Rieger 18 Mar '09

18 Mar '09

we are retiring 14 shelves and would like to scrub the disks, before giving them up. anybody got any pointers ? (begin rant) on a side note, i think its not fair that netapp does not give a credit when returning disk shelves. (ok rant over)

7 8

Re: scrub disks (how to)
by Eino Tuominen 17 Mar '09

17 Mar '09

Chaim Rieger wrote: > we are retiring 14 shelves and would like to scrub the disks, before > giving them up. > > anybody got any pointers ? If your ontap is recent enough (dont' remember the version) you can use disk sanitize from the command line. -- Eino Tuominen

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters