Tuesday, August 25, 2015

NetApp port and cabling

A FAS3240 (single-chassis HA) for example has two SAS, two GBIC slots, two GBICs with FCP modules, five RJ45 and a USB – and that’s without using the two PCI expansion slots or the chassis I/O expansion.
Here I’ll break down the ports you see on the back of a FAS3240 and describe the three “new” management methods e0M, SP and ACP.

The documentation that ships with the controller has a good legend to help decipher the icons printed by each connection:

And a picture of the chassis, just in case you are not standing next to it.

I’ll go left-to-right
7: SAS cables for your external SAS shelves. 0a, 0b. If you ordered your filer with SAS shelves it should have shipped with cables. Note that you can multi-path shelves with SAS just like FCP.
8: HA cables. c0a, c0b. If you buy a multi-chassis filer (ie you want a FAS3240 with the expansion module you’ll get two physical chassis) or want to do metro-cluster. Note also – these are 10G Ethernet ports but they have OS-set IP addresses and cannot be used for anything but HA.
6: FCP. 0c, 0d. Used for connecting to Fibre Channel switches, shelves or tape drives (for NDMP backups)
3: e0a and e0b. Two 1GB Ethernet adapters for network access and traditional management. iSCSI, CIFS, NFS, http will all use these ports.
4: Unlocked management. e0M / SP combo port. This is the successor to BMC/RLM out-of-band management port. It adds a twist in that port e0M on the filer shares this port (there is an internal hub). You can configure just the SP port (sp setup) and use it for out-of-band management, you can also configure e0M from the filer which will use this port for in-band management – Filerview, System Manager etc. Note that you are required to have e0M on a separate IP network than your other ethernet ports, and it is required to be on the same network as the Service Processor. It is possible data (iSCSI, NFS, CIFS) traffic will go out this port as a last resort – but it won’t have it’s own default gateway. This needs to be on a dedicated management-only network. Do not configure e0M unless you intend to use it – the filer will default management traffic to it if it is configured.
5: Locked management. e0P. Used for Alternate Control Path (ACP) Out-Of-Band (OOB) management of SAS shelves More and More
1/2: Serial port and RJ45-to-DB9 adapter. Used to manage the filer via console. Note you’ll need one of these if you have a modern system to connect the old-school serial cable up to your modern USB port. Don’t forget putty also.
Not labeled: USB. Currently described as “unused”
Always configure SP. Don’t configure e0M unless SP is connected to a dedicated management network. Always connect the ACP cables (hey, you paid for it!).
Always multipath SAS and FCP when you have the ports available.
Always take the lifeboat with the motor.


Many of the specifics of the DS2246 are encoded in the product name:
  DSxxxx: Disk shelf
  DS2xxx: 2U
  DSx24x: 24 drives
  DSxxx6: 6Gbps SAS (aggregate 24Gb/sec)

http://www.sysadmintutorials.com/tutorials/netapp/netapp-disk-shelf-cabling-examples/

Netapp Disk Shelf Cabling Examples

This page is dedicated to a few examples I’ve put together in Visio to highlight the correct SAS and ACP cabling combinations for Netapp disk shelf cabling.
Two types of controllers and two types of disk shelves are used in these examples. They are:
  • Netapp FAS2040
  • Netapp FAS3240
  • Disk Shelf DS4243
  • Disk Shelf DS2246
A few notes before we get started:
  • Netapp FAS2040 use single-path HA
  • SAS Cables can be SAS copper or SAS optical or a mix.  EXCEPT Shelf-to-Shelf connections in a stack must be all SAS copper cables or all SAS optical cables. If the Shelf-to-Shelf cable is SAS copper then the controller to shelf cable must also be SAS copper. If the Shelf-to-Shelf cable is SAS optical then the controller to shelf cable must also be SAS optical.
  • SAS optical cables connected to disk shelves require a disk shelf firmware that supports SAS optical cables
  • The total end-to-end path, from controller to the last shelf, cannot exceed 510 meters.
  • Square Ports are always cabled to circles ports, and circle ports are always cabled to square ports. Never cable square ports to square ports or circle ports to circle ports.
  • The illustrations below show the Green Cable as the SAS cable and the Red Cable as the ACP cable.
Let’s dive into some examples.

FAS2040 – 1 Netapp Disk Shelf

This example shows a Netapp FAS2040 with 2 controllers connected to a single DS4243 or DS2246 Netapp disk shelf.

Netapp Disk Shelf Cabling

FAS2040 – 2 Netapp Disk Shelves

This example follows on from the previous example by adding an additional disk shelf for a total of 2 disk shelves.

Netapp Disk Shelf Cabling

FAS2040 – 3 Netapp Disk Shelves

This example follows on from the previous example by adding another additional disk shelf for a total of 3 disk shelves.

