toasters

toasters@lists.teaparty.net

13515 discussions

RPC Enumeration security finding
by Alexander Griesser 25 Jul '19

25 Jul '19

Hey there, One of our customers had a pentester onsite who found the following issues with the NetApp filers there. RPC Enumeration discovered By sending a DUMP request to the portmapper, it is possible to enumerate the RPC services running on the remote port. Using this information, an attacker can connect and bind to each service by sending an RPC request to the remote port and exploit the host. Note: Specific Target IPs are included in the "Detailed IP List." nGuard recommends downloading the latest security patches from Microsoft. Does anyone know what exactly the problem here is and if there are any tunables to change the behaviour on NetApp (Ontap9+) filers? Thanks, Alexander Griesser Head of Systems Operations ANEXIA Internetdienstleistungs GmbH E-Mail: AGriesser(a)anexia-it.com<mailto:AGriesser@anexia-it.com> Web: http://www.anexia-it.com<http://www.anexia-it.com/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

3 3

small query reg upgrade from 9.4p1 to 9.5p6 C-Mode
by Yuvaraja Shivaram 25 Jul '19

25 Jul '19

Hi all, I have uploaded 9.5p6 software to the path /mroot/etc/software/ ... Manually(using system shell), in both the nodes so now would like to validate the version with below command... cluster image validate -version 9.5p6 it is getting failed since package is not there in the system repository... cluster image package show-repository (this commands also does not show anything...) so do I need to enter below command to push the 9.5p6 package into repository... cluster image package get -url mroot/etc/software/9.5p6_q_image.tgz Regards raj

4 3

Autosupport HTTPs receiver self hosted
by Alexander Griesser 18 Jul '19

18 Jul '19

Hey there, when using SMTP for autosupports, one can add additional e-mail addresses which will also receive the SMTP notifications and we're using this feature to collect autosupports in one of our support mailboxes. If we'd want to move away from SMTP, how could we do that in the future? When we switch to the https transport method, the autosupports most likely will only be posted to NetApp, I suppose. Am I overlooking something or is there really no way to specify an additional URL or something like this so that we can also receive these alerts then? Ideally, I'd either like to run the autosupport receiver locally on our infrastructue and forward the requests to NetApp then. This way, I could parse the requests and (if necessary) create tickets, etc. and archive them internally. Anyone ever worked on something like this or knows where I can find more information about that? Thanks, Alexander Griesser Head of Systems Operations ANEXIA Internetdienstleistungs GmbH E-Mail: AGriesser(a)anexia-it.com<mailto:AGriesser@anexia-it.com> Web: http://www.anexia-it.com<http://www.anexia-it.com/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

2 5

Find Chassis PSU Part Number
by Alexander Griesser 16 Jul '19

16 Jul '19

Hey there, on one of my lab systems, a chassis PSU broke (no maintenance anymore). I'm trying to find out what part number I need to replace here, but didn't have any luck so far. ::> system controller fru show-manufacturing-info -instance Node: XXX System Serial Number: XXX Model Name: FAS8020 System ID: XXX Kernel Version: NetApp Release 9.1P12: Mon Mar 5 05:01:09 PST 2018 Firmware Release: 9.5 FRU Description: PSU2 FRU Sub-type: - FRU Serial Number: 1350ABA-1349-XXXX FRU Part Number: 114-00040 FRU Revision of Part Number: +A5 FRU Manufacturer: - FRU Manufacturing Date: - FRU Product Identifier: - When I use part finder, it lists three different compatible models, as it seems: SP-763-R5 SP-763-R6 X763-R6 And I'm not sure which one is the right one here or is any 1300W PSU working in this situation? Thanks, Alexander Griesser Head of Systems Operations ANEXIA Internetdienstleistungs GmbH E-Mail: AGriesser(a)anexia-it.com<mailto:AGriesser@anexia-it.com> Web: http://www.anexia-it.com<http://www.anexia-it.com/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

2 2

Need to quickly downgrade from 9.5 to 8.2.4
by Carolyn Chambers 07 Jul '19

07 Jul '19

Hello, We are the middle of move planning and need to snapmirror some 7 Mode data. The gear we have for the destination is from the factory with 9.5. The usual netboot is throwing errors. Any suggestions? Thanks, Carolyn 972.578.2708

