DevTech101

DevTech101

Contents

Drupal blog & MySQL server list

Blog configuration
GUI Console Global Zone Local zone Local zone
blog1-ilom blog1-global
blog1a
blog1b
blog2-ilom blog2-global
blog2a
blog2b
Blog database configuration
GUI Console Global Zone Local zone
blogdb1-ilom blogdb1-global
blogdb1a
blogdb2-ilom blogdb2-global
blogdb2a

Mysql and Drupal Layout

Click below to get the Drupal MySQL Layout

Install Sun One Webserver 7U5 in /opt/webserver7

/usr/sfw/bin/gtar sjsws-7_0u5-solaris-sparc.tar.gz
 
# select to install in /opt/webserver7
# Run setup and follow the prompts 
./setup

Note: Doing the install select an admin only node blog1a/b – blog2a/b, on blog-wadmin install the full install web & admin node.

Download & Install from sunfreeware.com all needed packages

PHP 5.2.1 installation and configuration

Install Sun coolstack 1.3.1

The packages below where used in the dev environment, in production we used the Webstack 1.5 bundle and installed amp on the blogs and mysql on the blogdb.

Sun coolstack Package list
Package list
CSKruntime_1.3.1_sparc.pkg
CSKlibsbundle_1.3.1_sparc.pkg
CSKperl_1.3.1_sparc.pkg
CSKamp_1.3.1_sparc.pkg
CSKmemcached_1.3.1_sparc.pkg
CSKmysql_1.3.1_sparc.pkg

Modify and add to the php.ini

Change and add this values to the php.ini and restart the webserver
The php.ini located in /etc/opt/webstack/php/5.2/php.ini

# Change the value to 256M
memory_limit = '''256M'''
 
# take off the semicolon from this extensions
extension=mbstring.so
extension=gd.so
 
; Compiled and by eli on 5/22/09
extension=imagick.so
 
# Add this at the bottom 
;;;;;;;;;;;;;;;;;;;
; Module Settings ;
;;;;;;;;;;;;;;;;;;;
 
[Date]
; Defines the default timezone used by the date functions
date.timezone = America/New_York
 
;date.default_latitude = 31.7667
;date.default_longitude = 35.2333
 
;date.sunrise_zenith = 90.583333
;date.sunset_zenith = 90.583333
 
post_max_size = 10M
upload_max_filesize = 10M
 
cgi.fix_pathinfo = Off
 
;session.bug_compat_42 = Off
;session.bug_compat_warn = Off
;magic_quotes_gpc = Off
;fastcgi.logging = true

How to install Imagick

Download & Install from sunfreeware.com all needed packages

Sunfreeware Package list
Name Package list
autoconf autoconf-2.63-sol10-sparc-local (2.6.4 didn’t work)
automake automake-1.9-sol10-sparc-local
expat expat-2.0.1-sol10-sparc-local
fontconfig fontconfig-2.4.2-sol10-sparc-local
freetype freetype-2.3.9-sol10-sparc-local
imagemagick imagemagick-6.5.1-sol10-sparc-local
jpeg jpeg-7-sol10-sparc-local
lcms lcms-1.17-sol10-sparc-local
libgcc libgcc-3.4.6-sol10-sparc-local
libiconv libiconv-1.9.2-sol10-sparc-local
libtool libtool-1.5.24-sol10-sparc-local
m4 m4-1.4.7-sol10-sparc-local
make make-3.81-sol10-sparc-local
perl perl-5.8.8-sol10-sparc-local
re2c re2c-0.13.5-sol10-sparc-local
tiff tiff-3.9.1-sol10-sparc-local
ImageMagic PHP extension
Name Package Get it from
imagick imagick-2.3.0.tar http://pecl.php.net/package/imagick

How to install Imagick for PHP extension

/usr/sfw/bin/gtar imagick-2.3.0.tar.gz
mv package.xml imagick-2.3.0
export PATH=$PATH:/usr/local/bin
/opt/coolstack/php5/bin/pear install -fa imagick-2.3.0/package.xml

Help With the PHP pear/pecl system

To set pear/pecl to work with a proxy

pear config-set http_proxy http://username:password@proxyip:80

To install directly from php run

/opt/webstack/php/5.2/bin/pecl install imagick (to install image magick)

To get a list of of available pear packages

pear remote-list

To update the pear channel list

pear channel-update pear.php.net

MySql configuration

MySQL & replication configuration

First steps, configure my.cnf

Master 1 my.cnf

Add the following to the [mysqld] section of my.cnf making the appropriate changes and restart mysqld:
Click bellow for a copy of the file

