Tuesday, April 15, 2008

Learn 10 more good UNIX usage habits

As a follow-up to Michael Stutz's excellent article, this article provides 10 more good habits to adopt that will improve your UNIX® command-line efficiency. Learn about common errors and how to overcome them, and discover exactly why these 10 UNIX habits are worth picking up!

Let's face it: Bad habits are hard to break. But habits that you've just become comfortable with can be even more difficult to overcome. Sometimes, a fresh look at things may provide you with an "A-ha, I didn't know you could do that!" moment. Building on Michael Stutz's excellent article, "Learn 10 good UNIX usage habits," this article suggests 10 more UNIX command-line commands, tools, and techniques that may make you more productive as a UNIX command-line wizard.

The 10 additional good habits you should adopt are:

  • Use file name completion.
  • Use history expansion.
  • Reuse previous arguments.
  • Manage directory navigation with pushd and popd.
  • Find large files.
  • Create temporary files without an editor.
  • Use the curl command-line utility.
  • Make the most of regular expressions.
  • Determine the current user.
  • Process data with awk.

Use file name completion

Wouldn't it be great if you didn't have to type a long, convoluted file name at the command prompt? Well, you don't, as it turns out. You can configure the most popular UNIX shells for file name completion, instead. This functionality works a bit differently in each shell, so I show you how to use file name completion in the most popular shells. File name completion allows you to type faster and avoid errors. Lazy? Perhaps. More efficient? Definitely!

Which shell am I running?

What happens if you don’t know which shell you're currently running? Although this trick isn't officially part of the 10 more good habits, it's still pretty useful. As shown in Listing 1, you can use the echo $0 or ps –p $$ command to display the shell you're using. In my case, I'm running the Bash shell.


Listing 1. Determine your shell
 
                
$ echo $0
-bash
$ ps –p $$
PID TTY           TIME CMD
6344 ttys000    0:00.02 –bash

 

C shell

The C shell supports the most straightforward file name completion. Setting the filec variable enables the functionality. (You can use the command set filec). After you start typing the name of a file, you can click Escape, and the shell fills in the name of the file—or as much as it can. For example, say you have files named file1, file2, and file3. If you type f, then click Escape, file will be filled out, and you'll have to type the 1, 2, or 3 to complete the appropriate file name.

Bash

The Bash shell also provides file name completion but uses the Tab key instead of the Escape key. You don't need to set anything to enable file name completion in the Bash shell; it's set by default. Bash also implements an additional feature. After typing a portion of a file name, then clicking Tab, if you reach that point at which multiple files satisfy your request and you need to add text to select one of the files, you can click Tab twice more for a list of the files that match what you have typed so far. Using the earlier examples of files named file1, file2, and file3, start by typing f. When you click Tab once, Bash completes file; clicking Tab one more time expands the list of file1 file2 file3.

Korn shell

For Korn shell users, file name completion depends on the value of the EDITOR variable. If EDITOR is set to vi, you type part of name, and then click Escape followed by a backslash (\) character. If EDITOR is set to emacs, you type part of the name, and then click the Escape key twice to complete the file name.

Use history expansion

What happens if you're using the same file name for a series of commands? Well, there's a shortcut that can quickly retrieve the last file name you used. As shown in Listing 2, the !$ command returns the file name that the previous command used. The file this-is-a-long-lunch-menu-file.txt is searched for occurrences of the word pickles. After searching, the vi command is used to edit the this-is-a-long-lunch-menu-file.txt file without the need for retyping the file name. You use the bang, or exclamation point (!), to access the history, and the dollar sign ($) returns the last field of the previous command. It's a great tool if you are using long file names repeatedly.


Listing 2. Using !$ to retrieve the last file name used with a command
 
                
$ grep pickles this-is-a-long-lunch-menu-file.txt
pastrami on rye with pickles and onions
$ vi !$      

 

Reuse previous arguments

The !$ command returns the last argument used with a command. But what happens if you have a command that used arguments and you want to reuse just one of them? The !:1 operator returns the argument used in a command. The example in Listing 3 shows how you can use this operator in combination with the !$ operator. In the first command, a file is renamed to a more meaningful name, but to preserve use of the original file name, a symbolic link is created. The file kxp12.c is renamed in a more readable manner, then the link command is used to create a symbolic link back to the original file name, in case it's still used elsewhere. The !$ operator returns the file_system_access.c argument, and the !:1 operator returns the kxp12.c argument, which is the first argument of the previous command.


Listing 3. Using !$ and !:1 in combination
 
                
$ mv kxp12.c file_system_access.c
$ ln –s !$ !:1

 

Manage directory navigation with pushd and popd

UNIX supports a wide variety of directory-navigation tools. Two of my favorite productivity tools are pushd and popd. You're certainly aware that the cd command changes your current directory. What happens if you have several directories to navigate, but you want to be able to quickly return to a location? The pushd and popd commands create a virtual directory stack, with the pushd command changing your current directory and storing it on the stack, and the popd command removing the directory from the top of the stack and returning you to that location. You can use the dirs command to display the current directory stack without pushing or popping a new directory. Listing 4 shows how you can use the pushd and popd commands to quickly navigate the directory tree.


Listing 4. Using pushd and popd to navigate the directory tree
 
                
$ pushd .
~ ~
$ pushd /etc
/etc ~ ~
$ pushd /var
/var /etc ~ ~
$ pushd /usr/local/bin
/usr/local/bin /var /etc ~ ~
$ dirs
/usr/local/bin /var /etc ~ ~
$ popd
/var /etc ~ ~
$ popd
/etc ~ ~
$ popd
~ ~
$ popd

 

The pushd and popd commands also support parameters to manipulate the directory stack. Using the +n or -n parameter, where n is a number, you can rotate the stack left or right, as shown in Listing 5.


Listing 5. Rotating the directory stack
 
                
$ dirs
/usr/local/bin /var /etc ~ ~
$ pushd +1
/var /etc ~ ~ /usr/local/bin
$ pushd -1
~ /usr/local/bin /var /etc ~

 

Find large files

Need to find out where all your free disk space went? Here are a couple of tools you can use to manage your storage. As shown in Listing 6, the df command shows you the total number of blocks used on each available volume and the percentage of free space.


Listing 6. Determining volume usage
 
                
$ df
Filesystem                            512-blocks      Used  Available Capacity  Mounted on
/dev/disk0s2                           311909984 267275264   44122720    86%    /
devfs                                        224       224          0   100%    /dev
fdesc                                          2         2          0   100%    /dev
map -hosts                                     0         0          0   100%    /net
map auto_home                                  0         0          0   100%    /home

 

Want to find the largest files? Use the find command with the -size parameter. Listing 7 shows how to use the find command to find files larger than 10MB. Note that the -size parameter takes a size in kilobytes.


Listing 7. Find all files larger than 10MB
 
                    
$ find / -size +10000k –xdev –exec ls –lh {}\;

 

Create temporary files without an editor

This is a simple one: You need to quickly create a simple temporary file but don't want to fire up your editor. Use the cat command with the > file-redirection operator. As shown in Listing 8, using the cat command without a file name simply echoes anything typed to standard input; the > redirection captures that to the specified file. Note that you must provide the end-of-file character when you're finished typing—typically, Ctrl-D.


Listing 8. Quickly create a temporary file
 
                 
$ cat > my_temp_file.txt
This is my temp file text
^D
$ cat my_temp_file.txt
This is my temp file text

 

Need to do the same thing but append to an existing file instead of creating a new one? As shown in Listing 9, use the >> operator, instead. The >> file-redirection operator appends to an existing file.


Listing 9. Quickly append to a file
 
                
$ cat >> my_temp_file.txt
More text
^D
$ cat my_temp_file.txt
This is my temp file text
More text

 

Use the curl command-line utility

I can access the Web from the command line? Are you crazy? No, it's just curl! The curl command lets you retrieve data from a server using the HTTP, HTTPS, FTP, FTPS, Gopher, DICT, TELNET, LDAP, or FILE protocols. As shown in Listing 10, I can use the curl command to access the current local conditions of the National Weather Service for my location (Buffalo, NY). When combined with the grep command, I can retrieve the conditions in Buffalo. Use the -s command-line option to suppress curl processing output.


