Re: Single user mode and root password

2007-08-22 Thread Ronald van der Laan
Rob,

Yes, by replacing the /sbin/sulogin by a script that just calls /bin/bash,
you prevent the password check for both the fsck and single user modes.

Ronald van der Laan

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: IOCDS for Redhat

2007-08-22 Thread Harold Grovesteen

Thanks for the plug. Some of the rest of us might get some mileage from it.

Harold Grovesteen

Mark Post wrote:



Or, plug you could go to http://download.novell.com/Download?buildid=HfBRh4TspiE~ 
for a no-cost 180-day trial of SLES10 SP1./plug  :)


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390





--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Live Virtual Class, Aug 14 - Virtualization Basics (10am NY time)

2007-08-22 Thread Evans, Kevin R
Pam,

I went to http://www.vm.ibm.com/events/ to look at this class after the
event. Is this the correct URL for that? Clicking on the event still
asks for registration. Do I still need to go through that to look at the
presentation post-event.

Thanks,

Kevin Evans

-Original Message-
From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of
Pamela Christina in warm  sunny Endicott NY
Sent: Wednesday, August 08, 2007 4:25 PM
To: LINUX-390@VM.MARIST.EDU
Subject: Live Virtual Class, Aug 14 - Virtualization Basics (10am NY
time)

Here's info about the next in the series of Live Virtual
Classes (webcasts).   The price is right (no charge, no travel).
If you can't get to SHARE or System z Expo, why not try and LVC.
Or even if you can get to the events, listen in to the call, and
then you'll free up a time slot on your conference agenda for something
else.

Title:  Virtualization Basics

Abstract:
The latest buzz word in the industry seems to be virtualization. As we
have learned over the years,  one needs to be careful with buzzwords.
This presentation will not cover all the possible definitions for
virtualization. It will give you a strong understanding of what
virtualization means in the context of the z/VM hypervisor, and this can
be used to contrast with what others are calling virtualization. Key
topics covered in this presentation include: the virtual machine model,
the key components of z/VM, the role of the SIE instruction, and the
virtualization and management of various resources (processor, memory,
and I/O).


Audience: Customers, IBMers, ISVs and Business Partners

This 90-minute LVC will be conducted on Tuesday, August 14 starting at
10:00 Eastern U.S./4:00 p.m. CET and recorded for subsequent replay.
The replay will be available 1 week after the live session via a link on
the z/VM website (http://www.vm.ibm.com/)

Important:
Enroll for this session by EOD Monday, August 13 with this URL:
https://asp22.centra.com:443/Reg/main/00013c73780113c2f41183002cd1/e
n_US


There is no tuition to participate in this session, however you must
enroll at least 1 business day ahead of the session date to enable your
participation. The LVC will be delivered using the Centra tool that
employs Voice over IP (VoIP) technology to provide both the audio as
well as the visuals to your Windows workstation.  Each participant must
enroll individually, ie. no sharing of LVC logins is supported.

After enrolling in the LVC, you should run a a System Check via the
following URL to verify your workstation meets the following minimum
requirements.
System Check: https://stg.centra.com/SysCheck/main/Customers/ibmstg
  Windows 2000 or Windows XP
  Internet Explorer 5.01, Netscape 7.2, Firefox 1.0 or later.
  28.8 kbps or faster Internet connection
  P350+ MHz, 128+ MB memory
  800x600 16-bit color display or better
  sound card and speakers (to hear the audio portion of the LVC)
  microphone (required if you want to ask a question during the LVC)


For LVC info and comments about them, contact Dick Kendrick
  +1.469.718.0048 or [EMAIL PROTECTED]


If you want to access the replays, or see what else is
on the events calendar for z/VM and more...

 http://www.vm.ibm.com/events/


Regards,
Pam C
Dame Pamela the Publicist

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or
visit
http://www.marist.edu/htbin/wlvindex?LINUX-390

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: GDPS/XRC

2007-08-22 Thread Paolo Cacciari
.snip
We are in the planning stages of implementing GDPS/XRC.  We have z/OS,
z/VM, and Linux on zSeries (running as guests on z/VM).  z/VM is at 5.3
installed on CKD.   Linux is SLES9 SP3 installed on CKD and SCSI.  CKD for
/ (root) and SCSI for user data.  The SCSI is via EDEV.