# Add by eli
log-bin = blogdb1a-bin
binlog-do-db=blogdb1
binlog-ignore-db=mysql
 
server-id = 10
auto_increment_increment = 10
auto_increment_offset = 1
master-host = blogdb2a
master-user = replica
master-password = password
master-connect-retry = 10
expire_logs_days = 10
max_binlog_size = 500M
relay-log = /logdb1a/relay-bin
# let's do these too, just in case
relay-log-index = /logdb1a/relay-bin.index
relay-log-info-file = /logdb1a/relay-bin.info
# relay log restrictions
#relay-log-space-limit=15G
skip-innodb_doublewrite

Master 2 my.cnf

Add the following to the [mysqld] section of my.cnf making the appropriate changes and restart mysqld

# Add by eli
log-bin = blogdb2a-bin
binlog-do-db=blogdb1
binlog-ignore-db=mysql
 
server-id = 20
auto_increment_increment = 10
auto_increment_offset = 2
master-host = blogdb1a
master-user = replica
master-password = password
master-connect-retry = 10
expire_logs_days = 10
max_binlog_size = 500M
relay-log = /logdb2a/relay-bin
# let's do these too, just in case
relay-log-index = /logdb2a/relay-bin.index
relay-log-info-file = /logdb2a/relay-bin.info
# relay log restrictions
#relay-log-space-limit=15G
skip-innodb_doublewrite

Create the MySql database

gtar -zvxf webstack-all-1.5-b09-solaris-i586.tar.gz
./install mysql
# Note: if the install script failles just install the pkg manual and re-run the mysql install
pkgadd -d sun-wsbase.pkg
cd /opt/webstack/mysql/5.0/bin/64
./mysql_install_db
chown -R mysql:mysql /var/opt/webstack/mysql
# Start the MySql database
/opt/webstack/mysql/5.0/bin/64/mysqld_safe &
# Set the MySql root password and grant access rights (both Master1/Master2)
/opt/webstack/mysql/5.0/bin/64/mysqladmin -u root password 'password'
# Master 1
/opt/webstack/mysql/5.0/bin/64/mysqladmin -u root -h blogdb2a password 'password'
# Master 2
/opt/webstack/mysql/5.0/bin/64/mysqladmin -u root -h blogdb1a password 'password'
# Harden the DataBase (remove anon access etc..)
/opt/webstack/mysql/5.1/bin/64/mysql_secure_installation

Note: To configure MySQL For Solaris SMF Click here, This will provide with auto start-up self heeling dependency & more.

Create Replication Accounts

Create Replication Accounts
On both master servers run the following query as root:

mysql> CREATE USER 'replica'@'localhost' IDENTIFIED BY 'password';
mysql> GRANT REPLICATION SLAVE ON *.* TO 'replica'@'%' IDENTIFIED BY 'password';

Start Replication & Dump/Load Existing Data

Start Replication & Dump/Load Existing Data

On Master 1 Prevent writing

Prevent writing to the database.

mysql> FLUSH TABLES WITH READ LOCK;
mysql> SHOW MASTER STATUS\G
*************************** 1. ROW ***************************
File: master1-bin.000001
POSITION: 254
Binlog_Do_DB:
Binlog_Ignore_DB:
1 ROW IN SET (0.20 sec)

Make note of the position and file name. You must have these later. From a terminal you now need to dump the database for loading onto the slaves.

bash> mysqldump -A -u root -p > master1.sql

On Master 2 Load the data from Master 1

Load the data from Master 1 onto Master 2.

bash> mysql -h master2.yourdomain.com -u root -p < master1.sql

Enable Master 2 as a slave

Enable Master 2 as a slave to Master 1 (refer to master 1's show master status above for MASTER_LOG* values)

mysql> STOP SLAVE;
mysql> CHANGE MASTER TO
MASTER_HOST='blogdb1a.domain.com',
MASTER_USER='replica',
MASTER_PASSWORD='password',
MASTER_LOG_FILE='blogdb1a-bin.000004',
MASTER_LOG_POS=106;
mysql> START SLAVE;

Get the Log Info for Master 2

Get the Log Info for Master 2

mysql> SHOW MASTER STATUS\G
*************************** 1. ROW ***************************
File: master2-bin.000005
POSITION: 12314580
Binlog_Do_DB:
Binlog_Ignore_DB:
1 ROW IN SET (0.00 sec)

Enable Master 1 as a slave

Enable Master 1 as a slave to Master 2 (refer to master 2's show master status above for MASTER_LOG* values)

mysql> STOP SLAVE;
mysql> CHANGE MASTER TO
MASTER_HOST='blogdb2a.domain.com',
MASTER_USER='replica',
MASTER_PASSWORD='password',
MASTER_LOG_FILE='blogdb2a-bin.000004',
MASTER_LOG_POS=106;
mysql> START SLAVE;

Master-Master Setup is complete
If all you wanted was a master-master setup then you are finished. Any query executed on master 1 will also be executed on master 2.

