Difference between revisions of "SAC:Standard System Setup"
| Line 29: | Line 29: | ||
Note that proper functioning of LDAP service also depends on having the proper SSL certificates installed as described in [[SAC:SSLCert]]. Normally this should be setup on the base vm, and copied to new VMs. | Note that proper functioning of LDAP service also depends on having the proper SSL certificates installed as described in [[SAC:SSLCert]]. Normally this should be setup on the base vm, and copied to new VMs. | ||
| + | |||
| + | = Setting up Backups = | ||
| + | |||
| + | ... to be added ... | ||
| + | |||
| + | = Enabling munin = | ||
| + | |||
| + | ... to be added ... | ||
| + | |||
| + | = File System Layout = | ||
| + | |||
| + | We typically try to put OSGeo stuff under a /osgeo directory broken down by project or service. | ||
| + | |||
[[Category:Infrastructure]] | [[Category:Infrastructure]] | ||
Revision as of 21:27, 27 September 2011
This document pertains how to setup a new VM at OSU OSL.
Request a new VM
A support request should be made to OSU OSL support *after* discussion and agreement within SAC. Details will be needed on the disk space, memory and the machine on which it should be established. See SAC Service Status to get a sense of the machines available and what is already running on them. The support request should be made to support at osuosl.org.
Base VM
New VMs are made by cloning the "Base VM", and reconfiguring the memory and disk space. The Base VM is not normally running, but when it is it will be at base.osgeo.osuosl.org. When policy changes are made on how the base system should be configured for all VMs, they should also be applied to this base VM.
First Login
New VMs will only allow root logins by SAC Primary Administrators with the correct ssh keys setup, but they should also support regular LDAP logins for anyone in the "sac" shell group with sudo access preconfigured for primary administrators.
Enable LDAP
See SAC:LDAP for information on how the OSGeo LDAP server works.
By default new VMs should support login by members of the "SAC" LDAP Shell group. Allowed groups can be changed primarily by editing the /etc/ldap/ldap.conf file and modifying the line that looks like:
pam_groupdn cn=sac,ou=Shell,dc=osgeo,dc=org
The "cn" value can be changed to other LDAP shell groups. Currently this includes "telascience" which is a very broad set of OSGeo folks suitable for shared project servers, or the "qgis" group used only on the qgis server now.
For very secure servers (like the "secure" server) we would likely want to disable LDAP access. I'm not exactly sure how to do that.
Note that proper functioning of LDAP service also depends on having the proper SSL certificates installed as described in SAC:SSLCert. Normally this should be setup on the base vm, and copied to new VMs.
Setting up Backups
... to be added ...
Enabling munin
... to be added ...
File System Layout
We typically try to put OSGeo stuff under a /osgeo directory broken down by project or service.