UKOUG Solaris SIG (LOSUG) 2010 Presentations

The Solaris Special Interest Group (SIG) has been active since 2005 in a different guise, as London OpenSolaris User Group (LOSUG). The group was formed with the help of Sun Microsystems to enhance the popularity of their next release of their operating system OpenSolaris.

New locations:

• UKOUG Solaris SIG main site
• LinkedIn
• Twitter (@SolarisSIG)
• YouTube

Since the opensolaris.org website is about to go offline I am in the process of keeping a copy of the old slides and photos, so they want be lost....

2010 Presentations

UKOUG Solaris SIG (LOSUG) 2009 Presentations

The Solaris Special Interest Group (SIG) has been active since 2005 in a different guise, as London OpenSolaris User Group (LOSUG). The group was formed with the help of Sun Microsystems to enhance the popularity of their next release of their operating system OpenSolaris.

New locations:

• UKOUG Solaris SIG main site
• LinkedIn
• Twitter (@SolarisSIG)
• YouTube

Since the opensolaris.org website is about to go offline I am in the process of keeping a copy of the old slides and photos, so they want be lost....

2009 Presentations

UKOUG Solaris SIG (LOSUG) 2008 Presentations

The Solaris Special Interest Group (SIG) has been active since 2005 in a different guise, as London OpenSolaris User Group (LOSUG). The group was formed with the help of Sun Microsystems to enhance the popularity of their next release of their operating system OpenSolaris.

New locations:

• UKOUG Solaris SIG main site
• LinkedIn
• Twitter (@SolarisSIG)
• YouTube

Since the opensolaris.org website is about to go offline I am in the process of keeping a copy of the old slides and photos, so they want be lost....

2008 Presentations 

UKOUG Solaris SIG (LOSUG) 2007 Presentations

The Solaris Special Interest Group (SIG) has been active since 2005 in a different guise, as London OpenSolaris User Group (LOSUG). The group was formed with the help of Sun Microsystems to enhance the popularity of their next release of their operating system OpenSolaris.

New locations:

• UKOUG Solaris SIG main site
• LinkedIn
• Twitter (@SolarisSIG)
• YouTube

Since the opensolaris.org website is about to go offline I am in the process of keeping a copy of the old slides and photos, so they want be lost....

2007 Presentations

February 2007 - Service Management Framework by Jarod Nash
Presentation Slides

April 2007 - NFS Update by Calum Mackay
Presentation Slides

June 2007 - Solaris Troubleshooting by Peter Harvey
Presentation Slides

July 2007 - Creating an OpenSolaris Build Server by James MacFarlane
Presentation Slides

October 2007 - Logical Domains (LDoms) by Liam Merwick
Presentation Slides

UKOUG Solaris SIG (LOSUG) 2005 Presentations

The Solaris Special Interest Group (SIG) has been active since 2005 in a different guise, as London OpenSolaris User Group (LOSUG). The group was formed with the help of Sun Microsystems to enhance the popularity of their next release of their operating system OpenSolaris.

New locations: 

• UKOUG Solaris SIG main site
• LinkedIn
• Twitter (@SolarisSIG)  
• YouTube

Since the opensolaris.org website is about to has go offline I am in the process of keeping a copy of the old slides and photos, so they want be lost....

2005 Presentations

UKOUG Solaris SIG November & December Slides

Here are the last 2 talks of 2012. It has been a good year and for the Solaris SIG and 2 goods talks to end it. Roll on 2013:

December 2012 - Peter Tribble : How Zones served Queen Victoria

ProQuest's Peter Tribble took us through how ProQuest builds and uses Solaris Zones to develop and deploy services to its customers with particular reference to a very Royal project, which involved the on-line publishing of Queen Victoria's Journals at http://www.queenvictoriasjournals.org.

 Slides:  Peter Tribble : How Zones served Queen Victoria

November 2012 - Chris Beal : Solaris 11 Serviceability Best Practices

Oracle's Chris Beal took us through best way to install, configure, and update your systems to identify when there has been a problem, and tools required to gather data to help solve it. Technologies to be discussed include: Automatic service request generation, Service Management Facility, Configuration, Oracle Support tools, Oracle Solaris configuration options, Managing package versions to minimize downtime, Version-lock facets, Shared/secure shell access

 Slides: Chris Beal : Solaris 11 Serviceability Best Practices

As always come an join us next time:

• UKOUG Solaris SIG main site
• LinkedIn
• Twitter (@SolarisSIG)  
• YouTube 

Solaris 11 Automount (auto.home) with Active Directory

Now that you have Authentication Login via your Active Directory server (See my previous entry) you now need to sort out your automount maps (auto.home/auto_home, auto.direct/auto_direct, etc). This was surprising very straight forward.

Updated: Testing Section (23rd November 2012) 

Reference:

nismap: http://technet.microsoft.com/en-us/library/cc772191.aspx
nis2ad:  http://technet.microsoft.com/en-us/library/cc754412.aspx
Solaris integration with Active Director: http://technicalprose.blogspot.co.uk/2011/12/solaris-integration-with-active_16.html

Notes:
On the windows side we referee to auto.home, but on the Solaris side we will be referring to auto_home

Settings being used:

Windows 2008 R2 AD servers = dcsad01 (193.61.1.1) and dcsad02 (193.61.2.2)
Domain = dcs.bbk.ac.uk
Kerberos Realm = DCS.BBK.AC.UK

UKOUG Solaris SIG 2012 Slides & Video so far

The Solaris Special Interest Group (SIG) has been active since 2005 in a different guise, as London OpenSolaris User Group (LOSUG). The group was formed with the help of Sun Microsystems to enhance the popularity of their next release of their operating system OpenSolaris. The world has changed a lot since then, but the UKOUG Solaris SIG has kept up with the changes in Oracle Solaris 11 and open source Solaris-based derivatives and still remains an independently run group.

Our events run frequently, in the evening on the third Wednesday of each month.  We have presentations given by professionals who are experts in their field, including Oracle Solaris developers and professionals as well as industry Solaris experts. Our members come from varied backgrounds including IT architects and engineers, analysts, system administrators, developers and many more. The events take place in the London Oracle City offices and are very popular, not just for the vast range of presentations, but also for the fact that participants and attendees can mingle and network with Solaris specialists, in a relaxed atmosphere over food and refreshments. 

The presentations are promoted via the UKOUG website and our social media channels where infromation about about our next talks can be found:

• UKOUG Solaris SIG main site
• LinkedIn
• Twitter (@SolarisSIG)  
• YouTube 

These are the talks we have had so far this year:

December 2012 - Peter Tribble : How Zones served Queen Victoria

ProQuest's Peter Tribble took us through how ProQuest builds and uses Solaris Zones to develop and deploy services to its customers with particular reference to a very Royal project, which involved the on-line publishing of Queen Victoria's Journals at http://www.queenvictoriasjournals.org.