Listing 10. Retrieve the current weather conditions with curl
 
                
$ curl –s http://www.srh.noaa.gov/data/ALY/RWRALY | grep BUFFALO
BUFFALO        MOSUNNY   43  22  43 NE13      30.10R

 

As shown in Listing 11, you can also use the curl command to download HTTP-hosted files. Use the -o parameter to specify where the output is saved.


Listing 11. Use curl to download HTTP-hosted files
 
                
$ curl -o archive.tar http://www.somesite.com/archive.tar

 

This is really just a hint of what you can do with curl. You can start exploring a bit more simply by typing man curl at your command prompt to display the complete usage information for the curl command.

Make the most of regular expressions

Many UNIX commands use regular expressions as arguments. Technically speaking, a regular expression is a string (that is, a sequence of characters composed of letters, numbers, and symbols) that represents a pattern defining zero or more strings. A regular expression uses meta-characters (for example, the asterisk [*] and question mark [?] symbols) to match parts of or whole other strings. A regular expression doesn't have to contain wildcards, but wildcards can make regular expressions useful for searching for patterns and manipulating files. Table 1 shows some basic regular expression sequences.


Table 1. Regular expression sequences
 
Sequence Description
Caret (^) Matches the expression at the start of a line, as in ^A
Question mark (?) Matches the expression at the end of a line, as in A?
Backslash (\) Turns off the special meaning of the next character, as in \^
Brackets ([]) Matches any one of the enclosed characters, as in [aeiou] (Use a hyphen [-] for a range, as in [0-9].)
[^ ] Matches any one character except those enclosed in brackets, as in [^0-9]
Period (.) Matches a single character of any value except end of line
Asterisk (*) Matches zero or more of the preceding characters or expressions
\{x,y\} Matches x to y occurrences of the preceding
\{x\} Matches exactly x occurrences of the preceding
\{x,\} Matches x or more occurrences of the preceding

Listing 12 shows some of the basic regular expressions used with the grep command.


Listing 12. Using regular expressions with grep
 
                
$ # Lists your mail
$ grep '^From: ' /usr/mail/$USER   
$ # Any line with at least one letter  
$ grep '[a-zA-Z]'  search-file.txt
$ # Anything not a letter or number
$ grep '[^a-zA-Z0-9] search-file.txt
$ # Find phone numbers in the form 999-9999 
$ grep '[0-9]\{3\}-[0-9]\{4\}' search-file.txt
$ # Find lines with exactly one character
$ grep '^.$' search-file.txt
$ #  Find any line that starts with a period "."          
$ grep '^\.' search-file.txt 
$ # Find lines that  start with a "." and 2 lowercase letters
$ grep '^\.[a-z][a-z]' search-file.txt

 

Many books have been written just about regular expressions. For a more in-depth look at command-line regular expressions, I suggest the developerWorks article, "Speaking UNIX, Part 9: Regular expressions."

Determine the current user

At times, you may have an administrative script that you want to make sure a certain user has or has not executed. To find out, you can use the whoami command to return the name of the current user. Listing 13 shows the whoami command run on its own; Listing 14 shows an excerpt from a Bash script using whoami to make sure the current user isn't root.


Listing 13. Using whoami from the command line
 
                
$ whoami
John


Listing 14. Using whoami in a script
 
                
if [ $(whoami) = "root" ]
then
   echo "You cannot run this script as root."
   exit 1
fi

 

Process data with awk

The awk command always seems to live in the shadows of Perl, but it can be a quick, useful tool for simple command-line-based data manipulation. Listing 15 shows how to get started with the awk command. To get the length of each line in the file text, use the length() function. To see if the string ing is present in the file text, use the index() function, which returns the location of the first occurrence of ing so that you can use it for further string processing. To tokenize (that is, split a line into word-length pieces) a string, use the split() function.


Listing 15. Basic awk processing
 
                
$ cat text
testing the awk command
$ awk '{ i = length($0); print i }' text
23
$ awk '{ i = index($0,”ing”); print i}' text
5
$ awk 'BEGIN { i = 1 } { n = split($0,a," "); while (i <= n) {print a[i]; i++;} }' text
testing 
the
awk
command

 

Printing specified fields of text file is a simple awk task. In Listing 16, the sales file consists of each salesperson's name followed by a monthly sales figure. You can use the awk command to quickly total the sales for each month. By default, awk treats each comma-separated value as a different field. You use the $n operators to access each individual field.


Listing 16. Using awk for data summarization
 
                
$cat sales
Gene,12,23,7
Dawn,10,25,15
Renee,15,13,18
David,8,21,17
$ awk -F, '{print $1,$2+$3+$4}' sales
Gene 42
Dawn 50
Renee 46
David 46

 

The awk command can be complex and used in a wide variety of situations. To explore the awk command more fully, start with the command man awk in addition to the resources mentioned in the Resources.

Conclusion

Becoming a command-line wizard takes a bit of practice. It's easy to keep doing things the same way simply because you're used to it. Expanding your command-line resources can provide a big increase in your productivity and propel you toward becoming a UNIX command line wizard!

Install WAS CE V1.x on Linux

Learn to make use of the Kerberos authentication tickets in the day-to-day network services on IBM® AIX® V6 and discover how Kerberos can be useful in getting rid of the password hassles for network service logons. This is another method towards achieving single sign on (SSO) on an AIX system network.

Introduction

The network applications in AIX (for instance, telnet, FTP, and r-commands like rlogin, rsh, rcp, and more) inherently support Kerberos authentication. All the administrators need to do is to install and configure Kerberos and configure AIX system (in turn its applications) to use that Kerberos setup for authentication. The Kerberos authentication means that once you have a valid Kerberos ticket (obtained by a manual /usr/krb5/bin/kinit or integrated login), the network applications can use this ticket as your authentication token and once authenticated successfully, you will be given access without being asked to enter your password.

Basic configuration

In order to enable Kerberos authentication, some common basic configuration is required on Kerberos front as well as on the AIX systems. Let's glance through them.

Kerberos configuration

  • Make one server machine the Kerberos master KDC (Key Distribution Center). This machine will be responsible for all the Kerberos-related tasks such as generating tickets, authenticating users, and more. Here the administrator needs to install and configure IBM Network attached storage (NAS) (preferably version 1.4.0.7 or latest) as a master KDC.
  • All the other machines in your network (from where you are going to use telnet, FTP, or r-commands to log in), install, and configure IBM NAS as a client to the master KDC.
  • These are the machines where the telnet / FTP daemons are running and from the clients you will be connecting to this machine. Install and configure IBM NAS as a client to the master KDC on these machines, too.

For complete instructions on the IBM NAS server and client installation and configuration, please refer to the IBM NAS Version 1.4 Administration Guide, shipped with the AIX Version 5.3 Expansion Pack CD.

For the examples in this article, I refer to an example Kerberos environment. The Figure 1shows that enviroment and the logical flow of information.


Figure 1: An example showing Kerberized telnet in action
Figure 1: An example showing Kerberized telnet in             action
 

The following definitions are used throughout the article:
Kerberos Administrator Name:
admin/admin

Kerberos Realm Name:
ISL.IN.IBM.COM

IBM NAS 1.4.0.7 Master KDC:
Hostname: land.in.ibm.com Port: 88
OS: AIX 5.3

IBM NAS 1.4.0.7 Administration Server:
Hostname: land.in.ibm.com Port: 749
OS: AIX 5.3

IBM NAS 1.4.0.7 Client:
Hostname: fakir.in.ibm.com
OS: AIX 6.1

Machine with telnet service running:
Hostname: fsaix005.in.ibm.com Port: 23
OS: AIX 5.3

Machine with FTP service running:
Hostname: fsaix005.in.ibm.com Port: 21
OS: AIX 5.3

 

Check and synchronize the time difference between all the machines; it should not be more than 5 minutes. To check the correctness of Kerberos configuration, use '/usr/krb5/bin/kinit admin/admin', followed by '/usr/krb5/bin/klist' and see if you are able to get the Kerberos ticket, and use '/usr/krb5/sbin/kadmin -p admin/admin' to check that everything (time difference and more) is correct.

