1z0-821 Oracle Solaris 11 System Administration Questions and Answers

Network configuration in Oracle Solaris 11 includes

* Generic datalink name assignment – Generic names are automatically assigned to datalinks using the net0, net1, netN naming convention, depending on the total number of network devices that are on the system

Note: There is no upgrade path from Oracle Solaris 10 to Oracle Solaris 11. You must perform a fresh installation.

The NVRAM chip stores user-definable system parameters, also referred to as NVRAM variables or EEPROM parameters. The parameters allow administrators to control variables such as the default boot device and boot command. The NVRAM also contains writeable areas for user-controlled diagnostics, macros, and device aliases. NVRAM is where the system identification information is stored, such as the host ID, Ethernet address, and time-of-day (TOD) clock.

Examples of NVRAM variables:

Variable Default Description boot-device disk or net

The device from which to start up.

diag-device net The diagnostic startup source device.

diag-file Empty string Arguments passed to the startup program in diagnostic mode.

diag-switch? false Whether to run in diagnostic mode

The framework enables providers of cryptographic services to have their services used by many consumers in the Oracle Solaris operating system. Another name for providers is plugins. The framework allows three types of plugins:

* User-level plugins - Shared objects that provide services by using PKCS #11 libraries, such as pkcs11_softtoken.so.1.

* Kernel-level plugins - Kernel modules that provide implementations of cryptographic algorithms in software, such as AES.

Many of the algorithms in the framework are optimized for x86 with the SSE2 instruction set and for SPARC hardware.

* Hardware plugins - Device drivers and their associated hardware accelerators. The Niagara chips, the ncp and n2cp device drivers, are one example. A hardware accelerator offloads expensive cryptographic functions from the operating system. The Sun Crypto Accelerator 6000 board is one example.

How to Create an iSCSI LUN

The disk volume provided by the server is referred to as the target. When the LUN is associated with an iSCSI target, it can be accessed by an iSCSI initiator.

The following tasks are completed on the system that is providing the storage device.

1. Install the COMSTAR storage server software.

target# pkg install storage-server

Etc.

A: %PART

The amount of cpu used as a percentage of the total cpu in a processor-set to which the zone is bound. A zone can only have processes bound to multiple processor sets if it is the global zone, or if psrset(1m) psets are used. If multiple binding are found for a zone, it's %PART is the fraction used of all bound psets. For [total] and [system], %PART is the percent used of all cpus on the system.

Note: The zonestat utility reports on the cpu, memory, and resource control utilization of the currently running zones. Each zone's utilization is reported both as a percentage of system resources and the zone's configured limits.

The zonestat utility prints a series of interval reports at the specified interval. It optionally also prints one or more summary reports at a specified interval.

* Updating all of the packages on your installed system – To update all of the packages on your system that have available updates, use the pkg update command, as follows:

# pkg update

Running this command updates packages that you might not otherwise consider updating, for example, kernel components and other low-level system packages.

* Adding or updating individual packages – To add individual software packages, use the pkg install command. Any dependent packages are also updated at the same time.

* install package updates that deliver fixes– A pkg update operation might include bug fixes, so the operation is similar to applying a specific patch or patches in previous Oracle Solaris releases.

Note: The IPS interfaces first check for updates for currently installed packages before retrieving them via the network. By default, interfaces check repository catalogs in the following locations:

* The default installation repository at pkg.oracle.com/solaris/release.

* The support repository in My Oracle Support. This repository is restricted to users with Oracle Solaris 11 Express support contracts, and it contains packages with the latest bug fixes. For this reason, a support contract must be purchased for production deployments.

The user file-creation mode mask (umask) is use to determine the file permission for newly created files. It can be used to control the default file permission for new files. It is a four-digit octal number.

You can setup umask in /etc/bashrc or /etc/profile file for all users. By default most Unix distro set it to 0022 (022) or 0002 (002).

1. The default umask 002 used for normal user. With this mask default directory permissions are 775 and default file permissions are 664.

2. The default umask for the root user is 022 result into default directory permissions are 755 and default file permissions are 644.