From what I've read it appears that Linux for zSeries is supported by XRC
(on CKD - which means I'll need to convert off SCSI), but  I can't quite
determine if z/VM is supported.

I've searched the LISTSERV archives and found where folks have been
discussing this very issue...but I'm still unsure about z/VM.  If z/VM
isn't supported, must the Linux volumes be dedicated to the guest?
..snip

Susan,

Z/VM volumes are currently supported by XRC (take care of the upgrade level
of
your Z/os system). As per the absence of a valid timestamp in some z/VM
(and
Linux too) IOs, XRC will issue warning messages... but all goes ok...

As a suggestion, keep z/VM and Linux volumes in a separate SDM, to avoid
problems
on consistency groups, due to null timestamps

Hope this helps. regards.

_
Paolo Cacciari
Business Continuity and Resiliency Services, IBM Global Services - South
Region, EMEA
Via Darwin 85, 20019 Settimo Milanese(MI) – Italy - MISET001
The goal is to be prepared for a disaster not to continually plan for a
successful test
* [EMAIL PROTECTED]
( + 39 051 41.36799   Mobile: + 39 335 6287584
7 + 39 02 596.23288   Fax BO: + 39 051 406052

Re: Single user mode and root password

2007-08-22 Thread Michael MacIsaac
Mark,

 I would say that's a doc APAR in the making.  Mike?
We'll definitely look into it.

Mike MacIsaac [EMAIL PROTECTED]   (845) 433-7061

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Missing OSA/2 Interfaces

2007-08-22 Thread Michael MacIsaac
 I could have sworn that during the Redbook residency that we used
 some facility on the HMC to write screen contents into a file
 that we could subsequently transfer off to a PC.  Mike?

Yes, we had an OS/2 app, PMCAMERA I believe.

Now that the HMC is Linux-based, there is no way (to my knowledge) to run
other apps. However, since it is remotely available on the network, I
access it from my desktop to get screen shots.



Mike MacIsaac [EMAIL PROTECTED]   (845) 433-7061

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Bruce Hayden
Here is what I've used on SLES 10:

 cat /sbin/sulogin
#!/bin/bash
#Always log in without asking for a password
HOME=/root
exec -l /bin/bash --login --noprofile

On 8/22/07, Ronald van der Laan [EMAIL PROTECTED] wrote:
 Rob,

 Yes, by replacing the /sbin/sulogin by a script that just calls /bin/bash,
 you prevent the password check for both the fsck and single user modes.

 Ronald van der Laan


--
Bruce Hayden
Linux on System z Advanced Technical Support
Endicott, NY

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Spann, Elizebeth (Betsie)
Thank you for all the information and suggestions. Very much
appreciated,
Betsie 

-Original Message-
From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of
Bruce Hayden
Sent: Wednesday, August 22, 2007 6:11 AM
To: LINUX-390@VM.MARIST.EDU
Subject: Re: Single user mode and root password

Here is what I've used on SLES 10:

 cat /sbin/sulogin
#!/bin/bash
#Always log in without asking for a password HOME=/root exec -l
/bin/bash --login --noprofile

On 8/22/07, Ronald van der Laan [EMAIL PROTECTED] wrote:
 Rob,

 Yes, by replacing the /sbin/sulogin by a script that just calls 
 /bin/bash, you prevent the password check for both the fsck and single
user modes.

 Ronald van der Laan


--
Bruce Hayden
Linux on System z Advanced Technical Support Endicott, NY

--
For LINUX-390 subscribe / signoff / archive access instructions, send
email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or
visit http://www.marist.edu/htbin/wlvindex?LINUX-390

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Mark Post
 On Wed, Aug 22, 2007 at  9:11 AM, in message
[EMAIL PROTECTED], Bruce Hayden
[EMAIL PROTECTED] wrote: 
 Here is what I've used on SLES 10:
 
 cat /sbin/sulogin
 #!/bin/bash

Oooh, I can't agree with that.  Replacing a system module that might get called 
from multiple places isn't a good idea.  Updating /etc/inittab to invoke bash 
would be much better (and is what I do with Slack/390).


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Counties running Linux on a z-Series/System z?

2007-08-22 Thread Mario Held
Afternoon,

We are looking at bringing in a z9 BC to replace our existing 9672, with
the
possibility of also running Linux on the z9.  However, my CIO is
concerned with
the types of applications, number of IFLs required, other county
governments
doing this, etc., that can be run on the z9.

