Solaris 11 unshare ZFS NFS share

rdircio

Remove the share by identifying the share-name name. For example:

# zfs set -c share=name=data rpool/data
share 'data' was removed.

Remove the share by identifying the share-path name. For example:

# zfs set -c share=path=/data rpool/data
share 'data' was removed.

Disable IPV6 in Solaris 11

rdircio

it is not recommended to do so, but this is how i did it

# ipadm show-addr
#ipadm delete-addr vnic3/v6
#ipadm show-addr
#ipadm delete-addr lo0/v6
#ipadm show-addr
#svcadm disable svc:/network/routing/legacy-routing:ipv6
#svcadm disable svc:/network/dhcp/server:ipv6
#svcadm disable svc:/network/dhcp/relay:ipv6

Solaris 11 PF firewall

rdircio

The configuration file is kept in /etc/firewall/pf.conf

search sylvamo.com
nameserver 10.177.0.13
nameserver 10.176.0.4

ipadm create-ip vnic28
ipadm create-addr -T static -a local=10.181.20.87/24 vnic28/v4
route -p add default 10.181.20.1

> /etc/firewall/pf.conf
vi /etc/firewall/pf.conf
svcadm enable firewall
svcs -x firewall

block out all
block in all
pass in from 10.177.0.0/24 #----vdi
pass in from  10.181.20.0/24  #----- local colo
pass out to 10.181.20.0/24 #----- local colo
#----- all below are AD DC
pass out to 10.177.0.13
pass out to 10.140.164.157
pass out to 10.177.0.13
pass out to 10.176.0.5
pass out to 10.179.0.12
pass out to 10.140.168.137
pass out to 10.179.0.11
pass out to 10.140.12.73
pass out to 10.178.0.5
pass out to 10.177.0.14
pass out to 10.178.0.4
pass out to 10.21.34.11
pass out to 10.21.155.11
pass out to 10.20.90.10
pass out to 10.21.155.10
pass out to 10.176.0.4
pass out to 10.140.64.39
pass out to 10.140.76.71
pass out to 10.21.34.10

Solaris 11 project definition

rdircio

projects are defined per user, they are defined in /etc/user_attr and /etc/project

/etc/project
DAA_ADM:220:DAA System Administrator:daaadm::process.max-sem-nsems=(priv,2048,deny);project.max-sem-ids=(priv,1024,deny);project.max-shm-ids=(priv,1024,deny);project.max-shm-memory=(priv,18446744073709551615,deny);process.max-file-descriptor=(basic,65536,deny);

/etc/user_attr

:daaadm::::project=DAA_ADM

automount to make homedirs in solaris

rdircio

http://znogger.blogspot.com/2010/05/solaris-automatic-creation-of-home-dirs.html

add a line to /etc/auto_master

echo "/export/home/ad /etc/auto_homedir" >> /etc/auto_master

create the /etc/auto_homedir script

root@ueq2szsapapt01:~# cat /etc/auto_homedir
#!/bin/bash

(
HOMEDIRPATH=/export/home/ad
PHYSICALDIRPATH=/export/home/.ad
HOMEDIRGROUP=""
hdir=~$1
E=getent passwd $1 |wc -l
if [ $E -e 0 ]; then
exit
fi
sanitized=echo $1 | sed 's/\//_/g'
phdir="$PHYSICALDIRPATH/${sanitized}"
if [ -d "$phdir" ]; then
echo "localhost:$phdir"
exit
fi
mkdir -p $phdir
chown "$1":"$HOMEDIRGROUP" $phdir
echo "localhost:$phdir"
exit
) | tee /tmp/autohome.log

Set sticky bit and execute on the script

chmod +t+x /etc/auto_homedir

Restart the automounter

svcadm restart autofs

Create the base mountpoints

mkdir -p /export/home/ad

mkdir -p /export/home/.ad

clear group info for winbind user

rdircio

root@ueq2szsapapt01:/var/samba/locks# net cache samlogon list

SID Name When cached

S-1-5-21-4076327854-156698110-1354154815-49906 SYLVAMO\RDIRCIO Wed May 25 2:20:29 PM 2022 CDT
root@ueq2szsapapt01:/var/samba/locks# net cache samlogon delete S-1-5-21-4076327854-156698110-1354154815-49906

Restrict pam_winbind user login in Solaris 11

rdircio
  •  Create a /etc/security/pam_winbind.conf file with the following contents:

[global]

require_membership_of = [SID or NAME]

try_first_pass = yes

  • Restart the winbind SMF service:

# svcadm restart winbind

[SID or NAME] is a comma separated list of SID’s and/or AD users and/or AD groups

Example: the AD user jack and the members of the AD group IT-ADMIN are allowed to login in.

[global]

require_membership_of = jack,IT-ADMIN

try_first_pass = yes