Based on many books and Usenet groups comp.unix.admin and comp.sys.sgi.admin contributions.
"There are two major products that come out of Berkeley: LSD and UNIX. We don't believe this to be a coincidence." — Jeremy S. Anderson
For network configuration using static IPs, change the following files:
Once you get the machine to see the world, login with
Add swap space: "/usr/sbin/mkfile 4g /dev/swap2; /sbin/swap -a /dev/swap2; nedit /etc/fstab" and add the line "/dev/swap2 swap swap pri=3 0 0"
Exports/mounts: "nedit /etc/exports"
SSH replaces all of the following: telnet, rlogin, ftp which should be disabled manually... If you want to login from another remote unix machine, use the following command: ssh -X username@remotemachine.com (the -X is for the X-windows forwarding).
For copying files securely you are better off using scp which relies on ssh, but otherwise, some useful SSH tricks include:
ssh -X user@remotemachine.com
ssh user@remotemachine.com "prog"
cat file | ssh user@remotemachine.com "cat >file"
ssh user@remotemachine.com "cat file" >file
ftp-data 20/tcp ftp 21/tcp smtp 25/tcp mail domain 53/tcp nameserver # name-domain server domain 53/udp nameserver tftp 69/udp rje 77/tcp netrjs http 80/tcp # World-Wide-Web protocol hostnames 101/tcp hostname # usually from sri-nic iso-tsap 102/tcp x400 103/tcp # ISO mail x400-snd 104/tcp csnet-ns 105/tcp pop-3 110/tcp pop pop3 # Post Office auth 113/tcp authentication sftp 115/tcp uucp-path 117/tcp nntp 119/tcp readnews untp # USENET News Transfer Protocol ntp 123/udp # Network Time Protocol loc-srv 135/tcp # NCS local location broker loc-srv 135/udp imap 143/tcp imap2 imap4 xdmcp 177/udp # X Display Mgr. Control Prot. tempo 526/tcp newdate netnews 532/tcp readnews netwall 533/udp # -for emergency broadcasts ingreslock 1524/tcp albd 371/udp # location broker ta-rauth 601/tcp rauth kerberos 750/udp kdc # Kerberos (server) udp kerberos 750/tcp kdc # Kerberos (server) tcp krbupdate 760/tcp kreg # Kerberos registration kpasswd 761/tcp kpwd # Kerberos "passwd" klogin 543/tcp # Kerberos rlogin nfs 2049/udp nfs # Sun NFS nfs 2049/tcp nfs # Sun NFS eklogin 2105/tcp # Kerberos encrypted rlogin kshell 544/tcp krcmd # Kerberos remote shell x-server 6000/tcp # X11 window system prngd 708/tcp # prngd/EGD system service prngd-user 4840/tcp # prngd/EGD user service sgi-esphttp 5554/tcp # ESP web console server port sgi-dgl 5232/tcp # SGI Distributed Graphics Lib. sgi-arrayd 5434/tcp # SGI array services daemon realaudio 7070/tcp ra # Progr. Tech. RealAudio wn-http 8778/tcp # WhatsNew http protocol sgi_iphone 32769/tcp # InPerson phone swat 901/tcp # SWAT imaps 993/tcp imap2s imap4s # SSL IMAP pop3s 995/tcp pops pop-3s # SSL POP xinet-jgui 5969/tcp # Xinet Java GUI
/etc/inetd.conf, in particular the 'r' services, telnet, ftp, finger... They are either useless or can be better replaced by ssh. Here's a restrictive list:ftp stream tcp nowait root /usr/etc/ftpd ftpd -S -l -l -l -p sgi-dgl stream tcp nowait root/rcv /usr/etc/dgld dgld -IM -tDGLTSOCKET pop-3 stream tcp nowait root ?/usr/freeware/bin/ipop3d ipop3d mountd/1,3 stream rpc/tcp wait/lc root /usr/etc/rpc.mountd mountd mountd/1,3 dgram rpc/udp wait/lc root /usr/etc/rpc.mountd mountd sgi_mountd/1 stream rpc/tcp wait/lc root /usr/etc/rpc.mountd mountd sgi_mountd/1 dgram rpc/udp wait/lc root /usr/etc/rpc.mountd mountd rstatd/1-3 dgram rpc/udp wait root /usr/etc/rpc.rstatd rstatd walld/1 dgram rpc/udp wait root /usr/etc/rpc.rwalld rwalld rusersd/1 dgram rpc/udp wait root /usr/etc/rpc.rusersd rusersd rquotad/1 dgram rpc/udp wait root /usr/etc/rpc.rquotad rquotad sprayd/1 dgram rpc/udp wait root /usr/etc/rpc.sprayd sprayd sgi_videod/1 stream rpc/tcp wait root ?/usr/etc/videod videod sgi_fam/1-2 stream rpc/tcp wait/lc root ?/usr/etc/fam fam sgi_snoopd/1 stream rpc/tcp wait root ?