Are there any county governments running Linux on a z-Series or z9?

If so, would you be kind enough to share the types of applications,
number of
IFL's, data bases, or any other information that might be of interest to
my
CIO.


TIA,
Dave


Dave Stuart
Prin. Info. Systems Support Analyst
County of Ventura, CA
805-662-6731
[EMAIL PROTECTED]

Hi Dave,

at the SHARE User Event last week in San Diego I attended session 9231
Building
a strong z/VM and Linux on the mainframe architecture was given. There
the Linux
on the mainframe at Centre des services partages Quebec was shown. I found
a
softcopy of the presentation here:

http://blog.coleo.com/wp-content/uploads/2007/05/share_session_9231.pdf

Hope it includes what you are looking for.

Regards Mario

Mario Held
Linux Performance - Linux on System z
IBM Boeblingen Lab, Germany

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Bruce Hayden
The point is that sulogin *is* called from multiple places, so if
you're going to get rid of the root password (Rob's point) you either
get to modify all the places that invoke sulogin (I find 3 scripts in
/etc/init.d, plus /etc/inittab, and there could be more) or you modify
/sbin/sulogin.  In either case, you have local mods to maintain,
which has its drawbacks, of course..

On 8/22/07, Mark Post [EMAIL PROTECTED] wrote:

 Oooh, I can't agree with that.  Replacing a system module that might get 
 called from multiple places isn't a good idea.  Updating /etc/inittab to 
 invoke bash would be much better (and is what I do with Slack/390).


 Mark Post

--
Bruce Hayden
Linux on System z Advanced Technical Support
Endicott, NY

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Missing OSA/2 Interfaces

2007-08-22 Thread David Stuart
Mark, 

Which Redbook?  I am probably not familiar enough with the HMC's capabilities. 

Dave 



Dave Stuart
Prin. Info. Systems Support Analyst
County of Ventura, CA
805-662-6731
[EMAIL PROTECTED]

 Mark Post [EMAIL PROTECTED] 8/21/2007 1:00 PM 
 On Tue, Aug 21, 2007 at  2:07 PM, in message
[EMAIL PROTECTED], David Stuart [EMAIL PROTECTED]
wrote: 
-snip-
 However, as soon as the HMC comes back up, I'll run your commands, and send 
 on the output.  Hmm,  I don't think the HMC has 'Cut  Paste'...

I could have sworn that during the Redbook residency that we used some facility 
on the HMC to write screen contents into a file that we could subsequently 
transfer off to a PC.  Mike?  Anyone?  Am I right, or is my memory failing?


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390 

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Kim Goldenberg

Bruce Hayden wrote:

The point is that sulogin *is* called from multiple places, so if
you're going to get rid of the root password (Rob's point) you either
get to modify all the places that invoke sulogin (I find 3 scripts in
/etc/init.d, plus /etc/inittab, and there could be more) or you modify
/sbin/sulogin.  In either case, you have local mods to maintain,
which has its drawbacks, of course..


It's your foot, you can shoot it any way you want; I'd rather keep the
need for root around.

I'd also think about what each of those use root password for and leave
the original sulogin code in place (even if just renamed) just in case
it's needed in the future. Better yet, I'd update /etc/inittab and other
places with the code I'd want instead (like /sbin/nosulogin), so that
any maintenance wasn't messed with in the future, and updates didn't
just step on the new code.

I don't just blindly remove security functions just because it gets in
the way. Ive even set up ssh keys with non-null passphrases as well as
ssh-agent, to verify it's me and not someone who scarfed up my key
without my knowledge.

Kim

On 8/22/07, Mark Post [EMAIL PROTECTED] wrote:


Oooh, I can't agree with that.  Replacing a system module that might get called 
from multiple places isn't a good idea.  Updating /etc/inittab to invoke bash 
would be much better (and is what I do with Slack/390).


Mark Post



--
Bruce Hayden
Linux on System z Advanced Technical Support
Endicott, NY


---

Kim Goldenberg
Systems Programmer I
State of NJ - OIT
609-777-3722
[EMAIL PROTECTED]
[EMAIL PROTECTED]

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Counties running Linux on a z-Series/System z?

2007-08-22 Thread David Stuart
Thanks Mario, 

I'll take a look at the presentation. 