3. For directories, the base permissions are (rwxrwxrwx) 0777 and for files they are 0666 (rw-rw-rw).

In short,

1. A umask of 022 allows only you to write data, but anyone can read data.

2. A umask of 077 is good for a completely private system. No other user can read or write your data if umask is set to 077.

3. A umask of 002 is good when you share data with other users in the same group. Members of your group can create and modify data files; those outside your group can read data file, but cannot modify it. Set your umask to 007 to completely exclude users who are not group members.

A: You will see two files starting with id_rsa. id_rsa is the private key and id_rsa.pub is public key.

E: The .ssh/known_hosts file

In order to use public-key secure connection with other hosts (ssh, scp, sftp) there is a special directory, ~/.ssh/, where passphrases and public keys are stored. Normally you wouldn't need to know the gory details, but from time to time a host will change its public key and then you have difficulty using ssh or scp with that host, and have to edit a file named known_hosts.

If you try to ssh to another computer, but get an error message that warns about a changed or incorrect public key, then it is probably just a case of that host changing its public key. (It is possible, though usually not the case, that malicious hacking is involved.) Unless you actually suspect hacker involvement, you can edit the file ~/.ssh/known_hosts using your usual text editor (vi, emacs, nedit, or pico) and delete any line with the name of that host.

Then when you try to ssh that host again, it will be like the first time ever; ssh will ask you if you want to accept a new public key, you type the whole word yes, and everything will proceed normally from there.

Here is what a typical ~/.ssh/known_hosts file might contain. Note that newton is represented on two different lines:

newton 1024 35 153438062610297067329638677441205712613292203533062535600064224677647442245028855505387934431717435134842994423656065076260604296084868001730665553662299156116414854701274715680961503198280525759778667306417179500370189017139564144825610347509023078143132936185076849630461827976942220442313116255293297021841

ucsub 1024 37 132170811640421742212085598383135714069016332111955003414250071326834884018721183646445780180633494496866895830879394309011412231102757022090299732775466435482517698989962531081214859205054227533597152962802400251809883548442498002326460312850336779152617243800769119880843882425555806081435017335194477605333

simpson 1024 41 84089692059249458440345362273528263453600205470157624776507876697481412839375294315107162983484390901602702661279164375297211645960275026726690836525966507273615949171966757621717137045892868050436884725563247792566023489318554721885765548457461907512536847079297627580626353420887972219277539015703446529603

newton, 128.138.249.8 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA0d7Aoure0toNJ+YMYi61QP2ka8m5x5ZQlT7obP8CK3eropfqsMPPY6uiyIh9vpiFX2r1LHcbx139+vG6HOtVvuS8+IfMDtawm3WQvRuOopz3vVy5GtMwtaOgehsXoT930Ryev1bH5myPtWKlipITsOd2sX9k3tvjrmme4KCGGss=

B: The /etc/default/syslogd file contains the following default parameter settings. See FILES.

LOG_FROM_REMOTE

Specifies whether remote messages are logged. LOG_FROM_REMOTE=NO is equivalent to the -t command-line option. The default value for LOG_FROM_REMOTE is YES.

Which Solaris release you are running on your system can be determined using the following command:

cat /etc/release

This will tell you which release you are running and when it was released.

The more recent your system, the more info is contained in this file.

Example:

# cat /etc/release

Oracle Solaris 10 8/11 s10s_u10wos_17b SPARC

Copyright (c) 1983, 2011, Oracle and/or its affiliates. All rights reserved.

Assembled 23 August 2011

Check DNS

* (A) Check whether DNS is configured on your client by verifying that a non-empty /etc/resolv.conf file exists.

* (F) If /etc/resolv.conf does not exist or is empty, check that your DHCP server is providing DNS server information to the client:

# /sbin/dhcpinfo DNSserv

If this command returns nothing, the DHCP server is not set up to provide DNS server information to the client. Contact your DHCP administrator to correct this problem.