AIX authentication configuration

In order to make sure that all the network applications try Kerberos authentication before the standard password-based authentication, the administrator needs to change the preference of the authentication method on all the AIX machines.

The '/usr/bin/lsauthent' command shows the current authentication mode preference.

bash-2.05b# /usr/bin/lsauthent
Standard Aix
        

  

To change the authentication mode preference, use the '/usr/bin/chauthent' command.

bash-2.05b# /usr/bin/chauthent -k5 -std
        

  

Now, '/usr/bin/lsauthent' would show something like this:

bash-2.05b# /usr/bin/lsauthent
Kerberos 5
Standard Aix
        

  

Be sure to keep the standard password-based authentication method (-std above), as a fallback authentication method, or else you will not be able to log in to the system if the proper Kerberos login is not enabled.

Configuring Kerberos for telnet service

In the Kerberos environment, each Kerberos service is represented by a service principal. This service principal is nothing but a normal Kerberos principal, who holds the key to decrypt the response sent by the Kerberos server. For telnet service as well, you will need to create a telnet service principal and perform some configuration steps on the telnet server.

Use the following step-by-step process to configure Kerberos for telnet service.

If you have already configured the Kerberos client using the AIX 'mkkrb5clnt' command, then you do not need to do steps 1 and 2. The 'mkkrb5clnt' command created a host service principal and stored it in /var/krb5/security/keytab/<hostname>.keytab file. Link this file to the default keytab file /etc/krb5/krb5.keytab.

  1. On the machine where the telnet service is running (fsaix005.in.ibm.com), create the telnet service principal by the name 'host/<FQDN_telnetd_hostname>'. For us, it will be 'host/fsaix005.in.ibm.com'.

    Using the Fully Qualified Domain Name (FQDN) is very vital for this setup to work.

    bash-2.05b# hostname
    fsaix005.in.ibm.com
    
    bash-2.05b# kadmin -p admin/admin
    Authenticating as principal admin/admin with password.
    Password for admin/admin@ISL.IN.IBM.COM:
    kadmin:  addprinc -randkey host/fsaix005.in.ibm.com
    WARNING: no policy specified for host/fsaix005.in.ibm.com@ISL.IN.IBM.COM;
    defaulting to no policy. Note that policy may be overridden by
    ACL restrictions.
    Principal "host/fsaix005.in.ibm.com@ISL.IN.IBM.COM" created.
            

     
  2. Add the telnet service principal to the keytab file (/etc/krb5/krb5.keytab).
    kadmin:  ktadd host/fsaix005.in.ibm.com
    Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type Triple DES 
          cbc 
      mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type ArcFour 
         with 
      HMAC/md5 added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type AES-256 
        CTS  mode
      with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type DES cbc 
         mode 
      with RSA-MD5 added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type AES-128 
        CTS mode
      with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.
    kadmin:  q
    
    bash-2.05b#
    

     

    If you are not able to do 'kadmin' for some reason, then create the service principal on KDC and add to the keytab file (/etc/krb5/krb5.keytab) and transfer this keytab file to the machine where telnetd is running (fsaix005.in.ibm.com, for us).

  3. On the telnet service machine (fsaix005.in.ibm.com), run '/usr/krb5/bin/klist -k' and check the entries.
    bash-2.05b# hostname
    fsaix005.in.ibm.com
    
    bash-2.05b# /usr/krb5/bin/klist -k
    Keytab name:  FILE:/etc/krb5/krb5.keytab
    KVNO Principal
    ---- ---------
       3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
       3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
       3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
       3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
       3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
    
    bash-2.05b#
            

     
  4. On the telnet service machine (fsaix005.in.ibm.com), create a new user 'vipin' using which you will telnet to fsaix005. Change the password of this user.
    bash-2.05b# hostname
    fsaix005.in.ibm.com
    
    bash-2.05b# mkuser -R files vipin
    
    bash-2.05b# passwd vipin
    Changing password for "vipin"
    vipin's New password:
    Enter the new password again:
    
    bash-2.05b#
            

     
  5. Create a Kerberos principal with the same name 'vipin'. This can be done from any machine (either the master KDC or client) in the Kerberos realm.
    bash-2.05b# hostname
    fsaix005.in.ibm.com
    
    bash-2.05b# kadmin -p admin/admin
    Authenticating as principal admin/admin with password.
    Password for admin/admin@ISL.IN.IBM.COM:
    kadmin:  ank -pw vipin vipin
    WARNING: no policy specified for vipin@ISL.IN.IBM.COM;
      defaulting to no policy. Note that policy may be overridden by
      ACL restrictions.
    Principal "vipin@ISL.IN.IBM.COM" created.
    kadmin:  q
    
    bash-2.05b#
            

     
  6. Go to the any other client machine (fakir.in.ibm.com) on which the Kerberos client is configured. Run '/usr/krb5/bin/kinit vipin' to get the initial Kerberos ticket, as shown below:
    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# /usr/krb5/bin/kinit vipin
    Password for vipin@ISL.IN.IBM.COM:
    
    bash-2.05b# /usr/krb5/bin/klist
    Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
    Default principal:  vipin@ISL.IN.IBM.COM
    
    Valid starting     Expires            Service principal
    02/16/08 04:31:41  02/17/08 04:31:39  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM
    
    bash-2.05b#
            

     
  7. Try to telnet to the telnetd machine (fsaix005.in.ibm.com). If everything goes fine, you will not be asked to enter the password and you will be logged in as user "vipin".
    Here is how:
    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# telnet -l vipin fsaix005.in.ibm.com
    Trying...
    Connected to fsaix005.in.ibm.com.
    Escape character is '^]'.
    [ Kerberos V5 accepts you as ``vipin@ISL.IN.IBM.COM'' ]
    
    
    telnet (fsaix005.in.ibm.com)
    
    *******************************************************************************
    *                                                                             *
    *                                                                             *
    *  Welcome to AIX Version 5.3!                                                *
    *                                                                             *
    *                                                                             *
    *  Please see the README file in /usr/lpp/bos for information pertinent to    *
    *  this release of the AIX Operating System.                                  *
    *                                                                             *
    *                                                                             *
    *******************************************************************************
    Last unsuccessful login: Wed Feb 13 11:50:40 CST 2008 on /dev/pts/2 from 
         land.in.ibm.com
    Last login: Fri Feb 15 12:49:06 CST 2008 on /dev/pts/3 from aixdce8.in.ibm.com
    
    $ hostname
    fsaix005.in.ibm.com
    
    $ id
    uid=237(vipin) gid=1(staff)
    
    $ exit
    Connection closed
    
    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b#
            

     

    That’s all it takes to do the kerberized telnet! Please note the additional option (in the highlighted text above) while issuing the telnet command.

    If you want to check whether you actually got the ticket for the telnet service principal or not, run ‘/usr/krb5/bin/klist’ on the client and see the output. You should see something like this:

    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# /usr/krb5/bin/klist
    Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
    Default principal:  vipin@ISL.IN.IBM.COM
    
    Valid starting     Expires            Service principal
    02/16/08 04:31:41  02/17/08 04:31:39  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM
    02/16/08 04:32:56  02/17/08 04:31:39  host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
    
    bash-2.05b#
            

     


 

Configuring Kerberos for FTP service

Similar to telnet service, you can also configure FTP service to accept and use Kerberos authentication. Use the following step-by-step procedure to achieve this:

  1. Create an FTP service principal. This time the name of FTP service principal would be ‘ftp/<FQDN_ftpd_hostname>’. So for us, it will be something like ‘ftp/fsaix005.in.ibm.com’. Create the principal:
    bash-2.05b# hostname
    fsaix005.in.ibm.com
    
    bash-2.05b# kadmin -p admin/admin
    Authenticating as principal admin/admin with password.
    Password for admin/admin@ISL.IN.IBM.COM:
    kadmin:  ank -randkey ftp/fsaix005.in.ibm.com
    WARNING: no policy specified for ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM;
      defaulting to no policy. Note that policy may be overridden by
      ACL restrictions.
    Principal "ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM" created.
            