 Slides:  Peter Tribble : How Zones served Queen Victoria

Solaris 11 Authentication Login with Active Directory

Password Authentication in Computer Science at Birkbeck was always very complicated for no reason. Over the years we had multiple passwords which always confused our students:  YP & Active Directory, then NIS & AD, then LDAP with password Sync with AD, but with Solaris 11 & Solaris 10 I was finally in a position to get this sorted out.

There is a lot of pages out there which help with this, but the best I found was http://www.seedsofgenius.net/solaris/solaris-authentication-login-with-active-directory (This link does not seem to work now, so here is a cached version: https://web.archive.org/web/20151101112540/www.seedsofgenius.net/solaris/solaris-authentication-login-with-active-directory) so please go ahead and follow this for more details. I have a cut down version here for Solaris 11.

I will presume you have setup your Windows server (see link above Install UNIX Schema into Active Directory and Create ProxyDN User Account).

Updated: Testing Section (30th October 2012)
Updated: Setup DNS Section (7th July 2014)
Updated: Kerberos testing "kinit -V" (29th January 2016) 
Updated: Setup LDAP client "followReferrals=false" (29th January 2016)
Updated: Setup PAM (29th January 2016)
Updated: Tested on Solaris 11.3 (29th January 2016) 

Settings being used:

Windows 2008 R2 AD servers = dcsad01 (193.61.1.1) and dcsad02 (193.61.2.2)
Domain = dcs.bbk.ac.uk
Kerberos Realm = DCS.BBK.AC.UK

Combine Solaris Automated Install and Repository on one image. Success

Following on my last entry about Solaris 11 Automated Install with no network (Standalone) I thought I would post this update saying that I have managed to get it working, well I have managed to create a new 6.7GB ISO which can boot a VirtualBox client and installs Solaris 11 with NO network I am not sure why it was failing last time, but since then I have reinstalled Solaris 11 and added another disk to my desktop.

Copy Oracle Solaris 11 11/11 Automated Installer from ISO to disk:

# mount -F hsfs sol-11-1111-ai-x86.iso /mnt
# cd /mnt
# mkdir /var/tmp/AIboot
# find . -depth -print | cpio -pdm /var/tmp/AIboot
# cd /
# umount /mnt

Copy Oracle Solaris 11 11/11 Repository Image from ISO to disk:

# mount -F hsfs sol-11-1111-repo-full.iso /mnt
# cd /mnt
# rsync -aP /mnt/repo/ /var/tmp/AIboot/repoSolaris11
# cd /
# umount /mnt

Check it and edit default manifest so that is uses local repository:

# du -hs /var/tmp/AIboot
7.0G /var/tmp/AIboot

# ls /var/tmp/AIboot

auto_install      devices           mnt               repoSolaris11     solaris.zlib
bin               export            platform          root              solarismisc.zlib
boot              home              proc              save              system
dev               jack              reconfigure       sbin              tmp

Edit /var/tmp/AIboot/auto_install/default.xml

             <publisher name="solaris">
                     <origin name="http://pkg.oracle.com/solaris/release"/>
             </publisher>

Change to:

             <publisher name="solaris">
                     <origin name="file:///.cdrom/repoSolaris11"/>
             </publisher>

Create a new ISO:

# mkisofs -o /var/tmp/output.iso -b boot/grub/stage2_eltorito \
-c .catalog -no-emul-boot -boot-load-size 4 \
-boot-info-table -N -R -U -allow-multidot -no-iso-translate \
-cache-inodes -iso-level 4 -d -D -V Solaris11 /var/tmp/AIboot

Warning: Creating ISO-9660:1999 (version 2) filesystem.
Warning: ISO-9660 filenames longer than 31 may cause buffer overflows in the OS.
Size of boot image is 4 sectors -> No emulation
Size of boot image is 4 sectors -> No emulation
0.99% done, estimate finish Fri Mar 9 13:23:05 2012
1.13% done, estimate finish Fri Mar 9 13:22:53 2012
...
99.83% done, estimate finish Fri Mar 9 13:37:07 2012
99.97% done, estimate finish Fri Mar 9 13:37:06 2012
Total translation table size: 2048
Total rockridge attributes bytes: 36023282
Total directory bytes: 68673536
Path table size(bytes): 136082
Max brk space used 10144000
3530910 extents written (6896 MB)

The above iso then was used to install Solaris 11 on VirtaulBox.

Solaris 11 Automated Install with no network (Standalone)

After my last blog entry about Solaris 11 Automated Install without a network boot I was thinking that we have all the building blocks to do a true standaone install of Solaris 11 without any network connection at all.

Oracle gives us the iso's for "Oracle Solaris 11 11/11 Automated Installer" and the full "Oracle Solaris 11 11/11 Repository Image" from the Solaris download page, so why do we need a network!

The problem is that the repository is 7GB so testing it is a little difficult and trying to put the above two ISO's onto one 8GB USB is even harder. At this stage I have been unable to put the 7GB repository ISO onto a USB stick. Also, unable to combine the 2 ISO into 1 ISO which works (I end up with repository errors on install)!

But, in theory it will work and to demonstrate the idea I will use VirtualBox and a network for the manifest file (ONLY for manifest file!).  You can use my previous blog to replace the AI boot image with a modified one.

1. Download the above iso for x86:
• sol-11-1111-ai-x86.iso
• sol-11-1111-repo-full.iso


2. Create a new VirtualBox Solaris client
• it needs to be on the network (download manifest file)
• Storage we will add both ISO files as CD





3. Create a manifest file for the installation and place it on a web server:
• There is only one change required from the default manifest (download version default.xml):


             <publisher name="solaris">
                     <origin name="http://pkg.oracle.com/solaris/release"/>
             </publisher>



Change to:


             <publisher name="solaris">
                     <origin name="file:///media/SOL11REPO_FULL/repo"/>
             </publisher>



4. Now boot you client:
• Pick default option Oracle Solaris 11 11/11 Automated Install custom:





• Enter the URL for the modified manifest file:

At this point it should go off and install the software.

The perfect solution which I am happy for someone to try is to place the both AI boot and repository onto one ISO and then use no network, but I have failed so far!

Solaris 11 Automated Install without a network boot

After my last blog about Solaris 11 Automated Installer quick setup guide in a zone I did some more reading and I realised that you don't require to boot the client with DHCP, but boot it from a local device (CD or USB).