/usr/etc/rpc.snoopd snoopd sgi_pcsd/1 dgram rpc/udp wait root ?/usr/etc/cvpcsd pcsd sgi_pod/1 stream rpc/tcp wait root ?/usr/etc/podd podd sgi_xfsmd/1 stream rpc/tcp wait root ?/usr/etc/xfsmd xfsmd sgi_espd/1 stream rpc/tcp wait root ?/usr/etc/rpc.espd espd sgi-esphttp stream tcp wait root /usr/etc/esphttpd esphttpd -u300 ttdbserverd/1 stream rpc/tcp wait root ?/usr/etc/rpc.ttdbserverd rpc.ttdbserverd tcpmux/sgi_scanner stream tcp nowait root ?/usr/lib/scan/net/scannerd scannerd tcpmux/sgi_printer stream tcp nowait root ?/usr/lib/print/printerd printerd tcpmux/sgi_sysadm stream tcp nowait root ?/usr/sysadm/bin/sysadmd sysadmd swat stream tcp nowait root /usr/samba/bin/swat swat imaps stream tcp nowait root ?/usr/freeware/bin/imapd.ssl imapd imap stream tcp nowait root ?/usr/freeware/bin/imapd imapd pop3s stream tcp nowait root ?/usr/freeware/bin/ipop3d.ssl ipop3d
chkconfig service off"
showprods -D1" an possibly disable unwanted software with versions.
pwconv.
ftp stream tcp nowait root /usr/etc/ftpd ftpd -S -l -l -l -p". Yes, you'll be able to see every single ftp command in the /var/adm/SYSLOG file; but heh, who's talking about privacy here ?
man ftp will explain it).
#! /bin/sh
# remove world writable directories
find ~ftp -perm -002 -exec chmod o-w {} \;
# remove group write for ftp or guest
find ~ftp -perm -020 \( -user ftp -o -group guest \) -exec chmod g-w {} \;
/dirname machinename.domain localhost"; make an empty dir "mkdir ~ftp/pub/ReadOnly" and finally make the mount with the following /etc/fstab line: "localhost:/dirname ~ftp/pub/ReadOnly nfs ro,intr,bg 0 0". The directory will be visible in ftp://machinename/pub/ReadOnly/ and will be truly read-only, even if the permissions in it say something different.
Adding a new HD:
scsiha -p <controler number>; ioconfig -f /hw"
ssmgui and mess around with it for hours.
toolchest, [System][System Manager] then [Hardware and devices][Disk Manager]
Samba is a utility that runs on IRIX and allow it to trade files with PCs on a local network. It is not too easy to intall, every PC needs a registry hack and it is sometimes flaky (particularly in its handling of file permissions), but quite useful.
Remember to registry hack Windows machines to allow for clear text passwords to be sent over the local network. I don't like this but there doesn't seem to be an easy way around it.
Adding a new user to the list of Samba users: "cd /usr/samba; bin/addtosmbpass username <private/smbpasswd >>private/smbpasswd". Then edit private/smbpasswd to make sure there aren't any duplicates. Changing a user's Samba password is achieved with "bin/smbpasswd -U user password"
Problems going from IRIX 6.5.8 to IRIX 6.5.11 with our DLT8000. Have to use TS drivers instead of TPS (TS must be turned on manually with chkconfig ts on).
Backups script, with BackupList.txt containing the list of folders to save:
/usr/sysadm/privbin/backup -f /dev/tape1c -v -n -s BackupList.txt mt -f /dev/tape1c rewind mt -f /dev/tape1c offline
Installing Quantum SuperDLT 220 on IRIX 6.5.11. Add the following inside the /var/sysgen/master.d/scsi:
{ DECDLT, TPDLT, 7, 9, "QUANTUM", "SuperDLT1",
0, 0, {0},
MTCAN_BSF | MTCAN_BSR | MTCAN_APPEND | MTCAN_SPEOD |
MTCAN_CHKRDY | MTCAN_VAR | MTCAN_SETSZ | MTCAN_SILI |
MTCAN_SEEK | MTCAN_SYNC | MTCAN_CHTYPEANY | MTCAN_COMPRESS,
20, 8*60, 20*60, 5*60, 3*3600, 4096, 64*1024,
tpsc_default_dens_count, tpsc_default_hwg_dens_names, tpsc_default_alias_dens_names,
{0}, 0, 0, 0, 0, (u_char *)0 },
Then do the usual /etc/autoconfig; /etc/reboot; ...; cd /dev; ./MAKEDEV :
Fortran program hosing the stack ? 3 complementary solutions:
unlimit stacksize'
~/.cshrc file.
rlimit_stack_max = 0x40000000 ll' to the file /var/sysgen/stune/ (here increase to 1Gb) or, better, use systune. Run /etc/autoconfig and /etc/reboot.
