Difference between revisions of "SAC:Standard System Setup"

From OSGeo
Jump to: navigation, search
(added selinux notes)
(Fail2ban)
 
(9 intermediate revisions by 3 users not shown)
Line 1: Line 1:
 +
This document pertains how to setup a new VM at [[OSL|OSU OSL]]. 
 +
 +
= Request a new VM =
 +
 +
A support request should be made to OSU OSL support ''after'' discussion and agreement within SAC.
 +
Details will be needed on the disk space, memory and the machine on which it should be established.  See [[SAC Service Status]] to get a sense of the machines available and what is already running on them.  The support request should be made to support at osuosl.org.
 +
 +
= Base VM =
 +
 +
New VMs are made by cloning the "Base VM", and reconfiguring the memory and disk space.  The
 +
Base VM is not normally running, but when it is it will be at base.osgeo.osuosl.org.  When policy changes are made on how the base system should be configured for all VMs, they should also be applied to this base VM.
 +
 +
= First Login =
 +
 +
New VMs will only allow root logins by [[SAC:Primary Administrators|SAC Primary Administrators]] with the correct ssh keys setup, but they should also support regular LDAP logins for anyone in the "sac" shell group with sudo access preconfigured for primary administrators.
 +
 
= Enable LDAP =  
 
= Enable LDAP =  
  
As per [[SAC:Setup LDAP Authentication]] instructions using authconfig.
+
See [[SAC:LDAP]] for information on how the OSGeo LDAP server works.  
  
Also need to update /etc/sudoers file like this:
+
By default new VMs should support login by members of the [https://www.osgeo.org/cgi-bin/auth/ldap_shell.py?group=sac "SAC" LDAP Shell] group.  Allowed groups can be changed primarily
 +
by editing the /etc/ldap/ldap.conf file and modifying the line that looks like:
  
(need to work out how to use LDAP Admin group to identify access to sudoers file)
+
  pam_groupdn cn=sac,ou=Shell,dc=osgeo,dc=org
  
= YUM Update =
+
The "cn" value can be changed to other LDAP shell groups.  Currently this includes "telascience" which is a very broad set of OSGeo folks suitable for shared project servers, or the "qgis" group used only on the qgis server now.
  
  sudo yum check-update
+
For very secure servers (like the "secure" server) we would likely want to disable LDAP access. I'm not exactly sure how to do that.
sudo yum --exclude=dlm-kernel --exclude=cman-kernel --exclude=gnbd-kernel --exclude=GFS-kernel update
+
  
= Enable auto-home-dir creation =
+
Note that proper functioning of LDAP service also depends on having the proper SSL certificates installed as described in [[SAC:SSLCert]].  Normally this should be setup on the base vm, and copied to new VMs.
  
Add the following line to /etc/pam.d/login and /etc/pam.d/sshd:
+
= Setting up Backups =
  
  session    required    pam_mkhomedir.so skel=/etc/skel umask=0022
+
... to be added ...
  
= Mount /home from NFS =  
+
= Enabling munin =
  
Add the following to /etc/fstab:
+
... to be added ...
  
  bucket:/export/home    /mnt/home              nfs    intr
+
= File System Layout =
  
Then wipe, and link /home to /mnt/home after ensuring there is nothing of value in /home.
+
We typically try to put OSGeo stuff under a /osgeo directory broken down by project or service.  
  
  mount /mnt/home
+
= Recommended Options =
  rm -rf /home
+
== Fail2ban ==
  ln -s /mnt/home /home
+
  
= Disable SELinux =
+
A tool to prevent excessive scanning for user/passwords in the system, for preventing brute force ssh logins, for catching nasty Apache requests and the like.
  
On some systems it may be desired to disable SELinux.  This
+
See [[SAC:fail2ban]]
can be accomplished by:
+
  
* Editing /etc/selinux/config and changing SELINUX=enforcing to SELINUX=disabled.
+
== Awstats ==
* execute "sudo /usr/sbin/setenforce 0"
+
See ? page on server usage tracking.
 +
[[Category:Infrastructure]]

Latest revision as of 02:25, 4 May 2016

This document pertains how to setup a new VM at OSU OSL.

Request a new VM

A support request should be made to OSU OSL support after discussion and agreement within SAC. Details will be needed on the disk space, memory and the machine on which it should be established. See SAC Service Status to get a sense of the machines available and what is already running on them. The support request should be made to support at osuosl.org.

Base VM

New VMs are made by cloning the "Base VM", and reconfiguring the memory and disk space. The Base VM is not normally running, but when it is it will be at base.osgeo.osuosl.org. When policy changes are made on how the base system should be configured for all VMs, they should also be applied to this base VM.

First Login

New VMs will only allow root logins by SAC Primary Administrators with the correct ssh keys setup, but they should also support regular LDAP logins for anyone in the "sac" shell group with sudo access preconfigured for primary administrators.

Enable LDAP

See SAC:LDAP for information on how the OSGeo LDAP server works.

By default new VMs should support login by members of the "SAC" LDAP Shell group. Allowed groups can be changed primarily by editing the /etc/ldap/ldap.conf file and modifying the line that looks like:

 pam_groupdn cn=sac,ou=Shell,dc=osgeo,dc=org

The "cn" value can be changed to other LDAP shell groups. Currently this includes "telascience" which is a very broad set of OSGeo folks suitable for shared project servers, or the "qgis" group used only on the qgis server now.

For very secure servers (like the "secure" server) we would likely want to disable LDAP access. I'm not exactly sure how to do that.

Note that proper functioning of LDAP service also depends on having the proper SSL certificates installed as described in SAC:SSLCert. Normally this should be setup on the base vm, and copied to new VMs.

Setting up Backups

... to be added ...

Enabling munin

... to be added ...

File System Layout

We typically try to put OSGeo stuff under a /osgeo directory broken down by project or service.

Recommended Options

Fail2ban

A tool to prevent excessive scanning for user/passwords in the system, for preventing brute force ssh logins, for catching nasty Apache requests and the like.

See SAC:fail2ban

Awstats

See ? page on server usage tracking.