If you check out the download page for solaris down you will see Automated Installer can be downloaded as an ISO or USB version. If you download this and put it on to a CD or USB you can boot your client with it. When you boot it you see

Oracle Solaris 11 11/11 Automated Install custom
Oracle Solaris 11 11/11 Automated Install
Oracle Solaris 11 11/11 Automated Install custom ttya
Oracle Solaris 11 11/11 Automated Install custom ttyb
Oracle Solaris 11 11/11 Automated Install ttya
Oracle Solaris 11 11/11 Automated Install ttyb

• Picking Oracle Solaris 11 11/11 Automated Install custom means you will be prompted for a URL where your manifest is located on the network
• Picking Oracle Solaris 11 11/11 Automated Install will install Solaris using a default manifest

Modifying the default settings:
If you have placed the AI image onto a USB then you can edit it and change the default manifest.

• Mount the USB image (USB)

# ls /media/DataTraveler 2.0
.                        .volsetid                  jack                      sbin
..                       auto_install             lost+found               solaris.zlib
.catalog                 bin                      mnt                      solarismisc.zlib
.cdrom                   boot                     platform                 system
.image_info              dev                      proc                     tmp
.liveusb                 devices                  reconfigure
.SELF-ASSEMBLY-REQUIRED  export                   root
.transfer-manifest.xml   home                     save

Edit the default.xml file:

# vi /media/DataTraveler 2.0/auto_install/manifest/default.xml

You would think you could edit the default profile as well, but you can't since it uses the default one located at /usr/share/auto_install/sc_profiles/enable_sci.xml which is not accessible, since /usr is a lofi mount. I think this should be classed as a bug, since you would expect it to use /auto_install/sc_profiles.

I have just filed a BUG report with Oracle for this

This is the way it should be done, if this BUG did not exist!!!

Edit default system configuration file:

# cd /media/DataTraveler 2.0/auto_install/sc_profiles/

# vi enable_sci.xml

Or use the sample one:

# cd /media/DataTraveler 2.0/auto_install/sc_profiles/

# cp sc_sample.xml enable_sci.xml

This is the way you have to do it now. Long way!!! We have to replace the solaris.zlib on the image

As before we mount the USB image

# cd /media/DataTraveler 2.0

Mount the image

# lofiadm -a solaris.zlib

# mount -F hsfs /dev/lofi/1 /mnt

Now copy the whole image

# mkdir /export/newsolaris

# cd /mnt

# find . -depth -print | cpio -pdm /export/newsolaris

# cd /export/newsolaris

Now we finally get to making are changes

# cd ./share/auto_install/sc_profiles/

# ls -l

total 27
-r--r--r--   1 root     sys         3104 Feb 23 17:39 enable_sci.xml
-r--r--r--   1 root     sys         3104 Oct 21 00:04 sc_sample.xml
-r--r--r--   1 root     sys         4656 Oct 21 00:04 static_network.xml

# cp -ip sc_sample.xml enable_sci.xml

#

Now re-create the solaris.zlib image

# mkisofs -o /tmp/solaris.zlib -quiet -N -l -R -U -allow-multidot -no-iso-translate -cache-inodes -d -D -V "compress" /export/newsolaris

Warning: creating filesystem that does not conform to ISO-9660.

It needs to be compressed

# lofiadm -C lzma /tmp/solaris.zlib

Copy it back to the USB image

# cp /tmp/solaris.zlib /media/DataTraveler 2.0

If you want to create an ISO so that you can test it on VirtualBox. Try:

# /usr/bin/mkisofs -d -D -J -l -r -U -relaxed-filenames -b boot/grub/stage2_eltorito -no-emul-boot -boot-load-size 4 -boot-info-table -c .catalog -V "my_volume_name" -o /var/tmp/output.iso "/media/DataTraveler 2.0"
Warning: creating filesystem that does not conform to ISO-9660.
Setting input-charset to 'UTF-8' from locale.
Size of boot image is 4 sectors -> No emulation
Size of boot image is 4 sectors -> No emulation
3.59% done, estimate finish Mon Feb 27 13:03:22 2012
7.17% done, estimate finish Mon Feb 27 13:03:22 2012
.....
96.77% done, estimate finish Mon Feb 27 13:03:33 2012
Total translation table size: 2048
Total rockridge attributes bytes: 45685
Total directory bytes: 290816
Path table size(bytes): 1864
Max brk space used 7e000
139507 extents written (272 MB)

Save it and try it out!
You still require a network since the install still uses a network IPS repository

I have tested it with VirtualBox booting of an iso file I created from the USB image.

Solaris 11 Automated Installer quick setup guide in a zone

Setting up an Automated Install server with Solaris 11 is now very easy. See my recent Solaris SIG talk about it but here is a quick guide.

• Setup zone:

# zonecfg -z aiserver 'create; set zonepath=/zones/aiserver'

• Create system profile to speed install process up:
• This allows you to setup hostname, server IP address, initial user, etc

# sysconfig create-profile -o sysconfig.xml

• Install Zone with default manifest and using the system configuration create above:

# zoneadm -z aiserver install -c /var/tmp/sysconfig.xml
A ZFS file system has been created for this zone.
Progress being logged to /var/log/zones/zoneadm.20120221T133021Z.aiserver.install
       Image: Preparing at /zones/aiserver/root.

Install Log: /system/volatile/install.17908/install_log
AI Manifest: /tmp/manifest.xml.yhaq9I
SC Profile: /var/tmp/sysconfig.xml
    Zonename: aiserver
Installation: Starting ...

              Creating IPS image
              Installing packages from:
                  solaris
                      origin:  http://pkg.oracle.com/solaris/support/
DOWNLOAD                                  PKGS       FILES    XFER (MB)
Completed                              167/167 32064/32064  175.8/175.8

PHASE                                        ACTIONS
Install Phase                            44313/44313

PHASE                                          ITEMS
Package State Update Phase                   167/167
Image State Update Phase                         2/2
Installation: Succeeded

        Note: Man pages can be obtained by installing pkg:/system/manual done.
        Done: Installation completed in 127.429 seconds
  Next Steps: Boot the zone, then log into the zone console (zlogin -C) to complete the configuration process.

Log saved in non-global zone as /zones/aiserver/root/var/log/zones/zoneadm.20120221T133021Z.aiserver.install

# zoneadm -z aiserver boot
# zlogin -C -e\@ aiserver

• Install auto-installer software in the zone

# svcadm enable /network/dns/multicast
# pkg list install/installadm
pkg list: no packages matching 'install/installadm' installed
# pkg install install/installadm
# pkg list install/installadm
NAME (PUBLISHER)                          &nbsVERSION                    IFO
install/installadm                         0.5.11-0.175.0.0.0.2.1482  i--

• Create the boot service.
• No need to specify an ISO since the software will download an image.