Adding Slaves to your Master-Master

On Each Slave Follow this Procedure
Add the following to the [mysqld] section of my.cnf changing the server-id and master settings as appropriate and restart mysqld:

# this slave's server-id
server-id=11
# replicate from master 2
master-host=master2.yourdomain.com
master-port=3306
master-user=replica
master-password=replic8
master-connect-retry=10

Load the data dump from Master 1, if needed:

bash> mysql -h slave11.yourdomain.com -u root -p < master1.sql

Start Replication from Master 2 to each slave (refer to master 2's show master status above for MASTER_LOG* values)

mysql> CHANGE MASTER TO
MASTER_HOST='master2.yourdomain.com',
MASTER_USER='replica',
MASTER_PASSWORD='replic8',
MASTER_LOG_FILE='master2-bin.000005',
MASTER_LOG_POS=12314580;
mysql> START SLAVE;

Master-Master-Slave Setup is Complete
Congratulations, you are done with the server configuration! You may verify this by inserting or updating records on Master 1 and then verifying that the change is made on Master 1 and all of your slaves.

To Test replecation

on master1

mysql> USE blogdb1;

CREATE a test TABLE

mysql> CREATE TABLE recipes(ingredient VARCHAR(32), quantity VARCHAR(32), mtype VARCHAR(32), address VARCHAR(64));
mysql> INSERT INTO recipes(ingredient, quantity, address) VALUES('12345678', '5', 'North America');

on master2

mysql> SELECT * FROM recipes;
Do the same the other way around.

Mysql account info

  • mysql root pass: password

  • replecation user: replica
    • replecation password: password

  • drupal user : drupaluser
    • drupaluser password: password

Grant database access for the drupal blog user

Create a drupal user and grant access

mysql> CREATE USER 'drupaluser'@'localhost' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'blog1a.domain.com' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'blog1b.domain.com' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'blog2a.domain.com' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'blog2b.domain.com' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'10.20.16.151' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'10.20.16.152' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'10.20.16.153' IDENTIFIED BY 'password';
mysql> GRANT ALL ON *.* TO 'drupaluser'@'10.20.16.154' IDENTIFIED BY 'password';
FLUSH privileges;

Update the MySQL database with the latest drupal data

Dump the drupal database

/opt/coolstack/mysql/bin/mysqldump -h mysql1.domain.com -u drupaluser -p drupaldb1 > /tmp/drupaldb1.dump

Import the drupal databse

/opt/webstack/mysql/5.1/bin/64/mysql -u root -p blogdb1 < /tmp/drupaldb1.dump

MySQL Solaris SMF confgiration

Solaris SMF confgirations:
modify the file /opt/webstack/lib/svc/method/sun-mysql51
Line 40 add:

CONFFILE=`getproparg sun-mysql51/conffile`

Line 84 and 85 change
From:

echo ${MYSQLBIN}/64/mysqld_safe --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}"
${MYSQLBIN}/64/mysqld_safe --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}" > /dev/null &

To:

echo ${MYSQLBIN}/64/mysqld_safe --defaults-file="${CONFFILE}" --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}"
${MYSQLBIN}/64/mysqld_safe --defaults-file="${CONFFILE}" --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}" > /dev/null &

Line 104 and 105 change
From:

echo ${MYSQLBIN}/mysqld_safe --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}"
${MYSQLBIN}/mysqld_safe --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}" > /dev/null &

To:

echo ${MYSQLBIN}/mysqld_safe --defaults-file="${CONFFILE}" --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}"
${MYSQLBIN}/mysqld_safe --defaults-file="${CONFFILE}" --user=mysql --datadir="${MYSQLDATA}" --log-error="${MYSQLLOG_FILE}" --pid-file="${MYSQLPID_FILE}" > /dev/null &