     
  2. Now add this principal entry to the keytab file (/etc/krb5/krb5.keytab).
    kadmin:  ktadd ftp/fsaix005.in.ibm.com
    Entry for principal ftp/fsaix005.in.ibm.com with kvno 3, encryption type Triple DES 
        cbc
      mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal ftp/fsaix005.in.ibm.com with kvno 3, encryption type ArcFour 
        with 
      HMAC/md5 added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal ftp/fsaix005.in.ibm.com with kvno 3, encryption type AES-256 CTS 
        mode
      with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal ftp/fsaix005.in.ibm.com with kvno 3, encryption type DES 
        cbc mode with
      RSA-MD5 added to keytab WRFILE:/etc/krb5/krb5.keytab.
    Entry for principal ftp/fsaix005.in.ibm.com with kvno 3, encryption type AES-128 CTS 
        mode
      with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.
    kadmin:  q
    
    bash-2.05b#
            

     
  3. On the FTP service machine (fsaix005.in.ibm.com), run '/usr/krb5/bin/klist -k' and check the entries in the keytab file. This time it should look something like this:
              bash-2.05b# hostname
              fsaix005.in.ibm.com
    
              bash-2.05b# /usr/krb5/bin/klist -k
              Keytab name:  FILE:/etc/krb5/krb5.keytab
              KVNO Principal
              ---- ---------
              3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM
              3 ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM
    
              bash-2.05b#
            

     
  4. The next step is to get the initial Kerberos ticket. Since we already have a Kerberos user called 'vipin', we will be using this principal to get the initial Kerberos ticket by using the '/usr/krb5/bin/kinit' command.
    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# /usr/krb5/bin/kinit vipin
    Password for vipin@ISL.IN.IBM.COM:
    
    bash-2.05b# /usr/krb5/bin/klist
    Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
    Default principal:  vipin@ISL.IN.IBM.COM
    
    Valid starting     Expires            Service principal
    02/16/08 04:47:46  02/17/08 04:47:45  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM
    
    bash-2.05b#
            

     
  5. Once we have a valid ticket, we are all set now to do the kerberized FTP.
    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# ftp fsaix005.in.ibm.com
    Connected to fsaix005.in.ibm.com.
    220 fsaix005.in.ibm.com FTP server (Version 4.2 Sat Jun 16 07:20:05 CDT 2007) ready.
    334 Using authentication type GSSAPI; ADAT must follow
                                GSSAPI accepted as authentication type
                                GSSAPI authentication succeeded
    Name (fsaix005.in.ibm.com:root): vipin
    232 GSSAPI user vipin@ISL.IN.IBM.COM is authorized as vipin
    ftp>
    ftp> bye
    221 Goodbye.
    
    bash-2.05b#
            

     

    To cross-check the kerberized FTP success, you can close the FTP session and do ‘/usr/krb5/bin/klist’ to see the additional ticket of our FTP service principal.

    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# /usr/krb5/bin/klist
    Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
    Default principal:  vipin@ISL.IN.IBM.COM
    
    Valid starting     Expires            Service principal
    02/16/08 04:47:46  02/17/08 04:47:45  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM
    02/16/08 04:49:20  02/17/08 04:49:19  ftp/fsaix005.in.ibm.com@ISL.IN.IBM.COM
    
    bash-2.05b#
            

      

 




 

Configuring Kerberos for r-commands

The AIX r-commands (such as rlogin, rsh, and rcp) also support Kerberos authentication. We are going to take a look at how these commands can make use of a Kerberos ticket to allow us to do our stuff seamlessly.

The Kerberos service principal for all r-commands is going to be 'host/<FQDN_service_hostname>' again, which is the same as the telnet service principal. So, if you have configured the kerberized telnet authentication, then you do not need to do any more configuration steps. Just get the initial Kerberos ticket and fire the r-commands. For example:

Example showing Kerberos authentication in 'rlogin’

 

bash-2.05b# hostname
fakir.in.ibm.com

bash-2.05b# /usr/krb5/bin/kinit vipin
Password for vipin@ISL.IN.IBM.COM:

bash-2.05b# /usr/krb5/bin/klist
Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
Default principal:  vipin@ISL.IN.IBM.COM

Valid starting     Expires            Service principal
04/21/08 08:54:26  04/22/08 08:54:25  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM

bash-2.05b# rlogin fsaix005.in.ibm.com -l vipin
*******************************************************************************
*                                                                             *
*                                                                             *
*  Welcome to AIX Version 5.3!                                                *
*                                                                             *
*                                                                             *
*  Please see the README file in /usr/lpp/bos for information pertinent to    *
*  this release of the AIX Operating System.                                  *
*                                                                             *
*                                                                             *
*******************************************************************************
Last unsuccessful login: Mon Apr 21 07:55:42 CDT 2008 on /dev/pts/1 from 9.182.185.101
Last login: Mon Apr 21 08:01:29 CDT 2008 on /dev/pts/1 from fakir.in.ibm.com

$ hostname
fsaix005.in.ibm.com
$ exit
Connection closed.

bash-2.05b# /usr/krb5/bin/klist
Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
Default principal:  vipin@ISL.IN.IBM.COM

Valid starting     Expires            Service principal
04/21/08 08:54:26  04/22/08 08:54:25  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM
04/21/08 08:54:49  04/22/08 08:54:25  host/fsaix005.in.ibm.com@ISL.IN.IBM.COM

bash-2.05b#
        

  

Example showing Kerberos authentication in 'rsh’

We can also do the Kerberos authentication in ‘rsh’ the same way as the rlogin.

bash-2.05b# hostname
fakir.in.ibm.com

bash-2.05b# /usr/krb5/bin/kinit vipin
Password for vipin@ISL.IN.IBM.COM:

bash-2.05b# /usr/krb5/bin/klist
Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
Default principal:  vipin@ISL.IN.IBM.COM

Valid starting     Expires            Service principal
04/21/08 08:58:08  04/22/08 08:58:39  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM

bash-2.05b# rsh fsaix005.in.ibm.com -l vipin
*******************************************************************************
*                                                                             *
*                                                                             *
*  Welcome to AIX Version 5.3!                                                *
*                                                                             *
*                                                                             *
*  Please see the README file in /usr/lpp/bos for information pertinent to    *
*  this release of the AIX Operating System.                                  *
*                                                                             *
*                                                                             *
*******************************************************************************
Last unsuccessful login: Mon Apr 21 07:55:42 CDT 2008 on /dev/pts/1 from 9.182.185.101
Last login: Mon Apr 21 08:54:58 CDT 2008 on /dev/pts/1 from fakir.in.ibm.com

$ hostname
fsaix005.in.ibm.com
$ exit
Connection closed.

bash-2.05b# /usr/krb5/bin/klist
Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
Default principal:  vipin@ISL.IN.IBM.COM

Valid starting     Expires            Service principal
04/21/08 08:58:08  04/22/08 08:58:39  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM
04/21/08 08:58:33  04/22/08 08:58:39  host/fsaix005.in.ibm.com@ISL.IN.IBM.COM
                

  

Example showing Kerberos authentication in 'rcp’

This example copies a file from one machine (fakir.in.ibm.com) to another remote machine (fsaix005.in.ibm.com) using a Kerberos authentication.

