Oracle Solaris 11 Administration – Command Cheat Sheet

By: Ramdev
August 5, 2015

+ In this post we will be Discussing about :
Solaris Installation
System Configuration
Users and Groups
Boot Environments
Software installation and Packaging
File systems – Basic ZFS Administration
Disk Devices
Oracle Solaris Zones
Service Management Facility
Solaris 11 Networking
Networking – Manual Administration
Networking – Automatic Administration
Networking – Advanced Administration
Share & Discuss
Solaris Installation

Automated Installer (AI) is the new network based multi-client provisioning system on Oracle Solaris 11. AI provides hands-free installation of both SPARC and x86 systems by using an installation service that installs systems from software package repositories on the network.

Create an install service from a downloaded ISO file, specifying x86 based DHCP client starting at address 192.168.1.210 with a total count of 10 addresses:

# installadm create-service -n s11x86 -i 192.168.1.210 -c 10 -s /path/to/solaris-11-1111-ai-x86.iso

List all enabled services:

# installadm list

List any installation manifests associated with the install services:

# installadm list -m

Export the default installation manifest associated with the s11x86 service:

# installadm export -n s11x86 -m orig_default > manifest.xml

Import a manifest to be associated with the s11x86 service:

# installadm update-manifest -n s11x86 -m orig_default -f manifest.xml

List any system configuration profiles associated with the install services:

# installadm list -p

Create a system configuration profile interactively, saving the contents to a file:

# sysconfig create-profile -o profile.xml

Validate a system configuration profile against the default x86 install service:

# installadm validate -n default-i386 -P profile.xml

Associate a system configuration profile with the deafult x86 install service and give it a name sc-profile:

# installadm create-profile -n default-i386 -f profile.xml  -p sc-profile

Apply a criteria that all clients must have 4096MB memory or greater to the manifest s11manifest of s11x86 service:

# installadm set-criteria -m s11manifest -n s11x86 -a MEM=”4096-unbounded”

System Configuration

Common system configuration tasks have changed in Oracle Solaris 11 with the Service Management Facility (SMF) configuration repository being used to store configuration data. With the addition of configuration layers, administrators now have better control and assurance that their configuration changes will be preserved across system updates.

Configuring nodename:

# svccfg –s svc:/system/identity:node setprop config/nodename = “myhost”
# svcadm refresh svc:/system/identity:node
# svcadm restart svc:/system/identity:node

Configuring console keyboard layout:

# svccfg –s keymap:default setprop keymap/layout = UK-English
# svcadm refresh keymap
# svcadm restart keymap

Configuring system locale:

# svccfg –s timezone:default setprop timezone/localtime = astring: US/Mountain
# svcadm refresh timezone:default

Unconfigure a system and start an interactive configuration tool on reboot:

# sysconfig configure -s

Create a system configuration profile:

# sysconfig create-profile -o sc-profile.xml

Configure a system according to a system configuration profile:

# sysconfig configure -c sc-profile.xml

Users and Groups

The traditional root account has been changed to a ‘root’ role on all Oracle Solaris 11 installations as part of the Role Based Access Control (RBAC) feature set. This change gives improved auditability across the operating system, and the ability for administrators to delegate various system tasks to others in a safe way.

Revert to root as normal user account:

# rolemod –K type=normal root

Configure root as a role (default):

# usermod –K type=role root

Add a new user and delegate him the System Adminstrator profile:

# useradd -d /export/home/joerg -P “System Administrator” joerg

Boot Environments

Boot Environments are individual bootable instances of the operating system that take advantage of the Oracle Solaris ZFS filesystem snapshot and clone capability. During a system update, new boot environments are created so that system software updates can be applied in a safe environment. Should anything go awry, administrators can boot back into an older boot environment. Boot environments have low overhead and can be quickly created giving administrators an ideal best practice for any system
maintenance work.