# installadm create-service -n solarisx86
Creating service from: pkg:/install-image/solaris-auto-install
OK to use default image path: /export/auto_install/solarisx86? [y/N]: y
Download: install-image/solaris-auto-install ...  Done
Install Phase ...  Done
Package State Update Phase ...  Done
Image State Update Phase ...  Done
Reading Existing Index ...  Done
Indexing Packages ...  Done

Creating service: solarisx86

Image path: /export/auto_install/solarisx86

Refreshing install services

Creating default-i386 alias.

No local DHCP configuration found. This service is the default
alias for all PXE clients. If not already in place, the following should
be added to the DHCP configuration:
        Boot server IP       : 193.xx.xx.xx
        Boot file            : default-i386/boot/grub/pxegrub

Refreshing install services

# ls -l /etc/netboot
total 6
drwxr-xr-x 19 root root 28 Feb 21 15:42 default-i386
drwxr-xr-x 19 root root 28 Feb 21 15:42 solarisx86

• You are ready to boot PXE client towards this server

Solaris 11: Setting up Sendmail / SASL to handle SMTP AUTH

I thought I would finally get SMTP AUTH working on my Solaris 11 servers, so that I could then setup my phone to send e-mail correctly. If you have seen my previous post you will see that Solaris 11 can't do it with the standard software.

Build Cyrus SASL

• Install the packages which we requite and download Cyrus SASL Library

# sudo pkg install pkg:/developer/build/make system/header developer/gcc-3 text/gnu-grep database/berkeleydb-5

# echo $PATH
/usr/sbin:/usr/bin
# export PATH=$PATH:/usr/gnu/bin:/usr/sfw/bin

• At this time it will not compile, so alter the following lines.

# gzip -dc cyrus-sasl-2.1.25 | tar xf -
# cd cyrus-sasl-2.1.25

# vi ./lib/saslutil.c ./plugins/kerberos4.c ./plugins/digestmd5.c utils/Makefile.am

./lib/saslutil.c
85c85
extern int gethostname(char *, int);
change to:
extern int gethostname(char *, unsigned int);

./plugins/kerberos4.c
113c113
extern int gethostname(char *, int);
change to:
extern int gethostname(char *, unsigned int);

./plugins/digestmd5.c
106c106
extern int gethostname(char *, int);
change to:
extern int gethostname(char *, unsigned int);

./utils/Makefile.am
59a60,62
add the following lines:
saslpasswd2_LDFLAGS = -rpath $(libdir)
dbconverter_2_LDFLAGS = -rpath $(libdir)
pluginviewer_LDFLAGS = -rpath $(libdir)

• Now we are ready for building.

# ./configure --enable-cram --enable-digest --enable-plain \
          --enable-login --disable-krb4 --disable-anon \
          --disable-gssapi --with-saslauthd=/var/run/saslauthd
# make
# sudo make install

•  Add the following links:

# sudo ln -s /usr/local/lib/sasl2 /usr/lib/sasl2
# sudo ln -s /usr/local/lib/libsasl2.so.2.0.25 /usr/lib/libsasl2.so.2

Build Sendmail

• Download sendmail  8.14.5

• Stop existing sendmail processes.

# sudo svcadm disable svc:/network/smtp:sendmail
# sudo svcadm disable svc:/network/sendmail-client:default

# gzip -dc sendmail.8.14.5.tar.gz | tar xf -
# cd sendmail-8.14.5

• Set up sendmail FEATURES (SSL, SASL, DB)

# cat > devtools/Site/site.config.m4
dnl ### Changes to disable the default NIS support
APPENDDEF(`confENVDEF', `-UNIS')

dnl ### Changes for STARTTLS support
APPENDDEF(`confENVDEF',`-DSTARTTLS')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
APPENDDEF(`confLIBDIRS', `-L/usr/local/lib -L/usr/lib -R/usr/lib')
APPENDDEF(`confINCDIRS', `-I/usr/include/openssl')

dnl ### SASL support
APPENDDEF(`confENVDEF', `-DSASL=2')
APPENDDEF(`conf_sendmail_LIBS', `-lsasl2')
APPENDDEF(`confINCDIRS', `-I/usr/local/sasl -I/usr/include')

dnl ### Berkley DB support
APPENDDEF(`confENVDEF', `-DNEWDB')
APPENDDEF(`confINCDIRS', `-I/usr/include')
APPENDDEF(`confLIBDIRS', `-L/usr/lib')

dnl ### TCP Wrapper
APPENDDEF(`confENVDEF', `-DTCPWRAPPERS')
APPENDDEF(`conf_sendmail_LIBS', `-lwrap')
EOF
#

•  Build Sendmail

# ./Build -c
/* It should build but ignore the gtroff:error at the end */
# sudo mv /usr/lib/sendmail /usr/lib/sendmail_orig
# sudo cp obj.SunOS.5.11.i86pc/sendmail/sendmail /usr/lib/sendmail
# sudo sudo chgrp smmsp /usr/lib/sendmail
# sudo sudo chmod g+s,u-ws /usr/lib/sendmail

• Now a Vendor and SASL support to sendmail.cf file (I hope you know what you are doing here)
• Edit sendmil.mc add add the extra lines:

define(`VENDOR_NAME', `Berkeley')
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

# cd /etc/mail/cf/cf
# cat sendmail.mc
divert(0)dnl
VERSIONID(`sendmail.mc (Sun)')
define(`VENDOR_NAME', `Berkeley')
OSTYPE(`solaris11')dnl
DOMAIN(`solaris-generic')dnl
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl define(`confFALLBACK_SMARTHOST', `mailhost$?m.$m$.')dnl
MAILER(`local')dnl
MAILER(`smtp')dnl

LOCAL_NET_CONFIG
R$* < @ $* .$m. > $* $#esmtp $@ $2.$m $: $1 < @ $2.$m. > $3
#
# sudo make sendmail.cf
# sudo cp sendmail.cf ../../sendmail.cf

# sudo /usr/lib/sendmail -bt -d0 < /dev/null
Version 8.14.5
Compiled with: DNSMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7
    NAMED_BIND NDBM NETINET NETINET6 NETUNIX NEWDB PIPELINING
    SASLv2 SCANF STARTTLS TCPWRAPPERS USERDB XDEBUG

Setup sasl authentication server

• Now lets set up SASL plugin via a Sendmail.conf

# sudo cat > /usr/local/lib/sasl2/Sendmail.conf
pwcheck_method: saslauthd
EOF
#

• For authentication to work the saslauthd has to be started, so you can start in as a one off process (good for debugging) and at boot time.