  1. Here is the file on fakir.in.ibm.com that we want to transfer:
    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# ls -l /home/vipin/progs/try.c
    -rw-r--r--    1 root     system          200 Feb 14 03:55 home/vipin/progs/try.c
    
    bash-2.05b#
            

     
  2. Copy this file to fsaix005.in.ibm.com at the /home/vipin directory. The current contents of /home/vipin on fsaix005.in.ibm.com are:
    bash-2.05b# hostname
    fsaix005.in.ibm.com
    
    bash-2.05b# ls -l /home/vipin/t*
    ls: 0653-341 The file /home/vipin/t* does not exist.
    
    bash-2.05b#
            

     
  3. Run the Kerberos authentication and get the initial Kerberos ticket on fakir.in.ibm.com.
    bash-2.05b# hostname
    fakir.in.ibm.com
    
    bash-2.05b# /usr/krb5/bin/kinit vipin
    Password for vipin@ISL.IN.IBM.COM:
    
    bash-2.05b# /usr/krb5/bin/klist
    Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
    Default principal:  vipin@ISL.IN.IBM.COM
    
    Valid starting     Expires            Service principal
    04/21/08 09:20:13  04/22/08 09:20:45  krbtgt/ISL.IN.IBM.COM@ISL.IN.IBM.COM
    
    bash-2.05b#
            

     
  4. Once we have a valid ticket, we can run the ‘rcp’ command:
    bash-2.05b# rcp /home/vipin/progs/try.c vipin@fsaix005.in.ibm.com:/home/vipin
    
    bash-2.05b#
            

     

    Please pay attention to how we pass the user name for fsaix005.in.ibm.com. We also passing the destination directory on fsaix005.in.ibm.com. It’s important to remember that the destination directory needs to be writable by the user.

  5. And on fsaix005.in.ibm.com, we can cross-check the file copy operation like this:
    bash-2.05b# hostname
    fsaix005.in.ibm.com
    
    bash-2.05b# ls -l /home/vipin/t*
    -rw-r--r--   1 vipin    staff           200 Apr 21 09:21 /home/vipin/try.c
    
    bash-2.05b#
            

     

    Note the user ACLs of the newly copied file.

 


 

Commonly encountered kerberized telnet errors and mistakes

 

Error Solution
Kerberos V5 refuses authentication because admin/admin@ISL.IN.IBM.COM is not authorized to log in to the specified account. The initial Kerberos ticket was created using 'admin/admin,' not your normal username ('vipin,' in this example). Run '/usr/krb5/bin/kdestroy' to destroy the earlier Kerberos ticket and use '/usr/krb5/bin/kinit <username>' to get the correct ticket and retry.
Kerberos V5 refuses authentication because telnetd: krb5_rd_req failed: Decrypt integrity check failed. There is a mismatch in the key version number of the service principal. Delete the service principal (using 'delprinc' kadmin command'), and remove it from the keytab file (using 'ktrem' kadmin command). Again re-create a fresh service principal and add it to the keytab file and retry.
Kerberos V5 refuses authentication because telnetd: krb5_rd_req failed: Generic RC I/O error. On the telnet server, create a directory called "/var/tmp" if it is not already present. This should solve the problem.
 



 

Conclusion

This article demonstrated how to make use of the Kerberos authentication mechanism in the AIX network applications like telnet, FTP, and r-commands, which have support for Kerberos.

Make an Admin’s job easier with HACMP/XD-PPRC

HACMP/XD uses PPRC mirroring technology to provide disaster recovery for critical applications' data. To achieve high availability for distributed applications over extended distances, administrators need to configure PPRC in an HACMP/XD environment. This involves collecting configuration data from the storage as well as from the cluster nodes; at times this can be tedious. This article shows you how, using pprc4hacmp, configuration data is generated automatically for HACMP/XD-PPRC.

Introduction

The pprc4hcmp script is a tool that automatically generates configuration data for HACMP/XD-PPRC with minimal user input and helps in complex PPRC configuration under the HACMP/XD environment. Users should have minimal High Availability Cluster Multi Processing (HACMP) and IBM® AIX® knowledge to use this tool. A typical PPRC configuration requires identifying the PVIDs,VGnames, and Hostnames, and more. The main intention of the tool discussed in this article is that it generates PPRC-related configuration data that is required to configure HACMP PPRC.

Users just need to collect data from this tool and use it in configuring PPRC using SMIT. Those who have base HACMP and AIX knowledge can benefit from this tool by a great deal by leveraging from its centralized automated configuration data discovery.

What is HACMP/XD?

HACMP Extended Distance (HACMP/XD) is a software solution for disaster recovery, and is an extension to the base HACMP software that enables a cluster to operate over extended distance at two sites. In case of failure at the production site, HACMP/XD moves the application to the backup site, which is at a remote location. When the application is restarted on the remote site, the remote site should contain the data that was used by the application on the primary site, so that the applications can provide services to clients without data loss. As the sites are normally spread across different locations with larger distances, users need to use PPRC or XD technology.

HACMP uses different mirroring technologies to achieve this. They are:

  • GLVM -- Geographical Logical Volume Mirroring
  • HAGEO
  • PPRC by IBM System Storage™ DS8000™/DS6000™/ESS800™
  • SVC-PPRC

Customers often choose to use PPRC, as it is faster compared to network XD technologies. This article deals with HACMP/XD using PPRC with IBM System Storage.

What is PPRC?

Peer-to-peer remote copy (PPRC) is a protocol to mirror a disk from one storage system to another disk in a remote site. PPRC can be used to provide fast data recovery after failure of the primary site. PPRC is classified as synchronous and asynchronous. Synchronous PPRC causes each write to the primary volume to be performed to the secondary as well, and the I/O is only considered complete when the update to both primary and secondary have completed. Asynchronous PPRC I/O is considered to be completed immediately after performing the I/O on primary volume,and performs I/O to the secondary volume asynchronously. The IBM System Storage DS8000, DS6000, and ESS800 devices support PPRC.

What is DSCLI?

The DS command line interface (DSCLI) provides several commands to configure storage, such as adding host information, assigning disks, and the like. It also provides copy services commands used to configure PPRC.

What is ESSCLI?

The ESS command line interface (ESSCLI) is similar to DSCLI but is only applicable to ESS800 storage units. But to work with copy services, you can use DSCLI with both DS and ESS. If the HACMP cluster has both DS and ESS as part of the cluster, both DSCLI and ESSCLI need to be installed.

Sample PPRC setup

A typical PPRC setup is shown in Figure 1. To start PPRC, the minimal required resources are two storage systems connected with FCP/ESCON links.


Figure 1. Sample PPRC setup
Sample PPRC setup
 

This sample PPRC setup consists of two storage units; one is located at the production site and another is at a backup site. I have chosen two disks; one is from the DS8000 series with a volume ID of 0620 on the production site, and another is from the ESS800 series with a volume ID 103Fm on the backup site. They are connected with an FCP link. The volume ID of the disk is a combination of the LSS (Logical Sub System) and the disk sequence number. In this case, LSS is 06 and 20 is the sequence number of the disk. The PPRC path is a logical path that is defined between the primary LSS and the secondary LSS. These logical paths are defined over physical links between disk subsystems. Each physical link includes a host adapter in the primary disk subsystem and a host adapter in the secondary disk subsystem.

Follow these steps to establish a PPRC relationship:

  • Establish a pprcpath between LSS 06 -> 10 using the mkpprcpath dscli command
  • Establish a pprc relationship between 0620-> 103F using the mkpprc dscli command
  • Check for the pprcstate using the lspprc dscli command. If the state is full duplex, the two disks are in sync.

If you are establishing the PPRC relationship, use mode=FULL so that the remote disks will be mirrored completely (including VGDA). If it is already established and you don't want to start mirroring immediately, use copymode=nocopy . In the article, we are dealing with the Metro mirror, so select type=mmir .



 

Example commands

The following code listing is a sample of DSCLI commands.