Dave 




Dave Stuart
Prin. Info. Systems Support Analyst
County of Ventura, CA
805-662-6731
[EMAIL PROTECTED]

 Mario Held [EMAIL PROTECTED] 8/22/2007 10:07 AM 
Afternoon,

We are looking at bringing in a z9 BC to replace our existing 9672, with
the
possibility of also running Linux on the z9.  However, my CIO is
concerned with
the types of applications, number of IFLs required, other county
governments
doing this, etc., that can be run on the z9.

Are there any county governments running Linux on a z-Series or z9?

If so, would you be kind enough to share the types of applications,
number of
IFL's, data bases, or any other information that might be of interest to
my
CIO.


TIA,
Dave


Dave Stuart
Prin. Info. Systems Support Analyst
County of Ventura, CA
805-662-6731
[EMAIL PROTECTED]

Hi Dave,

at the SHARE User Event last week in San Diego I attended session 9231
Building
a strong z/VM and Linux on the mainframe architecture was given. There
the Linux
on the mainframe at Centre des services partages Quebec was shown. I found
a
softcopy of the presentation here:

http://blog.coleo.com/wp-content/uploads/2007/05/share_session_9231.pdf 

Hope it includes what you are looking for.

Regards Mario

Mario Held
Linux Performance - Linux on System z
IBM Boeblingen Lab, Germany

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390 

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Counties running Linux on a z-Series/System z?

2007-08-22 Thread David Kreuter
Hi - I'm one of the authors of said presentation, and have presented it in one 
format or another a bunch of times. Let me know if you have any questions or 
need any additional information. Glad to elaborate.
David

-Original Message-
From: Linux on 390 Port on behalf of David Stuart
Sent: Wed 8/22/2007 3:52 PM
To: LINUX-390@VM.MARIST.EDU
Subject: Re: Counties running Linux on a z-Series/System z?
 
Thanks Mario, 

I'll take a look at the presentation. 


Dave 




Dave Stuart
Prin. Info. Systems Support Analyst
County of Ventura, CA
805-662-6731
[EMAIL PROTECTED]

 Mario Held [EMAIL PROTECTED] 8/22/2007 10:07 AM 
Afternoon,

We are looking at bringing in a z9 BC to replace our existing 9672, with
the
possibility of also running Linux on the z9.  However, my CIO is
concerned with
the types of applications, number of IFLs required, other county
governments
doing this, etc., that can be run on the z9.

Are there any county governments running Linux on a z-Series or z9?

If so, would you be kind enough to share the types of applications,
number of
IFL's, data bases, or any other information that might be of interest to
my
CIO.


TIA,
Dave


Dave Stuart
Prin. Info. Systems Support Analyst
County of Ventura, CA
805-662-6731
[EMAIL PROTECTED]

Hi Dave,

at the SHARE User Event last week in San Diego I attended session 9231
Building
a strong z/VM and Linux on the mainframe architecture was given. There
the Linux
on the mainframe at Centre des services partages Quebec was shown. I found
a
softcopy of the presentation here:

http://blog.coleo.com/wp-content/uploads/2007/05/share_session_9231.pdf 

Hope it includes what you are looking for.

Regards Mario

Mario Held
Linux Performance - Linux on System z
IBM Boeblingen Lab, Germany

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390 

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390



--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Rob van der Heij
On 8/22/07, Kim Goldenberg [EMAIL PROTECTED] wrote:

 I don't just blindly remove security functions just because it gets in
 the way. Ive even set up ssh keys with non-null passphrases as well as
 ssh-agent, to verify it's me and not someone who scarfed up my key
 without my knowledge.

:soapbox.
This is not a matter of getting in the way. What does get in the way
is a root password that is known by some people and can be used beyond
their original need to know. If you have 100 Linux virtual machines
used by various people, it just does not work well to invent 100 good
passwords every month to give each team the proper access.

Acceptance by others gets very low when they cannot have a root
password, but you can... and they will come up with a manager to
approve that they put the root password in some silly automated ftp
that copies data from one system to the other...   Not having a root
password is the best way to get out of that.

We've used this and it really works. We did have a server virtual
machine play SCIF (with logging and auditing and access control) for
when no ssh login was possible, or for automation things.

The good thing about cryptic keys is that you separate authentication
and access control, which we believe is a good thing to do. It
provides granularity and ease of use. When you already have your
workstation protected well enough, ssh-agent makes it very easy indeed
(and secure because people don't see you type in a password).
Even if you have to type your passphrase each time, that's probably
more secure against people reading it over your shoulder (because it's
the same for all systems and you can probably type it very fast). Way
better than having to look up the root password for server #86 when
someone is watching you...