# sudo /usr/local/sbin/saslauthd -n 1 -V -d -a pam
saslauthd[398] :main : num_procs : 1
saslauthd[398] :main : mech_option: NULL
saslauthd[398] :main : run_path : /var/run/saslauthd
saslauthd[398] :main : auth_mech : pam
saslauthd[398] :ipc_init : using accept lock file: /var/run/saslauthd/mux.accept
saslauthd[398] :detach_tty : master pid is: 0
saslauthd[398] :ipc_init : listening on socket: /var/run/saslauthd/mux
saslauthd[398] :main : using process model
saslauthd[398] :get_accept_lock : acquired accept lock

• To set it up ant boot time we should set up a services, but for now we will stick to init.d files.
  

cat > /etc/init.d/saslauthd
#!/usr/sbin/sh
#
NAME=saslauthd
DAEMON="/usr/local/sbin/${NAME}"
DESC="SASL Authentication Daemon"

# -a Selects the authentication mechanism to use.
# -n Number of worker processes to create.
# -V Enable verbose logging
# -d Debugging (don't detach from tty, implies -V)

case "$1" in
'start')
${DAEMON} -n 1 -V -d -a pam
;;

'stop')
pgrep saslauthd
;;

*)
echo "Usage: $0 { start | stop }"
exit 1
;;
esac
EOF
#
# sudo ln init.d/saslauthd rc0.d/K38saslauthd
# sudo ln init.d/saslauthd rc1.d/K38saslauthd
# sudo ln init.d/saslauthd rc2.d/S82saslauthd
# sudo ln init.d/saslauthd rcS.d/K38saslauthd

• Time for some testing, via first the SASL daemon.

# cyrus-sasl-2.1.25/saslauthd/testsaslauthd -u RealUser -p MyPassword
0: OK "Success."

• We need the encrypted username and password to test sendmail:

# perl -MMIME::Base64 -e 'print encode_base64("\000MyUser\000MyPassword")'
AE15VXNlcgBNeVBhc3N3b3Jk

• Test the sendmail part:

# sudo /usr/lib/sendmail -bv  -O LogLevel=14 -bs -Am
220 mailer5.dcs.bbk.ac.uk ESMTP Sendmail 8.14.5/8.14.5; Tue, 31 Jan 2012 09:52:24 GMT
EHLO localhost
250-mailer5.dcs.bbk.ac.uk Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
250-DELIVERBY
250 HELP
AUTH PLAIN AE15VXNlcgBNeVBhc3N3b3Jk
235 2.0.0 OK Authenticated
quit
221 2.0.0 mailer5.dcs.bbk.ac.uk closing connection

• That is it.

refernces:
- Guía Instalación de Sendmail con SMTP-AUTH y (tema #2688)
- Sendmail-SMTP-AUTH-TLS-Howto
- OpenSolaris Sendmail Auth

Can Solaris 11 Sendmail / SASL handle SMTP AUTH

I thought I would finally get SMTP AUTH working on my Solaris 11 servers, so that I could then setup my phone to send e-mail correctly.

So can you do it with default Solaris 11 software?
If you can't wait the answer is NO! but here is what I tried just in case someone can solve the problem.

• First Solaris 11 comes with Sendmail and SASL, but worst luck Sendmail has not been built with SASL support (you see the following when you edit sendmail.cf. see later).

# sudo /usr/lib/sendmail -d0 -bt < /dev/null
Version 8.14.5+Sun
Compiled with: DNSMAP LDAPMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8
MIME8TO7 NAMED_BIND NDBM NETINET NETINET6 NETUNIX NEWDB NIS
PIPELINING SCANF STARTTLS TCPWRAPPERS USERDB USE_LDAP_INIT
XDEBUG
Warning: Option: AuthMechanisms requires SASL support (-DSASL)
Warning: Option: AuthOptions requires SASL support (-DSASL)

• Lets try compiling sendmail to see if Solaris SASL can work!
• Install the packages which we requite and download sendmail  8.14.5

# sudo pkg install pkg:/developer/build/make system/header developer/gcc-3 text/gnu-grep database/berkeleydb-5

# echo $PATH
/usr/sbin:/usr/bin
# export PATH=$PATH:/usr/gnu/bin:/usr/sfw/bin

• Stop existing sendmail processes.

# sudo svcadm disable svc:/network/smtp:sendmail
# sudo svcadm disable svc:/network/sendmail-client:default

# gzip -dc sendmail.8.14.5.tar.gz | tar xf -
# cd sendmail-8.14.5

• Set up sendmail FEATURES (SSL, SASL, DB)

# cat > devtools/Site/site.config.m4
dnl ### Changes for STARTTLS support
APPENDDEF(`confENVDEF',`-DSTARTTLS')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
APPENDDEF(`confLIBDIRS', `-L/usr/lib -R/usr/li')
APPENDDEF(`confINCDIRS', `-I/usr/include/openssl')

dnl ### SASL support
APPENDDEF(`confENVDEF', `-DSASL')
APPENDDEF(`conf_sendmail_LIBS', `-lsasl')
APPENDDEF(`confINCDIRS', `-I/usr/include/sasl')

dnl ### Berkley DB support
APPENDDEF(`confENVDEF', `-DNEWDB')
APPENDDEF(`confINCDIRS', `-I/usr/include')
APPENDDEF(`confLIBDIRS', `-L/usr/lib')
EOF

•  Build Sendmail

# ./Build -c
/* It should build but ignore the gtroff:error at the end */
# sudo mv /usr/lib/sendmail /usr/lib/sendmail_orig
# sudo cp obj.SunOS.5.11.i86pc/sendmail/sendmail /usr/lib/sendmail
# sudo sudo chgrp smmsp /usr/lib/sendmail
# sudo sudo chmod g+s,u-ws /usr/lib/sendmail

• Now a Vendor and SASL support to sendmail.cf file (I hope you know what you are doing here)
• Edit sendmil.mc add add the extra lines:

define(`VENDOR_NAME', `Berkeley')
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

# cd /etc/mail/cf/cf
# cat sendmail.mc
divert(0)dnl
VERSIONID(`sendmail.mc (Sun)')
define(`VENDOR_NAME', `Berkeley')
OSTYPE(`solaris11')dnl
DOMAIN(`solaris-generic')dnl
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl define(`confFALLBACK_SMARTHOST', `mailhost$?m.$m$.')dnl
MAILER(`local')dnl
MAILER(`smtp')dnl

LOCAL_NET_CONFIG
R$* < @ $* .$m. > $* $#esmtp $@ $2.$m $: $1 < @ $2.$m. > $3
#
# sudo make sendmail.cf
# sudo cp sendmail.cf ../../sendmail.cf