Listing 1. Example DSCLI commands
 
                
#/opt/ibm/dscli/dscli -user xxxxx -passwd xxxxx -hmc1 aaa.bbb.ccc.ddd
Date/Time: December 17, 2007 1:39:11 AM CST IBM DSCLI Version: 5.2.400.426  
DS:IBM.2107-xxxxxxx
(To list available PPRC Ports between two storage systems)
dscli> lsavailpprcport -l -remotewwnn 500507630EFFFDE4 
IBM.2107-7516231/06:IBM.2105-22012/10
Date/Time: March 30, 2007 5:36:35 AM CDT IBM DSCLI Version: 5.2.400.426    
Local Port Attached Port Type Switch ID Switch Port    
===================================================    
I0000      I0001         FCP  NA        NA    
I0000      I0002         FCP  NA        NA    
I0000      I0100         FCP  NA        NA

(To Establish PPRC path between LSS 06 and LSS 10 )
dscli>  mkpprcpath -dev IBM.2107-7516231 -remotedev IBM.2105-22012 -remotewwnn 
500507630EFFFDE4 -srclss 06 -tgtlss 10 i0000:i0100
Date/Time: April 20, 2007 6:27:42 AM CDT IBM DSCLI Version: 5.2.400.426 DS: 
IBM.2107-7516231
CMUC00149I mkpprcpath: Remote Mirror and Copy path 06:06 successfully established. 

(To establish PPRC metro mirror relationship between disks 0620 and 100F )
dscli>mkpprc -dev IBM.2107-7516231 -remotedev IBM.2107-13AAY4A -type mmir 
-mode full 0620:100F
Date/Time: April 20, 2007 6:31:45 AM CDT IBM DSCLI Version: 5.2.400.426 DS: 
IBM.2107-7516231
CMUC00153I mkpprc: Remote Mirror and Copy volume pair relationship 0620:100F 
successfully created.
  



 

Configure HACMP/XD and PPRC

Say an application is using these disk to store its data and the customer wants to make this application highly available using HACMP. Making application highly available is not sufficient; we should also make the disk data highly available to achieve complete high availability. This is can be achieved by using HACMP/XD with PPRC.

Let us consider the example discussed in the Sample PPRC setup section.


Figure 2. A simple two-site HACMP/XD cluster with PPRC setup
A simple two site HACMP/XD cluster with PPRC setup
 

First, configure a base HACMP/XD cluster which consists of one node per site. Each site has disks assigned from storage. In Figure 2, node1 and DS8000 are the hostname of the server and storage located at siteA, respectively. And node2 and ESS800 are the node name of the server and storage type that are located at siteB. Assuming that we have already established the PPRC relationship, the only thing needed is to integrate this to HACMP.

To integrate existing PPRC to HACMP, we have to configure the following:

  • Copy services configuration
  • DS ESS disk subsystems
  • DSCLI Managed PPRC Replicated Resource

Let's start with how to collect the required data to configure the items as shown in Figure 2. The disk 0620 is visible as hdisk10 on node1. And the disk 103F is visible as hdisk5 on node2. The user does not know the storage-related information. He just knows the PPRC disks are hdisk10 and hdisk5 and their PVIDs.

Note that once the two disks are in PPRC, they acquire the same PVIDs. After establishing the PPRC between the two disks, the remote disks' VGDA is replaced with the VGDA of the local disk so that they have the same PVIDs.

Now, if you want to integrate these disks (make VGs on these disks highly available) with HACMP, you need to collect the information like storage ID, volume ID, LSS ID, pri-sec portID, and sec-pri PortIDs. These can be collected using DSCLI commands as mentioned earlier. Instead of going through this process, use the pprc4hacmp script, which generates all this configuration data for you.

The assumptions here are:

  • That DSCLI is installed on all nodes and is in the /opt/ibm/dscli directory.
  • You are able to rsh or ssh from the current node to the remote node.
  • Two possibilities are considered: one is if PPRC is already configured (configured here means with respect to storage, not with HACMP) and another is a new PPRC configuration. This article deals with an existing PPRC.

You just need to pass the site names, node name (hostnames), PVIDs, and DS/ESS HMC IPS for each storage system. The pprc4hacmp script generates configuration data that you need to enter as part of the HACMP-PPRC configuration. It generates configuration data in two formats:

  • Colon-delimited
  • SMIT snapshot


 

How to use pprc4hacmp

The pprc4hacmp script can be operated in two modes:

  • Interactive mode
  • Non-interactive mode

Interactive mode

To start in interactive mode, enter the following:

#pprc4hacmp 

 

When you run the script as shown above, it prompts for several inputs that are used in generating the required HACMPPPRC configuration. These inputs are needed because in this mode the tool is not using any of the HACMP utilities or commands to get the configured cluster information.


Listing 2. Interactive mode example
 
                
# pprc4hacmp.sh
Enter primary Site Name......:
Site A
Enter one node from Primary Site ....:
Node1
Enter Secondary Site Name ......:
SiteB
Enter one node from secondary Site .....
Node2
Enter VG name ...:
RG1_CG1
Enter PVIDs@SiteA of all disks for the VG -RG1_CG1 separated by space...:
00c46a1d4e588ed3
Enter PVIDs@SiteB of all disks for the VG -RG1_CG1 separated by space...:
00c46a1d4e588ed3
Enter DS HMC ip at SiteA ....:
192.168.1.141
Enter username for 192.168.1.141.....:
unamexx
Enter password for 192.168.1.141.....:
passwordxx
Enter Storagetype for 192.168.1.141.....:
2107
Enter DS HMC ip at SiteB ....:
192.168.2.210
Enter username for 192.168.2.210.....:
unamexx
Enter password for 192.168.2.210.....:
passwordxx
Enter storage type for 192.168.2.210.....:
2105
validating input........

 

Non-interactive mode

To start in non-interactive mode, enter the following:

#pprc4hacmp  -i [variablefile]

 

The variablefile is a file that contains the required input information in a specific manner, as shown in the listing below:


Listing 3. Variable file template
 
                
PRISITE:sitename:nodename@site1
SECSITE:sitename:nodename@site2
PRIDSINFO:primary HMCip:username:password:storage Type
SECDSINFO:primary HMCip:username:password:storage Type
VGNAME:volumegroupname which is on pvs
PRIPVS:pvids from primary site
SECPVS:pvids from secondary site


Listing 4. Example variable file
 
                
PRISITEINFO:SiteA:Node1
SECSITEINFO:SiteB:Node2
PRIPVs: 00c46a1d4e588ed3
SECPVs: 00c46a1d4e588ed3
PRIDS:192.168.1.141:unamexx:passwordxx:2107
SECDS:192.168.2.210:unamexx:passwordxx:2105
VGNAME:RG1_CG1


Format 1. Non-interactive mode, colon-delimited format
 
                
# pprc4hacmp.sh -i varfile -c
validating input........
Searching for  DSCLI on node Node1 .......
          DSCLI found on node Node1

Searching for  DSCLI on node Node2 .......
          DSCLI found on node Node2

HMC 192.168.1.141  ping test ....... Success
Storage Image id managed by HMC-  192.168.1.141 ........... : IBM.2107-7516231
HMC 192.168.2.210  ping test ....... Success
Storage Image id managed by HMC-  192.168.2.210 ........... : IBM.2105-22012

Verifying PVs existence at SiteA......
Verifying PVs existence at SiteB.....
Verifying PV Vs LSSs on each Site ........
Finding LSS and VOlume PAIRs ......
Finding Pri-sec and sec-pri PortIDs for the Lsss 06 10.......

--------------- Copyservices Server Configuration data -------------------

CSSINFO:css_SiteA:DSCLI:SiteA:192.168.1.141:unamexx:passwordxx
CSSINFO:css_SiteB:DSCLI:SiteB:192.168.2.210:unamexx:passw0rdxx

----------------------------------****------------------------------------

------------------ DS ESS Subsystem Configuration data -------------------

DSESSINFO:dsess_SiteA:SiteA:192.168.1.141:unamexx:passwordxx::IBM.2107-7516231 :css_SiteA
DSESSINFO:dsess_SiteB:SiteB:192.168.2.210:unamexx:passwordxx::IBM.2105-22012 :css_SiteB

----------------------------------****------------------------------------

-------------DSCLI-Managed PPRC Replicated Resource Configuration---------

PPRC_REP_RES:PPRC_RG1_CG1:SiteA SiteB: 0620->103F:dsess_SiteA dsess_SiteB:06 10:
mmir:I0000->I00A4 I0002->I00A4:I0020->I0330 I0020->I0333:FCP:OFF:MANUAL:RG1_CG1

----------------------------------****------------------------------------


 

Output can be obtained in two formats, colon-delimited format and SMIT-snapshot format.