Netapp Disk Shelf Cabling

FAS3240 – 1 Netapp Disk Shelf

This example shows 2 Netapp FAS3240’s connected to a single DS4243 Netapp disk shelf.

Netapp Disk Shelf Cabling

FAS3240 – 2 Netapp Disk Shelves

This example follows on from the previous example by adding an additional disk shelf for a total of 2 disk shelves.

Netapp Disk Shelf Cabling

FAS3240 – 3 Netapp Disk Shelves

This example follows on from the previous example by adding an additional disk shelf for a total of 3 disk shelves.

Netapp Disk Shelf Cabling

FAS3240 – 6 Netapp Disk Shelves in 2 Seperate Stacks

In this example we use 3 Netapp DS4243 disk shelves in Stack 1 and 3 Netapp DS2246 disk shelves in Stack 2. The requirement for this configuration is 4 SAS ports. I have added the 4-Port SAS expansion card Netapp X2065A into each controller.

Netapp Disk Shelf Cabling
If you have any technical questions about this tutorial or any other tutorials on this site, please open a new thread in the forums and the community will be able to help you out.


Wednesday, September 10, 2014

FIPS 140-2

Federal Information Processing Standard (FIPS) Publication 140-2: Security Requirements for Cryptographic Modules

RHEL 6 FIPS 140-2 compliant https://access.redhat.com/solutions/137833

Resolution

Red Hat Enterprise Linux 6 is now certified for FIPS compliance. Please see Government standards

Prerequisites

dracut-fips and optionally dracut-fips-aesni
libgcrypt
nss-tools
openswan
openssh-clients
openssh-server
openssl

Steps to Configure

Edit /etc/sysconfig/prelink and disable prelinking.
  • Note: This file is provided by the prelink package, if this is not installed you can skip this step.
PRELINKING=no
Run command prelink and revert binaries and libraries to their original content before they were prelinked.
# prelink -u -a
Install the appropriate FIPS enabled version of dracut.
# yum install dracut-fips 
If using AESNI(Advanced Encryption Standard Instruction Set) install dracut-fips-aesni.
# yum-config-manager --enable rhel-6-server-optional-rpms
# yum install dracut-fips-aesni
Note: you will need to add the Server Optional RPMs repository for dracut-fips-aesni.

Back up your current /boot/initramfs image, and run dracut with the -f flag to build a new FIPS enabled initramfs.
# cp /boot/initramfs-2.6.32-358.el6.x86_64.img /boot/initramfs-nofips-2.6.32-358.el6.x86_64.img
# dracut -v -f
Edit /etc/grub.conf and append fips=1 to the kernel line.
If the /boot or /boot/efi resides on a separate partition the kernel parameterboot=<partition of /boot or /boot/efi must also be added.
Note: the /boot partition must be on a separate partition and not part of the / partition.
Missing this step can result in a failure of the FIPS integrity test at boot, noted in the following article:
Use df /boot to figure out what goes into the boot parameter and append it to the kernel line in/etc/grub.conf.
kernel /vmlinuz quiet rhgb ... fips=1 boot=/dev/sda1
Reboot the host.
# reboot
At this point in time the Kernel is running in FIPS mode following the Kernel Crypto API Cryptographic Module and its security policies.

While the Kernel is running in FIPS mode not all other services / tools are (unless they are FIPS aware). In the cases where tools are not FIPS aware you will need to do some additional configuration.
Example:
Edit /etc/ssh/sshd_config and add the following. Protocol 2 should already be uncommented in most cases.
- Note: also configure SSHD / SSH to use pre-defined list of ciphers.
Protocol 2
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
Macs hmac-sha1
Run the Netscape Cryptographic Module Utility and enable FIPS mode.
- IE: Create a FIPS compliant keystore/truststore.
# modutil -fips true -dbdir /etc/ipsec.d

Diagnostic Steps

Verify that FIPS has been enabled, the below will return "1" if FIPS is enabled.
# cat /proc/sys/crypto/fips_enabled
If using dracut-fips-aesni verify the AES modules are loaded
# lsmod | grep aes

aesni_intel            12915  0 
cryptd                  8006  1 aesni_intel
aes_x86_64              7914  1 aesni_intel
aes_generic            27609  2 aesni_intel,aes_x86_64

RHEL 5 FIPS 140-2 compliant https://access.redhat.com/articles/38655

Resolution

Ensure access to the following accredited packages is available:
|**Name**|**Version**|
|-|-|
|kernel|2.6.18-164.2.1.el5|
|libgcrypt|1.4.4-5.el5|
|openssl|0.9.8e-12.el5|
|openswan|2.6.21-5.el5_4.3|
|nss|3.12.6-2.el5_4|
|selinux-policy|2.4.6-255.el5_4.2|
|fipscheck-lib|1.2.0-1.el5|

