Aram Hăvărneanu https://xw.is/solaris-index/ solaris-index /solaris-index/ Solaris Tips and tricks for using Solaris. Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0008/ 0008 /0008/ Generate SPARC sysroot on amd64 Solaris 11 If you need libraries and headers for producing a Solaris/SPARC GCC cross compiler you can obtain them from a regular amd64 Solaris 11 installation. The following commands will install libraries suitable for Solaris gcc cross compiler in $PKG_IMAGE: TRIPLET=sparc64-sun-solaris2.11 export PKG_IMAGE=/export/$TRIPLET-sysroot zfs create rpool$PKG_IMAGE pkg image-create -F -p solaris=http://pkg.oracle.com/solaris/release $PKG_IMAGE pkg change-variant variant.arch=sparc pkg install --accept entire@latest solaris-minimal-server system/header gcc Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0007/ 0007 /0007/ Re-add "Primary Administrator" in Solaris 11 Solaris used to ship with a Primary Administrator RBAC profile, but it was removed some time in Solaris 11. We can easily add it back to the profile description and to the execution profile databases. After this, we can run pfexec(1) without a password. Run the following as root: echo 'Primary Administrator:suser:cmd:::*:uid=0;gid=0' >> /etc/security/exec_attr echo 'Primary Administrator:::All administrative tasks:auths=solaris.*;solaris.grant;help=RtPriAdmin.html' >> /etc/security/prof_attr usermod -P "Primary Administrator" aram Aram Hăvărneanu 2019 2 22 https://xw.is/0013/ 0013 /0013/ Boot SPARC server behind NAT over the Internet from Solaris 11 VM also behind NAT Aram Hăvărneanu 2019 2 22 Network topology We have two sites, both connected to the Internet, Vienna, and Sibiu. We wish to network boot the SPARC server (located in Vienna), while we're working on the laptop in Sibiu. We have access to VMware Fusion, and we can install a Solaris network boot server in a virtual machine. =latex, font=\footnotesize ] \node [router] (r1) {Router \#1\\(NAT)}; \node [switch, above=1.2cm of r1] (sw1) {Switch}; \node [host, line width=1pt, left =2.4cm of sw1] (sparc) {SPARC\\server}; \node [host, right=2.4cm of sw1] (z800) {z800}; \node [cloudnode, below=1.2cm of r1] (internet) {Internet}; \node [router, below=1.2cm of internet] (r2) {Router \#2\\(NAT)}; \node [switch, below=1.2cm of r2] (sw2) {Switch}; \node [router, right=2cm of sw2] (r3) {Router \#3\\(VMware)}; \node [host, left =2.4cm of sw2] (laptop) {Laptop}; \node [host, line width=1pt, below=1.2cm of r3] (solaris) {Solaris\\VM}; \draw [thick] (sparc.west |- internet) -- ($(internet.west)+(-0.6cm,0)$); \draw [thick] ($(internet.east)+(0.6cm,0)$) -- ([xshift=0.5cm]z800.east |- internet); \node [anchor=south west,yshift=2pt] at (sparc.west |- internet) {Site \#1 (Vienna)}; \node [anchor=north west,yshift=-2pt] at (sparc.west |- internet) {Site \#2 (Sibiu)}; \draw (sparc.east) -- node[pos=.37,above] {192.168.0.60} (sw1.west); \draw (sw1.east) -- node[pos=.60,above] {192.168.0.100} (z800.west); \draw (sw1.south) -- node[pos=.85,left] {192.160.0.1/24}(r1.north); \draw (r1.south) -- node[pos=.15,left] {84.112.126.72} (internet.north); \draw (internet.south) -- node[pos=.85,left] {xx.xx.xx.xx} (r2.north); \draw (r2.south) -- node[pos=.20,left] {172.20/20} (sw2.north); \draw (sw2.east) -- node[pos=.58,above] {172.20.8.xx} (r3.west); \draw (sw2.west) -- node[pos=.65,above] {172.20.8.yy} (laptop.east); \draw (r3.south) -- node[pos=.20,right] {172.16.24/24} node[pos=.85,right] {172.16.24.128} (solaris.north); \end {tikzpicture} ]]> Aram Hăvărneanu 2019 2 22 Strategy The idea is that we have access through ssh to a machine in the same LAN as the server (z800 in the diagram above). We want to make the SPARC server think it's booting from this machine while we're in fact using ssh port forwarding to forward the inbound connection to that machine to our VM. Aram Hăvărneanu 2019 2 22 Instructions Install Solaris 11 (amd64) in VMware, on laptop. Then set-up a SPARC Automated Installer (AI) server: vm# pfexec installadm create-service -a sparc Make a client-specific AI config: cp /etc/netboot/{system,webboot}.conf /etc/netboot/cl.ie.nt.ip Edit /etc/netboot/client-ip/webboot.conf to reference client (e.g. behind NAT) IPs. Set-up remote port forwarding: laptop$ ssh -S none -NT -R 5555:172.16.24.128:5555 -L 8080:192.168.0.1:80 vienna.mgk.ro Set-up the SPARC machine to netboot using static IP: ok setenv network-boot-arguments host-ip=192.168.0.60,router-ip=192.168.0.1,subnet-mask=255.255.255.0,file=http://192.168.0.100:5555/cgi-bin/wanboot-cgi ok boot net Aram Hăvărneanu 2019 2 22 https://xw.is/0010/ 0010 /0010/ Solaris 11 zones virtual networking with NAT Aram Hăvărneanu 2019 2 22 Prepare the Solaris global zone Prepare the global zone; net2 is the interface connected to the Internet. dladm create-etherstub ether0 dladm create-vnic -l ether0 vnic0 ipadm create-ip vnic0 ipadm create-addr -T static -a 10.0.0.1/8 vnic0/v4 routeadm -u -e ipv4-forwarding ipadm set-ifprop -p forwarding=on -m ipv4 net2 ipadm set-ifprop -p forwarding=on -m ipv4 vnic0 echo "map net2 10.0.0.0/8 -> 0/32 portmap tcp/udp auto" > /etc/ipf/ipnat.conf echo "map net2 10.0.0.0/8 -> 0/32" >> /etc/ipf/ipnat.conf svcadm enable network/ipfilter Aram Hăvărneanu 2019 2 22 Prepare the non-global zones Prepare the zone; for-sysroot is the zone name. dladm create-vnic -l ether0 vnic1 zonecfg -z for-sysroot "create; set ip-type=exclusive; add net; set physical=vnic1; end; commit" zoneadm -z for-sysroot install zoneadm -z for-sysroot boot zlogin -C for-sysroot In sysconfig(1M) set up vnic1/v4 10.0.0.2/8 with 10.0.0.1 as default router. Aram Hăvărneanu 2019 2 22 Revert (optional) If you want to revert the previous steps, do the following. Aram Hăvărneanu 2019 2 22 Delete the