Format 2. Non-interactive mode, SMIT snapshot format
 
                
# pprc4hacmp.sh -i varfile
validating input........
Searching for  DSCLI on node Node1 .......
          DSCLI found on node Node1

Searching for  DSCLI on node Node2 .......
          DSCLI found on node Node2


HMC 192.168.1.141  ping test ....... Success
Storage Image id managed by HMC-  192.168.1.141 ........... : IBM.2107-7516231
HMC 192.168.2.210  ping test ....... Success
Storage Image id managed by HMC-  192.168.2.210 ........... : IBM.2105-22012

Verifying PVs existence at SiteA......
Verifying PVs existence at SiteB.....
Veryfying PV Vs LSSs on each Site ........
Finding LSS and VOlume PAIRs ......
Finding Pri-sec and sec-pri PortIDs for the Lsss 06 10.......

--------------- Copyservices Server Configuration data -------------------

* CSS Subsystem Name                        [css_SiteA]
* CSS Site Name                              SiteA      +
* CSS IP Address                            [192.168.1.141]
* CSS User ID                               [unamexx]
* CSS Password                              [passwordxx]

----------------------------------****------------------------------------

--------------- Copyservices Server Configuration data -------------------

* CSS Subsystem Name                        [css_SiteB]
* CSS Site Name                              SiteB      +
* CSS IP Address                            [192.168.2.210]
* CSS User ID                               [unamexx]
* CSS Password                              [passwordxx]

----------------------------------****------------------------------------

------------------ DS ESS Subsystem Configuration data -------------------

* ESS Subsystem Name                              [dsess_SiteA]
* ESS Site Name                                    SiteA    +
  ESS Cluster1 IP Address                         [192.168.1.141]
  ESS Cluster2 IP Address                         [ ]
* ESS User ID                                     [unamexx]
* ESS Password                                    [passwordxx]
* Full ESS Storage ID                             [IBM.2107-7516231]
* List of CS Servers                              [css_SiteA]   +

----------------------------------****------------------------------------


------------------ DS ESS Subsystem Configuration data -------------------

* ESS Subsystem Name                              [dsess_SiteB]
* ESS Site Name                                    SiteB    +
  ESS Cluster1 IP Address                         [192.168.2.210]
  ESS Cluster2 IP Address                         [ ]
* ESS User ID                                     [unamexx]
* ESS Password                                    [passwordxx]
* Full ESS Storage ID                             [IBM.2105-22012]
* List of CS Servers                              [css_SiteB]   +

----------------------------------****------------------------------------


-------------DSCLI-Managed PPRC Replicated Resource Configuration---------

* PPRC Resource Name                              [PPRC_RG1_CG1]
* HACMP Sites                                     [SiteA SiteB]     +
* PPRC Volume Pairs                               [ 0620->103F]
* ESS Pair                                        [dsess_SiteA dsess_SiteB]     +
* LSS Pair                                        [06 10]     +
* PPRC Type                                        mmir       +
* Pri-Sec Port Pair IDs                           [I0000->I00A4 I0002->I00A4]
* Sec-Pri Port Pair IDs                           [I0020->I0330 I0020->I0333]
* PPRC Link Type                                   FCP      +
* PPRC Critical Mode                               OFF    +
* PPRC Recovery Action                             MANUAL      +
* Volume Group                                    [RG1_CG1]

----------------------------------****------------------------------------




 

Configuring CSS, DSESS, and PPRCs

The user uses the configuration data and smit pprc_ds to configuration HACMP.


Listing 5. Where to use the generated configuration data
 
                
smit pprc_ds
--------------------------------------------------------------------
  Copy Services Server Configuration
  DS ESS Disk Subsystem Configuration
  DSCLI-Managed PPRC Replicated Resource Configuration
  PPRC Consistency Groups Configuration
  Verify PPRC Configuration

 

From the above smit menu:

  • Choose the Copy Services Server Configuration option and configure CSS
  • Choose DS ESS Disk Subsystem Configuration and configure DS ESS subsystem
  • Choose DSCLI-Managed PPRC Replicated Resource Configuration and configure the PPRC-replicated resource


 

Summary

You only need basic knowledge of HACMP and AIX to use this utility. Using the configuration data generated by the pprc4hacmp tool can save you time as well as reduce or eliminate the chances of mistake in configuration. The user does not need to know about DSCLI commands, format of output, and different fields of output. So users can use this script to configure PPRC easily.

Learn Perl By Example

PERL is a powerful scripting language, very popular among UNIX/Linux admins. This tutorials will try to cover everything you need to know in order to program in Perl. Perl stands for Practical Extraction an Report Language,  it was first used as text processor, it borrows features from C, shell scripting (UNIX sh), sed, awk, Lisp, Pascal. It can be used also for developing dyamic web applications as CGIs. 


1. Few things to know before start programming in Perl
--------------------------------------------------------------------

Perl code is portable. Most scripts are written for version 5.8 or higher. When start programming in Perl first you might want to find the path of Perl binary. On most UNIX/Linux systems you can do that with whereis command:

whereis perl

As a result of this command you might have: /usr/bin/perl.
So your scripts must have first line of code with this value:

#!/usr/bin/perl
# rest of code # will be used for comments.

On first line of sourcecode this line will help shell in finding what binary to use when running the script.
In order to properly run the script your source code must also have executable flag for the user you use to run the script. This can be achieved for example for file prog1.pl adding executable flag from command line:

chown u+x progr1.pl
 

So, to start your Perl script you will follow:

a) Create an empty file:

touch program.pl

b) Add executable flag to that file

chown u+x program.pl

c) Find where your Perl binary is:

whereis perl

(you will get something like /usr/bin/perl)

c) Edit that file with your text editor, and add perl path with this syntax: #!/usr/bin/perl
(not that # on first line of your code will not be seen as comment)

edit program.pl

and put there: #!/usr/bin/perl.

Note1: edit is your default text editor in FreeBSD. If you have installed Midnight Commander package, you can use mcedit, which is nice. For Linux you can use nano or pico.

Note2: use strict; put in perl sourcecode will force us to declare variables  in a more safe (proper) way. All variables must be declared with my prefix.
 
Note3: by adding -w to #!/usr/bin/perl it will activate perl warnings, very usefull for debugging.


#!/usr/bin/perl -w



2. Perl Variables
-----------------

Perl has 3 types of variables:
- scalars;
- arrays;
- hashes;


2.1 Scalars
--------------
Example on how to define a scalar variable in Perl:

$var1 = "value"          # a scalar variable var1 is defined and a string

                                          "value" is assigned to that variable;

$var2 = 100               # a scalar variable var2 is defined, and an integer value is assigned.


Example for printing a scalar value:

print "$var1";


2.2 Arrays
-------------

Example on how to define an array in Perl:

@array1 = ( "Value1", "Value2", Value3");


Example on how to print an array:


print "Our array variable contains: @array1\n";


In our example we've used \n escape char to insert a new line (escape chars can be used the same way are used in C language).

The previous example will display all values from array1 array.

To display one element of the array:

print "First element of the array is: $array1[0]";

 As you might notice we've defined array with @ but printed a single value of that array using $. This is correct because we want to print a single value.

It is also possibility to print multiple values from an array:

print "Our array contains: @array1[0..2]";

Previous example will print elements from 0 to element nr.2 from array1.

