OpenSolaris – Samba server

Time to share your newly created ZFS volume via samba to your windows clients.  There is some CIFS / SMB support built into the kernel now, but i’ve grown used to the SMB server…

Fire up add software – click filesystems – enable filter for “smb”, there are three packages generally. I get all three, but you only need the kernel update and the server package. The other is the SMB client.

Once installed make sure you enable the server in servicesgui.

Ensure the filesystem does not have any permission issues. I usually run chmod -R 777 /share just to ensure everyone can access the files without issue.

Add some users into smb password file (U need to create the users and sync the passwords). I usually create a guest user profile

useradd guest

smbpasswd -a guest – it should prompt for password twice (this is the password you use from windows). Press enter twice to leave the password blank.

The configuration can be done via /etc/sfw/smb.conf or via the shared folders admin gui.

I prefer doing the admin via the /etc/sfw/smb.conffile as it tends to let you have more control than the basic options available to you via the GUI. The contents of the file are as follows;  (note: i have included alot of the setting as an example which may contridict other settings)

[global] – global settings, the following are obvious

workgroup = workgroup

server string = opensolaris

wins support = yes – lets your server act as a WINS box


[share] – share name

path = /raidz1/share – share path

available = yes – enabled?

browseable = yes

public = yes

valid users = user1, user2 – only these users can access the share

writable = yes – equivalent to read / write in windows share properties

read only = yes – sets the default permissions to read only

write list = user1, user2 – these users can write to the share. Overrides above “read only” setting.

There are some good examples within /etc/sfw/smb.conf-example. Look there for some tips.

You also have an option of managing samba via the web – SWAT (samba web admin t). To get this up an running enable the swat service svc:/network/swat:default then browse to http://server:901

Optimizing SMB

I’ve found that adding this to /etc/sfw/smb.conf helps throughput in some cases. Try for yourself;  (it tends to put a higher load on cpu)

[global]

aio read size = 1
aio write size = 1

Further to this entry i have discovered that the built in CIFS / SMB service is much more efficient since it is included as part of the kernel. See my other posts on setting up cifs

Updated : 9/08/2009

I’ve swapped back to samba due to the issues i’ve had with cifs in the later releases. Remember if you wish to swap back to samba yo uneed to remove the sharesmb properties from each of your zfs shares – else on reboot zfs will re-enable the server/smb service.

There are some additional settings to ensure that your file server is the master browser for your workgroup. Put these under your [global]

[global]
domain master = Yes
local master = Yes
preferred master = Yes
os level = 35

Apparently on windows the os level reaches only 32 – so setting this to 35 ensures that your file server remains the master browser when an election is performed.

opensolaris – smbd issues?

Hmm… i’ve been having problems since the 2009.06 (snv_111b) update with cifs.

Cant pin it exactly as it could be “load” related… hmmm.

found this ? http://opensolaris.org/jive/thread.jspa?threadID=107681 this also may be a clue.. http://opensolaris.org/jive/thread.jspa?threadID=92472&tstart=75

imapd ?  might have to go back to 2008.11

You might get better performance if you enable oplocks but
there are known issues with it but you can do it just to
see if you see any difference:

svccfg -s smb/server setprop smbd/oplock_enable=boolean: true

So far running the above command has fixed things for me? I’ll update if the problem returns.

svccfg -s smb/server setprop smbd/oplock_enable=boolean: true

Updated : 27/07/2009

Problem came back, so i’m updating to 117 as per comments below

OpenSolaris – Headless server

I’ve moved from a CentOS linux distro running vmware server 2.0 to OpenSolaris running VirtualBox. My previous system was totally headless and i wanted something similar to replace it.

I’ve just started getting into OpenSolaris for many reasons (Sun has some cool stuff – ZFS / VirtualBox). But I have always wanted to run OpenSolaris as a headless server, and from what i initially found VirtualBox didn’t have the easy to use autostart on boot features that vmware server had. But there are always ways to get things working…

OpenSolaris 2008.11 has desktop sharing (system->preferences->desktop sharing) which is half of the job — enable this.