non-global zone Delete the zone. zoneadm -z for-sysroot shutdown zoneadm -z for-sysroot uninstall -F zonecfg -z for-sysroot delete -F dladm delete-vnic vnic Aram Hăvărneanu 2019 2 22 Restore the global zone Restore the global zone to its original state. routeadm -u -d ipv4-forwarding ipadm delete-addr vnic0/v4 ipadm delete-ip vnic0 dladm delete-vnic vnic0 dladm delete-etherstub ether0 ipadm set-ifprop -p forwarding=off -m ipv4 net2 svcadm disable network/ipfilter rm /etc/ipf/ipnat.conf Aram Hăvărneanu 2018 6 7 https://xw.is/0011/ 0011 /0011/ Build GDB and gdbserver(1) for Solaris 11 SPARC Aram Hăvărneanu 2018 6 7 Build GDB on development machine On development (e.g. amd64) machine: cd $HOME curl http://ftp.gnu.org/gnu/gdb/gdb-7.11.1.tar.gz | tar xf - mkdir -p $HOME/gdb-build cd $HOME/gdb-build ../gdb-7.11.1/configure --prefix $HOME/xgcc --bindir $HOME/bin --target sparc64-sun-solaris2.11 make -j5 && make inst Aram Hăvărneanu 2018 6 7 Build GDB and gdbserver(1) on target machine On target (e.g. Solaris/SPARC) machine: cd $HOME/src curl http://ftp.gnu.org/gnu/gdb/gdb-7.11.1.tar.gz | gtar xzf - zfs create -p rpool/export/home/aram/builds/gdb zfs create -p rpool/export/home/aram/builds/gdbserver cd $HOME/builds/gdb CFLAGS='-m64' ../../src/gdb-7.11.1/configure --disable-tui --host sparc64-sun-solaris2.11 --build sparc64-sun-solaris2.11 --target sparc64-sun-solaris2.11 --prefix $HOME/tools --bindir $HOME/bin make -j80 && make install cd $HOME/builds/gdbserver ../../src/gdb-7.11.1/gdb/gdbserver/configure --host sparc64-sun-solaris2.11 --build sparc64-sun-solaris2.11 --target sparc64-sun-solaris2.11 --prefix $HOME/tools --bindir $HOME/bin make -j80 && make install Aram Hăvărneanu 2018 6 7 https://xw.is/0009/ 0009 /0009/ Create a new administrative user in Solaris Aram Hăvărneanu 2018 6 7 Ensure "Primary Administrator" profile exist Make sure Primary Administrator profile exists and the current user is assigned to it. Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0007/ 0007 /0007/ Solaris › Re-add "Primary Administrator" in Solaris 11 Solaris used to ship with a Primary Administrator RBAC profile, but it was removed some time in Solaris 11. We can easily add it back to the profile description and to the execution profile databases. After this, we can run pfexec(1) without a password. Run the following as root: echo 'Primary Administrator:suser:cmd:::*:uid=0;gid=0' >> /etc/security/exec_attr echo 'Primary Administrator:::All administrative tasks:auths=solaris.*;solaris.grant;help=RtPriAdmin.html' >> /etc/security/prof_attr usermod -P "Primary Administrator" aram Aram Hăvărneanu 2018 6 7 Create the new user pfexec useradd -u 5008 -g staff -s /bin/bash -m -P 'Primary Administrator' -K 'defaultpriv=basic,dtrace_proc,dtrace_user' foo pfexec passwd -N foo References Context Aram Hăvărneanu https://xw.is/os-index/ os-index /os-index/ Operating systems Tips and tricks for using various operating systems. Aram Hăvărneanu https://xw.is/freebsd-index/ freebsd-index /freebsd-index/ FreeBSD Tips and tricks for using FreeBSD. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 https://xw.is/001J/ 001J /001J/ Upgrade FreeBSD 14.3 to 15.0 Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Introduction Everything on this page needs to be done as root unless otherwise specified, so su(1) to root. su - Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Upgrade the base system We will do the upgrade offline (in a new boot environment) so first create the BE using bectl(8) and mount it. bectl create 15.0-RELEASE bectl mount 15.0-RELEASE /mnt Then run freebsd-update(8): freebsd-update -b /mnt -d /mnt/var/db/freebsd-update -r 15.0-RELEASE upgrade freebsd-update -b /mnt -d /mnt/var/db/freebsd-update install freebsd-update -b /mnt -d /mnt/var/db/freebsd-update install freebsd-update -b /mnt -d /mnt/var/db/freebsd-update install Yes, you really need to run it that many times. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Upgrade the bootloader You need to update the bootloader, otherwise the system will stop booting eventually (but not immediately). I think this is only necessary after zpool upgrade, and zpool upgrade used to warn us about this, but apparently not anymore? (Maybe it's related to the switch to OpenZFS — unclear.) Presumably you can do this after booting into the new system, but before zpool upgrade. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 BIOS First, determine your boot devices. z800:aram$ zpool status zroot pool: zroot state: ONLINE scan: scrub repaired 0B in 00:01:46 with 0 errors on Mon Feb 5 17:48:15 2018 config: NAME STATE READ WRITE CKSUM zroot ONLINE 0 0 0 mirror-0 ONLINE 0 0 0 gpt/zfs0 ONLINE 0 0 0 gpt/zfs1 ONLINE 0 0 0 errors: No known data errors Look for the GEOM devices in the geom(8) output. z800:aram$ geom -t ... da0 PART da0p3 da0p3 DEV da0p3 LABEL gpt/zfs0 gpt/zfs0 DEV zfs::vdev ZFS::VDEV ... da2 PART da2p3 da2p3 DEV da2p3 LABEL gpt/zfs1 gpt/zfs1 DEV zfs::vdev ZFS::VDEV ... In our case, we need to install the new bootloader on da0 and da2 using gpart(8). gpart bootcode -b /mnt/boot/pmbr -p /mnt/boot/gptzfsboot -i 1 da0 gpart bootcode -b /mnt/boot/pmbr -p /mnt/boot/gptzfsboot -i 1 da2 Of course, if you already booted into the new system, these become: gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 1 da0 gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 1 da2 Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 EFI TODO. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Upgrade the packages It is unclear why we need devfs, but we need it. mount -t devfs devfs /mnt/dev/ pkg -c /mnt update pkg -c /mnt upgrade umount /mnt/dev/ Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Activate the new boot environment Activate the new boot environment, then reboot. bectl umount 15.0-RELEASE bectl activate 15.0-RELEASE If it doesn't work, you can revert to another BE in the bootloader. Aram Hăvărneanu 2018 11 7 2025 8 28 https://xw.is/001K/ 001K /001K/ FreeBSD fiber channel target Aram Hăvărneanu 2018 11 7 2025 8 28 Prerequisites You need: A fiber channel card that supports target mode, e.g. QLogic QLE2462. FreeBSD with a kernel that supports your card, e.g isp(4). a ZFS zvol. Aram Hăvărneanu 2018 11 7 2025 8 28 Create a ZFS zvol This will create a sparse 850GB ZFS zvol. sudo zfs create -p -s -V 850g tank1/export/fc Aram Hăvărneanu 2018 11 7 2025 8 28 Enable ctld(8) sudo sysrc ctld_enable=YES Aram Hăvărneanu 2018 11 7 2025 8 28 Bring the device online Use ctladm(8) to bring the devices online. sudo ctladm port -o on isp0 sudo ctladm port -o on isp1 Aram Hăvărneanu 2018 11 7 2025 8 28 Check the WWN address You'll get output like: z800:aram$ sudo ctladm port -l Port Online Frontend Name pp vp 0 YES camsim camsim 0 0 naa.50000009e370df01 1 YES ioctl ioctl 0 0 2 YES tpc tpc 0 0 3 YES camtgt isp0 0 0 naa.2100001b321cd5b6 4 YES camtgt isp1 0 0 naa.2101001b323cd5b6 Aram Hăvărneanu 2018 11 7 2025 8 28 Configure ctl.conf(5) Use this config for ctl.conf(5): lun fibre-channel { backend block device-id "5000c5001d5ba30b" serial "MGKSERIAL0001" option vendor "MGK" option product "FC Disk" option naa "600A0B80002682A8000067D95897A544" option removable "on" path /dev/zvol/tank1/export/fc } target naa.100000062b1b88c8 { auth-group no-authentication port mpt0 port mpt1 lun 0 fibre-channel } Make sure the WWN matches. Next, start the ctld daemon. The device-id is from a real Seagate FC disk, and the naa is from a real array. I think both are required by macOS to make multipathing work. sudo service ctld start Query the status, to see if everything is working correctly: z800:aram$ sudo ctladm devlist -v LUN Backend Size (Blocks) BS Serial Number Device ID 0 block 1782579200 512 MYSERIAL 0 MYDEVID 0 lun_type=0 num_threads=14 file=/dev/zvol/tank1/export/fc ctld_name=naa.2100001b321cd5b6,lun,0 scsiname=naa.2100001b321cd5b6,lun,0 Aram Hăvărneanu 2018 11 7 2025 8 28 Initiator side If using macOS, the mac should just "see" the target, no configuration required. Aram Hăvărneanu 2018 6 7 2025 7 15 https://xw.is/001A/ 001A /001A/ FreeBSD Post Install Steps Aram Hăvărneanu 2018 6 7 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so su(1) to root. su - Aram Hăvărneanu 2018 6 7 2025 7 15 Set the hostname echo 'hostname="phoenix.xw.is"' >> /etc/rc.conf Aram Hăvărneanu 2018 6 7 2025 7 15 Update the software freebsd-update fetch freebsd-update install Aram Hăvărneanu 2018 6 7 2025 7 15 Install basic software pkg install -y bash sudo rsync tmux Aram Hăvărneanu 2018 6 7 2025 7 15 ZFS If you don't have ZFS root, for example in a pre-made cloud computing image, you might want to create a separate ZFS pool. echo 'zfs_enable="YES"' >>/etc/rc.conf service zfs start zpool create -m /tank tank xbd1 zfs set compression=on tank Aram Hăvărneanu 2018 6 7 2025 7 15 Create a user Create a user with a random password that can then do passwordless sudo(8): pw useradd -n aram -c 'Aram Hăvărneanu' -g staff -G wheel -m -s /usr/local/bin/bash -L staff -w random Enable passwordless sudo for the staff group: /usr/local/etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2018 6 7 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu https://xw.is/openbsd-index/ openbsd-index /openbsd-index/ OpenBSD Tips and tricks for using OpenBSD. Aram Hăvărneanu 2019 1 2 2025 7 16 https://xw.is/001F/ 001F /001F/ OpenBSD Post Install Steps Aram Hăvărneanu 2019 1 2 2025 7 16 Introduction Everything on this page needs to be done as root unless otherwise specified, so su(1) to root. su - Aram Hăvărneanu 2019 1 2 2025 7 16 Vultr Vultr doesn't install ssh keys, if you want to permit direct SSH root login you need to populate .ssh/authorized_keys manually. mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Change the autogenerated password:usermod -p `jot -r -c 30 a z | rs -g0 0 30 | encrypt -b a` root Aram Hăvărneanu 2019 1 2 2025 7 16 Set the hostname echo 'freedom.mgk.ro' > /etc/myname Aram Hăvărneanu 2019 1 2 2025 7 16 Update the software echo 'https://cdn.openbsd.org/pub/OpenBSD' > /etc/installurl syspatch Aram Hăvărneanu 2019 1 2 2025 7 16 Install basic software pkg_add bash rsync Aram Hăvărneanu 2019 1 2 2025 7 16 Create a user Create a user with a random password that can then do passwordless doas(8): useradd -m -g staff -L staff -G wheel -c 'Aram Hăvărneanu' -s /bin/ksh -p `jot -r -c 30 a z | rs -g0 0 30 | encrypt -b a` aram Enable passwordless doas for the staff group: /etc/doas.conf permit nopass :staff permit nopass keepenv root EOF]]> Aram Hăvărneanu 2019 1 2 2025 7 16 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys After you've done this, you might want to disable root user login. Aram Hăvărneanu 2019 2 11 2019 2 22 https://xw.is/001G/ 001G /001G/ OpenBSD HE IPv6 tunnel Aram Hăvărneanu 2019 2 11 2019 2 22 Introduction We will create an IPv6 tunnel (provided by Hurricane Electric) suitable for subnetting (/48). Aram Hăvărneanu 2019 2 11 2019 2 22 Configuration In /etc/hostname.gif0: tunnel 207.246.122.61 209.51.161.14 !ifconfig gif0 inet6 alias 2001:470:1f06:95f::2 2001:470:1f06:95f::1 prefixlen 128 !route -n add -inet6 default 2001:470:1f06:95f::1 Enable it (as root): sh /etc/netstart gif0 Aram Hăvărneanu 2019 2 11 2019 2 22 Test Check that it works: Aram Hăvărneanu 2019 2 11 2019 2 22 Routing Assign IPs to the interface you wish to route to: freedom# cat /etc/hostname.enc0 inet 172.24.24.1 255.255.255.0 172.24.24.255 inet6 2001:470:8c78:a0::1 64 up Reconfigure it: sh /etc/netstart enc0 Enable IPv6 forwarding: freedom# cat /etc/sysctl.conf hw.smt=1 net.inet.ip.forwarding=1 net.inet6.ip6.forwarding=1 Same thing with sysctl (as root): sysctl net.inet6.ip6.forwarding=1 Aram Hăvărneanu 2019 2 22 https://xw.is/001H/ 001H /001H/ OpenSMTPD forward to Google Aram Hăvărneanu 2019 2 22 Introduction We'll use OpenSMTPD to forward to Google. Aram Hăvărneanu 2019 2 22 Prerequistes A Gmail or Google Workspace account. OpenSMTPD is already installed and running on OpenBSD. Aram Hăvărneanu 2019 2 22 How Enable access to what Google calls less secure apps. Then as root: echo "googlemail user@gmail.com:password" > /etc/mail/secrets You can use your Google Apps username instead of gmail, and googlemail is just a label that we will use later. In /etc/mail/smtpd.conf: table aliases file:/etc/mail/aliases table secrets db:/etc/mail/secrets.db listen on lo0 action "local" mbox alias <aliases> action "relay" relay host smtp+tls://googlemail@smtp.googlemail.com:587 auth <secrets> match for local action "local" match for any action "relay" Notice the googlemail label. After this, just restart smtpd: rcctl restart smtpd Aram Hăvărneanu 2019 2 22 Test echo "Does it work?" | mail -s "Mail test from OpenBSD" spam@mgk.ro Aram Hăvărneanu https://xw.is/linux-index/ linux-index /linux-index/ Linux Tips and tricks for using Linux. Aram Hăvărneanu 2025 9 10 https://xw.is/001M/ 001M /001M/ Red Hat Enterprise Linux Post Install Steps Aram Hăvărneanu 2025 9 10 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2025 9 10 Register your system. Generate a new activation key in the Red Hat Hybrid Cloud Console and register your system. rhc connect --activation-key <key> --organization 7877846 --disable-feature analytics --disable-feature remote-management Aram Hăvărneanu 2025 9 10 Update the software dnf -y upgrade-minimal reboot Aram Hăvărneanu 2025 9 10 Create a user Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G wheel,users -m -s /bin/bash -U aram passwd -l aram Enable passwordless sudo for the wheel group: /etc/sudoers.d/91-wheel-no-password]]> Aram Hăvărneanu 2025 9 10 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2025 9 10 Enable kpatch Install kpatch and enable it. dnf -y install kpatch kpatch-dnf dnf kpatch auto Aram Hăvărneanu 2025 9 10 Unregister your system When you retire your system, don't forget to unregister. rhc disconnect Aram Hăvărneanu 2019 11 28 2025 8 13 https://xw.is/debian-sysroot/ debian-sysroot /debian-sysroot/ Toolchains › Create Debian sysroots We'll create Debian sysroots suitable for a GCC cross compiler. Aram Hăvărneanu 2019 11 28 2025 8 13 Debootstrap machine Everything below runs on the debootstrap machine as root: sudo -i Aram Hăvărneanu 2019 11 28 2025 8 13 Prerequisites Debian or Ubuntu or any system that can run mmdebstrap(1) (modern alternative to debootstrap(8)), with a configured QEMU user emulator. Aram Hăvărneanu 2019 11 28 2025 8 13 Install debootstrap and associated tools apt install -y binfmt-support qemu-user-static mmdebstrap Aram Hăvărneanu 2019 11 28 2025 8 13 Run debootstrap We're going to create sysroots for riscv64 and s390x (see the list of supported Debian ports.). Add more packages to --include, if needed. archs="riscv64 s390x" for arch in ${archs}; do mmdebstrap --variant=buildd --include="zlib1g-dev libgmp-dev libmpfr-dev" --architectures=${arch} stable /tmp/sysroot-${arch}.tar.xz done Note that Debian images are multiarch, which means that libraries and header files are in a different location than the usual one. GCC must be made aware of this via --enable-multiarch when running the top-level configure script. Failure to set --enable-multiarch will result in a failed build. Additionally, GCC for the host should be configured just as the the GCC on the target (in the sysroot). For example, some platforms do not make use of multilib (even though GCC might support it), so in those cases multilib should be explicitly disabled on the build machine with --disable-multilib, because otherwise it might default to being enabled leading to build failure. Aram Hăvărneanu 2019 11 28 2025 8 13 Host machine The following runs on the host machine (the machine where you'll compile and run your cross compiler). It can be the same machine as the debootstrap machine. Aram Hăvărneanu 2019 11 28 2025 8 13 Create directories targets="riscv64-linux-gnu s390x-linux-gnu" for target in ${targets}; do mkdir -p $HOME/cross/${target}/sys-root done Note that when we created the sysroots we used the Debian architecture names (riscv64, s390x), but here we use the GCC target triple (riscv64-linux-gnu, s390x-linux-gnu). Aram Hăvărneanu 2019 11 28 2025 8 13 Copy sysroots Copy the sysroots from the debootstrap machine (here debian@194.182.186.188) to the host machine. targets="riscv64-linux-gnu s390x-linux-gnu" for target in ${targets}; do arch=$(echo ${target} | cut -d '-' -f 1) ssh debian@194.182.186.230 "cat /tmp/sysroot-${arch}.tar.xz" | tar -C ${HOME}/cross/${target}/sys-root -xJf - done Aram Hăvărneanu 2019 11 28 2025 8 13 Debootstrap machine (again) Aram Hăvărneanu 2019 11 28 2025 8 13 Cleanup Still as root: rm -rf /tmp/sysroot-*.tar.xz Aram Hăvărneanu 2019 8 9 2025 7 15 https://xw.is/001E/ 001E /001E/ Ubuntu Linux Post Install Steps Aram Hăvărneanu 2019 8 9 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2019 8 9 2025 7 15 Set hostname hostnamectl set-hostname test0.mgk.ro reboot Aram Hăvărneanu 2019 8 9 2025 7 15 Scaleway If you're on a braindead platform like Scaleway, you might also need to disable this: systemctl disable scw-set-hostname Aram Hăvărneanu 2019 8 9 2025 7 15 Package management Aram Hăvărneanu 2019 8 9 2025 7 15 Do not install recommended and suggested packages