Create a boot environment:

# beadm create solaris-05032012

Activate a boot environment:

# beadm activate solaris-05032012

Delete a boot environment:

# beadm destroy solaris-05032012

Show boot environments from SPARC boot PROM:

ok boot -L

Boot into a boot environment from SPARC boot PROM:

ok boot -Z rpool/ROOT/solaris-05032012

Software installation and Packaging

Oracle Solaris 11 includes IPS, a new network-centric package management framework with automatic dependency checking. IPS has integrated package and patching, and can seamlessly manage system updates to Oracle Solaris Zones environments.

Install a package called diagnostic/wireshark:

# pkg install diagnostic/wireshark

Install a group package to provide a desktop environment:

# pkg install solaris-desktop

Update all possible packages to the newest version, including any zones:

# pkg update

Do a dry run of a system update to understand what packages may change:

# pkg update -nv

Uninstall a package called diagnostic/wireshark:

# pkg uninstall wireshark

List all packages installed on a system:

# pkg list

Get more information about an installed package called diagnostic/wireshark:

# pkg info wireshark

List the contents of an installed package called diagnostic/wireshark:

# pkg contents wireshark

Search all packages in the configured repositories for a file called math.h:

# pkg search math.h

Search for all packages installed on a system that have a dependency on library/libxml2:

# pkg search -l -o pkg.name ‘depend::library/libxml2’

List currently associated package publishers:

# pkg publisher

Connect to the Oracle support repository and update the system:

# pkg set-publisher -g https://pkg.oracle.com/solaris/support -G http://pkg.oracle.com/solaris/release -k /path/to/ssl_key -c /path/to/ssl_cert solaris
# pkg update

File systems – Basic ZFS Administration

Oracle Solaris ZFS is the default root file system on Oracle Solaris 11. ZFS has integrated volume management, preserves the highest levels of data integrity and includes a wide variety of data services such as data deduplication, RAID and data encryption.

Create a ZFS pool with a single disk:

# zpool create testpool c3t2d0

Create a ZFS pool with 3 disks in RAID0 configuration:

# zpool create testpool c3t2d0 c3t3d0 c3t4d0

Create a ZFS pool with 3 disks in RAID1 configuration:

# zpool create testpool mirror c3t2d0 c3t3d0 c3t4d0

Create a ZFS pool with 3 disks in a RAIDZ configuration (single parity):

# zpool create testpool raidz c2t2d0 c3t3d0 c3t4d0

Create a ZFS pool with 1 disk and 1 disk as seperate ZIL (ZFS Intent Log):

# zpool create testpool c3t2d0 log c3t3d0

Create a ZFS pool with 1 disk and 1 disk as L2ARC (Level 2 storage cache):

# zpool create testpool c3t2d0 cache c3t3d0

Share a filesystem via NFS:

# zfs create zpool/fs1
# zfs set share=name=fs1,path=/rpool/fs1,prot=nfs rpool/fs1
# zfs set sharenfs=on rpool/fs1

Share a filesystem via CIFS:

# pkg install service/filesystem/smb
# svcadm enable -r smb/server
# echo “other password required pam_smb_passwd.so.1 nowarn” >> /etc/pam.conf
# smbadm enable-user joerg
# zfs set share=name=sh1,path=/rpool/fs1,prot=smb rpool/fs1
# zfs set sharesmb=on rpool/fs1

Use shadow migration:

# pkg install shadow-migration
# svcadm enable shadowd
# zfs set readonly=on path/to/data
# zfs create -o shadoow=file:///path/to/data target/new/path/to/data

Disk Devices

Show all disks on a system:

# cfgadm -s “select=type(disk)”

Configure a disk to be used via iSCSI

# svcadm enable svc:/network/iscsi/initiator
# iscsiadm modify initiator-node -A myclient
# iscsiadm add discovery-address 10.211.55.200
# iscsiadm discovery -t enable
# devfsadm -c iscsi

Replace a faulty disk c1t1d0 from ZFS pool testpool:

# zpool offline testpool c1t1d0
# cfgadm -c unconfigure c1::dsk/c1t1d0
# cfgadm -c configure c1::dsk/c1t1d0
# zpool replace testpool c1t1d0
# zpool online testpool c1t1d0

