· Solaris · Unix

What Replaced admintool on Solaris: Users, Printers and Software

Solaris 10 dropped admintool, and these tools took over its users, groups, hosts, printers, serial ports and software screens, with what Solaris 11 uses now.

What Replaced admintool on Solaris: Users, Printers and Software

Purpose

Solaris 9 supports admintool, and Solaris 10 does not . In Solaris 10, admintool and its software tool, swmtool, are no longer supported , and three tools took over their jobs. The Solaris Management Console (smc) handles users, groups, hosts and serial ports. Print Manager (printmgr) handles printers. Product Registry (prodreg) handles software.

Solaris 11 removed the Solaris Management Console GUI and all of its command-line tools , including smc and smuser. User accounts on Solaris 11 are managed only from the command line, with useradd, usermod and userdel. Use this map when you move scripts from a Solaris 9 box to Solaris 10 or 11, or when an old runbook says to open admintool and the command no longer exists.

admintool and the tools that replaced it are among the commands collected on the Solaris commands and scripts page .

Code

The first command adds a user through the Solaris Management Console. The second changes that user's shell and groups. The third opens the Solaris 10 software registry at the top level.

1./smuser add -H myhost -p mypasswd -u root -- -F "Joe Smith" \
2-n user1 -c "Joe's account"
3
4./smuser modify -H myhost -p mypasswd -u root -- -n user1 \
5-s /bin/ksh -G qa_group
6
7prodreg browse

Code Breakdown

Users

In Solaris 10, admintool's user screen became smuser , one of the Solaris Management Console commands. Its full path is /usr/sadm/bin/smuser, and it ships in the SUNWmga package. The synopsis is /usr/sadm/bin/smuser subcommand [auth_args] -- [subcommand_args], so every call has two halves.

The authentication half:

  • -H myhost names the console server. If you give no port, smuser connects to the default port, 898.
  • -p mypasswd passes the authentication password on the command line. Any user on the system can see it there, so the option counts as insecure.
  • -u root names the identity to authenticate as. Without -u, smuser uses the identity that runs the console process.
  • -- is required and must follow the authentication options.

The subcommand half:

  • -F "Joe Smith" sets the full, descriptive name of the user.
  • -n user1 sets the login name.
  • -c "Joe's account" takes a string of up to 256 printable characters, with no colon. The double quotes protect the apostrophe from the shell.
  • -s /bin/ksh sets the full path of the login shell, up to 1024 characters.
  • -G qa_group adds a supplementary group.

The first command sets no password for the new account. The system gives it the next free user ID above 100, and the user is asked for a password at first login. The second command then sets the account's shell to the Korn shell and adds it to the qa_group secondary group. smuser works on the local /etc files or on a NIS or NIS+ name service. A name service is a shared directory that serves user and host data to many machines.

Solaris 10 also has local commands: useradd, usermod and userdel add, change and remove a user. On Solaris 11 they are the only option. Solaris 11 replaced smc, smuser, smgroup and passmgmt with useradd, usermod, userdel, groupadd, groupmod, groupdel, roleadd, rolemod and roledel.

useradd writes the new user to /etc/passwd, /etc/shadow and /etc/user_attr. The -m flag creates the home directory if it does not already exist. The new login stays locked until someone runs passwd for it. The rule is the same on Solaris 10 .

The defaults differ between illumos and Solaris 11 useradd :

SettingillumosSolaris 11
base_dir/home/export/home
skel_dir/etc/skel/etc/skel
shell/bin/sh/usr/bin/bash

On illumos, the default group is also other (GID 1). A script that depends on the defaults will put home directories in different places on the two systems.

Groups

In Solaris 10, smgroup manages group entries through the console. The local commands groupadd, groupmod and groupdel add, change and remove a group, and on Solaris 11 they replace smgroup. groupadd creates a group by adding an entry to /etc/group. It adds the group to the local system only.

Hosts

In Solaris 10, host administration moved into the Solaris Management Console (smc). The console screen for it is the Computers and Networks tool. Solaris Management Console 2.1 supports that tool on Solaris 9 and Solaris 10, and admintool never had it. Solaris 11 removed the console and all of its command-line tools, so the Computers and Networks tool is gone there too.

Printers

The Solaris Management Console 2.1 has no printer tool. Solaris Print Manager is a separate tool, and in Solaris 10 it replaced admintool's printer screen. Its path is /usr/sadm/admin/bin/printmgr , it ships in SUNWppm, and you must be logged in as superuser to use it.

Print Manager works with LDAP, NIS, NIS+ and local files. It can run on a remote system and send its display to the local one. Its command-line console shows the lp command line for each add, modify and delete, so you can see which commands the GUI runs. In Solaris 10, lpadmin -n sets a PPD file when you create or change a printer.

Solaris 11 drops the LP print service, the lp print commands and the Print Manager GUI. In their place it uses CUPS (Common UNIX Print System), with the CUPS command-line tools and the CUPS Print Manager GUI. You start the GUI with system-config-printer.

Serial Ports

In Solaris 9, admintool and the Solaris Management Console both had a Serial Port tool. From Solaris 10, the console and its smserialport command manage serial ports, and the console handles terminals and modems.

Solaris 11 no longer supports saf, sac, sacadm, nlsadmin, pmadm, ttyadm or listen. ttymon express mode still works through two services: svc:/system/console-login:terma and svc:/system/console-login:termb.

Software

In Solaris 9, the Software Package tool existed only in admintool. The Solaris Management Console had none. In Solaris 10, prodreg browses, unregisters and uninstalls components in the Solaris Product Registry. With no subcommand it runs swing, which opens the Swing GUI. prodreg browse with no arguments starts at the top of the registry. The unregister subcommand is the only feature that the command line has and the GUI does not.

Solaris 11 replaces the SVR4 package and patch commands with the Image Packaging System (IPS) pkg commands and the Package Manager and Update Manager GUIs.

Key Points

  • Solaris 8 had two console generations. Solaris 8, 8 6/00 and 8 10/00 shipped AdminSuite 3.0. Solaris 8 1/01, 4/01, 7/01, 10/01 and 2/02 shipped Solaris Management Console 2.0. Solaris 9 and Solaris 10 ship console 2.1.
  • The sm* console commands and the local useradd and groupadd families all need superuser or an equivalent role.
  • The console's name service support covers users, groups and network information only.
  • On Solaris 11, administration commands moved from /sbin to /usr/sbin, and development tools moved from /usr/ccs/bin to /usr/bin. Update any script that calls them by full path.

Insights and Best Practices

Safe usage

The -p in both smuser examples puts the authentication password where any user on the box can read it. Keep it out of real runs on a shared system. For the new account's own password, do what the first command does: set none, and the user chooses one at first login. With useradd, run passwd as a separate step, because the account stays locked until you do.

Alternatives

Choose between smuser and useradd based on where the account lives. smuser reaches local files, NIS or NIS+. useradd and groupadd cannot manage user and group data in a name service, and useradd cannot change data that the network name service supplies. If a Solaris 10 system has a text-only terminal as its console, use the console commands instead of the GUI.

Scripting

Browse numbers in prodreg help when you browse by hand. Do not use them in scripts. On Solaris 10, pkgchk -P accepts a partial path, so use it instead of grepping /var/sadm/install/contents. Entries that useradd writes are limited to 2048 characters per line, so keep field values short in scripts that build accounts.

What to log

Print Manager's command-line console shows the lp command for every printer change. Copy those lines into the change log, and you have a record you can replay from a shell. For smuser, log the exit status and the message. A status of 2 means the command failed and printed an error.

When to Run This

  • Moving a Solaris 9 host to Solaris 10, where admintool no longer exists.
  • Managing users on a Solaris 10 box whose console is a text terminal.
  • Adding a printer for a whole NIS, NIS+ or LDAP domain with Print Manager.
  • Clearing stale entries from the Solaris 10 Product Registry with prodreg unregister.
  • Porting runbooks from Solaris 10 to Solaris 11, where the console, LP and SVR4 package commands are gone.

Troubleshooting Common Issues

smuser times out after a console server reboot. The first console connection after a reboot can time out. Run the same smuser command again.

smuser fails at once. smuser needs the Solaris Management Console to be initialized. When the command fails, it exits with status 2 and prints an error message. Check the status with echo $?, initialize the console, then retry.

useradd says the login is in use. The error is UX: useradd: ERROR: login is already in use. Choose another. Check for the name with grep '^user1:' /etc/passwd.

useradd cannot update system files. The error is UX: useradd: ERROR: Cannot update system files - login cannot be created. Check the files it writes with ls -l /etc/passwd /etc/shadow /etc/user_attr.

groupadd exits with status 9. The group is not unique. Look for it with grep '^qa_group:' /etc/group.

A login name is longer than eight characters. To change how useradd handles names over the traditional eight-character limit, edit /etc/default/useradd.

A UID is reserved or already in use. The operating system reserves UIDs 0 to 99. A UID in that range gets the warning UX: useradd: WARNING: uid uid is reserved. A UID that another account holds fails with UX: useradd: ERROR: uid uid is already in use. Choose another. Look for the UID with awk -F: '$3 == 150' /etc/passwd, then choose an unused UID of 100 or higher.

prodreg uninstall fails. The cause can be missing Java classes, too few permissions, or no Java on the system. Run prodreg browse to confirm the entry is still there. prodreg unregister cannot remove Solaris packages. Remove them with pkgrm, after which they no longer appear in prodreg.

An old script calls smc or smuser on Solaris 11. Those tools are no longer available. Rewrite the calls with useradd, usermod, userdel, groupadd, groupmod and groupdel.

References