Kernel

Verify the version of libgcrypt running is 1.4.4-5.el5 [1].
rpm -qi libgcrypt
Ensure prelinking is disabled [1]:
change the line "PRELINKING=yes" to "PRELINKING=no" in /etc/sysconfig/prelink
If the libraries were already prelinked, the prelink should be  undone on all the system files using the following command [5]:
prelink -u -a 
Recreate the initial RAM disk [1].
for x86_64 based platforms:
mkinitrd --with-fips -f /boot/initrd-$(uname -r).img $(uname -r)
for IA64 based platforms:
mkinitrd --with-fips -f /boot/efi/efi/redhat/initrd-$(uname -r).img $(uname -r)
Append the following to the current Linux kernel line in the /etc/grub.conf [1].
fips=1
For example:
# grub.conf generated by anaconda  
#  
# Note that you do not have to rerun grub after making changes to this file  
# NOTICE:  You have a /boot partition.&nbsp; This means that  
# all kernel and initrd paths are relative to /boot/, eg.  
# root (hd0,0)  
# kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00  
# initrd /initrd-version.img  
# boot=/dev/vda  
default=0  
timeout=5  
splashimage=(hd0,0)/grub/splash.xpm.gz  
hiddenmenu  
title Red Hat Enterprise Linux Server (2.6.18-194.el5)  
  root (hd0,0)  
  kernel /vmlinuz-2.6.18-194.el5 ro root=/dev/VolGroup00/LogVol00 rhgb quiet fips=1  
  initrd /initrd-2.6.18-194.el5.img
To verify that FIPS mode is enabled, check the contents of /proc/sys/crypto/fips_enabled [6]
cat /proc/sys/crypto/fips_enabled
If the value returned is 1 then FIPS mode is enabled, if the value returned is 0 then FIPS mode is disabled.
If in the future you need to update the kernel, a new FIPS enabled initrd will be built automatically if mkinitrd sees that  /proc/sys/crypto/fips_enabled has a 1 in it. So, once you are in FIPS mode, the kernel will continue to stay in FIPS mode across updates.

OpenSSH

If using OpenSSH Server or Client, ensure the following values are set in the/etc/ssh/sshd_config and ~/.ssh/config file respectively [3][4]:
  • Either no "Ciphers" option or the option with a subset out of  "aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc";
  • Either no "MACs" option or the option with "hmac-sha1";
  • "Protocol 2" must be specified.
To check if changes to the sshd_config need to be made the following checks can be run:
#egrep -i 'aes128-ctr|aes192-ctr|aes256-ctr|aes128-cbc|3des-cbc|aes192-cbc|aes256-cbc' /etc/ssh/sshd_config
#egrep -i 'hmac' /etc/ssh/sshd_config
#egrep -i 'protocol' /etc/ssh/sshd_config
Make changes to meet these requirements.

OpenSSL

Verify the version of openssl running is 0.9.8e-12.el5 [5].
rpm -qi openssl

Openswan

Verify the version of openswan running is 2.6.21-5.el5_4.3 [6]:
rpm -qi openswan
Verify the version of nss running is 3.12.6-2.el5_4 [6]:
rpm -qi nss
Verify the version of selinux-policy is 2.4.6-255.el5_4.2 [6]:
rpm -qi selinux-policy
The database for the cryptographic keys used by the pluto daemon must be initialized after it has been created as documented in the README.nss documentation with the following command assuming that the database is stored in the directory /etc/ipsec.d/
modutil -fips true -dbdir /etc/ipsec.d

Tuesday, July 15, 2014

netapp notes

Clearing NFS locks on a Network Appliance Filer

To remove stuck file locks:
  1. Login to appliance
  2. Enter priv set advanced
  3. To clear all current locks, enter: sm_mon -l
    To clear locks for a single client system, enter sm_mon -l client
  4. Enter priv set
Note that priv set advanced is advertised as mind-bogglingly dangerous and is therefore not to be used without the guidance of support.


Priv Commands:


availtime
blink_off
blink_on
bootfs
cmos_read
cmos_write
dd
disk
disk_list
disk_stat
environ
exit
getXXbyYY
hammer
ic
ifinfo
inodepath
java
led_off
led_off_all
led_on
led_on_all
led_on_off
led_test
led_test_one
lmem_stat
log
ls
mbstat
mem_scrub_stats
memerr
mv
nfs_hist
ontapi
panic
perf
ps
rdfile
registry
remote
result
revert_to
rm
rmt
rsm
rtag
rtfo
sata
scsi
sh
show_bios_log
showfh
showfh4
sm_mon
sm_mon_old
sm_not
smb_hist
snet
statit
stty
syslog
tape_qual
test_lcd
toe
waffinity_stats
wafl
wafl_susp
wrfile