7 13

Migrating ONTAP 8.3 to 9.5
by Edward Rolison 01 Jul '19

01 Jul '19

I've got a new cluster in, running the latest and greatest ONTAP version. For reasons, the predecessor cluster is running a 'stable' platform, and hasn't been tracking the most recent updates. It's a snapmirrored cluster. I'm trying to figure out migration routes now. Is there any equivalent of 7-mode -> CDOT TDP replication, or am I going to have to bite the bullet and do an update on the source cluster to a newer version? And if so, because the snapmirror relationship that already exists, does that mean a 'stepped' approach of 8.3->9.1->9.4 (to 9.5 potentially) because that's what I'll need to do to preserve the snapmirror relationship with the replication partner? I'm not overly keen on pushing up a major version number on both our prod/DR environment but if the choice is that or 'rsync/xcp' then I'll probably go with that. I am just hoping there's a migration-assist option that means I don't have to do that, analogous to TDP from 7 mode.

4 4

Providing someone access to shut down storage
by cs 20 Jun '19

20 Jun '19

Hi, Has anyone out there set up a foolproof tool for admins to use to shut down storage clusters during/for maintenance? Or do you simply let them go down / come up with the power like a network switch? I’m trying to figure out what it would take to create an “easy button” admins could use to shut down a storage cluster, basically so I don’t have to get up in the middle of the night to run one command. Some kind of web-based interface I could enable/disable as needed where an admin could type the name of the cluster in a text box and click the shutdown button. I suppose they should authenticate with the interface so their credentials could be captured and logged too. I suppose I could cron-job it, but that relies on others doing their part to get VMware shut down before the storage goes away. -- scott

1 0

server-ca certs expiring
by cheese＠nosuchhost.net 18 Jun '19

18 Jun '19

hi i have several systems with ontap 9.3P10 and have messages like: 6/12/2019 00:00:01 L1Q-A1 ERROR mgmtgwd.certificate.expiring: A digital certificate with Fully Qualified Domain Name (FQDN) Class2PrimaryCA, Serial Number 85BD4BF3D8DAE369F694D75FC3A54423, Certificate Authority 'Class 2 Primary CA' and type server-ca for Vserver L1Q will expire in the next 25 day(s). what should i do here? my netapp partner told me to renew them via deleteing them and creating new certs. i should create a new server-ca, which is not even an option in ontap (even with advanced privileges) ? i think this must be wrong. i hope others have the same problem and a solution. yours josef

5 7

Is there a best practice for adjust RAID "scrub" options?
by Sylvain Robitaille 05 Jun '19