Some stuff you migh want to add to your ~/.cshrc file:
alias ll 'ls -alF'
alias lc 'ls *.{c,h,cc,hh,inc,f,f90}'
alias ln 'ln -i'
alias psg 'ps -ef | grep'
alias cd.. cd ..
set history = 400
# For interactive shells, set the prompt to show the host name and event number.
if ( (! $?ENVONLY) && $?prompt ) then
if ( -o /bin/su ) then
set prompt="`hostname -s`(`whoami`) \!# "
else
set prompt="`hostname -s`(`whoami`) \!% "
endif
endif
# rwxr-xr-x
umask 022
unlimit stacksize
How to control big running jobs so they don't hose all the CPU available ? We typically run jobs that take several days to complete on 4 processor machines, so we want the ability to lower their priority, run them on specific processors, suspend them during the day... Here are a few options:
nice Job"npri -w Job"runon CpuNum Job"npri. Warning, incompatible with cpuset.
kill -STOP" and "kill -CONT"% cat >TwoCPU.cfg MEMORY_LOCAL CPU 2 CPU 3 ^D % cpuset -q TwoCPU -c -f TwoCPU.cfgNow a user can run a job that will be restricted to processor 2 and 3 (while other processes can still use all 4): "
cpuset -q TwoCPU -A Job". In the evening, if you want the job to use all available processors you can release it (as root) with: "cpuset -q TwoCPU -d". But in the morning you cannot put the job back into the bottle of TwoCPU. Warning, if you have some processors configured with cpuset, even non exclusively, you cannot use runon on them.
Working installation of Qpopper, allowing for Authenticated POP (APOP) retrieval. Compiled with the following:
./configure --enable-apop=/etc/pop.auth --enable-popuid=pop --with-openssl --disable-specialauth --enable-timing
Check the /etc/services for pop services and also add the following line to /etc/inetd.conf:
pop3 stream tcp nowait root /usr/local/bin/popper popper -s -t /var/spool/popper/popper.log
To add yourself (as a user) to the APOP list, do "popauth" and then type a password (same as your login or a specific one for your email). Then change the option in Eudora to APOP (yeah, it won't work in Netscape or Outlook express).
tcsh as a shell script and ksh as a programming script.
ksh -x script" or writing #! /bin/ksh -x on the first line of the script.
cut -d: -f2-5" than awk/sed for filtering columns.
#! /bin/sh # Script that determines its own location current_directory=`pwd` cd `dirname $0` script_directory=`pwd` cd $current_directory
FFLAGS= -col120 -n32 -mips4 -r12000 -O3 -static
CFLAGS= -n32 -mips4 -r12000 -O3
cvd ExeFileName and then type the command line parameters inside the debugger. Basic use is fairly easy; advanced use is... well, advanced.
shutdown -y -g0 -p or /etc/reboot. Use -g120 or wall to warn users.
/usr/sysadm/privbin/addUserAccount -l username -u UID -g 20 -P -G "Full User Name" -C -H /Users/username -S /bin/tcsh -R and type user password.
addtosmbpass if PC user.
popauth if Eudora user (must then use APOP and not POP3).
/etc/exports for NFS access if Mac. Update NFS with "exportfs -a; killall -HUP inetd".
/etc/hosts.
/etc/aliases: "group::include:/etc/group.list" and create a file /etc/group.list with the list of email addresses (complete emails, no aliases). Then run newaliases.
lpstat -t" to determine the job (for instance ariane-31415) and then cancel it with "cancel ariane-31415".
crontab -l > cron; nedit cron; crontab <cron; rm cron"
/etc/passwd file. Put the HD back.
| The Good | The Bad and the Ugly |
|---|---|
|
The UNIX System Administration Handbook, although not concerned with IRIX, is a very valuable source of information gathered from experience. Deals with all the glitches that can happen on a Unix box. It does not replace a Unix book, but it teaches you the politics and pitfalls of system administration. The UNIX Hater's Handbook, gives some insight as to why Unix is sometimes so flaky (command names ? vi ? X-Windows ?...) If you program in C, Harbison and Steele's C: A Reference Manual is the best book around; it's not a shelf book since it's always on my desk right at hand. And for security's sake, although it's a bit old: C Traps and Pitfalls by Andy Koenig. |
On the other hand, I do not recommand getting The New Kornshell: even the experienced script writer will be at a loss in the details the authors go (it's no introduction to scripting at all). The examples are useless: they never say what they are supposed to do and they never tell you the results. And main criticism: I have yet to find a system where the new kornshell (which came out in 93) is installed... You'd be much better off learning perl through its main two books.
Another book to steer clear of: The Programmer's Guide to Fortran 90: a programming book without a single figure or drawing, with the poorest pagination I've ever seen. Impossible to find the options for |
Back to my hacking page or my home page.