I had issues if i used a password protected session (it kept prompting on the actual console for password to unlock the key chain), so chose not to prompt for password for now. Now every time after you have logged in you are able to connect to your machine via VNC. (veno-server)

The other half of the problem is how to have the machine automatically log on as a user on boot-up. This is easily enabled via /etc/x11/gdm/custom.conf or gdmadmin. See this post for more details on the autologon.

Updated : 26/07/2009

After a bit of playing about I’ve found another way to make opensolaris the perfect headless box. First fire up gdmsetup and enable the required remote sessions.

Go to the “Remote” tab and set the style to “same as local”, then under security ensure that “Deny TCP connections to Xserver” is not checked.

Next go into the services GUI and tick the box next to X server (x11/xvnc-inetd). Next type;

svcs | grep vnc

Disable all vnc services except the one we want to enable (below);

svcadm enable xvnc-inetd

Now to get the vnc session to remain open when you disconnect update the service with the following parameter change;

svccfg -s xvnc-inetd setprop inetd/wait = boolean: true

Reboot. Done.

You should upon reboot be able to vnc straight into the box with a session that wont reset on disconnect.

Opensolaris : Citrix XenServer / ESX – Hooking into ZFS

To share your zfs pool via NFS (that works with Citrix Xen / ESX) to a host called “esxhost”;

zfs set sharenfs=rw,nosuid,root=esxhost tank/nfs

Note : You MUST have a resolvable name from the opensolaris box. i.e. you should be able to ping it. I have tried with ip’s only and it will fail. I have edited the /etc/hosts file to include the following line for my config;

# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# ident “%Z%%M% %I% %E% SMI”
#
# Internet host table
#
192.168.9.120 esxhost

This also requires that you are using both DNS and Files in your /etc/nsswitch.conf file. You should have a line like so;

# You must also set up the /etc/resolv.conf file for DNS name
# server lookup. See resolv.conf(4). For lookup via mdns
# svc:/network/dns/multicast:default must also be enabled. See mdnsd(1M)
hosts: files dns mdns

# Note that IPv4 addresses are searched for in all of the ipnodes databases
# before searching the hosts databases.
ipnodes: files dns mdns

i’ve also run this before hand; (to allow full access)

chmod -R 777 /tank/nfs

Update : check this guide http://blog.laspina.ca/ubiquitous/running-zfs-over-nfs-as-a-vmware-store

Update 2: there are known issues with waiting for sync when using both NFS and ZFS together…. There are reasons why you shouldnt do this, but in a test enviornemnt disabling sync at ZFS level may help performance (zfs set sync=disabled)

I like this idea of spliting up your SSD too… again in test enviornment no problems, in production i would utilize the entire drive to the tasks https://blogs.oracle.com/ds/entry/make_the_most_of_your

VirtualBox – Dup on ping

I’ve had this with certain kernels (2009.06) on opensolaris. Seems there is some incompatibility between some kernels and the opensolaris virtualbox network emulation. This only seems to effect linux virtual guests.

When you try to ping an address you get something like this…

[root@VA-DHCPWEB ~]# ping 192.168.9.15
PING 192.168.9.15 (192.168.9.15) 56(84) bytes of data.
64 bytes from 192.168.9.15: icmp_seq=1 ttl=128 time=1.85 ms
64 bytes from 192.168.9.15: icmp_seq=1 ttl=127 time=1.88 ms (DUP!)

I usually forward a port from my dsl router through to a VM, but it does not like it when the network is performing as above. I’m yet to find a permanent fix other than dropping back a kernel level.

I have no VLANs configured, and just have a single unmanaged switch on a single subnet. There is only a single nic configured on the virtual guest. Found this, but didn’t seem to resolve my issues. http://www.virtualbox.org/ticket/2713

If i ping the IP of the vm host it does not have the DUP packets, so it seems to be anything beyond the host adapter.