Complete & modify the SMF configuration

svccfg -s application/database/sun-mysql51:default
setprop sun-mysql51/log=astring: /logdb2a
setprop sun-mysql51/data=astring: /db2a
setprop sun-mysql51/enable_64bit=true
setprop sun-mysql51/conffile=astring: /etc/opt/webstack/mysql/my.cnf
end
svcadm refresh svc:/application/database/sun-mysql51:default
svcadm enable svc:/application/database/sun-mysql51:default

Enable clean URL in Sun WebServer

Enable clean URL in Sun web server for drupal, add to this two files

  • /opt/webserver7/admin-server/config-store/domain-blog/config/domain-blog-obj.conf
  • /opt/webserver7/admin-server/config-store/domain-blog/config/obj.conf

###
# Drupal clean URLs
###
# If the request has not already been restarted, the request is
# for a virtual server that I know has Drupal on it, and the URI does not
# map to an accessible file or directory


# Find the URI and the Query string in the URL, then restart the
# request with the URI and Query passed to index.php
  
     AuthTrans fn="restart" uri="/index.php?q=$1&$3"
  

[snip]

Add php support to webserver 7

Run configure-sun-webserver to add php support

cd /opt/webstack/php/5.2/samples/scripts
./configure-sun-webserver

drupal zone configuration

The fowling blog zone configuration was used (just chnage the blog server name,path etc...)

create -b
set zonepath=/zones/blog1a
set autoboot=true
set scheduling-class=FSS
set ip-type=shared
add fs
set dir=/blog-data
set special=zones/blog-data
set type=lofs
end
add net
set address=10.10.254.130
set physical=igb0
end

MySQL zone configuration

create -b
set zonepath=/zones/blogdb1a
set autoboot=true
set scheduling-class=FSS
set ip-type=shared
add net
set address=10.10.254.132
set physical=igb0
end
add dataset
set name=zones/db1a
end
add dataset
set name=zones/logdb1a
end

Create and setup the ZFS file systems used by the blog & blogdb

For the blog drupal store create a zfs file system called zones/blog-data

zfs create -o mountpoint=/blog-data zones/blog-data
on the zone:
zonecfg -z [zonename]
add fs
set dir=/blog-data
set special=zones/blog-data
set type=lofs
end
commit

For the MySQL database create two file systems

zfs create -o recordsize=16 zones/db1a
zfs create zones/logdb1a

Add the data-set to the zone
zonecfg -z blogdb1aadd dataset
set name=zones/db1a
end
add dataset
set name=zones/logdb1a
end
commit

OS tuning

Tuning for the blog servers

Add to /etc/system

** limit ZFS cache to 4GB
set zfs:zfs_arc_max = 10737418240
** 256M pages
set max_uheap_lpsize=0x10000000
*
* Web Server Tuning
set rlim_fd_max=500000
set rlim_fd_cur=500000

** OS tuning
set ip_squeue_soft_ring=1
set ip:ip_soft_rings_cnt=8
set autoup=900
set sq_max_size=0
set consistent_coloring=2
set ip:ip_squeue_bind=0
set ip:ip_squeue_fanout=1
set ip:ip_squeue_enter=3
set ip:ip_squeue_worker_wait=0

set segmap_percent=6
set bufhwm=32768
set maxphys=1048576
set maxpgio=128
set ufs:smallfile=6000000

*For ipge driver
set ipge:ipge_tx_ring_size=2048
set ipge:ipge_tx_syncq=1
set ipge:ipge_srv_fifo_depth=16000
set ipge:ipge_reclaim_pending=32
set ipge:ipge_bcopy_thresh=512
set ipge:ipge_dvma_thresh=1
set pcie:pcie_aer_ce_mask=0x1

create /etc/init.d/NetTune.sh
cd /etc/rc2.d
ln -s /etc/init.d/NetTune.sh S70NetTune

#!/bin/bash

# ** Web Server tuning **
ndd -set /dev/tcp tcp_max_buf 4194304
ndd -set /dev/tcp tcp_cwnd_max 2097152
ndd -set /dev/tcp tcp_recv_hiwat 400000
ndd -set /dev/tcp tcp_xmit_hiwat 400000
ndd -set /dev/tcp tcp_conn_req_max_q 16384
ndd -set /dev/tcp tcp_conn_req_max_q0 16384
ndd -set /dev/tcp tcp_naglim_def 1
ndd -set /dev/tcp tcp_smallest_anon_port 2048
# ** make sure that all the network interfaces were not going to the same core
# * http://docs.sun.com/app/docs/doc/819-2635/abygx?a=view
allpsr=`/usr/sbin/psrinfo | grep -v off-line | awk '{ print $1 }'`
set $allpsr
numpsr=$#
while [ $numpsr -gt 0 ];
do
shift
numpsr=`expr $numpsr - 1`
tmp=1
while [ $tmp -ne 4 ];
do
/usr/sbin/psradm -i $1
shift
numpsr=`expr $numpsr - 1`
tmp=`expr $tmp + 1`
done
done