Seriusly, who wants this? Disable it: cat <<EOT >/etc/apt/apt.conf.d/61norecommends APT::Install-Recommends "false"; APT::Install-Suggests "false"; EOT Aram Hăvărneanu 2019 8 9 2025 7 15 Update the software apt update && apt -y upgrade reboot Aram Hăvărneanu 2019 8 9 2025 7 15 User management Aram Hăvărneanu 2019 8 9 2025 7 15 Create a user (cloud computing) Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G users -m -s /bin/bash -g staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2019 8 9 2025 7 15 Fix the user created during installation (non-cloud) usermod -a -G staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2019 8 9 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2019 8 9 2025 7 15 Install packages For home installations you might want to install avahi: apt install avahi-daemon For development systems you might want to install: apt install -y git build-essential clang clang-format clang-tidy Aram Hăvărneanu 2019 3 13 2025 7 15 https://xw.is/001D/ 001D /001D/ Install newer kernels in Debian stable Aram Hăvărneanu 2019 3 13 2025 7 15 Prerequisites Install Debian. Everything on this page needs to be done as root, so sudo(8) to root. sudo -i Aram Hăvărneanu 2019 3 13 2025 7 15 Enable backports cat <<EOT >>/etc/apt/sources.list deb http://deb.debian.org/debian/ stretch-backports main contrib non-free deb-src http://deb.debian.org/debian/ stretch-backports main contrib non-free EOT Aram Hăvărneanu 2019 3 13 2025 7 15 Upgrade some packages It's unclear why we need this or whether we need it at all: sudo apt-get -t stretch-backports upgrade Aram Hăvărneanu 2019 3 13 2025 7 15 Search for a new kernel apt search linux-image Aram Hăvărneanu 2019 3 13 2025 7 15 Install new kernel apt-get -t stretch-backports install linux-image-4.19.0-0.bpo.2-amd64 linux-headers-4.19.0-0.bpo.2-amd64 firmware-linux-free Aram Hăvărneanu 2019 3 13 2025 7 15 Reboot reboot After reboot, check for the new kernel: aram@debian:~$ uname -a Linux debian 4.19.0-0.bpo.2-amd64 1 SMP Debian 4.19.16-1~bpo9+1 (2019-02-07) x86_64 GNU/Linux aram@debian:~$ Aram Hăvărneanu 2018 8 31 2025 7 15 https://xw.is/001C/ 001C /001C/ Debian Linux Post Install Steps Aram Hăvărneanu 2018 8 31 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2018 8 31 2025 7 15 Set hostname hostnamectl set-hostname sky.mgk.ro reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Scaleway If you're on a braindead platform like Scaleway, you might also need to disable this: systemctl disable scw-set-hostname Aram Hăvărneanu 2018 8 31 2025 7 15 Package management Aram Hăvărneanu 2018 8 31 2025 7 15 Enable more repositories Debian doesn't enable the contrib and non-free repositories by default. Do it: cat <<EOT >/etc/apt/sources.list deb http://deb.debian.org/debian/ stretch main contrib non-free deb-src http://deb.debian.org/debian/ stretch main contrib non-free deb http://security.debian.org/debian-security stretch/updates main contrib non-free deb-src http://security.debian.org/debian-security stretch/updates main contrib non-free deb http://deb.debian.org/debian/ stretch-updates main contrib non-free deb-src http://deb.debian.org/debian/ stretch-updates main contrib non-free EOT Aram Hăvărneanu 2018 8 31 2025 7 15 Do not install recommended and suggested packages Seriusly, who wants this? Disable it: cat <<EOT >/etc/apt/apt.conf.d/50norecommends APT::Install-Recommends "false"; APT::Install-Suggests "false"; EOT Aram Hăvărneanu 2018 8 31 2025 7 15 Update the software apt update && apt -y upgrade reboot Aram Hăvărneanu 2018 8 31 2025 7 15 User management Aram Hăvărneanu 2018 8 31 2025 7 15 Create a user (cloud computing) Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G users -m -s /bin/bash -g staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2018 8 31 2025 7 15 Fix the user created during installation (non-cloud) usermod -a -G staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2018 8 31 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2018 8 31 2025 7 15 Install packages For home installations you might want to install avahi: apt install avahi-daemon For development systems you might want to install: apt install rsync git build-essential linux-headers-amd64 gccgo gccgo-go golang-go clang clang-format clang-tidy And if you set up backports: apt -t stretch-backports install clang-6.0 golang-go apt autoremove Aram Hăvărneanu 2018 8 31 2025 7 15 Newer kernel If it's a testing or development system, perhaps you might want a newer kernel. Aram Hăvărneanu 2018 8 31 2025 7 15 https://xw.is/001B/ 001B /001B/ Fedora Linux Post Install Steps Aram Hăvărneanu 2018 8 31 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2018 8 31 2025 7 15 Cloud Init If your install uses cloud-init (e.g. Amazon EC2) do the following: Aram Hăvărneanu 2018 8 31 2025 7 15 Set hostname echo 'preserve_hostname: yes' >/etc/cloud/cloud.cfg.d/55-preseve-hostname.cfg echo 'eden.mgk.ro' >/etc/hostname reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Enable IPv6 cat <<EOF >/etc/cloud/cloud.cfg.d/56-custom-networking.cfg network: version: 1 config: - type: physical name: eth0 subnets: - type: dhcp - type: dhcp6 EOF reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Scaleway If you're on a braindead platform like Scaleway, you might also need to disable this: systemctl disable scw-set-hostname Aram Hăvărneanu 2018 8 31 2025 7 15 Update the software dnf -y upgrade-minimal reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Create a user Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G wheel,users -m -s /bin/bash -U aram passwd -l aram Enable passwordless sudo for the wheel group: /etc/sudoers.d/91-wheel-no-password]]> Aram Hăvărneanu 2018 8 31 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2018 