* (B) If an /etc/resolv.conf file exists and is properly configured, check for the following possible problems and contact your system administrator for resolution:

** The DNS server might not be resolving your IPS repository server name.

** No default route to reach the DNS server exists.

From the content of the /etc/shadow file we get:

* username: jack

* encrypted password: $5$9JFrt54$7JdwmO.F11Zt/ jFeeOhDmnw93LG7Gwd3Nd/cwCcNWFFg

* Last password change (lastchanged): Days since Jan 1, 1970 that password was last changed: 0

* Minimum: The minimum number of days required between password changes i.e. the number of days left before the user is allowed to change his/her password: 15

Maximum: The maximum number of days the password is valid (after that user is forced to change his/her password): 30 Warn : The number of days before password is to expire that user is warned that his/her password must be changed: 3

* Inactive : The number of days after password expires that account is disabled

* Expire : days since Jan 1, 1970 that account is disabled i.e. an absolute date specifying when the login may no longer be used

A (not H): You can use your existing storage pools as long as they are upgraded. You have the flexibility of encrypting specific file systems.

B (not E): Can I enable encryption on an existing pool?

Yes, the pool must be upgraded to pool version 30 to allow encrypted ZFS file systems and volumes.

C (not D): ZFS encryption is integrated with the ZFS command set. Like other ZFS operations, encryption operations such as key changes and rekey are performed online.

F (not G): Encryption is the process in which data is encoded for privacy and a key is needed by the data owner to access the encoded data. You can set an encryption policy when a ZFS dataset is created, but the policy cannot be changed.

Single quotes are most strict. They prevent even variable expansion. Double quotes prevent wildcard expansion but allow variable expansion. For example:

#!/bin/sh

echo $SHELL

echo "$SHELL"

echo '$SHELL'

This will print:

/usr/bin/bash

/usr/bin/bash

$SHELL

The coreadm command is used to specify the name and location of core files produced by abnormally-terminating processes.

installadm add-manifest

Associates manifests with a specific install service, thus making the manifests available on the network, independently from creating a service. When publishing a non-default manifest, it is required to associate criteria either via criteria entered on the command line (-c) or via a criteria XML file (-C).

Add a memory cap.

zonecfg:my-zone> add capped-memory

Set the memory cap.

zonecfg:my-zone:capped-memory> set physical=50m

End the memory cap specification.

zonecfg:my-zone:capped-memory> end

The prtconf command prints the system configuration information. The output includes the total amount of memory, and the configuration of system peripherals formatted as a device tree.

If a device path is specified on the command line for those command options that can take a device path, prtconf will only display information for that device node.

C: The Group ID (GID) field contains the group's numerical ID. GIDs can be assigned whole numbers between 100 and 60000.

D: Group names contain only lowercase characters and numbers.

SVC.CONFIGD is the repository daemon responsible for maintaining /etc/svc/repository.db. The repository.db must come clean during this integrity check otherwise it is a "no go" for usual boot sequence to run level 3. The repository may get corrupted due to various hardware issues, software bugs, disk write failures, etc.

Note: When svc.configd(1M), the Solaris Repository Daemon, is started, it does an integrity check of the smf(5) repository, stored in /etc/svc/repository.db. This integrity check can fail due to a disk failure, the database file being corrupted either due to a hardware bug, a software bug, or an accidental overwrite. If the integrity check fails, svc.configd will write a message to the console.

B: Configure the AI install server to use a static IP address and default route. 

D: The create-service command can set up DHCP on the AI install server. If you want to set up a separate DHCP server or configure an existing DHCP server for use with AI. The DHCP server must be able to provide DNS information to the systems to be installed.

E: An automated installation of a client over the network consists of the following high-level steps:

1. The client system boots over the network and gets its network configuration and the location of the install server from the DHCP server.

2. The install server provides a boot image to the client.

3. Characteristics of the client determine which installation instructions and which system configuration instructions are used to install the client.

4. The Oracle Solaris 11 OS is installed on the client, pulling packages from the package repository specified by the installation instructions in the AI install service.

G: Install the AI tool set.