Tuning for the MySQL databse

Add to /etc/system

** limit ZFS cache to 10GB
set zfs:zfs_arc_max = 10737418240
** 256M pages
set max_uheap_lpsize=0x10000000
** Disable ZFS Prefetch needed for MySQL DB
set zfs:zfs_prefetch_disable = 1
** Disable ZFS cache flushes
*set zfs:zfs_nocacheflush = 1
** OS tuning
set ip_squeue_soft_ring=1
set ip:ip_soft_rings_cnt=8
set autoup=900
set sq_max_size=0
set consistent_coloring=2
set ip:ip_squeue_bind=0
set ip:ip_squeue_fanout=1
set ip:ip_squeue_enter=3
set ip:ip_squeue_worker_wait=0

create /etc/init.d/NetTune.sh
cd /etc/rc2.d
ln -s /etc/init.d/NetTune.sh S70NetTune

ndd -set /dev/tcp tcp_conn_req_max_q 16384
ndd -set /dev/tcp tcp_conn_req_max_q0 16384
ndd -set /dev/tcp tcp_naglim_def 1
ndd -set /dev/tcp tcp_smallest_anon_port 2048

Configure the performance settings in sun web server

Login to blog-wadmin and go to
Configurations > domain-blog > Performance

coming soon.

Install eaccelerator-0.9.5.3

./configure --enable-eaccelerator=shared --with-php-config=/opt/webstack/php/5.2/bin/php-config --with-eaccelerator-userid=webservd
make
make install

To configure eaccelerator & image magic add this to php.ini

extension=imagick.so
; eaccelerator extension
extension="eaccelerator.so"
eaccelerator.shm_size="128"
eaccelerator.cache_dir="/tmp/eaccelerator"
eaccelerator.enable="1"
eaccelerator.optimizer="1"
eaccelerator.check_mtime="1"
eaccelerator.debug="0"
eaccelerator.filter=""
eaccelerator.shm_max="0"
eaccelerator.shm_ttl="1800"
eaccelerator.shm_prune_period="1800"
eaccelerator.shm_only="0"
eaccelerator.compress="1"
eaccelerator.compress_level="9"

To complete memcahched config & install

Install the following packages

  • memcached-1.2.6-sol10-x86-local
  • libevent-1.2a-sol10-x86-local

memcached & eaccelerator startup script in /etc/init.d/memcached

#!/sbin/sh
 
case $1 in
 
        'start') /usr/local/bin/memcached -u webservd -l 127.0.0.1 -p 11211 -m 32 -d
                 mkdir /tmp/eaccelerator
                 chmod 777 /tmp/eaccelerator
        ;;
        'stop') pkill -9 memcached
        ;;
        *) echo "Usage: $0 [start|stop]"
        ;;
esac

# Complete startup script
cd /etc/rc2.d
ln -s /etc/init.d/memcached S99memcached

This link is needed to fix memcached looking for an older library

cd /usr/local/lib 
ln -s libevent-1.2a.so.1.0.3 libevent-1.2.so.1

Mysql Backup scripts

Download the pytohn setup tools from http://pypi.python.org/pypi/setuptools
Download MySQL-python from sourcefourge
Download gcc & libiconv from www.sunfreeware.com

export PATH=/opt/webstack/mysql/5.1/bin/64:/usr/sbin:/usr/bin:/usr/sfw/sbin:/usr/sfw/bin:/usr/local/bin:/usr/ccs/bin:
export LD_LIBRARY_PATH=/opt/webstack/mysql/5.1/lib/mysql:/usr/lib:/usr/sfw/lib:/usr/local/lib:/usr/ccs/lib
 
pkgadd -d gcc...
pkgadd -d libiconv...
 