Mirror existing boot disk c3t0d0s0 with disk c3t2d0s0

# fdisk -B c3t2d0s0
# prvtoc /dev/rdsk/c3t0d0s0 | fmthard -s – /dev/rdsk/c3t2d0s0

On x86 systems:

# installgrub /boot/grub/stage1 /boot/grub/stage2 /dev/rdsk/c3t2d0s0

On SPARC systems:

# installboot -F zfs /usr/platform/`uname -i`/lib/fs/zfs/bootblk/dev/rdsk/c3t2d0s0

Oracle Solaris Zones

Oracle Solaris Zones provide isolated and secure virtual environments running on a single operating system instance, ideal for application deployment. When administrators create a zone, an application execution environment is produced in which processes are isolated from the rest of the system.

Create a zone with an exclusive IP network stack:

# zonecfg -z testzone
testzone: No such zone configured
Use ‘create’ to begin configuring a new zone.
zonecfg:testzone> create
zonecfg:testzone> set zonepath=/zones/testzone
zonecfg:testzone> set autoboot=true
zonecfg:testzone> verify
zonecfg:testzone> commit
zonecfg:testzone> exit

List all running zones verbosely:

# zoneadm list -v

List all configured zones:

# zoneadm list -c

List all installed zones:

# zoneadm list -i

Install a zone:

# zoneadm -z testzone install

Boot a zone:

# zoneadm -z testzone boot

List configuration about a zone:

# zoneadm -z testzone list

Login to a zone:

# zlogin -C testzone

Halt a zone

# zoneadm -z testzone halt

Shutdown a zone

# zoneadm -z testzone shutdown

Monitor a zone for CPU, memory and network utilization every 10 seconds:

# zonestat -z testzone 10

Service Management Facility

Service Management Facility (SMF) provides a framework for managing services on Oracle Solaris including the ability to automatically restart any service after failure. Each service instance is named with a fault management resource indicator (FMRI).

Show all services (including disabled services):

# svcs

List detailed information about system/zones:

# svcs -l system/zones

List processes associated with the network/netcfg service:

# svcs -p network/netcfg

Show why services that are enabled but are not running, or preventing other services from running:

# svcs -xv

Enable a service called network/dns/client:

# svcadm enable network/dns/client

Restart a service called network/nfs/server using an abbreviated FMRI:

# svcadm restart nfs/server

Disable a service called network/ssh:

# svcadm disable network/ssh

Display all properties and values in the SMF configuration repository for the service network/ssh:

# svcprop network/ssh

Interactively display the general/enabled property within the SMF configuration repository for the service network/ssh:

# svccfg
svc:> select ssh:default
svc:/network/ssh:default> listprop general/enabled
svc:/network/ssh:default> exit

Set the port number of the application/pkg/server service to 10000:

# svccfg -s application/pkg/server setprop pkg/port=10000
# svcadm refresh application/pkg/server

Configure email notifications for all services that drop from online to maintenance state:

# svccfg setnotify -g from-online,to-maintenance mailto:admin@myhost.org

List all configuration changes that have been made in the SMF configuration repository to the name-service/switch service:

# svccfg -s name-service/switch listcust –L

Solaris 11 Networking

Oracle Solaris 11 uses profile based networking configuration, comprised of two configuration modes – manual and automatic. These modes differ in how administrators configure the system, either manually using dladm and ipadm, or through creating and applying network configuration profiles.

Networking – Manual Administration

Switch to manual network configuration:

# netadm enable –p ncp defaultfixed

Show physical network interfaces:

# dladm show-phys

Create interface with static IPv4 configuration:

# ipadm create-ip net0
# ipadm create-addr –T static –a local=10.9.8.7/24 net0/addr
# ipadm show-addr

Create interface with DHCP configuration:

# ipadm create-ip net0
# ipadm create-addr –T dhcp net0/addr

Create interface with auto-generated IPv6 configuration:

# ipadm create-ip net0
# ipadm create-addr –T addrconf net0/addr

Configure default route:

# route –p add default 192.168.1.1

Activate DNS configuration:

# svccfg –s dns/client setprop config/nameserver = net_address: 192.168.1.1
# svccfg –s dns/client setprop config/domain = astring: “myhost.org”
# svccfg –s name-service/switch setprop config/host = astring: \“files dns\”
# svcadm refresh name-service/switch
# svcadm refresh dns/client