Update: This problem seemed to show itself with the new kernel / updates on the 2009.06 release of opensolaris. I’ve reverted back to 2008.11 and all seems to be working fine again. It may have something to do with project crossbow (new virtualization around the networking space) http://www.opensolaris.com/use/ProjectCrossbow.pdf

Opensolaris 2008.11 and xvm

I’ve been dabbling with virtual box up until this point. But have decided to take it to the next step by using xvm to run my virtual machines. I have taken a guide from BDerzhavets at this site : http://bderzhavets.blogspot.com/2008/12/xvm-on-opensolaris-2008.html

First step is to open package manager and find the “vitalization” grouping. Install everything in this group. You’ll probably find some packages are already installed.

Next you’ll need to add the xvm kernel to the grub startup menu (menu.1st). This bit is a bit of blind faith from my perspective – its a shame that the xvm kernel package doesn’t add itself to grub? Anyhow… You need to add the following as another boot option in the /rpool/boot/grub/menu.lst file;

title OpenSolaris 2008.11 snv_101b_rc2 X86 xVM
bootfs rpool/ROOT/opensolaris
kernel$ /boot/$ISADIR/xen.gz
module$ /platform/i86xpv/kernel/$ISADIR/unix /platform/i86xpv/kernel/$ISADIR/unix -B $ZFS-BOOTFS

After a bit more reading you can apparently run bootadm -m upgrade to automatically ad the new kernel to the boot menu. But there might be some issues with on-boot? Some good info on this page : http://trevoro.ca/blog/2008/05/07/getting-xvm-to-work-in-opensolaris-200805/

…added the xVM entry automatically after performing the linkage steps. You will still need to add the ‘bootfs rpool/ROOT/opensolaris lines however.

Update : i have not implemented this yet – i’m currently happy with the stable file / virtual box server that i’m using at the moment. Its also a little early to check out this tech, as there is a lot of work being done at http://www.opensolaris.org/os/community/xen/ that is near completion.

OpenSolaris cifs/smb server – configuring ACL’s on shares

O.k. from this  point I’m assuming you have created your zfs shares via the zfs command and renamed appropriately like so…..   (if you havent setup cifs yet then check read this)

zfs set sharesmb=on protected/backup

zfs set sharesmb=name=backup protected/backup

Now to check your current shares type…

sharemgr show

zfs

zfs/protected/backup
backup=/protected/backup

zfs/protected/photos
photos=/protected/photos

Now its time to look at NFSv4 ACL’s. This page has a great explanation of ACL’s and how to set things up. http://cuddletech.com/blog/pivot/entry.php?id=939

The ZFS manual here has the compact access and inheritance codes for chmod : http://opensolaris.org/os/community/zfs/docs/zfsadmin.pdf

Here are the current compact codes for access control;

add_file w , add_subdirectory p , delete d , delete_child D , execute x , list_directory r , read_acl c , read_attributes a , read_data r , read_xattr R , write_xattr W , write_data w , write_attributes A , write_acl C , write_owner o

Here are the current compact codes for inheritance control;

file_inherit f , dir_inherit d , inherit_only i , no_propagate n

So… The below command (referencing above compact codes) will give me (the owner) full permissions to files / directories, and read only access to everyone else. I have enabled inheritance so newly created files should also maintain their parents ACL without windows creating its own. Note: i used chown on the root of the my share first  i.e. chown -R daz /protected

then…

chmod -R A=\

owner@:wACpdDo:d:allow,\

owner@:wACpdDo:f:allow,\

everyone@:rxaARWcs:d:allow,\

everyone@:raARWcs:f:allow \

/protected/

Remember to test that this has provided what you want. Connect to your share as guest test the permissions, then connect as the owner and test permissions again. The fun thing about this particular ACL system is that you are not restricted to just one owner and one group. You can add additional lines as required using user: and group: attributes. I’ve done a multi-user ACL post here.

There is alot of flexibility – i’d say even more than the samba server options by a long shot. Its probably a little bit more fiddly getting your commands right, but once up and running you can have alot more control.

