Month: December 2022

Solaris: script to check various settings of a system if they comply to some pre-defined settings

Problem

If you setup a system, you want to make sure that it complies to a pre-defined config. You can do that with some configuration management system, but there are cases where it useful to do that outside of this context.

Solution

The shell script below I started to write in 2008. Over time (until 2016) it extended into something which is able to output a report of over 1000 items. You can configure it via ${HOME}/.check_host.cfg and /etc/check_host.cfg (it reads both in this order, first config wins and other config is not read). You can use option “-h” to see the usage text. Option “-n” suppresses messages which help to fix issues, “-a” prints out simple HTML instead of text.

check_host_sanitized.shDownload
Share/Save

Solaris: script to create commands to setup LDOMs based upon output from “ldm ls”

Problem

You have a LDOM which you want to clone to somewhere else and all you have to perform that is the ldm command on the target system.

Solution

Download the AWK script below. Use the output of “ldm ls -l -p <ldom>” as the input of this AWK script. The output will be a list of commands to re-create the config for VDS, VDISK, VSW and NETWORK.

I wrote this in 2013, so changes to the output of “ldm ls” since then are not accounted for.

gen_ldm_config.awkDownload
Share/Save

Windows: remove one item from filesystem ACL

PowerShell snippets to remove a group/user from a filesystem ACL in Windows (and compare how to do it in Linux/FreeBSD/Solaris).

Problem

There may be a folder (with broken inheritance) with files / directories where you want to make sure that there is no specific group / item included.

Solution

Here are some PowerShell snippets to solve this.

Populate $folders with all directories in the current directory:

$folders =  get-childitem . -directory

To test with one folder:

$folders = "X:\path\to\folder"

PowerShell to list folders with BUILTIN\Users in the ACL (to see which item will be affected):

foreach ($dir in $folders) { $value = get-acl $dir | Select-object -ExpandProperty Access | where { $_.IdentityReference -eq "BUILTIN\Users"} | Select -Expand IdentityReference; if ($value) {echo $dir} }

Print ACL of before and “to be” after removal (but not removing anything):

foreach ($item in $folders) { $value = get-acl $item | Select-object -ExpandProperty Access | where { $_.IdentityReference -eq "BUILTIN\Users"} | Select -Expand IdentityReference; if ($value) {echo $item; $ACL = (get-item $item).getAccessControl('Access'); $ACL.SetAccessRuleProtection($true, $true); echo $ACL |Select-object -ExpandProperty Access; $ACL = (get-item $item).getAccessControl('Access'); $ACL.Access | where {$_.IdentityReference -eq "BUILTIN\Users"} |%{$acl.RemoveAccessRule($_)}; echo $ACL |Select-object -ExpandProperty Access } }

Set the ACL (disable inheritance (convert current settings to explicit ACL) and remove BUILTIN\Users):

foreach ($item in $folders) { $value = get-acl $item | Select-object -ExpandProperty Access | where { $_.IdentityReference -eq "BUILTIN\Users"} | Select -Expand IdentityReference; if ($value) {echo $item; $ACL = (get-item $item).getAccessControl('Access'); $ACL.SetAccessRuleProtection($true, $true); Set-Acl -Path $item -AclObject $ACL; $ACL = (get-item $item).getAccessControl('Access'); $ACL.Access | where {$_.IdentityReference -eq "BUILTIN\Users"} |%{$acl.RemoveAccessRule($_)}; Set-Acl -Path $item -AclObject $ACL } }

How would this be solved in Solaris?

setfacl -d <entry> *

How would this be solved in FreeBSD/Linux?

setfacl -x <entry> *

Share/Save