Login Security Part 2 - Setting up a Solaris11 to authenticate to AD using SAMBA

Setting up a Solaris11 to authenticate to AD using SAMBA:

1. Add to /etc/system and reboot (This is once off on the global zone only)
2. vi /etc/samba/smb.conf*
3. mv /etc/pam.conf /etc/pam.conf.bak
4. mv /etc/pam.conf-winbind /etc/pam.conf
5. svccfg -s name-service/switch
   > setprop config/password = "files winbind"
   > setprop config/group = "files winbind"
   > exit
6. svcadm refresh name-service/switch
7. net join -U ADUserThatCanAddToDomain -S ADDomainControllerName
8. svcadm enable samba winbind
9. getent passwd

*Truncated smb.conf:

[global]
        workgroup = <HELLO>
        #realm = <HELLO.COM>
        encrypt passwords = yes
        netbios aliases = <hostname>
        server string = <hostname>
        security = DOMAIN
        auth methods = winbind
        password server = <ADDomainControllerIP>
        unix password sync = Yes
        log level = 2 vfs:3
        syslog = 2
        log file = /var/log/samba/smb-%U-%M.log
        max xmit = 65535
        name resolve order = host bcast
        deadtime = 15
        socket options = TCP_NODELAY IPTOS_LOWDELAY
        load printers = No
        disable spoolss = Yes
        show add printer wizard = No
        preferred master = No
        local master = No
        domain master = No
        dns proxy = No
        ldap ssl = no
        socket address =
        idmap uid = 10000-20000
        idmap gid = 10000-20000
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = yes
        hide special files = Yes
        hide unreadable = Yes
        veto files = /lost+found/samba_recycle_bin/

Login Security Part1

I'm busy looking at how we allow users to log into our systems and improving it. This post will explain how it's done currently.

Well first of all, there are two ways we let users access our Solaris machines, SSH and Samba. So running "netservices limited" pretty much closes down all the unnecessary stuff like ftp and rlogin.

Secondly, we want users to enter using their AD accounts. LDAP methinks is the most popular way to do this but here we have a Samba/Winbind implementation - where our UNIX server is added into the AD domain. It's pretty simple - when it works. When it doesn't it can be frustrating. I'll do a separate post on the setting up the Samba Winbind AD integration.

Lastly, when any user logs in (except root), a menu comes up. The user has to choose the relevant application user (e.g. oracle, ctma, uptime) and is changed to it. When a user logs out of the application user it's back to the menu. Exit the menu and the user is logged out.

The menu logs the user into the application user using ssh and key authentication so the only the password the user has to know is the AD password. Effectively the only thing a user can do as them self on the machine is choose which application user to change to.

Notes:

1. Access to Samba shares is controlled using /etc/samba/smb.conf
2. Access to ssh login is using the AllowUsers option in /etc/ssh/sshd_config and setting up key authentication for user
3. Because the change from user to application user is done using ssh - this screws with auditing.

*Most of this setup was in place when I got here, so I can't really take any credit for it

Oracle Database 11gR2 Installation On Solaris 11.1 (x86-64)

Hey, this dude chose the same theme as me!

http://dbarohit.blogspot.com/2012/12/oracle-database-11g-release-2-11201.html

Pure coincidence but I think I might change my theme down the line. Anyway, I needed the info but for SPARC. I'll post my own SPARC version once I've got a procedure that I'm happy with.

Edit: Changed my blog theme.

Loads of "wrong magic number" disk errors in /var/adm/messages

If you're getting lots of the "wrong magic number" on your console:

Jun 29 20:38:11 HOSTNAME scsi: [ID 107833 kern.warning] WARNING: /scsi_vhci/disk@g5000c50017c1704b (sd33):

Jun 29 20:38:11 HOSTNAME Corrupt label; wrong magic number
Jun 29 20:38:11 HOSTNAME scsi: [ID 107833 kern.warning] WARNING: 

Then you might want to try labeling the disk in format. Worked for me. They were gatekeeper disks from the SAN so I wasn't too worried about the data on them but if you are (I'm not sure how labeling affects data), you might want to follow this dude's procedure (I haven't tried it): http://unix.lofland.net/2011/06/30/corrupt-label-wrong-magic-number-errors/

Copying a Solaris 11 Zone

Sidenote: While looking for some other info, a post I read said that Oracle was starting to use the word "zone" instead of "container" going forward. I don't know how official that is but I'm going to start doing the same - it's less to type!

 Okay, so one of my regular tasks in Solaris 10 is to copy a zone. My regular Solaris 10 procedure is like:

1. Make a copy of the zone config (zonecfg -z zone export -f zone.cfg)
2. Make a copy of the zonepath zfs filesystem (using zfs send and receive)
3. Make a copy of any other filesystems  (using zfs send and receive)
4. Edit the zone.cfg file to reference the copied zonepath and filesystems instead of the original ones. Also change the IP.
5. Create the zone using the zone.cfg file (zonecfg -z zone1 -f zone.cfg)
6. Attach the new zone (with -u)
7. Boot the new zone and correct the hostname (using sys-unconfig).

For Solaris 11, points 2 and 7 have changed:

1. Make a copy of the zone config (zonecfg -z zone export -f zone.cfg)
2. Make a copy of the zonepath zfs filesystem (using zfs send and receive) including the zonepath's child filesystems but excluding the VARSHARE filesystem*
3. Make a copy of any other filesystems  (using zfs send and receive)
4. Edit the zone.cfg file to reference the copied zonepath and filesystems instead of the original ones. Also change the IP.
5. Create the zone using the zone.cfg file (zonecfg -z zone1 -f zone.cfg)
6. Attach the new zone (with -u)
7. Boot the new zone, make sure export's mountpoint is /export and not /rpool/export and correct the hostname (using sysconfig configure -s).

---

*If you copied the zone and you included the VARSHARE filesystem, you're going to have problems when starting the zone. To fix this, log into the zone and do the following commands:

  zfs set canmount=noauto rpool/VARSHARE
  zfs set mountpoint=/var/share rpool/VARSHARE

  svcadm clear svc:/system/filesystem/minimal:default

  zfs set mountpoint=/export rpool/export

---

Mounting filesystems on /var

If you trying to mount filesystems below /var, you're going to have a bad time.

The container won't boot because it mounts the filesystems first and then /var after.

I have an application that likes to put stuff in directories under /var so I made it filesystems under /var. I'm first going to reinstall the application to see if I can specify directories in other places. Barring that I will probably just put a link to some other place under /var. It's kinda avoiding the issue but I'm pressed for time, will try to solve the actual issue at a later stage.

Solaris 11 Network Aggregation

Should be rather simple to set up:

dladm create-aggr -l net1 -l net3 aggr1
ipadm delete-ip aggr1
ipadm create-ip aggr1
ipadm create-addr -T static -a 192.168.100.172/24 aggr1

Source: http://blog.allanglesit.com/2011/03/solaris-11-network-configuration-advanced/