Tech Blog

These are blog entries written by the UNIX Health Check development team. Our team has extensive technical experience on both AIX and Red Hat systems, and we like to share our knowledge with our visitors.

Topics: Red Hat / Linux

Red Hat Enterprise Linux links

Official Red Hat sites:

Other Red Hat related sites:

Topics: Red Hat / Linux, Security↑

Generating random passwords

A way to create a random password yourself is using a password generator. The pwmake is a command-line tool for generating random passwords that consist of all four groups of characters: uppercase, lowercase, digits and special characters.

The utility allows you to specify the number of entropy bits that are used to generate the password. The entropy is pulled from /dev/urandom. The minimum number of bits you can specify is 56, which is enough for passwords on systems and services where brute force attacks are rare. 64 bits is adequate for applications where the attacker does not have direct access to the password hash file (/etc/shadow). For situations when the attacker might obtain the direct access to the password hash or the password is used as an encryption key, 80 to 128 bits should be used. If you specify an invalid number of entropy bits, pwmake will use the default of bits.

To create a password of 128 bits, enter the following command: 

# pwmake 128
*oLhezv@Hal7YmUM;Igqilur0N&

Topics: Red Hat / Linux↑

Red Hat Customer Portal

Access Red Hat Customer Portal at https://access.redhat.com

  • Access everything provided with subscription in one location:
    • Search knowledge-base for solutions, FAQs, and articles.
    • Access official product documentation.
    • Submit and manage support tickets.
    • Attach and detach product subscriptions.
    • Download software, updates, and evaluations.
  • Parts of site accessible to everyone.
    • Other parts are exclusive to customers with active subscriptions.
  • Get help with Customer Portal at https://access.redhat.com/help/
Note: The Red Hat Customer Portal can be accessed via command line tool: 
# redhat-support-tool
Welcome to the Red Hat Support Tool.
Command (? for help):
You can access it from any terminal or SSH connection, and you can use it as interactive shell (which is default) or execute individual commands with options and arguments. The syntax is identical for both methods. To see all available commands, use "help".

Topics: AIX↑

AIX Links

Links / URLs regarding IBM AIX:

Topics: Backup & restore, Spectrum Protect↑

Register a new TSM / IBM Spectrum Protect administrator

To register a new TSM / IBM Spectrum Protect administrator, run:

register admin adminname password contact="Contact details of the new admin" emailaddress=email-address@ofthenewadmin.com
Next, grant system privilege authority to the new admin:
grant authority adminname class=sys
To remove a TSM admin, run:
remove admin adminname

Topics: Backup & restore, Spectrum Protect↑

Show configuration of a TSM / IBM Spectrum Protect server

To save the complete configuration of a TSM server to a file, run:

dsmadmc -id=admin -password=admin show config > /tmp/config
This assumes that you have an admin account with the password admin. And it will write the output file to /tmp/config.

If you wish to have comma separated output, add -comma.

To just display the status of the TSM / IBM Spectrum Protect server, run (this is included in the output of show config):
q status
Another very interesting command to run is:
q system

Topics: Backup & restore, Spectrum Protect↑

Tail TSM / IBM Spectrum Protect console log

The following command can be used to tail the TSM / IBM Spectrum Protect console log:

dsmadmc -console
This will allow you to continously follow what is happening on the TSM / IBM Spectrum Protect server.

Topics: Backup & restore, Spectrum Protect↑

Start a backup from the TSM / IBM Spectrum Protect server

There is a way to start a backup from the TSM / IBM Spectrum Protect server itself, and that is by defining a client action. For example, to start an incremental backup on a node, run:

define clientaction action=incremental
You can use wild cards like * in the node name, for example:
def clienta node* act=i
You can monitor the schedule event, using the following command:
q ev * @1
You may cancel this schedule, by running:
delete schedule [policy domain] @1

Topics: Red Hat / Linux, System Admin↑

Red Hat: Creating a backup to ISO images

The following procedure describes how to create a full system backup, using MondoRescue, to ISO images, that can later be burnt to DVD, and used to recover the entire system.

First, set up the REPO for MondoResuce: 

# cd /etc/yum.repos.d/
# wget ftp://ftp.mondorescue.org/rhel/7/x86_64/mondorescue.repo
Install MondoRescue: 
# yum install mondo
Answer "y" to everything.

You will need a destination to put the ISO files in. For example a remote NFS mount on a separate server is a good choice, so the backup is not locally on the same system.

