Fixes Ciphers on Apache httpd server

I thought I would just make a note of the steps to check what cipher I was running on our web server and to see how to remove any old/weak ones.

Ref:

• How to identify and remove CBC ciphers in the CipherSuite?
• Mozilla SSL Configuration Generator
• ssl-enum-ciphers NSE Script
• SSL Server Test

Solaris 11.4: FileZilla 3.31 builds on Solaris cleanly (nearly)

After seeing a post on twitter about building FileZilla on Solaris 11.3 I thought I would I would try it on Solaris 11.4.

I did get it working but with some "Dirty Fixes", by adding cast of "size_t" to a lot of code, but then I realised that there was a quicker fix..

Solaris 11.4: LDAP changes for ldapsearch & ldapmodify

With the release of Oracle Solaris 11.4 Beta and the move over to OpenLDAP, you will notice ldap commands have changed. To help myself and may be some others I will document the changes for reference.

Ref: Using ldapsearch to do an LDAP Search using TLS/SSL
       Updated: How to Connect Securely to LDAP using PHP
       How To Manage and Use LDAP Servers with OpenLDAP Utilities

Solaris 11.4: Tips about Upgrading from Solaris 11.3

With the release of Oracle Solaris 11.4 Beta I am sure many have upgraded but when I tried to upgrade my Sun Ultra 24 desktop I had a few problems. This is more down to me modifying the Solaris over the years and not with Solaris 11.4.

Just checked and I installed Solaris 11 back in 20th October 2011 11:19pm.

Solaris 11.4: Setting up Sendmail / SASL to handle SMTP AUTH

With the release of Solaris 11.4 Beta we finally get SASL implementation based on the open source Cyrus SASL version 2.1.26 with a few changes. Which means that Solaris can now handle SMTP AUTH out of the box.

I have been here before with previous blog entries:
- Can Solaris 11 Sendmail / SASL handle SMTP AUTH
- Solaris 11: Setting up Sendmail / SASL to handle SMTP AUTH

Ref: Using Simple Authentication and Security Layer

Setting up Oracle Solaris iSCSI Targets for Multipathed

After wasting 2 weeks on getting this to work I thought I would post a step-by-step guide.

I have been using iscsi targets on Oracle Solaris for years, but only with the installation of a new storage system with two VLANS (multipathed) for failover I needed Solaris to recognise the different VLANs in case of a interface failure.

This wasn't easy, since the Oracle Solaris documentation  is very unclear about it. It has all the information there but finding it and understanding it is near impossible.

The following steps show you the procedure to connect and a single iscsi target accessible via two interfaces for failover.

Oracle Solaris 11.3 PHP and LDAPS now work together

Well 2 years ago I complained about LDAPS did not work with PHP in Solaris 11.2 well with Oracle Solaris 11.3 and a recent SRU they are now working in partnership.

Gotchas when migrating from Samba to Oracle Solaris 11 SMB Server

I am in the middle of migrating "Oracle Solaris 11 non-global zone running Samba" to an "Oracle Solaris 11 kernel zone running SMB server".
This blog isn't going to explain why you want to move and/or advantages/disadvantages, but I may get to do that at a later date. It is he to warn you about some things which you may not be aware of.

How to copy a file from Solaris Global Zone to a Kernel Zone without a network

I posted this Tweet on twitter a while ago

Damn wish there was a way to copy a file from #Solaris global zone to a kernel zone with out going over network.

and Darren Moffat pointed out a /system/shared which is read only from the zone but is writeable from the global zone. Here is a quick example:

Hoy to copy a file from Solaris Global Zone to a Kernel Zone without a network

I posted this Tweet on twitter a while ago

Damn wish there was a way to copy a file from #Solaris global zone to a kernel zone with out going over network.

and Darren Moffat pointed out a /system/shared which is read only from the zone but is writeable from the global zone.

solaris-kz# ls /system/shared/
solaris-kz# touch /system/shared/ReadOnly
touch: cannot create /system/shared/ReadOnly: Read-only file system
solaris-kz# df /system/shared/
/system/shared     (/dev/kz/sdir/shared@0):296322344 blocks 28136253 files

global-zone# zoneadm list -vc
  ID NAME        STATUS   PATH  BRAND      IP   
   0 global      running  /     solaris    shared
   1 solaris-kz  running  -     solaris-kz excl 

global-zone# ls /system/volatile/zones/solaris-kz/zonepath/root/shared/
global-zone# touch /system/volatile/zones/mysqlsrv/zonepath/root/shared/myfile   

solaris-kz# ls /system/shared/
myfile

Compile GEOS geometry library on Solaris 11 using Oracle Developer Studio 12.5

This is a follow on from my posts about installing PostGIS in those posts I used GNU compilers, but I have managed to get parts to compile with Developer Studio 12.5.

