Re: [zones-discuss] Interfaces to automate zone system
Hi Tomas, Tomas Heran wrote: Hi Zoram, you might want to take a look at Project Duckwater - Simplified name services management: http://www.opensolaris.org/os/project/duckwater/. Now, Duckwater's command for creating and managing name services configuration - nscfg(1M) - doesn't know anything about zones, but I can add an RFE for us to be able to export a name service profile (the set of all name service configuration) into a file which you can later import somewhere else - e.g. you would configure name services in global zone, then exported this configuration (using nscfg) into a file and later imported this file (again, using nscfg) into your non-global zone(s). Would that work for you? This sounds promising. My basic requirement is that I should be able to non-interactively install and boot a zone (why? because interactive install/boot is too tedious in a multi-node environment like Sun Cluster). The user, if he wishes to, can explicitly enter the sysidcfg(4) parameters for the zone. But we expect that in most cases the only thing that would be different would be the root password (it would be unwise to have the same root password for global and non-global zones), and for the rest of the parameters use either a. global zone settings (name service, nfsv4 domain, security policy, timezone,...) or b. reasonable defaults (e.g., terminal) Stable interfaces to query name service configuration of the global zone (or any zone for that matter) will be a great help. Thanks, Zoram Regards, Tomas This message posted from opensolaris.org ___ zones-discuss mailing list zones-discuss@opensolaris.org -- Zoram Thanga::Sun Cluster Development::http://blogs.sun.com/zoram ___ zones-discuss mailing list zones-discuss@opensolaris.org
Re: [zones-discuss] Interfaces to automate zone system
Actually it is kind of there already. Put a command in /usr/bin in the global zone that displays the Global zone name. This shared file system it is available to the local zones. When you build a full zone, this command goes with it. The only issue is if you change the Global zone name on a system, the full zone will need to be updated. Very rare. See: http://www.logiqwest.com/dataCenter/Demos/RunBooks/Zones/listingGlobal.html My concern is this functionality is actually a security violation. Konstantin Gremliza wrote: Hi there, I have a question regarding zonemgr. We would like to use lofs to mount (ro) a file /etc/GLOBAL into the zones. It should contain the name of the global zone so anyone can easily find out, what system he is really on. Zonemgr 1.8 only supports directories for readonly lofs mounts: option -r Can it be changed to support files ? Thanks and regards, Konstantin ___ zones-discuss mailing list zones-discuss@opensolaris.org -- Michael Barto Software Architect LogiQwest Inc. 16458 Bolsa Chica Street, # 15 Huntington Beach, CA92649 http://www.logiqwest.com/ [EMAIL PROTECTED] Tel:714 377 3705 Fax:714 840 3937 Cell: 714 883 1949 'tis a gift to be simple This e-mail may contain LogiQwest proprietary information and should be treated as confidential. ___ zones-discuss mailing list zones-discuss@opensolaris.org
[zones-discuss] Interfaces to automate zone system identification
Hi All,
I'd like to automate system identification for a zone when it is freshly
installed. In most cases, I'd like to keep the same settings for domain
name, name service, security policy, etc., as in the global zone.
I'm wondering if there are (C) library interfaces to determine which
name service is used in the global zone, so that I can make the
following entry in the zone's /etc/sysidcfg file:
name_service=service{service specific parameters}
So, I'd like do something like:
name_service = get_name_service()
if (name_service is NIS) {
/* get domain name */
/* get yp master */
} else if (name_service is NIS+) {
/* get NIS+ details */
} else if (name_service is LDAP) {
/* get LDAP details */
} else if (name_service is DNS) {
/* get DNS details */
} ...
Also, is there a library interface to get what the security_policy
setting is in the global zone? So I want to do something like:
security_policy = get_security_policy()
if (security_policy is kerberos) {
/* get kerberos details */
} else if ...
...
Thanks,
Zoram
--
Zoram Thanga::Sun Cluster Development::http://blogs.sun.com/zoram
___
zones-discuss mailing list
zones-discuss@opensolaris.org
Re: [zones-discuss] Interfaces to automate zone system identification
Hi Mike,
Mike Gerdts wrote:
On Nov 15, 2007 4:04 AM, Zoram Thanga [EMAIL PROTECTED] wrote:
Hi All,
I'd like to automate system identification for a zone when it is freshly
installed. In most cases, I'd like to keep the same settings for domain
name, name service, security policy, etc., as in the global zone.
It sounds like simply copying in whole or part the relevant files from
the global zone and making the appropriate modifications to
$zonepath/root/etc/.sysid* (forget the exact file name) would be a
workable approach. This would have to be done from the global zone.
Yes, the program will only run in the global zone, and only once after
the new zone is installed.
However, I'm wondering if we can count on the presence of /etc/sysidcfg
on the global zone. Once a system has been initialized, we could safely
remove /etc/sysidcfg and there would be no problem, right?
I'm wondering if there are (C) library interfaces to determine which
name service is used in the global zone, so that I can make the
following entry in the zone's /etc/sysidcfg file:
To the best of my knowledge, such an API is not even available to
query in the same zone (e.g. global zone querying global zone). Such
an API that allowed cross-zone queries of this information would cross
isolation boundaries that have been held rather dear with zones.
No, I am not looking to cross zone boundaries here - just obtain all the
necessary information from the global zone and apply them to the freshly
installed NGZs. Of course, if the user wants to specify sysid settings
that are different from those of the global zone, she would be allowed
to do so. But if she just wants to re-use the same name service setting,
security policy setting, etc, then that's when I'd like to query the GZ
for those informations.
name_service=service{service specific parameters}
So, I'd like do something like:
name_service = get_name_service()
if (name_service is NIS) {
/* get domain name */
/* get yp master */
} else if (name_service is NIS+) {
/* get NIS+ details */
} else if (name_service is LDAP) {
/* get LDAP details */
} else if (name_service is DNS) {
/* get DNS details */
} ...
This approach, much like the one used by sysidconfig, is broken. What
happens when you use LDAP for everything except hosts and DNS for
hosts? If you are coming up with a new solution for setting up naming
services, please don't repeat this mistake.
Yes. I am aware of the complications, and no we're not trying to come up
with new naming service solutions :) I just want to know how to query
the settings when the user says use the same settings as in the GZ.
You may want to take a look at zonemgr. It will do quite a bit of
customization of a zone without interaction and may be just what you
are looking for.
I'll take a look. Can zonemgr query the settings if the user didn't
specify them?
Thanks,
Zoram
--
Zoram Thanga::Sun Cluster Development::http://blogs.sun.com/zoram
___
zones-discuss mailing list
zones-discuss@opensolaris.org