You can also print multiple distinct elements from array:

print "Our array contains: @array1[0,4,7]";

The previous example will print only values for element 0, 4 and 7. Please note that in perl first value of an array is number 0.

That is fine but how do we find the number of elements of an array?

 print "Number of elements of an array: $#array1";

Please note that $#array1 in our example is number of elements, but because elements from an array in Perl starts with value 0, the real number of elements of an array is $#array + 1.

There is another method to define an array:

@array2 = qw(Value1 Value2 Value3 Value4);


Some functions for working with arrays:
- pop - remove last element of an array:
- push - add an element to the end of  array;
- shift - removes first element of an array;
- unshift - add an element to the beginning of array;
- sort - sort an array.

Let's see some examples.

Pop Function (remove last element of an array):

#!/usr/bin/perl -w

@array1 = ("Data1", "Data2", "Data3");

print "Array1 values: @array1[0..$#array1]\n";

pop @array1;

print "Array1 after applying pop function: @array1[0..$#array1]\n";



Push Function (add an element to the end of array):

#!/usr/bin/perl -w

@array1 = ("Data1", "Data2", "Data3");

print "Array1 values: @array1[0..$#array1]\n";

push @array1, "Data4";

print "Array1 after applying push function: @array1[0..$#array1]\n";



Shift Function (removes first element of an array):

#!/usr/bin/perl -w

@array1 = ("Data1", "Data2", "Data3");

print "Array1 values: @array1[0..$#array1]\n";

shift @array1;

print "Array1 after applying shift function: @array1[0..$#array1]\n";


The same principle apply for unshift and sort functions. Sort functions works best with strings.


2.3 Hashes
--------------

Hashes are types of variables defined as key / value pair.

Example of defining a hash variable:


%name_email = ("John", " \n john@example.com This email address is being protected from spam bots, you need Javascript enabled to view it This email address is being protected from spam bots, you need Javascript enabled to view it , "George", " \n george@example.com This email address is being protected from spam bots, you need Javascript enabled to view it This email address is being protected from spam bots, you need Javascript enabled to view it ");

Another way to define a has variable:


%name_email = (

             John => " \n john@example.com This email address is being protected from spam bots, you need Javascript enabled to view it This email address is being protected from spam bots, you need Javascript enabled to view it ",

             George => " \n george@example.com This email address is being protected from spam bots, you need Javascript enabled to view it This email address is being protected from spam bots, you need Javascript enabled to view it ",

             );



Example of using hash variables:

#!/usr/bin/perl -w

%name_email = ( "John", " \n This email address is being protected from spam bots, you need Javascript enabled to view it ", "George", " \n This email address is being protected from spam bots, you need Javascript enabled to view it ");

print $name_email{"John"};


Note: We've used escape character to preserver @. Also note that printing a hash variable means to print a scalar with value key between braces { }.

3. Perl control structures
-------------------------

3.1 Conditionals
----------------

For testing conditionals within Perl if it is used. To better illustrates, see the following example:


#!/usr/bin/perl -w

$var1 = 100;

$var2 = 200;

if ($var1 < $var2) {

        print "$var1 < $var2\n";
}


Note1: When evaluating expressions if variables are numbers we will use mathematical operators ( < > = <= >= ==). When we use string variables we use string evaluation operators like gt (greater then) eq (equal) and so on.

Note 2: When we evaluate two numbers to be identical, we use == operator (not = which is used for assigning values.


Another example follows:



#!/usr/bin/perl -w

$var1 = 400;

$var2 = 200;

if ($var1 < $var2) {

        print "$var1 < $var2\n";

        }
elsif ($var1 > var2) {

        print "$var1 > $var2\n";

        }


elsif function as a nested if.

The inverse test of if is unless function:


unless ($var1 == $var2) {

       print "$var1";



3.2 Loops
----------
3.2.1 For loops
---------------

In Perl sometimes are many way to solve a problem. We will show 3 ways to construct a loop using for.

Example 1: For loop using C style:


#!/usr/bin/perl -w

# for loop example 1

for ($i = 1; $i < 100; $i++) {

        print "$i\n";

        }


Example 2: for loops using ranges


#!/usr/bin/perl -w

# for loop example 2

$var1 = 1;

$var2 = 100;

$i = 1;

for ($var1..$var2) {

        print "$i\n";

        $i+=1;

        }


Example 3: loop using foreach


#!/usr/bin/perl -w

# for loop example 3

@array1 = ( "Val1", "Val2", "Val3", "Val4", "Val5");

foreach (@array1) {

        print "$_\n";

        }


Note1: $_ will print the current value of an array.


3.2.2 While loops
----------------------

An example is presented next:


#!/usr/bin/perl -w

$var1 = 1;

$var2 = 8;


while ($var1 < $var2) {

        print "$var1\n";

        $var1 += 1;
}


3.2.3 Until loops
--------------------

Until is negation of while. Here is an example:


#!/usr/bin/perl -w

$var1 = 1;

$var2 = 8;

until ($var2 < $var1) {

        print "$var2\n";

        $var2 -= 1;
}


4. Defining and using subroutines
------------------------------------------

Subroutines allow us to better structure our code, organize it and reuse it.

A subrutine will start with keyword sub. The following example shows how to define a subroutine which calculates sum of two numbers:


#!/usr/bin/perl -w

$var1 = 100;

$var2 = 200;

$result = 0;

$result = my_sum();

print "$result\n";


sub my_sum {

        $tmp = $var1 + $var2;

        return $tmp;

}


Note: Subroutines might have parameters. When passing parameters to subroutines, it will be stored in @_ array.
Do not confuse it with $_ which stores elements of an array in a loop.


5. Using file parameters (positional parameters)
------------------------------------------------------------
Sometimes we need to transmit parameters to our script files.

@ARGV is an array reserved for parameters transmitted to files (default value of number of arguments is set -1 if no parameters are transmitted.


#!/usr/bin/perl -w

if ($#ARGV < 2) {

        print "You must have at least 3 parameters.\n";

        }

else    {

        print "Your parameters are: @ARGV[0..$#ARGV]\n";

}
 

Package Management in Debian Linux

To manage packages in Debian Linux you have 3 tools: dpkg, apt-get and aptitude.
Here are some useful command to manage packages under Debian linux using those tools.


Install ftpd FTP server on Debian
---------------------------------------------
apt-get install ftpd


Remove a package from Debian
--------------------------------------------
apt-get remove ftpd


Do not install only simulate package installation on Debian
--------------------------------------------
apt-get -s ftpd


Install and remove a Debian package using dpkg
------------------------------------------------------------------
Install:
dpkg -i ftpd

Remove:
dpkg -r ftpd


2. Find files from ftpd package on Debian
--------------------------------------------------------
dpkg -L ftpd


Search for a package from Debian installed packages
----------------------------------------------------------------------------
dpkg -l | grep ftpd

To list all packages use:

dpkg -l


Resynchronize the package index file from sources
-----------------------------------------------------------------------
(index is fetched from location listed in /etc/apt/sources.list)

apt-get update


Upgrade Debian packages after you've run an update
------------------------------------------------------------------------

apt-get upgrade


Search for a package in cache
-----------------------------------------

apt-cache search net-tools


Find to which package belongs a file in Debian
------------------------------------------------------------------
Find complete path of netstat:

whereis netstat

You will get:

netstat: /bin/netstat /usr/share/man/man8/netstat.8.gz

Then type following command using complete path for file

dpkg -S /bin/netstat

You will get:
net-tools: /bin/netstat

(net-tools is the package name).


Get info about a package in Debian
--------------------------------------------------

dpkg -s net-tools


List packages from cache dir
----------------------------------------

 ls /var/cache/apt/archives/


Remove all files from packages cache
----------------------------------------------------

apt-get clean


Manage packages in Debian with aptitude
---------------------------------------------------------
aptitude install ftpd
- will install ftpd package
aptitude remove ftpd - will remove ftpd package
aptitude update - will update packages  index
aptitude seach ftpd - will search for ftpd package
aptitude download ftpd - will download ftpd package in current directory