Activate DNS configuration (alternate approach by editing /etc/resolv.conf and /etc/nsswitch.conf and then importing these modifications into SMF)

# nscfg import –f svc:/system/name-service/switch:default
# nscfg import –f svc:/network/dns/client:default
# svcadm refresh dns/client

Networking – Automatic Administration

Create a network configuration profile:

# netcfg create ncp datacenter
# netcfg
netcfg> select ncp datacenter
netcfg:ncp:datacenter> create ncu phys net0
Created ncu ‘net0’. Walking properties …
ip-version (ipv4,ipv6) [ipv4|ipv6]> ipv4
ipv4-addsrc (dhcp) [dhcp|static]> static
ipv4-addr> 192.168.1.27
ipv4-default-route> 192.168.1.1
netcfg:ncp:datacenter:ncu:net0> end
Committed changes
netcfg:ncp:datacenter> exit

Create a network location profile:

# netcfg
netcfg> create loc datacenter
Created loc ‘datacenter’. Walking properties …
activation-mode (manual) [manual|conditional-any|conditionalall]>
conditional-any
conditions> ip-address is 192.168.1.27
nameservices (dns) [dns|files|nis|ldap] dns
nameservices-config-file (“/etc/nsswitch.dns”)>
dns-nameservice-configsrc (dhcp) [manual|dhcp]> manual
dns-nameservice-domain> datacenter.myhost.org
dns-nameservice-servers> 192.168.1.1
dns-nameservice-search>
dns-nameservice-sortlist>
dns-nameservice-options>
nfsv4-domain>
ipfilter-config-file>
ipfilter-v6-config-file>
ipnat-config-file>
ippool-config-file>
ike-config-file>
ipsecpolicy-config-file>
netcfg:loc:datacenter>
netcfg:loc:datacenter> exit
Committed changes
Activate a network configuration profile:
# netadm enable -p ncp datacenter

Networking – Advanced Administration

Create a virtual network interface over existing physical interface net0 with address 192.168.0.80:

# dladm create-vnic -l net0 vnic0
# ipadm create-ip vnic0
# ipadm create-addr -T static -a 192.168.0.80 vnic0/v4

Create two virtual network interfaces over a virtual switch (without a physical network interface):

# dladm create-etherstub stub0
# dladm create-vnic -l stub0 vnic0
# dladm create-vnic -l stub0 vnic1

Reduce the bandwidth of the virtual network interface vnic0 to 100Mbps:

# dladm set-linkprop -p maxbw=100 vnic0

Restrict the bandwidth going to IP address 192.168.0.30 by creating a flow on virtual network interface vnic0, then restrict its bandwidth to 50Mbps:

# flowadm add-flow -l vnic0 -a remote_ip=192.168.0.30 flow0
# flowadm set-flowprop -p maxbw=50 flow0

Restrict network traffic to TCP for a local port 443 for network interface net0:

# flowadm add-flow -l net0 -a transport=TCP,local_port=433 flow0

Activating Jumbo Frames (ethernet packets greater than 1500 bytes):

# dladm set-linkprop -p mtu=9000 net0

Configure Link Aggregation:

# dladm create-aggr -l net0 -l net1 aggr0
# ipadm create-ip aggr0
# ipadm create-addr -T static -a 10.1.1.2/24 aggr0/v4

Configure VLANS:

# dladm create-vlan -l net0 -v 100 administration1
# dladm create-vlan -l net0 -v 2 production1
# ipadm create-ip administration1
# ipadm create-ip production1
# ipadm create-addr -T static -a 192.168.2.2/24 administration1/v4static
# ipadm create-addr -T static -a 192.168.1.2/24 production1/v4static

Configure an IPMP group:

# ipadm create-ip net0
# ipadm create-ip net1
# ipadm create-ip net2
# ipadm create-ipmp ipmp0
# ipadm add-ipmp -i net0 -i net1 -i net2 ipmp0
# ipadm create-addr -T static -a 192.168.1.27/24 ipmp0/v4
# ipadm create-addr -T static -a 192.168.1.50/24 net0/test
# ipadm create-addr -T static -a 192.168.1.51/24 net1/test
# ipadm create-addr -T static -a 192.168.1.52/24 net2/test

