Showing posts with label Boot Environments. Show all posts
Showing posts with label Boot Environments. Show all posts

Sunday, May 26, 2013

GRUB menu

There's a few things we can do to customize the GRUB menu.
In general I tend to keep the defaults as much as possible.
One little thing I always like to touch is the entries' texts.

By default GRUB menu entries get the same name as a corresponding BE.
When I update a system I use specify the new version as the BE name such as:

# pkg update --be-name 11.1-7.5.0
# beadm create -e 11.1-7.5.0 11.1-7.5.0-bk

As a side effect, this generates a corresponding GRUB menu entry such as:

# bootadm list-menu
...

0 Oracle Solaris 11.1
1 11.1-7.5.0
2 11.1-7.5.0-bk

 
This is convenient and expected, but it isn't very cute.
For example, I'd like to prepend the "Oracle Solaris" string.

Of course we can manually edit the appropriate file as in previous releases.
In fact, that used to be the only way to customize anything about GRUB.
Fortunately (or not) we now count on bootadm sucommands:

# bootadm
...

bootadm set-menu ... key=value
bootadm list-menu ... -i
bootadm add-entry ... 
bootadm remove-entry ... -i
bootadm change-entry ... -i {key=value}+ [set-default]
bootadm generate-menu [-f] ...


In particular, for the purpose of this post if suffices to me just the following:

# bootadm change-entry -i 1 title="Oracle Solaris 11.1-7.5.0"
# bootadm change-entry -i 2 title="Oracle Solaris 11.1-7.5.0-bk"
# bootadm list-menu
...

0 Oracle Solaris 11.1
1 Oracle Solaris 11.1-7.5.0
2 Oracle Solaris 11.1-7.5.0-bk


That's really cool, safe and more comfortable than manual editing.
Check bootadm(1M) for more detail.

For example, it's now easy to create boot entries for:
  • single user mode/state (kernel argument -s).
  • backups on another ZFS pool
    

Friday, April 26, 2013

GRUB password

Nowadays I'd say it's hard to believe that anything is really secure.
Nevertheless one can keep going adding more and more barriers.
The idea is not to be selected as an easier path to attack.
But again, if someone is determined who can tell...

Despite this gave introduction, my goal is to repeat one known tiny bit:
Help preventing unauthorized GRUB configuration change by adding a password.
The method below isn't for GRUB2 (the next generation), but for the older version.

Locate the grub menu file where to configure the password:

# bootadm list-menu
the location ... is: /rpool/boot/grub/menu.lst
default 4
timeout 15
...


Invoke the grub binary to create the password.
Take note of the resulting encrypyted hash.

# /boot/grub/bin/grub
 
    GNU GRUB  version 0.97  (640K lower / 65536K upper memory)
 [ ...
   ...
   ... ]


grub> md5crypt

Password: ***************
Encrypted: $1$...


grub> quit

Edit the grub menu file and include the generated password hash as shown below:

# head -7 /rpool/boot/grub/menu.lst
splashimage /boot/grub/splash.xpm.gz
foreground 343434
background F7FbFF
default 4
timeout 15
password --md5 $1$...
#---------- ADDED BY BOOTADM - DO NOT EDIT ----------

...
 
That's all what's need for GRUB1.
For GRUB2 I'm still trying to learn how to do it.
   

Thursday, September 6, 2012

Custom JumpStart flash install

Assume that the setup is according to Custom JumpStart framework setup.
Consider 192.168.0.12 as the IP address of the js-01 X86 Custom JumpStart server.
 
Solaris have always addressed the enterprise needs.
Automated installation is just another example of that.
All that's needed is already included built-in.
 
Solaris is continuously evolving and since Solaris 10 U9, support for Flash Archives have been incorporated to ZFS-root-based Custom JumpStart installations.
 
Compared to the conventional process, the flash install option is simpler.
The main benefit is that a fully updated system can be deployed in one step.
The conventional process requires a time-consuming post-installation update.
Since Solaris has many updates, currently U10 for Solaris 10, the catch-up is long.
Nonetheless, the conventional process is still invaluable to get to consistent images.
 
Another benefit is that it can be part of a disaster recovery procedure for a global zone (GZ).
This assumes, of course, that the non-global zones are backed up by other means.
My preferred NGZ backup option is through ZFS snapshots and streams.

The initial step is, of course, to create a Flash Archive base installation image.
As mentioned, the conventional Custom JumpStart can be used as a starting point.
In fact, I'd say that, for consistency, it's the preferred way to start creating an image.
  
Don't create NGZs for applications yet as they'll be carried out on a later phase.
  
Next, fully update the system.
Begin by applying the most recent patchset for the bulk part.
Wrap up by taking advantage of smpatch for a more fine grained control. 
Use no alternate BEs (ABE) as they aren't supported in the image.
   
Perform some clean-up before creating the image. 
Verify /var/tmp and possibly delete /var/run and inactive BEs (boot environments).
  
Finally, archive the image to where it can be used by Custom JumpStart.
 
js-01:~ # zfs create
            -o mountpoint=/images
            -o sharenfs='rw=base-01,ro=...' ...
js-01:~ # chmod 1777 /images 
 
base-01:~ # mount -F lofs -o nosub / /mnt
base-01:~ # [ -d /mnt/var/run ] && rm -r /mnt/var/run
base-01:~ # ls -la /mnt/var
base-01:~ # umount /mnt
base-01:~ # rm -r /var/tmp/...
base-01:~ # ludelete -R
 
base-01:~ # flarcreate
              -S -n base-01 /net/js-01/images/base-01.flar
 
js-01:~ # chown root:root /images/base-01.flar
  
If not going to use a Flash Archive file anytime soon, consider compressing it.
To achieve the highest compression ratio 7za is the answer.
 
# 7za a base-01{,.flar}
# [ -f base-01.7z ] && rm base-01.flar
  
A few adjustments to the Custom JumpStart profile and rules are needed as follows:
  
# cat rules

# keyword value   begin-script  profile          finish-script
# ------- ------- ------------- ---------------- ---------------
  karch   i86pc   -             profile_x86_flar finish_x86_flar

# cat profile_x86_flar
#
# keyword               value
# --------------------  -------------------------------------
  install_type          flash_install
  archive_location      nfs 192.168.0.12:/images/base-01.flar
  partitioning          explicit
  pool                  rpool auto auto auto mirror any any


# cat finish_x86_flar
#!/bin/sh
  
BASE=/a
BIN=$BASE/usr/bin
SBIN=$BASE/usr/sbin

#................................................................
# X86 fix - The boot device isn't where Solaris was installed
  
$BIN/sync
$SBIN/reboot
   
There's still one important problem: patching the boot miniroot.
Due to the natural evolution of ZFS, the miniroot must be updated accordingly.
The original booting miniroot can't handle the recent ZFS updates on a fully updated image.
   

Monday, February 27, 2012

Introducing the smpatch update tool

I think that the regularly updated patchsets are great to update baseline images.
But in my opinion, smpatch is the best tool to maintain Solaris 10 up to date.
It's simple to use yet very powerful in getting the job done.
It's built-in and easy to configure as well.

Here's a few goodies:

  • Update level analysis;
  • Download specific patches;
  • Perform partial or full updates;
  • Target a specific boot-environment (BE);
  • Update Solaris 10 zones in Solaris 11 system.

Furthermore, it's possible to point to a local update proxy/cache of patches.
This offloads the Internet link by avoiding redundant downloads.
Of course, it speeds up the update process as well.
This mode doesn't require system registration.