# sudo /usr/lib/sendmail -bt -d0 < /dev/null
Version 8.14.5
Compiled with: DNSMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7
NAMED_BIND NDBM NETINET NETINET6 NETUNIX NEWDB PIPELINING
SASLv2 SCANF STARTTLS USERDB XDEBUG

• Now lets set up SASL plugin via a Sendmail.conf

# cat > /etc/sasl/Sendmail.conf
# pw_check: shadow

• I have tried the following in the above with no luck: shadow,pam,auxprop, but none seem to check password information.
• Testing, but first we need the encrypted username and password:

# perl -MMIME::Base64 -e 'print encode_base64("\000MyUser\000MyPassword")'
AE15VXNlcgBNeVBhc3N3b3Jk

• Test the sendmail part:

# sudo /usr/lib/sendmail -bv  -O LogLevel=14 -bs -Am
220 mailer5.dcs.bbk.ac.uk ESMTP Sendmail 8.14.5/8.14.5; Tue, 31 Jan 2012 09:52:24 GMT
EHLO localhost
250-mailer5.dcs.bbk.ac.uk Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-AUTH DIGEST-MD5 CRAM-MD5 PLAIN
250-DELIVERBY
250 HELP
AUTH PLAIN AE15VXNlcgBNeVBhc3N3b3Jk
535 5.7.0 authentication failed
Jan 31 09:52:35 mailer5 sendmail[5928]: Password verification failed
Jan 31 09:52:35 mailer5 sendmail[5928]: q0V9qOd1005928: AUTH failure (PLAIN): user not found (-20) SASL(-13): user not found: Password verification failed, relay=root@localhost
quit
221 2.0.0 mailer5.dcs.bbk.ac.uk closing connection

• So no luck, if you can spot anything I am doing wrong please let me know.
• I will post shortly how to get over the above.

refernces:
- Guía Instalación de Sendmail con SMTP-AUTH y (tema #2688)
- Sendmail-SMTP-AUTH-TLS-Howto
- OpenSolaris Sendmail Auth

Oracle Support Cost so high why would you buy Sun Hardware now

I work in education (UK, University) and we have bought a lot of Sun hardware over the years. Yes, the hardware was always a little more expensive, but I always found it more reliable and you had Solaris running on it which meant you had a world class system.

Well how things have changed since Oracle have taken over and the cost of running a Solaris system is out of reach of most people and business now.

Oracle Premier Support cost is 12% of cost of hardware Per Year!

Lets compare this with HP and Microsoft Windows.

HP System & MS Windows
HP ProLiant DL380 system	£3292
HP 5 year Hardware support	£495
Micosoft Server 2008 Academic Lic *	£93
Total Support Cost for 5 years (3.5% p/y)	£588
How much would it cost me with Oracle Support rates (with Solaris) for 5 years (12% p/y)	£1975
Sun/Oracle & Solaris
Sun Fire X4170 2CPU+32GB	£6250
Oracle 5 Year Premier Support (£750 per year)	£3750
Sun Fire X4170 2CPU+32GB (bought from SUN 2010), Support costs us approx £130 per year	£650

* Micosoft Server 2008 Academic Lic
I think I need to clarify the cheap Microsoft license. Since we are a University we can use the Microsoft Campus Enrollment which allows us to obtain many Microsoft products and heavily discounted prices. But what about Support. I am trying to check what telephone support level we get, but one thing is for sure you can obtain software updates, patches and hot fixes as part of the deal. This is the thing which Oracle is missing or I have not managed to speak to someone who is can give me a better answer.

Interoperability between Windows and OpenIndiana shares using ZFS & ACL (and Solaris 11)

What I have always wanted to do is to have one location for all my users to store there files.
At the moment we have a Windows Home filesystem and Solaris Home filesystem and even though samba does a good job I have never been very happy with it. This is where ZFS and the ACL which is part of the NFS v4 allow me to finally achieve Windows & Solaris Interoperability.

This has been tested on OpenIndiana oi_147 and Windows Server 2008 running "Active Directory"

In this example:

Domain              = test.int

Windows 2008 server = windows     = 192.168.56.3

Solaris Server      = openindiana = 192.168.56.5

Setup Windows Server
-- Windows 2003 would do
-- Windows 2008 with patches
-- NTLMv2 authentication problem:
      http://support.microsoft.com/kb/957441/
-- Windows Server 2008 SP1 with Microsoft Kerberos hot fix KB951191:
-- or Windows Server 2008 SP2


Setup Solaris Server
-- Check DNS setup

# cat  /etc/resolv.conf
domain  test.int
nameserver  192.168.56.3

# grep  dns  /etc/nsswitch.conf
hosts:      files dns mdns
ipnodes:    files dns mdns 

-- Check software installed (SMB Server libraries and commands)

% pkg list smb
NAME (PUBLISHER)                              VERSION         STATE      UFOXI
service/file-system/smb                       0.5.11-0.148    installed  -----
system/file-system/smb                        0.5.11-0.148    installed  -----

If not then install it

$ pfexec install service/file-system/smb

-- Sync clocks on network (any time difference 5mins can cause problems)

$ pfexec ntpdate DC-host
or
$ pfexec rdate time-host
in our case:
$ pfexec ntpdate windows

--  Set up mapping of users and groups between systems
    Showing the most basic setup:

$ svcs \*idmap\*
STATE          STIME    FMRI
disabled       12:16:59 svc:/system/idmap:default
$ svcadm enable idmap
$ svcs \*idmap\*
STATE          STIME    FMRI
online         12:40:38 svc:/system/idmap:default
$ pfexec idmap add 'winuser:*@test.int' 'unixuser:*'
$ pfexec idmap add 'wingroup:*@test.int' 'unixgroup:*'
$ idmap list
add     winuser:*@test.int    unixuser:*
add     wingroup:*@test.int    unixgroup:*

-- Configure Kerberos: (AD uses Kerberos authentication)
    Edit /etc/krb5/krb5.conf and specify the fully qualifed AD domain name, in UPPERCASE, as the default realm. Also, specify the fully qualified host name for the domain controller at the kdc, admin_server and kpasswd_server

edit  /etc/krb5/krb5.conf to look like:

    [libdefaults]

        default_realm = TEST.INT

    [realms]

        TEST.INT = {

                kdc = windows.test.int

                admin_server = windows.test.int

                kpasswd_server = windows.test.int

                kpasswd_protocol = SET_CHANGE

        }

     [domain_realm]

         .test.int = TEST.INT

-- Start the smb (CIFS) services and check it is running

$ pfexec svcadm enable -r smb/server
$ svcs \*smb\*
STATE          STIME    FMRI
disabled       Nov_08   svc:/network/smb/client:default
online         15:21:01 svc:/network/smb/server:default
online         15:21:03 svc:/network/shares/group:smb

-- Need to join the AD domain with a Domain Administrator access
    If you are using Windows 2008 Domain then you will need an extra step.