If you are looking for the GNU version then it is here: Compile PostgreGIS (GEOS geometry library) on Solaris 11 (11.3) using gcc

Compile Proj4 reprojection library on Solaris 11 using Oracle Developer Studio 12.5

This is a follow on from my posts about installing PostGIS in those posts I used GNU compilers, but I have managed to get parts to compile with Developer Studio 12.5.

If you are looking for the GNU version then it is here: Compile PostgreGIS (Proj4 reprojection library) on Solaris 11 (11.3) using gcc

Install PostGIS on Solaris 11 (11.3)

I said I would install PostGIS for a student project but I wish I never said yes, since it has taken over a week to compile it.

As you may guess there are not many working instruction out in the wild!

I will break down this step-by-step guide into different blogs entries otherwise it will get very long.

• Compile PostgreSQL on Solaris 11 (11.3)
• Proj4 reprojection library (GNU compilers)  or (Developer Studio 12.5) 
• GEOS geometry library (GNU compilers) or (Developer Studio 12.5)
• GDAL

I had to compile all software using GCC since Solaris Studio gave to many problems:

Compile PostgreGIS (GDAL) on Solaris 11 (11.3)

Before you install PostGIS you will need to install some of the requirements.

GDAL. is a translator library for raster and vector geospatial data format.

Compile PostgreGIS (GEOS geometry library) on Solaris 11 (11.3)

Before you install PostGIS you will need to install some of the requirements.

GEOS geometry library, version 3.3 or greater, but GEOS 3.5+ is recommended to take full advantage of all the new functions and features.

Compile PostgreGIS (Proj4 reprojection library) on Solaris 11 (11.3)

Before you install PostGIS you will need to install some of the requirements.

Proj4 reprojection library is used to provide coordinate reprojection support within PostGIS.

Compile PostgreSQL on Solaris 11 (11.3)

I know PostgreSQL is available as a binary from http://www.postgresql.org and to be honest I have always used it but just in case you need to go down the PostGIS route then you may need to recompile it.

References: PostgreSQL 9.5.3 Documentation

# pkg install developer/gcc-45 build/gnu-make
# export PATH=/usr/gcc/4.5/bin:/usr/bin:/usr/sbin:/usr/sfw/bin:/usr/lib:/usr/gnu/bin:
# bzip2 -dc postgresql-9.5.3.tar.bz2 | tar xf -
# cd postgresql-9.5.3

Install PostgreSQL on Solaris 11 (11.3)

Here are some quick instruction on how to install PostgreSQL on Solaris 11.3.

• PostgreSQL 9.5: http://www.postgresql.org/

Add a user

At this time  postgres user exists on Solaris, so I am going to use that, but just in case then:

# groupadd -g 90 postgres
# useradd -u 90 -S files -s /usr/bin/pfksh -d / -g postgres postgres

# grep postgres /etc/passwd  /etc/group
/etc/passwd:postgres:x:90:90:PostgreSQL Reserved UID:/:/usr/bin/pfksh
/etc/group:postgres::90:

Setup

Convert Oracle Solaris 11.3 Native (Non-Global) Zone to a Kernel Zone

I think more and more people will start using Kernel Zone and I have a feeling that will soon be the only zone that Solaris will offer soon. So, I thought I would show how to convert a none-global zone into a kernel zone.

References:

• How to Get Started Creating Oracle Solaris Kernel Zones in Oracle Solaris 11 by Duncan Hardie
• Creating and Using Oracle Solaris Kernel Zones
• Creating and Using Oracle Solaris Zones

Oracle Solaris 11.3: SMB 2.1 will it make a difference

As you will be aware Oracle Solaris 11.3 supports SMB 2.1 which brings improvements over SMB/Samba 3.6 version on Solaris 11.2:

• Reduces the previous number of SMB 1.0 commands and sub commands from over a hundred to just 19 commands.
  
• Supports a new caching model called Lease. This model enables the client to have multiple opens on a single file which helps in holding on to the cache.
  
• Provides more scalable performance for high-speed networks and includes the following performance benefits:
  
  • SMB payload requests can scale up to 1MB instead of 64K.
    
  • Reduces CPU utilization on the server and client.
    
  • SMB clients gain the performance benefit of not losing local caching when the same file is opened multiple times.
    

Comparing SMB versions(dialect):
SMB 3.02: Windows 2012 R2
SMB 3.00: Windows 2012    , Samba 4.1
SMB 2.10: Windows 2008 R2 , Solaris 11.3
SMB 2.00: Windows 2008    , Samba 3.6 (dialect=1.5)
SMB 1.00:                 , Solaris 11.2 (dialect=1.5)

I decided to run some test on Windows 7 clients using IOzone Filesystem Benchmark to measure file performance (What you're really testing is your system's buffer cache + disk cache + disk speed combo) using a collection of different servers.