05 Jun '19

Hello NetApp Gurus. I'm hoping mostly to get some guidance on RAID group scrubbing options and with some luck, perhaps pointers to documentation that would help me determine appropriate values in our environment. We've been seeing what feels like a large number of scrubbing "timeouts" on our filers. Log entries similar to this one: May 28 05:00:02 fc1-ev-n1.console.private [kern.notice] [fc1-ev-n1:raid.scrub.suspended.timer:notice]: Disk scrub suspended because the scrub time limit 240 was exceeded. It will resume at the next weekly/scheduled scrub. What we'd like to know is how concerned we should be about this. Ideally we'd be seeing "scrubs" complete reasonably frequently, but I'm honestly not sure how I could determine how frequently that happens, or how frequently it *should* happen for that matter. The scrub options on the filer have not been changed from the Ontap defaults (NetApp Release 9.5P2, but we've been seeing this with earlier versions as well): Node Option Value Constraint ------- ----------------------- ------ ---------- fc1-n1 raid.media_scrub.rate 600 only_one fc1-n1 raid.scrub.perf_impact low only_one fc1-n1 raid.scrub.schedule none (and the same for the partner node, of course) The "storage raid-options" manual page indicates that the default schedule of daily at 1am for 4 hours, except Sundays when it runs for 12 hours, applies if no explicit schedule is defined. If I examine the scrub status of our aggregates: fc1-ev::> storage aggregate scrub -aggregate * -action status Raid Group:/e1n2_tssd/plex0/rg0, Is Suspended:false, Last Scrub:Thu May 30 02:39:10 2019 Raid Group:/e1n2_t01/plex0/rg0, Is Suspended:true, Last Scrub:Sun May 26 02:55:15 2019, Percentage Completed:65% Raid Group:/e1n2_t02/plex0/rg0, Is Suspended:false, Last Scrub:Thu May 30 02:28:37 2019 Raid Group:/e1n2_root/plex0/rg0, Is Suspended:false, Last Scrub:Thu May 30 03:39:03 2019 Raid Group:/e1n1_root/plex0/rg0, Is Suspended:false, Last Scrub:Wed May 29 02:03:43 2019 Raid Group:/e1n1_d01/plex0/rg0, Is Suspended:true, Last Scrub:Tue May 28 03:22:52 2019, Percentage Completed:7% Raid Group:/e1n1_d01/plex0/rg1, Is Suspended:true, Last Scrub:Wed May 29 02:00:56 2019, Percentage Completed:4% Raid Group:/e1n1_d01/plex0/rg2, Is Suspended:false, Last Scrub:Wed May 29 04:02:50 2019 Raid Group:/e1n1_d01/plex0/rg3, Is Suspended:false, Last Scrub:Wed May 29 04:08:45 2019 Raid Group:/e1n1_d00/plex0/rg0, Is Suspended:true, Last Scrub:Sun Apr 28 06:00:40 2019, Percentage Completed:81% Raid Group:/e1n1_d00/plex0/rg1, Is Suspended:true, Last Scrub:Sun Apr 28 07:38:30 2019, Percentage Completed:80% The truth is I'm not sure how to interpret this output: - Is it the case that each RAID group where "Is Suspended:false" *completed* its scrub at the "Last Scrub" time, while those that are suspended are those for which we're seeing log entries? - Given the default schedule that has the scrub run for 12 hours on Sunday mornings, does it seem odd that /e1n2_t01/plex0/rg0 was suspended last Sunday at 02:55:15, prior to completion? In fact, all those interrupted on a Sunday were interrupted well before 12 hours. Might there be other reasons for suspending scrub operations? The load on this filer is not excessive in any way: CPU utilization is typically comfortably below 50% - How do I determine why the two RAID groups containing e1n1_d00 haven't run scrubbing in over a month? Is there something I should do about that? I've found documentation that explains the options and how to change them, but none that explains how to decide whether I *should* change them, or how to determine what to change them to. I'm interpretting that raid.media_scrub.rate and raid.scrub.schedule could be used together to tune the scrubbing, but am quite unsure how to determine what the best values would be for our filers. Any pointers to documentation that would help here would be hugely appreciated. Thanks in advance ... -- ---------------------------------------------------------------------- Sylvain Robitaille syl(a)encs.concordia.ca Systems analyst / AITS Concordia University Faculty of Engineering and Computer Science Montreal, Quebec, Canada ----------------------------------------------------------------------

3 5

all.zip and all_shelf_fw.zip most current versions
by Alexander Griesser 28 May '19

28 May '19

Hey, I'm interested in the ways people keep their firmware updated on their filers. On the support website, you can download all.zip and all_shelf_fw.zip, but they are most of the time not recent enough, so f.ex. today I could download all.zip from 10-APR-19 and there is more recent firmware for quite some disks dated with 17-May-19. Does anyone know if there is a public/private URL where I can download a "nightly" build or something like this for all.zip? Or is there any URL/FTP/etc. (without having to parse the download website with some selenium scripts or something like that) that I could use to mirror all the firmware files to one of my servers and create the zip file there? Best, Alexander Griesser Head of Systems Operations ANEXIA Internetdienstleistungs GmbH E-Mail: AGriesser(a)anexia-it.com<mailto:AGriesser@anexia-it.com> Web: http://www.anexia-it.com<http://www.anexia-it.com/> Anschrift Hauptsitz Klagenfurt: Feldkirchnerstraße 140, 9020 Klagenfurt Geschäftsführer: Alexander Windbichler Firmenbuch: FN 289918a | Gerichtsstand: Klagenfurt | UID-Nummer: AT U63216601

5 11

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters