Oracle Business Breakfast Oracle Solaris 11.4 Beta Jörg Möllenkamp Oracle Elite Engineering Exchange
Total Page:16
File Type:pdf, Size:1020Kb
Oracle Business Breakfast Oracle Solaris 11.4 Beta Jörg Möllenkamp Oracle Elite Engineering Exchange V 0.13 21.03.2018 dd/jm Copyright Copyright © © 2018,2018,Oracle and/or its affiliates. All rights reserved. |Oracle and/or its affiliates. All rights reserved. Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 3 Scope What you can take away from this presentation? • How we will develop and deliver Oracle Solaris in the future. • Insight into the new and innovative features of Oracle Solaris 11.4 Beta • Practical command line examples you can try for yourself • No marketing slides. (unfortunately) Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 4 Oracle Solaris Strategy Best UNIX For Mission Critical WorkloaDs • Continuous Delivery Model – Innovation and critical fixes through dot releases, Quarterly Critical Patch Updates, and monthly Support Repository Updates • Secure and Stable – Integrated security and availability features to simplify deployments and operations • Oracle Database Integration – Data/systems management, networking, and performance features to enable optimal Oracle Database results on SPARC/Solaris Mission Critical Operating System Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 5 What Customers told us: Oracle Solaris Priorities A Non-disruptive stream of innovation • Consistent Operational Model • Operational Compatibility • Simple OS Deployment and Patching Methodology • Continuous Application Compatibility – No ISV Re-Qualification • Long support lifespan Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 6 What we delivered: Continuous Delivery of Security, Stability anD Software Enhancements Legacy Oracle Solaris Less Major Releases Slow ADoption Continuous Delivery MoDel Disruptive Quicker Simpler Smaller More High Risk Complex Disruptive Frequent Slow anD Expensive Re-Qualifications Seamless Upgrades Enable Agile Incorporation of New Capabilities with Guaranteed Compatibility for 1,000’s of Oracle, ISV, and Customer Applications Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 7 Oracle Lifetime Support HarDware anD Operating Systems http://www.oracle.com/us/support/lifetime-support/lifetime-support-hardware-337183.html • Premier Support • Provides maintenance for your Oracle hardware and integrated software (for example, firmware). Maintenance and software upgrades are included for Oracle operating systems and Oracle VM for ten years from their general availability date - extended to 20 years for Oracle Solaris 11 (2031) http://www.oracle.com/us/support/library/lifetime-support-hardware-301321.pdf on p.34 (37) • Extended Support for Operating Systems • Puts you in control of your operating system upgrade strategy by providing additional maintenance and upgrades for Oracle Solaris operating system for an additional fee (2034) • Sustaining Support for Operating Systems • Maximizes your investment protection by further extending support for operating systems and firmware. Features include access to Oracle online support tools, operating system upgrade rights, pre-existing fixes, patches and assistance from technical support experts Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 8 One Support Stream 11.0 11.1 11.2 11.3 Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 9 Monthly Support Repository Updates (SRUs) SRU 1 SRU 2 SRU 3 SRU 4 SRU 5 SRU 6 SRU 7 SRU 8 SRU 9 SRU 10 SRU 11 11.Update Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 10 Quarterly Critical Patch Updates (CPUs) CPU CPU CPU CPU Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 11 Continuous Minor Enhancement Delivery CPU CPU CPU CPU Minor Minor Minor Enhancements Enhancements Enhancements Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 12 Critical Patch Updates Practical Example • Install: pkg install solaris-11-cpu – It‘s higher in the hierarchy than entire. Not installed by default – Provides additional CPU detail for the administrator – Must be installed for the examples on the next slide to work. – The commands work with Oracle Solaris 11.3 as well. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 13 Critical Patch Updates Practical Example # pkg search CVE-2014-7187: INDEX ACTION VALUE PACKAGE CVE-2014-7187 set pkg://solaris/shell/[email protected],5.11-0.175.2.2.0.8.0 pkg:/support/critical-patch- update/[email protected] CVE-2014-7187 set pkg://solaris/shell/[email protected],5.11-0.175.2.2.0.8.0 pkg:/support/critical-patch- update/[email protected] ... CVE-2014-7187 set pkg://solaris/shell/[email protected],5.11-0.175.2.2.0.8.0 pkg:/support/critical-patch- update/[email protected] $ pkg contents -rHo value -a name=info.cve solaris-11-cpu@latest CVE-1999-0103 CVE-2002-2443 CVE-2003-0001 CVE-2004-0230 ... # pkg search -l CVE-2014-7187 INDEX ACTION VALUE PACKAGE info.cve set CVE-2014-7187 pkg:/support/critical-patch-update/[email protected] Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 14 Critical Patch Updates A siDe note • In a recent CPU (Q4/CY2017) Solaris wasn‘t mentioned at all. • Because the restructuring took place not long before that, this led to a multitude of rumors. • In reality this was great news. • The simple reason for not being in the CPU: – The number of security vulnerabilities in Oracle owned software in Oracle Solaris was ZERO! – In that quarter ZERO security vulnerabilties were fixed in the kernel or Oracle software shipped inside Oracle Solaris. Thus no CPU for Oracle Solaris. – We fixed security vulnerabilities in Software like Samba in that SRU, but that is not Oracle owned Software. (https://blogs.oracle.com/solaris/oracle-solaris-not-in-latest-cpu-like-a-boss) Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 15 New features in Oracle Solaris SRU • The „minor enhancements by SRU“ already started with 11.3 • We didn‘t want to wait for a dot-release to introduce some minor enhancements, so we did release them already with 11.3 • This was done by introducing them into 11.3 SRU. • Example: – One-Time Passwords in SRU17 – Libdax for Solaris 11.3 x86 in SRU 29 (a library that emulates DAX in software so a software dependent on libdax developed on Solaris/SPARC will run on Solaris/x86 as well) – ... and much more Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 16 Oracle Solaris Continuous Delivery Some new Capabilities DelivereD in recent 11.3 SRUs • Security • New platform support • Two-Factor Authentication • Oracle SPARC M8 • Packet Filter Firewall • Fujitsu SPARC M10 and M12 • MIT Kerberos V5 update • Intel Skylake • Virtualization • Broadcom 25Gb, Intel 10GbE Ethernet • DAX APIs for SPARC M7, M8 • Fast SRIOV I/O failover • DAX Support in Kernel Zones • VLAN aware Kernel Zones • Updated FOSS Packages • 148 components updated in SRU since release of Oracle Solaris 11.3 Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 17 One Time Password for SSH Configuration • Frequently asked customer question • It was introduced in Oracle Solaris 11.3 SRU17. • Not very difficult – Switch to OpenSSH – Install pkg – Setup OTP – Setup PAM Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 18 One Time Passwords Practical Example: Convert to OpenSSH (in Oracle Solaris 11.3, 11.4 is OpenSSH-only) root@nfsclient:~# pkg install network/openssh root@nfsclient:~# pkg set-mediator -I openssh ssh root@nfsclient:~# echo "AuthenticationMethods password,keyboard-interactive" >> /etc/ssh/sshd_config root@nfsclient:~# svcadm disable ssh;svcadm enable ssh; sleep 10; svcs -x ssh svc:/network/ssh:default (SSH server) State: online since Wed May 03 14:17:58 2017 See: sshd(1M) See: /var/svc/log/network-ssh:default.log Impact: None. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 19 One Time Passwords Practical Example: Install otp pkg root@nfsclient:~# pkg install otp Packages to install: 1 [...] Updating package cache 1/1 root@nfsclient:~# Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 20 One Time Password for SSH Practical Example: Setup OTP jmoekamp@nfsclient:~$ otpadm set secret New TOTP secret=MSQF 4RYZ OXCH 4ZUI FNYX CZEN NBNJ 5HEA Enter current code from authenticator: Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 21 One Time Password Practical Example: Setup OTP Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 22 One Time Password Practical Example: Setup OTP Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 23 One Time Password Practical Example: Setup OTP anD PAM jmoekamp@nfsclient:~$ otpadm set secret New TOTP secret=MSQF 4RYZ OXCH 4ZUI FNYX CZEN NBNJ 5HEA Enter current code from authenticator: 009538 root@nfsclient:~# cat <<EOT >> /etc/pam.d/sshd-kbdint > auth required pam_unix_cred.so.1 > auth required pam_otp_auth.so.1 > EOT Copyright © 2018, Oracle and/or its affiliates. All rights reserved. | 24 One Time Password Practical Example: Try it out glamdring:~ jmoekamp$ ssh -v [email protected] [...] debug1: Authentications that can continue: password debug1: Next authentication method: password [email protected]'s password: supersecret Authenticated with partial success. debug1: Authentications that can continue: keyboard-interactive debug1: Next authentication method: keyboard-interactive OTP code: 369249 debug1: Authentication succeeded (keyboard-interactive). [...] Last login: Wed May 3 14:14:26 2017 from 192.168.1.2 Oracle Corporation SunOS 5.11 11.3 March 2017 jmoekamp@nfsclient:~$ Copyright © 2018, Oracle and/or its affiliates. All rights reserved.