gtar zvxf stuptools...
cd setuptools...
python setup.py install
 
gtar xvzf MySQL-python...
cd MySQL-python...
python setup.py install

MySQL Backup script

#!/bin/bash
 
echo "-------------------------------"
date
echo "=========== Start ============="
# Set the correct path
export PATH=/opt/webstack/mysql/5.1/bin/64:/usr/sbin:/usr/bin:/usr/sfw/sbin:/usr/sfw/bin:/usr/local/bin:/usr/ccs/bin:
export LD_LIBRARY_PATH=/opt/webstack/mysql/5.1/lib/mysql:/usr/lib:/usr/sfw/lib:/usr/local/lib:/usr/ccs/lib
 
# Take ZFS snap
/mysql_backup/mysql_snapback.py -f /mysql_backup/mysql_snapback.cfg
 
# Prepare the ZFS snap for NetBackup
echo "-------------------------------"
date
echo "=========== Done =============="

Configure cron to run the backup job

0 1 * * * /mysql_backup/mysql_backup.sh >> /mysql_backup/mysql_daily_backup.log 2>&1

create MySQL backup user

CREATE USER 'backupusr'@'localhost' IDENTIFIED BY 'password';
GRANT ALL ON *.* TO 'backupusr'@'blogdb1a.domain.com' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE, CREATE, DROP, reload, shutdown, ALTER, super, LOCK TABLES, replication client ON *.* TO 'backupusr'@'blogdb2a.domain.com' IDENTIFIED BY 'password'; 
GRANT SELECT, INSERT, UPDATE, CREATE, DROP, reload, shutdown, ALTER, super, LOCK TABLES, replication client ON *.* TO 'backupusr'@'10.20.22.153' IDENTIFIED BY 'password'; 
FLUSH privileges;

You could download the script from here

Drupal / mysql patches

  • Patch for the mysql / drupal count() issue
  • Patch For Mysql Master / Master (active / standby)

memcached & apc configurations

  • Enable apc.so in php.ini with the fowling options
  • Add memcached to drupal's settings.php

Solaris 10 hardening

disable services

svcadm disable svc:/network/telnet
svcadm disable svc:/network/login:rlogin
svcadm disable svc:/application/x11/xfs
svcadm disable svc:/network/ftp:default
svcadm disable svc:/network/rpc/rusers
svcadm disable svc:/network/rpc/rstat
svcadm disable svc:/network/shell:default
 
svcadm disable svc:/application/font/stfsloader:default
svcadm disable svc:/network/finger:default
svcadm disable svc:/network/stlisten:default
svcadm disable svc:/network/rpc/gss:default
svcadm disable svc:/network/rpc/metamed:default
svcadm disable svc:/network/rpc/meta:default
svcadm disable svc:/network/rpc/mdcomm:default
svcadm disable svc:/network/rpc/smserver:default
svcadm disable svc:/network/rpc/cde-calendar-manager:default
svcadm disable svc:/network/rpc/cde-ttdbserver:tcp
svcadm disable svc:/network/rpc/metamh:default
svcadm disable svc:/network/security/ktkt_warn:default
svcadm disable svc:/network/cde-spc:default
svcadm disable svc:/network/stdiscover:default
svcadm disable svc:/network/rpc-100235_1/rpc_ticotsord:default
 
svcadm disable svc:/network/nfs/cbd:default
svcadm disable svc:/network/nfs/mapid:default
svcadm disable svc:/network/nfs/status:default
svcadm disable svc:/network/nfs/nlockmgr:default
svcadm disable svc:/network/nfs/client:default
svcadm disable svc:/network/nfs/rquota:default
 
svcadm disable svc:/application/print/server:default
svcadm disable svc:/application/print/ppd-cache-update:default
svcadm disable svc:/application/cde-printinfo:default
svcadm disable svc:/application/print/ipp-listener:default
svcadm disable svc:/application/print/rfc1179:default
 
svcadm disable svc:/network/rpc/bind:default
svcadm disable svc:/network/ipsec/ipsecalgs:default
svcadm disable svc:/network/ipsec/policy:default

Configure sendmail hardening

echo 'MODE=""' > /etc/default/sendmail
cd /etc/mail/cf/cf
cat <<'EOF' > newsubmit.mc
include(`/etc/mail/cf/m4/cf.m4')
define(`confCF_VERSION', `Submit')
define(`__OSTYPE__', `')
define(`confTIME_ZONE', `USE_TZ')
define(`confDONT_INIT_GROUPS', `True')
FEATURE(`msp', `smtp.domain.com')
EOF
mv /etc/mail/submit.cf /etc/mail/submit.cf.old
/usr/ccs/bin/m4 newsubmit.mc > /etc/mail/submit.cf 
svcadm restart sendmail

References

Web References

0 0 votes
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x