8 31 2025 7 15 Enable NTP service If not already enabled, enable NTP: systemctl enable --now ntpd.service Aram Hăvărneanu 2018 8 31 2025 7 15 Install packages For home installations you might want to install avahi: dnf install nss-mdns avahi systemctl enable --now avahi-daemon.service For development systems you might want to install: dnf -y groupinstall 'Development Tools' dnf -y install rsync clang clang-tools-extra gcc-go golang Aram Hăvărneanu 2019 3 20 https://xw.is/0017/ 0017 /0017/ Use local time for RTC on systemd-based Linux distributions This is not recommended, but if you need to use local time for whatever reason, you can do this: timedatectl set-local-rtc 1 Aram Hăvărneanu 2019 2 22 https://xw.is/0018/ 0018 /0018/ Upgrade Debian Linux to Testing See the Debian wiki for more information. Everything on this page must be ran as root. Switch to root with su -. Aram Hăvărneanu 2019 2 22 Upgrade to testing Run the following commands apt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb https://deb.debian.org/debian testing main contrib non-free deb https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -y Answer the questions. If you enable extra architectures (see below), you might want to limit the architectures of the main repositories to amd64 (assuming you use that). In this case do this instead: apt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb [arch=amd64] https://deb.debian.org/debian testing main contrib non-free deb [arch=amd64] https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -y Aram Hăvărneanu 2019 2 22 Make apt prefer testing by default If you are going to use multiple repos (e.g. debian-ports below), make testing the default like so: echo 'APT::Default-Release "testing";' >/etc/apt/apt.conf.d/91prefertesting Aram Hăvărneanu 2019 2 22 Add support for new (hardware) ports If you want to add support for new ports (e.g. RISC-V), do this: apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb https://deb.debian.org/debian-ports unstable main deb https://deb.debian.org/debian-ports unreleased main deb https://deb.debian.org/debian-ports experimental main EOF apt-get update Consider limiting the new ports to a specific architecture. Also consider limiting the main repositories to amd64 (if you use amd64). So do this instead: apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb [arch=riscv64] https://deb.debian.org/debian-ports unstable main deb [arch=riscv64] https://deb.debian.org/debian-ports unreleased main deb [arch=riscv64] https://deb.debian.org/debian-ports experimental main EOF apt-get update Aram Hăvărneanu 2019 2 22 https://xw.is/0019/ 0019 /0019/ Upgrade Debian Linux to Unstable See the Debian wiki for more information.Everything on this page must be ran as root. Switch to root with su -.Before upgrading to Debian Unstable, you must first upgrade to Debian Testing. Aram Hăvărneanu2019222https://xw.is/0018/0018/0018/Linux › Upgrade Debian Linux to TestingSee the Debian wiki for more information.Everything on this page must be ran as root. Switch to root with su -.Aram Hăvărneanu2019222Upgrade to testingRun the following commandsapt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb https://deb.debian.org/debian testing main contrib non-free deb https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -yAnswer the questions. If you enable extra architectures (see below), you might want to limit the architectures of the main repositories to amd64 (assuming you use that). In this case do this instead:apt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb [arch=amd64] https://deb.debian.org/debian testing main contrib non-free deb [arch=amd64] https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -yAram Hăvărneanu2019222Make apt prefer testing by defaultIf you are going to use multiple repos (e.g. debian-ports below), make testing the default like so:echo 'APT::Default-Release "testing";' >/etc/apt/apt.conf.d/91prefertestingAram Hăvărneanu2019222Add support for new (hardware) portsIf you want to add support for new ports (e.g. RISC-V), do this:apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb https://deb.debian.org/debian-ports unstable main deb https://deb.debian.org/debian-ports unreleased main deb https://deb.debian.org/debian-ports experimental main EOF apt-get updateConsider limiting the new ports to a specific architecture. Also consider limiting the main repositories to amd64 (if you use amd64). So do this instead:apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb [arch=riscv64] https://deb.debian.org/debian-ports unstable main deb [arch=riscv64] https://deb.debian.org/debian-ports unreleased main deb [arch=riscv64] https://deb.debian.org/debian-ports experimental main EOF apt-get update Aram Hăvărneanu2019222Upgrade to unstableRun the following commands:cat <<EOF >/etc/apt/sources.list deb http://deb.debian.org/debian unstable main deb http://deb.debian.org/debian-debug unstable-debug main deb http://deb.debian.org/debian-ports unstable main EOF apt-get update apt-get dist-upgrade -y apt autoremove -yThen answer the questions. Consider limiting the architecture to amd64 (if that's what you use):cat <<EOF >/etc/apt/sources.list deb [arch=amd64] http://deb.debian.org/debian unstable main deb [arch=amd64] http://deb.debian.org/debian-debug unstable-debug main deb [arch=amd64] http://deb.debian.org/debian-ports unstable main EOF apt-get update apt-get dist-upgrade -y apt autoremove -y Aram Hăvărneanu https://xw.is/solaris-index/ solaris-index /solaris-index/ Solaris Tips and tricks for using Solaris. Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0008/ 0008 /0008/ Generate SPARC sysroot on amd64 Solaris 11 If you need libraries and headers for producing a Solaris/SPARC GCC cross compiler you can obtain them from a regular amd64 Solaris 11 installation. The following commands will install libraries suitable for Solaris gcc cross compiler in $PKG_IMAGE: TRIPLET=sparc64-sun-solaris2.11 export PKG_IMAGE=/export/$TRIPLET-sysroot zfs create rpool$PKG_IMAGE pkg image-create -F -p solaris=http://pkg.oracle.com/solaris/release $PKG_IMAGE pkg change-variant variant.arch=sparc pkg install --accept entire@latest solaris-minimal-server system/header gcc Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0007/ 0007 /0007/ Re-add "Primary Administrator" in Solaris 11 Solaris used to ship with a Primary Administrator RBAC profile, but it was removed some time in Solaris 11. We can easily add it back to the profile description and to the execution profile databases. After this, we can run pfexec(1) without a password. Run the following as root: echo 'Primary Administrator:suser:cmd:::*:uid=0;gid=0' >> /etc/security/exec_attr echo 'Primary Administrator:::All administrative tasks:auths=solaris.*;solaris.grant;help=RtPriAdmin.html' >> /etc/security/prof_attr usermod -P "Primary Administrator" aram Aram Hăvărneanu 2019 2 22 https://xw.is/0013/ 0013 /0013/ Boot SPARC server behind NAT over the Internet from Solaris 11 VM also behind NAT Aram Hăvărneanu 2019 2 22 Network topology We have two sites, both connected to the Internet, Vienna, and Sibiu. We wish to network boot the SPARC server (located in Vienna), while we're working on the laptop in Sibiu. We have access to VMware Fusion, and we can install a Solaris network boot server in a virtual machine. =latex, font=\footnotesize ] \node [router] (r1) {Router \#1\\(NAT)}; \node [switch, above=1.2cm of r1] (sw1) {Switch}; \node [host, line width=1pt, left =2.4cm of sw1] (sparc) {SPARC\\server}; \node [host, right=2.4cm of sw1] (z800) {z800}; \node [cloudnode, below=1.2cm of r1] (internet) {Internet}; \node [router, below=1.2cm of internet] (r2) {Router \#2\\(NAT)}; \node [switch, below=1.2cm of r2] (sw2) {Switch}; \node [router, right=2cm of sw2] (r3) {Router \#3\\(VMware)}; \node [host, left =2.4cm of sw2] (laptop) {Laptop}; \node [host, line width=1pt, below=1.2cm of r3] (solaris) {Solaris\\VM}; \draw [thick] (sparc.west |- internet) -- ($(internet.west)+(-0.6cm,0)$); \draw [thick] ($(internet.east)+(0.6cm,0)$) -- ([xshift=0.5cm]z800.east |- internet); \node [anchor=south west,yshift=2pt] at (sparc.west |- internet) {Site \#1 (Vienna)}; \node [anchor=north west,yshift=-2pt] at (sparc.west |- internet) {Site \#2 (Sibiu)}; \draw (sparc.east) -- node[pos=.37,above] {192.168.0.60} (sw1.west); \draw (sw1.east) -- node[pos=.60,above] {192.168.0.100} (z800.west); \draw (sw1.south) -- node[pos=.85,left] {192.160.0.1/24}(r1.north); \draw (r1.south) -- node[pos=.15,left] {84.112.126.72} (internet.north); \draw (internet.south) -- node[pos=.85,left] {xx.xx.xx.xx} (r2.north); \draw (r2.south) -- node[pos=.20,left] {172.20/20} (sw2.north); \draw (sw2.east) -- node[pos=.58,above] {172.20.8.xx} (r3.west); \draw (sw2.west) -- node[pos=.65,above] {172.20.8.yy} (laptop.east); \draw (r3.south) -- node[pos=.20,right] {172.16.24/24} node[pos=.85,right] {172.16.24.128} (solaris.north); \end {tikzpicture} ]]> Aram Hăvărneanu 2019 2 22 Strategy The idea is that we have access through ssh to a machine in the same LAN as the server (z800 in the diagram above). We want to make the SPARC server think it's booting from this machine while we're in fact using ssh port forwarding to forward the inbound connection to that machine to our VM. Aram Hăvărneanu 2019 2 22 Instructions Install Solaris 11 (amd64) in VMware, on laptop. Then set-up a SPARC Automated Installer (AI) server: vm# pfexec installadm create-service -a sparc Make a client-specific AI config: cp /etc/netboot/{system,webboot}.conf /etc/netboot/cl.ie.nt.ip Edit /etc/netboot/client-ip/webboot.conf to reference client (e.g. behind NAT) IPs. Set-up remote port forwarding: laptop$ ssh -S none -NT -R 5555:172.16.24.128:5555 -L 8080:192.168.0.1:80 vienna.mgk.ro Set-up the SPARC machine to netboot using static IP: ok setenv network-boot-arguments host-ip=192.168.0.60,router-ip=192.168.0.1,subnet-mask=255.255.255.0,file=http://192.168.0.100:5555/cgi-bin/wanboot-cgi ok boot net Aram Hăvărneanu 2019 2 22 https://xw.is/0010/ 0010 /0010/ Solaris 11 zones virtual networking with NAT Aram Hăvărneanu 2019 2 22 Prepare the Solaris global zone Prepare the global zone; net2 is the interface connected to the Internet. dladm create-etherstub ether0 dladm create-vnic -l ether0 vnic0 ipadm create-ip vnic0 ipadm create-addr -T static -a 10.0.0.1/8 vnic0/v4 routeadm -u -e ipv4-forwarding ipadm set-ifprop -p forwarding=on -m ipv4 net2 ipadm set-ifprop -p forwarding=on -m ipv4 vnic0 echo "map net2 10.0.0.0/8 -> 0/32 portmap tcp/udp auto" > /etc/ipf/ipnat.conf echo "map net2 10.0.0.0/8 -> 0/32" >> /etc/ipf/ipnat.conf svcadm enable network/ipfilter Aram Hăvărneanu 2019 2 22 Prepare the non-global zones Prepare the zone; for-sysroot is the zone name. dladm create-vnic -l ether0 vnic1 zonecfg -z for-sysroot "create; set ip-type=exclusive; add net; set physical=vnic1; end; commit" zoneadm -z for-sysroot install zoneadm -z for-sysroot boot zlogin -C for-sysroot In sysconfig(1M) set up vnic1/v4 10.0.0.2/8 with 10.0.0.1 as default router. Aram Hăvărneanu 2019 2 22 Revert (optional) If you want to revert the previous steps, do the following. Aram Hăvărneanu 2019 2 22 Delete the non-global zone Delete the zone. zoneadm -z for-sysroot shutdown zoneadm -z for-sysroot uninstall -F zonecfg -z for-sysroot delete -F dladm delete-vnic vnic Aram Hăvărneanu 2019 2 22 Restore the global zone Restore the global zone to its original