Solaris 11 Command Cheat Sheet : Managing Services

By: Ramdev
August 17, 2015

+ In this post we will be Discussing about :
What is the Service Management Facility?
Understanding the SMF Fault Managed Resource Indicator (FMRI)
Enabling, disabling and restarting services
Listing information about services
Configuration layers in the SMF repository
Listing service property configuration
Setting service property configuration
Share & Discuss
What is the Service Management Facility?

The Oracle Solaris Service Management Facility (SMF) is responsible for managing system and pplication services, replacing the legacy init scripting start-up mechanism common to other UNIX operating systems. SMF helps improves the availability of a system by,  ensuring that essential services run continuously even in the event of any software or hardware failures with an automatic restart capability. SMF is a part of the wider predictive

Self-healing capability in Oracle Solaris. Another crucial component of this is the Fault Management Architecture (FMA), responsible for reporting and isolating failed hardware components.

Understanding the SMF Fault Managed Resource Indicator (FMRI)

Each SMF managed service instance is unique described by an FMRI, that an administrator can use to enable or disable the service, find out information about or modify configuration properties related to that service. For example, the file system automounter service  described by svc:/system/filesystem/autofs:default

FMRI Segment Description
svc:/ FMRI scheme
system/filesystem Service category
autofs Service name
default Service instance

Many SMF commands allow FMRI abbreviations by specifying the instance name, or any of the trailing portion of the service name, assuming it is unique on the system. For example, administrators could also refer to the above service as filesystem/autofs:default, autofs:default, and autofs. We will deliberately use multiple abbreviations in this cheat sheet.

Enabling, disabling and restarting services

Enable service svc:/network/smtp:sendmail:

# svcadm enable smtp:sendmail

Disable service svc:/network/telnet:default:

# svcadm disable telnet

Restart service svc:/network/httpd:apache22:

# svcadm restart apache22

Listing information about services

Show all enabled services (including temporarily disabled services):

# svcs

Show all enabled and disabled services:

# svcs -a

List detailed information about svc:/system/zones:default:

# svcs -l zones:default

List processes associated with svc:/network/netcfg:default:

# svcs -p network/netcfg

Show why services that are enabled but are not running (or preventing other services from running):

# svcs –xv

Display all services which depend on the svc:/network/ssh:default:

# svcs -D network/ssh

List all services svc:/network/ssh:default depends on:

# svcs –d network/ssh

Show all service state notifications that are configured on a system:

# svcs –n

Configuration layers in the SMF repository

Service configuration is defined in a number of layers within the SMF configuration repository that helps preserve any local administrative customizations during system upgrade, particularly when the underlying vendor provided default configuration changes. A service property could have different values at different layers of the repository. A simple priority mechanism is used to determine which  value is used by the service.

Configuration Layer  –>   Description

manifest             –>          Values provided as part of SMF manifests located in /lib/svc/manifest/

system-profile –>          Values provided as part of SMF profiles located in /etc/svc/profile/generic.xml

site-profile         –>          Values provided as part of SMF profile located in /etc/svc/profile/site/

admin                   –>          Values provided by interactive use of SMF commands or libraries

Listing service property configuration

List all properties (including inherited properties) of the service instance svc:/network/ssh:default:

# svcprop ssh:default

List properties specific to the service instance svc:/network/ssh:default:

# svcprop –c ssh:default

List the pkg/port property of the service instance svc:/application/pkg/server:default:

# svcprop –p pkg/server pkg/server:default

List all properties within the pkg property group of the service instancesvc:/application/pkg/server:default:

# svcprop –p pkg pkg/server:default

Interactively display the general/enabled property for the servicesvc:/network/ssh:default:

# svccfg

svc:> select ssh:default

svc:/network/ssh:default> listprop general/enabled

svc:/network/ssh:default> exit

# svccfg –s switch:default listcust –L

Setting service property configuration

Configure the config/nodename property on the svc:/system/identity:node service instance::