Use the installadm create-service command to create an AI install service. Give the service a meaningful name, and specify the path where you want the service created. Specify the source of the network boot image (net image) package or ISO file.

installadm create-service [-n svcname]

[-s FMRI_or_ISO] [-d imagepath]

-d imagepath

The imagepath is the location of the new install service. The install-image/solaris-auto-install package is installed to this location, or the specified ISO file is expanded at this location.

The /var/adm/messages is the file to which all the messages printed on the console are logged to by the Operating System. This helps to track back check the console messages to troubleshoot any issues on the system.

Syslog daemon also writes to this /var/adm/messages file.

The /var/adm/messages file monitored and managed by newsyslog and its configuration file is /usr/lib/newsyslog.

This script runs as the roots cron job everyday, checks the /var/adm/messages file and copies/moves it to /var/adm/messages.0, 1, 2, 3, 4, 5, 6, 7. In other words, it does the Log Rotation for the /var/adm/messages.

In an event the /var file system is running out of space, these files needs to checked and can be removed (not the actual /var/adm/messages itself) to free up space on the file system.

However, care has to be taken, if you decide to empty the /var/adm/messages itself for any reason. This process is called Truncation.

SOLARIS SYSTEM ADMIN TIPS, /var/adm/messages

On POSIX-compliant platforms, SIGTERM is the signal sent to a process to request its termination. The symbolic constant for SIGTERM is defined in the header file signal.h. Symbolic signal names are used because signal numbers can vary across platforms, however on the vast majority of systems, SIGTERM is signal #15.

SIGTERM is the default signal sent to a process by the kill or killall commands. It causes the termination of a process, but unlike the SIGKILL signal, it can be caught and interpreted (or ignored) by the process. Therefore, SIGTERM is akin to asking a process to terminate nicely, allowing cleanup and closure of files. For this reason, on many Unix systems during shutdown, init issues SIGTERM to all processes that are not essential to powering off, waits a few seconds, and then issues SIGKILL to forcibly terminate any such processes that remain.

Note: dladm rename-link [-R root-dir] link new-link

Rename link to new-link. This is used to give a link a meaningful name, or to associate existing link configuration such as link properties of a removed device with a new device.

dlstat show-aggr [-r | -t] [-i interval] [-p] [ -o field[, ...]] [-u R|K|M|G|T|P] [link]

Display per-port statistics for an aggregation.

The Internet Protocol (IP) is the principal communications protocol in the Internet protocol suite for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet.

Set the EDITOR variable to vi.

Commands like `crontab -e` will use ed per default. If you'd like to use some better editor (like vi) you can use the environment variable EDITOR:

# EDITOR=vi; crontab –e will open the users crontab in vi. Of course you can set this variable permanently.

Incorrect answers

C: -e Edits a copy of the current user's crontab file, or creates an empty file to edit if crontab does not exist. When editing is complete, the file is installed as the user's crontab file. If a username is given, the specified user's crontab file is edited, rather than the current user's crontab file; this can only be done by a user with the solaris.jobs.admin authorization. The environment variable EDITOR determines which editor is invoked with the -e option. The default editor is ed(1). All crontab jobs should be submitted using crontab. Do not add jobs by just editing the crontab file, because cron is not aware of changes made this way.

'ipadm show-addr' displays all the configured addresses on the system.

Example:

# ipadm show-addr

ADDROBJ TYPE STATE ADDR

lo0/v4 static ok 127.0.0.1/8

lo0/v6 static ok ::1/128

A: Configure the Repository Server Service

To enable clients to access the local repository via HTTP, enable the application/pkg/server

Service Management Facility (SMF) service.

# svccfg -s application/pkg/server setprop pkg/inst_root=/export/repoSolaris11

# svccfg -s application/pkg/server setprop pkg/readonly=true

E: Use pkg.depotd to serve the repository to clients.

Start the Repository Service

Restart the pkg.depotd repository service.

# svcadm refresh application/pkg/server

# svcadm enable application/pkg/server

To check whether the repository server is working, open a browser window on the localhost location.