state. routeadm -u -d ipv4-forwarding ipadm delete-addr vnic0/v4 ipadm delete-ip vnic0 dladm delete-vnic vnic0 dladm delete-etherstub ether0 ipadm set-ifprop -p forwarding=off -m ipv4 net2 svcadm disable network/ipfilter rm /etc/ipf/ipnat.conf Aram Hăvărneanu 2018 6 7 https://xw.is/0011/ 0011 /0011/ Build GDB and gdbserver(1) for Solaris 11 SPARC Aram Hăvărneanu 2018 6 7 Build GDB on development machine On development (e.g. amd64) machine: cd $HOME curl http://ftp.gnu.org/gnu/gdb/gdb-7.11.1.tar.gz | tar xf - mkdir -p $HOME/gdb-build cd $HOME/gdb-build ../gdb-7.11.1/configure --prefix $HOME/xgcc --bindir $HOME/bin --target sparc64-sun-solaris2.11 make -j5 && make inst Aram Hăvărneanu 2018 6 7 Build GDB and gdbserver(1) on target machine On target (e.g. Solaris/SPARC) machine: cd $HOME/src curl http://ftp.gnu.org/gnu/gdb/gdb-7.11.1.tar.gz | gtar xzf - zfs create -p rpool/export/home/aram/builds/gdb zfs create -p rpool/export/home/aram/builds/gdbserver cd $HOME/builds/gdb CFLAGS='-m64' ../../src/gdb-7.11.1/configure --disable-tui --host sparc64-sun-solaris2.11 --build sparc64-sun-solaris2.11 --target sparc64-sun-solaris2.11 --prefix $HOME/tools --bindir $HOME/bin make -j80 && make install cd $HOME/builds/gdbserver ../../src/gdb-7.11.1/gdb/gdbserver/configure --host sparc64-sun-solaris2.11 --build sparc64-sun-solaris2.11 --target sparc64-sun-solaris2.11 --prefix $HOME/tools --bindir $HOME/bin make -j80 && make install Aram Hăvărneanu 2018 6 7 https://xw.is/0009/ 0009 /0009/ Create a new administrative user in Solaris Aram Hăvărneanu 2018 6 7 Ensure "Primary Administrator" profile exist Make sure Primary Administrator profile exists and the current user is assigned to it. Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0007/ 0007 /0007/ Solaris › Re-add "Primary Administrator" in Solaris 11 Solaris used to ship with a Primary Administrator RBAC profile, but it was removed some time in Solaris 11. We can easily add it back to the profile description and to the execution profile databases. After this, we can run pfexec(1) without a password. Run the following as root: echo 'Primary Administrator:suser:cmd:::*:uid=0;gid=0' >> /etc/security/exec_attr echo 'Primary Administrator:::All administrative tasks:auths=solaris.*;solaris.grant;help=RtPriAdmin.html' >> /etc/security/prof_attr usermod -P "Primary Administrator" aram Aram Hăvărneanu 2018 6 7 Create the new user pfexec useradd -u 5008 -g staff -s /bin/bash -m -P 'Primary Administrator' -K 'defaultpriv=basic,dtrace_proc,dtrace_user' foo pfexec passwd -N foo Aram Hăvărneanu https://xw.is/macos-index/ macos-index /macos-index/ macOS Tips and tricks for using macOS. https://xw.is/macos-installer/ macos-installer /macos-installer/ Create a bootable installer for macOS Documentation https://support.apple.com/en-us/101578 You can use a USB flash drive or other secondary volume as a startup disk from which to install the Mac operating system. These steps are primarily for system administrators and other experienced users. Aram Hăvărneanu 2022 7 28 https://xw.is/0004/ 0004 /0004/ Use the Apple Keychain for ssh key passphrases On modern macOS systems, you can set up your system such that your encrypted ssh keys get automatically decrypted using the passphrase stored in the Apple Keychain (which gets unlocked at login). Aram Hăvărneanu 2022 7 28 Add your passphrase to the Keychain Create your keys as usual, then do this once for every key: ssh-add --apple-use-keychain ~/.ssh/id_ed25519 You must use the full path your key, a relative path will not work! Note that we're adding the key to the ssh agent here, but we will not be using the ssh agent. Rather, this operation has the side effect that the key will be saved in the keychain. Aram Hăvărneanu 2022 7 28 Configure ssh to use the Keychain Add this to your ~/.ssh/config: Host * IgnoreUnknown UseKeychain UseKeychain yes IgnoreUnknown is there so that UseKeychain (an Apple-specific extension) will work with non-Apple ssh implementations. Contrary to Internet misinformation you do not need to use ssh-agent(1), or enable any special Apple-specific options for the ssh agent. Of course you can do this per-host, or per-key, but then IgnoreUnknown should come early in your configuration, before any use of UseKeychain. Aram Hăvărneanu 2020 7 29 https://xw.is/0005/ 0005 /0005/ HiDPI XQuartz XQuartz doesn't support HiDPI in any reasonable way, but you can sort of make it work on a temporary basis using the following technique. Assuming you want to run a remote X application, and you want that application to use HiDPI: Install XQuartz, for example brew install xquartz. Enable full screen mode in XQuartz. It doesn't work in non-root window mode. Connect to remote server using remote X forwarding, like ssh -Snone -X z800.local. Disabling multiplexing is important because it doesn't work well with X forwarding. Run xterm, we need an X (non-native) terminal for later. In a native terminal (Terminal.app) run xrandr --output default --mode 5120x2880 --dpi 218. Unfortunately we can't make this permanent. After this, you will be in high resolution full screen X, with a very tiny xterm. Run whatever application from that xterm. You might need to force HiDPI mode for that application, but it should have all the pixels available. To get out of X, press ⌥ ⌘ A. Unfortunately this will turn off the X resolution hack set above. To get back into X at the correct resolution, run xrandr --output default --mode 5120x2880 --dpi 218 again in the native terminal. It's awful, but it works. Backlinks Related https://xw.is/solaris/ solaris /solaris/ Solaris Software https://www.oracle.com/solaris Proprietary Unix operating system originally developed by Sun Microsystems. Contributions