# svccfg

# svc:>select identity:node

# svc:/system/identity:node> setprop config/nodename = “myhost”

# svc:/system/identity:node> refresh

# svc:/system/identity:node> exit

Configure the config/nameserver property on the svc:/network/dns/client service with two IP addresses:

# svccfg –s dns/client

svc:/network/dns/client> setprop config/nameserver =  (“192.168.0.1” “10.0.0.4”)

svc:/network/dns/client> select default

svc:/network/dns/client:default> refresh

List all configuration changes (at all layers) to svc:/system/nameservice/switch:default:

# svccfg –s switch:default listcust -L

Delete an administrative customization to the config/nameserver property in the svc:/network/dns/client service:

# svccfg –s dns/client

svc:/network/dns/client> delcust config/nameserver

svc:/network/dns/client> refresh

Delete the config/nameserver property from the svc:/network/dns/client service (and thus masking it):

# svccfg –s dns/client

# svc:/network/dns/client> delprop config/nameserver

Extract an SMF system profile in order to apply configuration to other systems:

# svccfg extract –a > system-profile.xml

Apply an SMF system profile to a system:

# cp system-profile.xml /etc/svc/profile/site

# svcadm restart manifest-import

Solaris Troubleshooting : netstat -a reports connections in the BOUND state

By: Ramdev
May 9, 2011

The BOUND state is the state a socket shows after it is created and the ‘bind()’ call is made, but none of the ‘listen()’, ‘accept()’, ‘connect()’ or ‘close()’ calls have been made.  The confusion is that it is not a TCP state, it is a socket state, but it appears in the field that ‘netstat’ usually uses for TCP state info.

BOUND is a transitory state and the application should be doing a ‘listen()’  right after ‘bind()’ succeeds, then wait in ‘accept()’ for incoming data.

A listening server process – a client would typically ‘connect()’ – will ‘bind()’ automatically.

Sometimes this state is shown after closing or killing an application.  Either situation is likely to be a problem in the way application was implemented and some adjustment is required in fixing the application code (socket programming).

If the application holds this socket open, it will prevent any other application to bind to the same TCP port number.  This can cause services to hang.  Having a BOUND state for a long period of time may cause the application to appear hung or be unresponsive.

Depending how the application works, a server could make multiple attempts to contact unavailable clients and this could result in many sockets left in a BOUND state, eventually resulting in exhausting the supply of available sockets.

If problems rebinding to ports are reported periodically, either when killing a daemon, or if the daemon closes a bound socket, and then creates a new one, the new socket cannot be rebound.  The process reports the following error:

bind: Address already in use

Eventually, by killing daemons, the BOUND state goes away (kill -15 <pid> , kill -11 <pid> , kill -9 <pid>).  However, the socket would be still bound with no process running at that time.  There is no way to free the bound ports unless the processes that have bound the socket are killed and that does not always work.  A reboot is sometimes in order.

Notice that when the application opens a socket connection it has complete  control of the socket until it releases it and that socket connection shows TIME_WAIT in the ‘netstat -an’ output. To try to identify the process, use the ‘pfiles‘ command (Solaris 8 and above).  Prior to Solaris 8, the ‘lsof‘ public domain application may be used on the system.

A possible workaround while troubleshooting is to define another socket in /etc/services.  For example:

service-name1        5010/tcp
service-name2        5011/tcp
When appropriate, ‘truss’ the application while issuing the ‘kill’ or ‘kill
-9’ commands to get more info as to why it is not closing correctly.