$ ping windows
windows is alive 

$ pfexec smbadm join -u Administrator test.int
After joining test.int the smb service will be restarted automatically.
Would you like to continue? [no]: yes
Enter domain password:
Joining test.int ... this may take a minute ...
failed to find any domain controllers for test.int

$ tail /var/adm/messages

...openindiana smbd[1101]: [ID 700049 daemon.error] smbd: failed locating domain controller for test.int
....openindiana smbd[1134]: [ID 702911 daemon.notice] smbd_dc_update: test.int: located windows
....openindiana smbd[1134]: [ID 702911 daemon.notice] Failed to establish NETLOGON credential chain

Set the LAN manager authentication level on your Solaris system

$ pfexec sharectl set -p lmauth_level=2 smb
$ pfexec smbadm join -u Administrator test.int
After joining test.int the smb service will be restarted automatically.
Would you like to continue? [no]: yes
Enter domain password:
Joining test.int ... this may take a minute ...
Successfully joined test.int

Setup Solaris filesystem
As we said we are after a single fire-system (share) which works on both Operating System, so that any permissions work on both platforms and are transferable to the other one:

  -- Enable Cross-Protocol Locking
      - SMB assumes mandatory locking
      - UNIX advisory locking
  -- Mixed case
  -- Enable SMB sharing on share

$ pfexec zfs  create  -o nbmand=on  -o  casesensitivity=mixed rpool/export/homes

repeat next 2 lines cd for all users
$ pfexec zfs create rpool/export/homes/andrew
$ pfexec zfs set  sharesmb=name=andrew  rpool/export/homes/andrew

$ sharemgr show -vp
default nfs=()
smb smb=()
    * /var/smb/cvol     smb=()    ""
          c$=/var/smb/cvol     smb=(abe="false" guestok="false")    "Default Share"
zfs
    zfs/rpool/export/homes/andrew smb=()
      andrew=/export/homes/andrew

$ zfs get  nbmand,casesensitivity,sharesmb  rpool/export/homes/andrew
NAME                      PROPERTY         VALUE        SOURCE
rpool/export/homes/andrew  nbmand           on           inherited from rpool/export/homes
rpool/export/homes/andrew  casesensitivity  mixed        -
rpool/export/homes/andrew  sharesmb         name=andrew  local

$ pfexec chown  andrew:staff  /export/homes/andrew

 -- watch out for which ls / chmod commands

$ touch file1
$ which ls
/usr/gnu/bin/ls
$ ls -la
total 10
drwxr-xr-x   3 andrew   staff          4 Nov 18 18:42 .
drwxr-xr-x   4 root     root           4 Nov 18 18:33 ..
drwxr-x---   2 root     sys            3 Nov 18 18:34 .$EXTEND
-rw-r--r--   1 andrew   staff          0 Nov 18 18:42 file
$ /usr/bin/ls -lv
total 1
-rw-r--r--   1 andrew   staff          0 Nov 18 18:42 file
     0:owner@:read_data/write_data/append_data/read_xattr/write_xattr
         /read_attributes/write_attributes/read_acl/write_acl/write_owner
         /synchronize:allow
     1:group@:read_data/read_xattr/read_attributes/read_acl/synchronize:allow
     2:everyone@:read_data/read_xattr/read_attributes/read_acl/synchronize
         :allow
$ /usr/bin/ls -lV
total 1
-rw-r--r--   1 andrew   staff          0 Nov 18 18:42 file
                 owner@:rw-p--aARWcCos:-------:allow
                 group@:r-----a-R-c--s:-------:allow
              everyone@:r-----a-R-c--s:-------:allow

-- Identity Mapping...
    - Unknown Windows identities are mapped to dynamically alloctaed UIDs/GIDs 
    - Unnown Unix identities are not mapped to Windows so they MUST exist in AD.

i.e.

idmap[501]: [ID 523480 daemon.notice] AD lookup of winname root@test.int failed, error code -9961
idmap[501]: [ID 523480 daemon.notice] AD lookup of winname sys@test.int failed, error code -9961
idmap[501]: [ID 523480 daemon.notice] AD lookup of winname staff@test.int failed, error code -9961

    - It is a good idea that well know accounts which may be used in ACL have a permanent map to a UNIX group
    i.e. lets bind UNIX group "winadmin"to Windows Group

$ idmap add "wingroup:Domain Admins@test.int"  unixgroup:winadmin

-- ACL Property on filesystem
   discard - New objects, no ACL entries are inherited
   noallow - New objects, only inheritable ACL entries that have access to type deny are inherited.
    restricted - New objects, the write_owner and write_acl permissions are removed when ACL entry is inherited.
    passthrough - New objects are created with a mode determined by the inheritable ACEs (Access Control Entries). [Sorry what is that in english]
    passthrough-x - As above, plus files are created with the execute (x) set.

$ pfexec zfs get aclinherit rpool/export/homes

NAME                        PROPERTY    VALUE          SOURCE

rpool/export/homes          aclinherit  restricted     default

$ pfexec zfs set aclinherit=passthrough-x rpool/export/homes

$ zfs get aclinherit  rpool/export/homes/andrew
NAME                      PROPERTY    VALUE          SOURCE
rpool/export/homes/andrew  aclinherit  passthrough-x  inherited from rpool/export/homes

ACL TABLE to be inserted here

What has changed in recent versions

    - deny ACL are not required in most cases now. exceptions: 0705 (g-rwx), 0060 (u-rwx)
    - aclmode has gone, which means that chmod will discard all ACLs
    - user and owner are treated together?