There are also “ACL sets” which combine the above attributes into groups….. i.e .you can have just the word “full_set” (full permissions) or “read_set”  (supposedly gives you read, but i couldn’t see any child files after using this) between the first set of colons in the above command… Using ACL sets the above command could be changed to…

chmod -R A=\

owner@:full_set:d:allow,\

owner@:full_set:f:allow,\

everyone@:rxaARWcs:d:allow,\

everyone@:raARWcs:f:allow \

/protected/

This should still give the owner full permissions (previously the owner just inherited the everyone groups permissions it didnt have as well)

These are the possible choices for ACL sets: full_set , read_set , modify_set , write_set

see here for more examples : http://sigtar.com/2009/02/15/opensolaris-cifssmb-server-configuring-acl’s-on-shares-part-2/

—– workgroup authentication —–

Assuming you are NOT using a domain:
Did you enable the password database settings?
user@solaris:~# cat >> /etc/pam.conf

# Seem to need this line for smb / cifs:
other password required pam_smb_passwd.so.1 nowarn

(Control-D to end)

user@solaris:~# passwd
passwd: Changing password for user
New Password:
Re-enter new Password:
passwd: password successfully changed for user

OpenSolaris – Migrating from samba to cifs

OpenSolaris 2008.11 has a cifs/smb server built into the kernel. From what i have been reading (and discovering) this is a much more efficient and faster way to get your files out into the network.

Previously i have run a dedicated samba service to share my files as I’ve come from various linux distros which require it. Seems i should be doing things differently on OpenSolaris.

The dedicated samba service is called;

svc:/network/samba:default

The new kernel embedded solaris smb/cifs service is called;

svc:/network/smb/server:default

If you do not have it running or installed you’ll need to add the following packages (use package manager); 

SUNWsmbs

SUNWsmbskr

Update : both these packages are called SUNWsmbfs in newer builds

Enable the service via “services” gui else use the svcadm command; 

svcadm enable svc:/network/smb/server:default

This is a great page on how to do a basic cifs setup http://blogs.sun.com/timthomas/entry/solaris_cifs_in_workgroup_mode

I just need to find a bit more detail on how to configure access to the shares (update: see below). In another post i made previously using samba it was easy enough to restrict guests to read only while giving some users rw access… I’m also interested in whether its possible to backup or manually configure the cifs server via any config file? Still looking into this one.

First step is to disable the samba service and enable the solaris smb/cifs service;

svcadm disable network/samba

svcadm enable -r smb/server – the “r” switch also enables all services that smb requires.

The next step is to add the following line to your /etc/pam.conf file. This is so future changes to passwords  also update the smb password file;

other   password required       pam_smb_passwd.so.1     nowarn

now set the name of the workgroup…

smbadm join -w workgroup

now setup your users (you have to reset your current passwords to update the password file above). I usually create and use a “Guest” account to keep some windows boxes happy. I set the guest account password to blank… 

useradd guest

passwd guest – then enter twice to enter a blank password

Next its time to setup the actual shares. If you have a zfs pool setup (you most likey do if you are running opensolaris) then you can share your data via the zfs command like so….   (i have a “backups” zfs file system within a “unprotected” zpool)

zfs set sharesmb=on unprotected/backups

Unfortunately this creates a share called “unprotected_backups” which can be seen via the sharemgr show -vp command. To rename the share to something more appropriate do the following…

zfs set sharesmb=name=backups unprotected/backups

All going well the share should now be called “backups”, if you have both the old and new name listed restart the smb server : svcadm restart smb/server

From your windows machine you should be able to browse to your share via \\servername\backups, if you get a prompt then type “guest” and press enter. Here is an example of a quick and easy way to mount drives via an XP commandline…

net use * \\serverip\backups /user:guest

Update: i have figured out the ACLs for cifs — See this Post

OpenSolaris – RTL8111/8168B issues

I’ve got an integrated RTL8111 nic which seemed to work fine under opensolaris 2008.11. But if the nic was put under load for a various length of time it seemed to just drop off the network.

At first i thought it was my SMB service dying, but after a quick ping i relised i had lost the entire TCP/IP stack on that particular card. Hmm…

It does come back online if you are patient and wait for about 5mins or so.

