[zones-discuss] heads-up: zlogin fails if root has no password (nv105)

2009-01-05 Thread Steffen Weiberle
For my test zones, I usually don't set a password via /etc/sysidcfg. 
Usually I don't configure ssh to allow root login, and the zones are 
configured with limited network services (secure by default), so I don't 
worry.

With build 105 (the one with Crossbow integrated), all of a sudden 
zlogin fails if the zone does not have a root password. The error is an 
incorrect password type of message.

# zlogin master
[Connected to zone 'master' pts/4]
Login incorrect


So does logging in on the console. The error messages for this on the 
console are:

Jan  5 15:04:33 master login: pam_unix_account: zlogin: empty password 
not allowed for account root from local host
Jan  5 15:04:33 master login: login account failure: Permission denied


Is this intentional, or a side effect (especially for zlogin)? I looked 
for a flag day and did not find one. Not sure how long this has been 
happening. I don't remember it with 101[a]. If not intentional, I can 
file a bug.

Thanks
Steffen
___
zones-discuss mailing list
zones-discuss@opensolaris.org


Re: [zones-discuss] heads-up: zlogin fails if root has no password (nv105)

2009-01-05 Thread Menno Lageman
Steffen Weiberle wrote:
 For my test zones, I usually don't set a password via /etc/sysidcfg. 
 Usually I don't configure ssh to allow root login, and the zones are 
 configured with limited network services (secure by default), so I don't 
 worry.
 
 With build 105 (the one with Crossbow integrated), all of a sudden 
 zlogin fails if the zone does not have a root password. The error is an 
 incorrect password type of message.
 
 # zlogin master
 [Connected to zone 'master' pts/4]
 Login incorrect
 
 
 So does logging in on the console. The error messages for this on the 
 console are:
 
 Jan  5 15:04:33 master login: pam_unix_account: zlogin: empty password 
 not allowed for account root from local host
 Jan  5 15:04:33 master login: login account failure: Permission denied
 
 
 Is this intentional, or a side effect (especially for zlogin)? I looked 
 for a flag day and did not find one. Not sure how long this has been 
 happening. I don't remember it with 101[a]. If not intentional, I can 
 file a bug.

It's intentional and present since build 104. See 
http://opensolaris.org/os/community/on/flag-days/pages/2008111501/

Menno
___
zones-discuss mailing list
zones-discuss@opensolaris.org


[zones-discuss] After upgrading snv_101b my zones do not start anymore

2009-01-05 Thread Zoltan Farkas
When attempting to boot them I get:

#zoneadm -z email-zone boot
zone 'email-zone': Error: no active dataset.
zone 'email-zone':
zoneadm: zone 'email-zone': call to zoneadmd failed

Here is the conf of my zone:
# zonecfg -z email-zone info
zonename: email-zone
zonepath: /zones/email-zone
brand: ipkg
autoboot: true
bootargs:
pool:
limitpriv:
scheduling-class:
ip-type: shared
net:
address: 192.168.1.9
physical: e1000g0
defrouter not specified

the zone sits on its own zfs file system:

# zfs list
NAME USED AVAIL REFER MOUNTPOINT
rpool/zones/email-zone 1.27G 228G 1.16G /zones/email-zone

#ls -l
drwx-- 4 root root 4 Nov 26 10:42 email-zone

I tried to detach and reattach zone and get:
# zoneadm -z email-zone detach
cannot open 'rpool/zones/email-zone/ROOT': dataset does not exist
Error: no active dataset.

/zones/email-zone# ls -l
total 3
drwxr-xr-x 13 root sys 14 Nov 13 09:03 dev
drwxr-xr-x 16 root root 18 Oct 14 16:25 root

anybody knows what went wrong? 

thanks

--zoly

___
zones-discuss mailing list
zones-discuss@opensolaris.org


Re: [zones-discuss] heads-up: zlogin fails if root has no password (nv105)

2009-01-05 Thread Dan Price
On Mon 05 Jan 2009 at 03:08PM, Steffen Weiberle wrote:
 For my test zones, I usually don't set a password via /etc/sysidcfg. 
 Usually I don't configure ssh to allow root login, and the zones are 
 configured with limited network services (secure by default), so I don't 
 worry.
 
 With build 105 (the one with Crossbow integrated), all of a sudden 
 zlogin fails if the zone does not have a root password. The error is an 
 incorrect password type of message.
 
 # zlogin master
 [Connected to zone 'master' pts/4]
 Login incorrect
 
 
 So does logging in on the console. The error messages for this on the 
 console are:
 
 Jan  5 15:04:33 master login: pam_unix_account: zlogin: empty password 
 not allowed for account root from local host
 Jan  5 15:04:33 master login: login account failure: Permission denied

I guess you are subject to the desires of the security folks here.
I agree that it is mildly annoying.

zlogin -S (failsafe) should still work, AFAIK.

-dp

-- 
Daniel Price - Solaris Kernel Engineering - d...@eng.sun.com - blogs.sun.com/dp
___
zones-discuss mailing list
zones-discuss@opensolaris.org


Re: [zones-discuss] After upgrading snv_101b my zones do not start anymore

2009-01-05 Thread Jerry Jelinek
Zoltan Farkas wrote:
 When attempting to boot them I get:

This was discussed here:

http://www.opensolaris.org/jive/thread.jspa?threadID=80209tstart=75

I also blogged about this here:

http://blogs.sun.com/jerrysblog/entry/zones_on_opensolaris_2008_11

Jerry
___
zones-discuss mailing list
zones-discuss@opensolaris.org