Re: [zones-discuss] Possible to use zones for hardening? Security?

2010-11-26 Thread Paul van der Zwan
On 26 Nov 2010, at 10:50 , Orvar Korvar wrote: petrben, Yes that is my question too: is running in a local zone safer?. That is why I created this thread. I was thinking something like this: If someone hacks my WinXP, then he must bypass VBox. Then he is inside the local zone. Then he

Re: [zones-discuss] Not all zones will start at system boot on b133

2010-03-12 Thread Paul van der Zwan
On 03/ 1/10 04:20 AM, Paul van der Zwan wrote: When I boot my b133 system not all zones will get started, even when they are marked with auto-boot = yes. In the smf log /var/svc/log/system-zones:default.log I see: [ Feb 26 21:14:44 Enabled. ] [ Feb 26 21:15:09 Executing start method (/lib/svc

[zones-discuss] Error on zoneadm attach -u when going from b132 to b133

2010-02-22 Thread Paul van der Zwan
I upgraded my system from b132 to b133 this weekend and I got error messages when I ran attach -u to upgrade my zones. The second run of the install of updated packages fails. In the log I find: $ pfexec cat /var/tmp/dns.attach_log.sCaydi [Saturday, 20 February 2010 20:57:50 CET] Log File:

Re: [zones-discuss] Error on zoneadm attach -u when going from b132 to b133

2010-02-22 Thread Paul van der Zwan
On 22 feb 2010, at 12:02, Frank Batschulat (Home) wrote: On Mon, 22 Feb 2010 11:49:46 +0100, Paul van der Zwan paul.vanderz...@sun.com wrote: I upgraded my system from b132 to b133 this weekend and I got error messages when I ran attach -u to upgrade my zones. The second run

Re: [zones-discuss] [osol-discuss] Error on zoneadm attach -u when going from b132 to b133

2010-02-22 Thread Paul van der Zwan
On 22 feb 2010, at 12:26, Alan Burlison wrote: Paul van der Zwan wrote: If I run attach -u a second time it attaches without doing anything, or giving an error. Are my zones OK or are they partly upgraded ? Sounds like an issue mentioned in the release notes: http

Re: [zones-discuss] [osol-discuss] GDM connect to GDM in a zone ?

2010-02-02 Thread Paul van der Zwan
On 2 feb 2010, at 00:54, Brian Cameron wrote: Paul: Is it possible to run GDM inside a zone on b131 ? I would like to have a zone I can use to run stuff like netbeans etc in, and I don’t want to use the global zone for that. It would think that it should be possible, though I have

[zones-discuss] GDM connect to GDM in a zone ?

2010-02-01 Thread Paul van der Zwan
Is it possible to run GDM inside a zone on b131 ? I would like to have a zone I can use to run stuff like netbeans etc in, and I don’t want to use the global zone for that. As far as I can tell the gdm smf service depends on dbus and that is marked as global zone only. One more complication is

[zones-discuss] Downgrading zones on Opensolaris 2009.x ( b131)

2010-01-25 Thread Paul van der Zwan
I have upgraded my Opensolaris system to b131 and followed the zoneadm detach/attach -u procedure to upgrade my zones to b131 as well. Unfortunately I am running into bug 6912829 ( causes panic on zoneadm halt ) quite often. Downgrading the global zone by beadm activating my old be is easy. But

Re: [zones-discuss] Zone with IP address from a different subnet

2008-06-06 Thread Paul Van Der Zwan
James Carlson writes: Steffen Weiberle writes: BTW, this only works for default routes. Static ones don't work. at least that is my/others' experience. That's not true. Default routes are not supposed to be special. They're just regular network routes that happen to

Re: [zones-discuss] Patches via Live Upgrade with 2 zones on Solaris 10 Update 4 failed

2008-03-07 Thread Paul Van Der Zwan
Have you tried a luactivate directly after the lumake ? There is a bug in cpio that causes lucreate to fail to create the zones in the new be when there is a server in the zone that uses unix domain sockets. One server I had that caused the problem was the admin server used for

Re: [zones-discuss] exclusive-ip

2007-12-11 Thread Paul van der Zwan
On 11 Dec 2007, at 13:23, caroline wrote: Hi, I set up exclusive-ip zone, using theses instructions : set ip-type=excluse add net set physical=ce The ce interface currently cannot be used with exclusive ip instances. Look at the crosbow faq for supported network interfaces:

[zones-discuss] Shared-ip routing and VNI interface

2007-12-03 Thread Paul Van Der Zwan
I'm having a problem figuring out why my ping replies never get sent. I have a Blade 1500 running Solaris 10 08/07 On it I have 2 active local zones, zone1 and zone2, their configs are: # zonecfg -z zone1 export create -b set zonepath=/zones/zone1 set autoboot=false set ip-type=shared add

Re: [zones-discuss] Shared-ip routing and VNI interface

2007-12-03 Thread Paul van der Zwan
On 3 Dec 2007, at 12:49, James Carlson wrote: Paul Van Der Zwan writes: I'm having a problem figuring out why my ping replies never get sent. There's no way for any of your configured zones to transmit, so they don't. Vni is really not much different from lo0. You cannot transmit packets