And non-encrypted private keys (null passphrase) are evil. Except for
cold bodies (i.e. not warm bodies, so machines or automated processes.
And obviously you make sure that such a key only gives access to what
that process must do..

The authorized_keys file for root on that server gives full access
control. And it does auditing too. You can also use this for db2inst1
or whatever functional accounts you have. And it does not have to be
the same list of users who have access. If you want to go fancy, you
move the authorized_keys into LDAP and get the ability to build groups
and update access without messing with individual systems.

PS I believe we were eventually forced to have a root password because
corporate standards dictate that you change it every nn days, and if
you don't have one you cannot check that it expires every nn days :-(
 So I think we eventually set random passwords that nobody knew.

Rob

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Forced Disk Check During Boot

2007-08-22 Thread John Summerfield

David Stuart wrote:

Thanks Alan and Mark,

I think I'll leave things as they are for now.  But now I know they're 
considered normal.


Thanks,
Dave



Dave Stuart
Prin. Info. Systems Support Analyst
County of Ventura, CA
805-662-6731
[EMAIL PROTECTED]


Mark Post [EMAIL PROTECTED] 8/20/2007 4:34 PM 
On Mon, Aug 20, 2007 at  7:26 PM, in message

[EMAIL PROTECTED], David Stuart [EMAIL PROTECTED]
wrote:
-snip-

During a reboot this afternoon, I received a message stating that it had
been 143 days since /dev/dasd?1 had been checked.  Check forced.

-snip-

Is this normal?  I don't remember ever seeing this before, even when it had
been several months since the prior reboot.


Yes, the EXT2 and EXT3 file systems (and probably all file systems) do this.  
If you're using EXT3, you can do a:
tune2fs -c0 -i0 /dev/dasd??
to turn that off.  There are two switches you need to specify because there are 
two counts that are kept:
1. Number of days since the last file system check
2. Number of file system mounts since the last file system check

I would _not_ recommend doing this on an EXT2 file system, unless you always 
have it mounted read-only.


These days I wouldn't recommend using ext2.

Some recommend turning it off to avoid unexpectedly long boot times: I
have reconfigured the system and now reboot just to be sure it's okay.

And then it takes eons to come up and my downtime balloons

There is the complementary recommendation to schedule time to run the
fsck. Depending on the filesystem, the system might not need to be down
for the check.




--

Cheers
John

-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]

Please do not reply off-list

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread John Summerfield

Mark Post wrote:

On Tue, Aug 21, 2007 at  5:08 PM, in message

[EMAIL PROTECTED], R P Herrold
[EMAIL PROTECTED] wrote:

On Tue, 21 Aug 2007, Mark Post wrote:


Master Resource Control: runlevel S has been reached
Give root password for login:

Looks the same to me.  Same results for telinit 1 as well.

possibly a bootloader password.  that is not the customary
login password prompt challenge.


No, that wasn't a prompt for a boot loader password.  No such thing exists on 
mainframe Linux.  (Or if it does, and no one told me, I certainly haven't 
turned it on.)  That was from the 3215 console after issuing the telinit 
command.  It comes from /sbin/sulogin, which is what is invoked via 
/etc/inittab in single user mode:
# what to do in single-user mode
ls:S:wait:/etc/init.d/rc S
~~:S:respawn:/sbin/sulogin


One can (subject to security policies) change that to invoke bash.

unless one has really good security (better than I've seen), that's a
fairly pointless effort at securing the system.

If your disk is encrypted, you win, unless the stakes are high enough to
make it worth trying to get your keys.

If I can mount your disk I win.

If I can boot from my media, I win.

If I can type stuff at the bootloader (assuming it exists) and it's not
protected with a password, I win with init=/bin/bash






--

Cheers
John

-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]

Please do not reply off-list

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Live Virtual Class, Aug 14 - Virtualization Basics (10am NY time)

2007-08-22 Thread John Summerfield

Pamela Christina from hot  humid Endicott NY wrote:

...ooops..forgot to say this in the first posting.

Dr. Brian Wade will be presenting Virtualization Basics on
the Aug 14. Live Virtual Class.


In future, could people recognise that not everyone understands US
times, and translate times to GMT (UTC). Probably we can all translate
GMT to our local times.