The web shows that there is some known issues with some cards dropping under load. Most places recommend to get a certified pci-e intel nic and your problems will go away. I’m considering this the last possible option, as i don’t particularly want to spend any more money.

The driver that seems to be at fault is the rge native driver… I have found this bug link that “could” be the issue, but might be specifically for the Realtek 8111C. Add the following at the end of the /etc/system file;

set ip:dohwcksum = 0

This setting is short for “do hardware checksum”. From what i have read setting this to zero moves the checksum calculations from the network card to your cpu (it doesn’t open your system to less error checking etc)

Update: This seemed to initially fix the problem for me, but the issue still occurred again after some time.

This forum thread also pointed to a similar issue… http://opensolaris.org/jive/thread.jspa?threadID=91282

Another solution may be found at the sun HLC site.  From the HLC i have found the home of the driver for the  RTL8111/8168B.  http://homepage2.nifty.com/mrym3/taiyodo/eng/

This driver is called gani Driver link here

This page has a good bit on moving from rge to gani driver…. http://schlaepfer.nine.ch/twiki/bin/view/Schlaepfer/SelfMadeNas2. The only problem is that creating the gani driver doest seem to be straight forward.

1. In /etc/driver_aliases find rge “pci10ec,8168” and exchange it with gani “pci10ec,8168”
2. Move /etc/hostname.rge0 to /etc/hostname.gani0
3. Reboot the system

Update2: I thought i had this driver working properly, but after a reboot everything stopped. I couldn’t even ping an ip on the same subnet. Driver was still loaded as i could ping my own ip.

Now i’m looking into the parameters on the rge driver. To get a list of the variables the device has to modify type…

ndd -get /dev/rge0 \?

of the parameters that are listed only the read and write ones can be changed. adv_pause_cap relates to duplex settings and adv_1000fdx_cap relates to speed. If you disable either of these parameters then they are not negotiated with your switch. Probably not worth touching these ones unless you want to run a gb card at 100 half duplex or something.

I’m experimenting with disabling adv_asym_pause_cap at the moment to see if that helps. By default this is enabled. This can be disabled via..

ndd -set /dev/rge0 adv_asym_pause_cap 0

Update3: so far so good? — the above seems to have removed the issue. I still have the  ip:dohwcksum = 0 setting in the /etc/system file. I might try removing that.

Update4: removing ip:dohwcksum = 0 did not re-create the issue – so leaving it off.

Update5: problem came back (but took much longer to appear). Hmmm…..

Now I’ve got another problem with the rge driver. My CIFS write speed has dropped right back to about 2MB/s. There doesn’t seem to be any issues with the read speed which still pulls through about 70MB/s.

It doesn’t seem to be a CPU bottleneck, so again I’m blaming the rge drivers…  The adv_asym_pause_cap parameter did not seem to make any difference to this particular issue – so I’m not blaming that. I’m currently stuck on this one. hmmm…

Looks like i’m going to have to give up on this one and get a Intel pci-e card. I’ll update this post if a new card fixes all the above problems (therefore pointing at the rge driver as the culprit)

Update6: I’ve got the Intel card, and the problems have not re-appeared as of yet. I’ll update if the problem does show itself, but i believe the problem was the rge driver. Hopefully the rge driver is fixed / updated in future releases of opensolaris.

Please leave a message if anyone has made any progress with the rge driver. Cheer.

OpenSolaris – Manual Network DNS issue

If you have tried to setup a manual IP on your opensolaris box you may find that DNS is not working as you would expect in some cases. nslookup resolves the name to an ip, but pinging doesnt make it to the box…

How to fix;

Edit your /etc/nsswitch.conf file and add the word “dns to the hosts and ipnodes lines
If you make a backup of /etc/nsswitch.conf you can also just copy /etc/nsswitch.dns over it…

cp /etc/nsswitch.dns /etc/nsswitch.conf

You may also want to check that auto-magic mode has been disabled when setting up your networking manually;

svcs -a | grep nwam

If it is enabled type;

svcadm disable svc:/network/physical:nwam