Edit /etc/mindi/mindi.conf, to allow for a larger RAM disk. Mindi is used by Mondo. Wihout it, Mindi will exit saying it ran out of space. Add to mindi.conf: 
EXTRA_SPACE=240000
BOOT_SIZE=240000
Now run the MondoRescue backup: 
# mondoarchive -O -V -i -s 4480m -d /target -I / -T /tmp
You can also add the -E option to tell MondoRescue to exclude certain folders.

The -s option tells MondoResuce to make ISO images of DVD size 4480m.

The command says it will log to /var/log/mondoarchive.log. A /var/log/mindi.log is also written. It will also indicate the number of media images to be created. Let it run, and your backup is successful.

Topics: AIX, System Admin↑

Configuring dsh

The dsh (distributed shell) is a very useful (and powerful) utility that can be used to run commands on multiple servers at the same time. By default it is not installed on AIX, but you can install it yourself:

First, install the dsm file sets. DSM is short for Distributed Systems Management, and these filesets include the dsh command. These file sets can be found on the AIX installation media. Install the following 2 filesets: 

# lslpp -l | grep -i dsm
  dsm.core       7.1.4.0  COMMITTED  Distributed Systems Management
  dsm.dsh        7.1.4.0  COMMITTED  Distributed Systems Management
Next, we'll need to set up some environment variables that are being used by dsh. The best way to do it, is by putting them in the .profile of the root user (in ~root/.profile), so you won't have to bother setting these environment variables manually every time you log in: 
# cat .profile
alias bdf='df -k'
alias cls="tput clear"
stty erase ^?
export TERM=vt100

# For DSH
export DSH_NODE_RSH=/usr/bin/ssh
export DSH_NODE_LIST=/root/hostlist
export DSH_NODE_OPTS="-q"
export DSH_REMOTE_CMD=/usr/bin/ssh
export DCP_NODE_RCP=/usr/bin/scp
export DSH_CONTEXT=DEFAULT
In the output from .profile above, you'll notice that variable DSH_NODE_LIST is set to /root/hostlist. You can update this to any file name you like. The DSH_NODE_LIST variable points to a text file with server names in them (1 per line), that you will use for the dsh command. Basically, every host name of a server that you put in the list that DSH_NODE_LIST refers to, will be used to run a command on using the dsh command. So, if you put 3 host names in the file, and then run a dsh command, that command will be executed on these 3 hosts in parallel.

Note: You may also use the environment variable WCOLL instead of DSH_NODE_LIST.

So, create file /root/hostlist (or any file that you've configured for environment variable DSH_NODE_LIST), and add host names in it. For example: 
# cat /root/hostlist
host1
host2
host3
Next, you'll have to set up the ssh keys for every host in the hostlist file. The dsh command uses ssh to run commands, so you'll have to enable password-less ssh communication from the host where you've installed dsh on (let's call that the source host), to all the hosts where you want to run commands using dsh (and we'll call those the target hosts).

To set this up, follow these steps:
  • Run "ssh-keygen -t rsa" as user root on the source and all target hosts.
  • Next, copy the contenst of ~root/.ssh/id_rsa.pub from the source host into file ~root/.ssh/authorized_keys on all the target hosts.
  • Test if you can ssh from the source hosts, to all the target hosts, by running: "ssh host1 date", for each target host. If you're using DNS, and have fully qualified domain names configured for your hosts, you will want to test by performing a ssh to the fully qualified domain name instead, for example: "ssh host1.domain.com". This is because dsh will also resolve host names through DNS, and thus use these instead of the short host names. You will be asked a question when you run ssh for the first time from the source host to the target host. Answer "yes" to add an entry to the known_host file.
Now, ensure you log out from the source hosts, and log back in again as root. Considering that you've set some environment variables in .profile for user root, it is necessary that file .profile gets read, which is during login of user root.

At this point, you should be able to issue a command on all the target hosts, at the same time. For example, to run the "date" command on all the servers: 
# dsh date
Also, you can now copy files using dcp (notice the similarity between ssh and dsh, and scp and dcp), for example to copy a file /etc/exclude.rootvg from the source host to all the target hosts:
# dcp /etc/exclude.rootvg /etc/exclude.rootvg
Note: dsh and dcp are very powerful to run commands on multiple servers, or to copy files to multiple servers. However, keep in mind that they can be very destructive as well. A command, such as "dsh halt -q", will ensure you halt all the servers at the same time. So, you probably may want to triple-check any dsh or dcp commands that you want to run, before actually running them. That is, if you value your job, of course.

Number of results found: 470.
Displaying results: 81 - 90.