--

Cheers
John

-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]

Please do not reply off-list

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Linux Laptops

2007-08-22 Thread John Summerfield

Adam Thornton wrote:

On Aug 8, 2007, at 2:15 AM, Rob van der Heij wrote:


On 8/8/07, Rod [EMAIL PROTECTED] wrote:


Cough cough - I have no problems running Debian 4 on my PPC iBook
- cough cough.


Got a cold mate?  I want to do virt and afaik VMware does not do
Debian...


That's, er, news to me.  What makes you say that?


On PowerPC?




--

Cheers
John

-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]

Please do not reply off-list

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Linux Laptops

2007-08-22 Thread John Summerfield

Tom Duerbusch wrote:

It seems like Dell had a Linux Preload offer for a few months.  I took it that 
Microsoft had a talk with them and the Linux preloads were taken off the 
market.  It seems to me that was 2 years ago.

I wonder what changed to allow Lenovo to consider doing this?


I think Dell's doing it now. HP's been offering Ubuntu for a while.

--

Cheers
John

-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]

Please do not reply off-list

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Linux Laptops

2007-08-22 Thread John Summerfield

David Heilman wrote:

I have had SuSE Linux running on T60's and T40's for the past 3 years.
The R series had problems but the T series seems to run great. I am
about to try SuSE on a Gateway Notepad to see how well that works.


I'm running OpenSUSE 10.2 on a R40. Had to add madwifi for the wireless.
The infernal modem works (sort of) to my great surprise. I think power
management does not work, but I've not actually tried to do anything to it.

Screen runs at 1440x1050 or so. Very nice.




--

Cheers
John

-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]

Please do not reply off-list

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Linux Laptops

2007-08-22 Thread John Summerfield

Rob van der Heij wrote:

On 8/6/07, Alan Cox [EMAIL PROTECTED] wrote:


Today there are very few laptops on the market, the rest is
configuration and packaging. Its Intel mobile + MICH + intel video +
intel wireless (aka Centrino), Intel mobile + MICH + intel video + other
wireless, AMD + ATI + broadcom and a few other combinations.


While my Shuttle SD11G5 does not sit in my lap, it uses the same gear:
Intel 915GM + ICH6M, Intel GMA900, Broadcom Gigabit (and probably more
quiet than my T43)
I had lots of trouble getting a Linux distribution installed that did
both audio and video. Most annoying problem was that GUI-based install
failed halfway (expect because video memory was used as page cache
too). I am now fairly happy with Centos 5 (though I cannot get
dual-head to work as I can with Windows on my T43).


Contrary to Alan, my experience with Intel video is mostly bad. A Dell
Optiplex GX270 I gave up on, video was unacceptable with Fedora Core 6,
SLE{S,D} 10 beta and RHEL5 beta.

Same/similar graphics is working with Scientific Linux 5 (RHEL-clone) pm
an IBM ThinkCentre, but there's a big pause when switching between
virtual consoles.



--

Cheers
John

-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]

Please do not reply off-list

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Linux Laptops

2007-08-22 Thread Adam Thornton

On Aug 22, 2007, at 4:10 AM, John Summerfield wrote:

Adam Thornton wrote:

On Aug 8, 2007, at 2:15 AM, Rob van der Heij wrote:

On 8/8/07, Rod [EMAIL PROTECTED] wrote:

Cough cough - I have no problems running Debian 4 on my PPC iBook
- cough cough.

Got a cold mate?  I want to do virt and afaik VMware does not do
Debian...

That's, er, news to me.  What makes you say that?

On PowerPC?


Sure.

If you run Bochs.

Adam

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Mark Post
 On Wed, Aug 22, 2007 at  6:32 PM, in message
[EMAIL PROTECTED], Rob van der Heij
[EMAIL PROTECTED] wrote: 
-sip-
 This is not a matter of getting in the way. What does get in the way
 is a root password that is known by some people and can be used beyond
 their original need to know. 

If you let that happen.  My prior management did not, unless there was a 
contractual requirement, in which case all SLAs were null for those particular 
systems.  In all other cases, sudo was sufficient.  It's mostly a matter of 
knowledgeable management who also have some, umm, guts.  Mine was, and did.

-snip-
 And non-encrypted private keys (null passphrase) are evil. 

Careful.  Gabe didn't say he did that.  He said he had non-null passphrases.