Possible Solution
    - Owner needs the correct permissions
    - Group needs the correct permissions
    - User Andrew

$ /bin/ls -ldv /export/homes/andrew
drwxr-xr-x   3 andrew   staff          3 Nov 30 12:40 /export/homes/andrew
     0:owner@:list_directory/read_data/add_file/write_data/add_subdirectory
         /append_data/read_xattr/write_xattr/execute/read_attributes
         /write_attributes/read_acl/write_acl/write_owner/synchronize:allow
     1:group@:list_directory/read_data/read_xattr/execute/read_attributes
         /read_acl/synchronize:allow
     2:everyone@:list_directory/read_data/read_xattr/execute/read_attributes
         /read_acl/synchronize:allow

$ /bin/ls -ldV /export/homes/andrew
drwxr-xr-x   3 andrew   staff          3 Nov 30 12:40 /export/homes/andrew
                 owner@:rwxp--aARWcCos:-------:allow
                 group@:r-x---a-R-c--s:-------:allow
              everyone@:r-x---a-R-c--s:-------:allow

-- So, A0 refers to position 0, A1 refers to position 1, etc....
-- The following commands will replace the ACL at position 0,1,2 with new ones
-- The only change is to add inheritance to the directories

pfexec /bin/chmod "A0=owner@:rwxp--aARWcCos:fd:allow" /export/homes/andrew
pfexec /bin/chmod "A1=group@:r-x---a-R-c--s:fd:allow"  /export/homes/andrew
pfexec /bin/chmod "A2=everyone@:r-x---a-R-c--s:fd-----:allow"  /export/homes/andrew

-- Make life easier lets do it as user andrew and gnu removed from path:
-- Add user andrew (owner) to the ACL
-- Add group staff (group) to the ACL

$ chmod "A+user:andrew:rwxpdDaARWcCos:fd-----:allow" /export/homes/andrew

$ chmod "A+group:staff:r-x---a-R-c--s:fd:allow"  /export/homes/andrew

$ chmod "A+group:winadmin:rwxpdDaARWcCos:fd-----:allow"   /export/homes/andrew

$ ls -ldV /export/homes/andrew
drwxr-xr-x+  3 andrew   staff          3 Nov 30 12:40 /export/homes/andrew
         group:winadmin:rwxpdDaARWcCos:fd-----:allow
            group:staff:r-x---a-R-c--s:fd-----:allow
            user:andrew:rwxpdDaARWcCos:fd-----:allow
                 owner@:rwxp--aARWcCos:fd-----:allow
                 group@:r-x---a-R-c--s:fd-----:allow
              everyone@:r-x---a-R-c--s:fd-----:allow

Hope it works....

Ref:
- Jarod Nash (LOSUG slides)
- http://wiki.genunix.org/wiki/index.php/CIFS_Service_Troubleshooting
- http://arc.opensolaris.org/caselog/PSARC/2010/029/20100126_mark.shellenbaum

Goodbye OpenSolaris/SXCE! Hello OpenIndiana

Finally did it. Being running Solaris Express Community Edition SXCE (last release was 129) on my work desktop for a few years now and was was planning to upgrade to OpenSolaris, but since we all knew what happened there I went for one better ;-)

1. Downloaded iso from http://openindiana.org/download and burnt it to a DVD


2. Booted my Sun Ultra 24 off the DVD:
• OK! I put in a new disk in the box just to be safe


3. Installed the software.
   
   • I did have a couple of devices not found which is strange since it is a Sun box
     Intel : 82X38/X48 Express MEI Controller
     Intel : 82801|(ICH9 Family) Thermal Subsystem
     


4. First fix the root problem
• open a Terminal
• execute "su" and give the password you chose for your account at installation time
• you will be informed that root's password has expired and prompted to change it
• once changed you can exit the su session


5. If you wish change Default User to have
• System => Administration => Users and Groups
• Enter Root password
• Select Default User and select Properties
• Select User profiles tab and find and select Primary Administrator


6. Install some extra software (Office, medialib for flash to work

# pfexec pkg refresh
# pfexec pkg install office
# pfexec pkg install library/medialib

7. Download and install Adobe Flash Player : Adobe Flash Player 10.1 x86

# bzip2 -dc flash_player_10_solaris_x86.tar.bz2| tar xf -
# pfexec cp flash_player_10_solaris_r22_87_x86/libflashplayer.so /usr/lib/firefox/plugins
# pfexec chown root:bin /usr/lib/firefox/plugins//libflashplayer.so

li>Download and install Adobe Reader
• Adobe Reader 9.2 x86

# chmod +x ./AdbeRdr9.4-1_i486solaris_enu.bin
Extracting files, please wait. (This may take a while depending on the configuration of your machine)
This installation requires 172 MB of free disk space.
Enter installation directory for Adobe Reader 9.4 [/opt]
Installing platform independent files ... Done
Installing platform dependent files ... Done
Setting up libraries ... Done
Setting up desktop and menu icons ... Done
Setting up the browser plugin ... Done

8. Download and install Virtual Box
Instruction can be found at http://wiki.openindiana.org/oi/Using+OpenIndiana+--+technical+FAQ

Complete local copy (mirror) of pkg.opensolaris.org

As you are aware with every official release of OpenSolaris, comes a full download of all the IPS packages (7GB), but what happens if you want to work on the pkg.opensolaris.org/dev releases and you want a local mirror. I have found this blog which does it. I have modified it slight since I think it had a couple of errors.

1. Create partition to store the packages. I have been told a complete will be around 65GB, but I am using a cut down version.

$ pfexec zfs create -o atime=off rpool/export/pkg


2. Create repository

pfexec pkgsend -s file:///export/pkg create-repository -–set-property publisher.prefix=opensolaris.org

3. Obtain list of packages you want.  In this case everything currently install and the release (134) I am interested in.

$ cd /export/pkg
$ pfexec pkg list -Hva | egrep “134:|install” > /tmp/pkglist.txt
$ head -1 /tmp/pkglist.txt
pkg://opensolaris.org/SUNWcs@0.5.11,5.11-0.134:20100302T005446Z

$ pfexec cat /tmp/pkglist.txt | sed 's/pkg:\/\/opensolaris\.org\///' \
       | cut -f 1 -d ' ' > /tmp/packages.txt
$ head -1 /tmp/packages.txt
SUNWcs@0.5.11,5.11-0.134:20100302T005446Z

4.Now download IPS package and place it into local repository.

$ for i in $(cat /tmp/packages.txt); 
do 
pfexec pkgrecv -s http://pkg.opensolaris.org/dev -d file:///export/pkg "$i"
done

5. You can test it to see all is there (http://localhost:80)

$ pfexec /usr/lib/pkg.depotd -d /export/pkg -p 80

6. To make sure the repository is always available.

$ pfexec svccfg -s application/pkg/server setprop pkg/inst_root=/export/pkg
$ pfexec svcadm refresh pkg/server
$ pfexec svcadm enable pkg/server

London OpenSolaris User Group (LOSUG) - Finally did a talk

Autoinstaller: Past & Present

I gave a talk at the LOSUG meeting on Autoinstaller in OpenSolaris 2009.06 and will talk about what is new in 2010.03. He will talk about and demonstrate how to use Autoinstaller to install OpenSolaris to your own personnel specification, including Autoinstaller Manifests, pkg repository, creating IPS package and SMF service.