Example of a successful attempt of identification and solution:

% netstat -an | grep BOUND
*.33330              *.*                0      0 24576      0 BOUND
*.33330              *.*                0      0 24576      0 BOUND

%
% su    ( type root password )
# cd /proc ; pfiles * | egrep “^[0-9]|sockname” > /var/tmp/pfiles1.txt
# vi /var/tmp/pfiles1.txt

<SNIP>

814:    /bin/sh -c dtfile -noview
815:    dtfile -noview
819:    cachefsd
856:    java_vm
sockname: AF_UNIX
sockname: AF_UNIX
sockname: AF_UNIX
sockname: AF_UNIX
sockname: AF_UNIX
sockname: AF_UNIX
sockname: AF_INET6 ::  port: 33330

# ps -ef | grep 856
demo   856   811  0   Jan 25 pts/12   2:46 java_vm
root  6619  6400  0 13:58:10 pts/12   0:00 grep 856
#
# kill -15 856
#
# ps -ef | grep 856
root  6630  6400  0 13:59:13 pts/12   0:00 grep 856
#
# netstat -an | grep BOUND
#

Solaris 10 : Enable / Disable telnet Service

By: Ramdev
October 18, 2011

For security purposes, administrators may wish to disable telnet (incoming connections) on a Solaris 10 system.

To disable telnet on a Solaris 10 system:

# svcadm disable telnet

To re-enable telnet on a Solaris 10 system:

# svcadm -v enable -r telnet

Steps to Follow

An example of functioning telnet, disabling of telnet, and then re-enabling telnet on a Solaris 10 system. If the system in question does not have console or terminal server access, another remote connection (ie. rsh/rlogin/ssh) may be required to make the change. Using telnet to connect while attempting to disable telnet will disconnect the window.

1. rsh into S10 system and check current telnet service status:

# svcs -a | grep telnet
online Dec_01 svc:/network/telnet:default
## svcs -l svc:/network/telnet:default
fmri svc:/network/telnet:default
name Telnet server
enabled true
state online
next_state none
state_time Thu 01 Dec 2005 08:39:08 AM EST
restarter svc:/network/inetd:default
contract_id 110
## svcs -xv svc:/network/telnet:default
svc:/network/telnet:default (Telnet server)
State: online since Thu 01 Dec 2005 08:39:08 AM EST
See: man -M /usr/share/man -s 1M in.telnetd
See: man -M /usr/share/man -s 1M telnetd
Impact: None.

2. Here we disable telnet with ‘svcadm disable’ command, and then recheck telnet service status:

# svcadm disable telnet
# svcs -a | grep telnet
disabled 21:27:34 svc:/network/telnet:default
## svcs -l svc:/network/telnet:default
fmri svc:/network/telnet:default
name Telnet server
enabled false
state disabled
next_state none
state_time Sat 10 Dec 2005 09:27:34 PM EST
restarter svc:/network/inetd:default
contract_id
# svcs -xv svc:/network/telnet:default
svc:/network/telnet:default (Telnet server)
State: disabled since Sat 10 Dec 2005 09:27:34 PM EST
Reason: Disabled by an administrator.
See: http://sun.com/msg/SMF-8000-05
See: man -M /usr/share/man -s 1M in.telnetd
See: man -M /usr/share/man -s 1M telnetd
Impact: This service is not running.

NOTE: At this point the telnet is disabled. No reboot required for it to take affect.

3. From a remote system, we try to telnet to this S10 system that we just disabled telnet on:

% telnet netlab46
Trying 129.148.12.46…
telnet: Unable to connect to remote host: Connection refused

4. rsh’d back into S10 system to re-enable telnet……

# svcadm -v enable -r telnet
svc:/network/telnet:default enabled.
svc:/network/inetd:default enabled.
svc:/network/loopback enabled.
svc:/system/filesystem/local enabled.
svc:/milestone/single-user enabled.
svc:/system/identity:node enabled.
svc:/system/filesystem/minimal enabled.
svc:/system/filesystem/usr enabled.
svc:/system/filesystem/root enabled.
svc:/system/device/local enabled.
svc:/milestone/devices enabled.
svc:/system/manifest-import enabled.
svc:/milestone/sysconfig enabled.
svc:/milestone/name-services enabled.

5. From same remote system, we try to telnet to this S10 system that we just re-enabled telnet on:

% telnet netlab46
Trying 129.148.12.46…
Connected to netlab46.
Escape character is ‘^]’.login: root
Password:
Last login: Sat Dec 10 21:26:42 from 129.148.192.154
Sun Microsystems Inc. SunOS 5.10 Generic January 2005