My personal opinion is that any Linux system protected by a z/VM 
userid/password doesn't _need_ to have a login prompt on the virtual console.  
Having bash running is just fine.  Even so, in absolute terms, that _is_ less 
secure than having both.  Just not meaningfully so, IMO.  And just because you 
have a root password doesn't mean you can't use key pairs as well (as you 
yourself said you did).


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Missing OSA/2 Interfaces

2007-08-22 Thread Mark Post
 On Wed, Aug 22, 2007 at  1:51 PM, in message
[EMAIL PROTECTED], David Stuart [EMAIL PROTECTED]
wrote: 
 Mark, 
 
 Which Redbook?  I am probably not familiar enough with the HMC's 
 capabilities. 

Dave,

The Linux for zSeries and S/390: Distributions book.  It didn't talk about 
getting things from the HMC, it was just a tool we used to get stuff from the 
console into the book.


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Single user mode and root password

2007-08-22 Thread Mark Post
 On Wed, Aug 22, 2007 at  1:19 PM, in message
[EMAIL PROTECTED], Bruce Hayden
[EMAIL PROTECTED] wrote: 
 The point is that sulogin *is* called from multiple places, so if
 you're going to get rid of the root password (Rob's point) you either
 get to modify all the places that invoke sulogin (I find 3 scripts in
 /etc/init.d, plus /etc/inittab, and there could be more) or you modify
 /sbin/sulogin.  In either case, you have local mods to maintain,
 which has its drawbacks, of course..

If you did it with RPM, then that would be a different matter.  I don't think 
that's what you meant, though.  Doing it without RPM is just a Bad Idea.  Sort 
of like putting on superzaps outside of SMP/E, etc.


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Forced Disk Check During Boot

2007-08-22 Thread Mark Post
 On Wed, Aug 22, 2007 at  4:47 AM, in message
[EMAIL PROTECTED], John Summerfield
[EMAIL PROTECTED] wrote: 
-snip-
 I would _not_ recommend doing this on an EXT2 file system, unless you always 
 have it mounted read-only.
 
 These days I wouldn't recommend using ext2.

I would, but only in the context I framed it in.  Read-only disks, shared 
between z/VM guests (or I guess you could do it in LPARs.  Aiee!)  If you try 
to use ext3 in those situations, bad things happen.  Most often, ugly error 
messages in the system log when a system tries to write to the journal, or 
replay it, etc.


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Linux Laptops

2007-08-22 Thread Mark Post
 On Wed, Aug 22, 2007 at  9:59 PM, in message
[EMAIL PROTECTED], Adam Thornton
[EMAIL PROTECTED] wrote: 
-snip-
 Virtual PC, however, *does*, and it's not terrible (although it's
 pretty crash-prone), 

Ok, explain to me how something that is pretty crash-prone is _not_ terrible?


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Live Virtual Class, Aug 14 - Virtualization Basics (10am NY time)

2007-08-22 Thread Mark Post
 On Wed, Aug 22, 2007 at  5:18 AM, in message
[EMAIL PROTECTED], John Summerfield
[EMAIL PROTECTED] wrote: 
 Pamela Christina from hot  humid Endicott NY wrote:
 ...ooops..forgot to say this in the first posting.

 Dr. Brian Wade will be presenting Virtualization Basics on
 the Aug 14. Live Virtual Class.
 
 In future, could people recognise that not everyone understands US
 times, and translate times to GMT (UTC). Probably we can all translate
 GMT to our local times.

What, you don't have one of those handy dandy timezone changers on your desktop 
toolbar?  Heck, even Windows has that.  I use mine all the time to figure out 
what the time is in other parts of the world.  Or you could use the world 
clock, or


Mark Post

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390


Re: Linux Laptops

2007-08-22 Thread Adam Thornton

On Aug 22, 2007, at 11:47 PM, Mark Post wrote:


On Wed, Aug 22, 2007 at  9:59 PM, in message

[EMAIL PROTECTED], Adam Thornton
[EMAIL PROTECTED] wrote:
-snip-

Virtual PC, however, *does*, and it's not terrible (although it's
pretty crash-prone),


Ok, explain to me how something that is pretty crash-prone is _not_
terrible?


Well, in the context of all the things Microsoft has blessed us with
over the decades, it's better than most.

It was an acceptable way to run Visio.  And, um, the DD character
generator that came with the 3E _Player's Handbook_.

Adam

--
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390