Infrastructure:Deployment Guide - Revision history

Pew: Changed redirect target from Sysadmin Handbook to Infrastructure:Sysadmin Handbook

2019-01-05T05:57:34Z

Changed redirect target from Sysadmin Handbook to Infrastructure:Sysadmin Handbook

Pew: Redirected page to Sysadmin Handbook

2019-01-03T08:38:43Z

Redirected page to Sysadmin Handbook

imported>Pew at 01:13, 3 January 2018

2018-01-03T01:13:05Z

imported>Pew at 01:12, 3 January 2018

2018-01-03T01:12:54Z

imported>Pew at 08:32, 2 January 2018

2018-01-02T08:32:24Z

imported>Pew at 07:45, 2 January 2018

2018-01-02T07:45:50Z

imported>Echarlie: See also, categories

2017-08-19T05:00:43Z

imported>Echarlie: /* Networks */ some comments from deploying stuff

2017-08-19T04:54:15Z

‎Networks: some comments from deploying stuff

imported>Mhazinsk at 04:34, 19 August 2017

2017-08-19T04:34:22Z

imported>Mhazinsk: Created page with "This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19. == Networks == We ''should'' have the following networks in place: * Cyberdelia br0 on et..."

2017-08-19T04:33:40Z

Created page with "This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19. == Networks == We ''should'' have the following networks in place: * Cyberdelia br0 on et..."

New page

This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19.

== Networks ==
We ''should'' have the following networks in place:

* Cyberdelia br0 on eth4 <--> eth1 on temp88191. This is the main LUUG network.
** 10.0.0.1/22 for VTLUUG NAT
** IPv6 via NDP proxying
** Global IPv4s via ARP proxying (edit /root/scripts/router/ipv4/Nat and edit $Inside_Hosts). Gateway is 128.173.88.1/22.
* Internal VM network (10.99.0.1/24). This is useful for sharing NFS insecurely, but be aware it only works on cyberdelia. If we get more VM hosts, they won't be able to use it without network reconfiguration.
* "Internet" (a CNS portal) <--> eth0 on temp88191. LUUG only has one of these, and port security is enabled.

Most of our hosts consist of a "LUUG network" eth0 as the default route and a

DNS/DHCP:
* I think echarlie manages vtluug.org DNS?
* jkh and Roddy own ece.vt.edu. DNS updates take time to perform
* temp88191 runs DHCP and dnsmasq on eth1 (that is, 10.0.0.1/22). Edit /etc/dnsmasq.conf, add your static entries, and restart dnsmasq.

== Auth ==
* <code>apt-get -y install sssd-ldap nscd</code>
* <code>vim /etc/sssd/sssd.conf</code>
<pre>
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
debug_level = 5

[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
homedir_substring = /home

[domain/LDAP]
id_provider = ldap
auth_provider = ldap
ldap_search_base = dc=vtluug,dc=org
ldap_tls_reqcert = allow
ldap_uri = ldaps://razor.vtluug.org
</pre>

== Storage ==
* <code>apt-get -y install nfs-common</code>
* <code>vim /etc/idmap.conf</code>
<pre>
[General]

Verbosity = 0
Pipefs-Directory = /run/rpc_pipefs
# set your own domain here, if it differs from FQDN minus hostname
# Domain = localdomain
Domain = vtluug.org

[Mapping]

Nobody-User = nobody
Nobody-Group = nogroup
</pre>
* <code>vim /etc/fstab</code>
<pre>
10.99.0.1:/tank/nfs/home /home nfs soft,auto,nodev 0 0
10.99.0.1:/tank/nfs/share /tank/nfs/share nfs soft,auto,nodev,nosuid 0 0
10.99.0.1:/tank/nfs/scratch /tank/nfs/scratch nfs soft,auto,nodev,nosuid 0 0
10.99.0.1:/tank/nfs/files /tank/nfs/files nfs soft,auto,nodev,nosuid 0 0
</pre>
* <code>mkdir -p /tank/nfs/{share,scratch,files}</code>
* <code>systemctl restart sssd</code>
* <code>mount -a</code>

== Testing ==
To verify that this worked: <code>su</code> to your user, <code>cd</code>, and you should be able to modify your files.

← Older revision		Revision as of 05:57, 5 January 2019
Line 1:		Line 1:
−	#REDIRECT [[Sysadmin Handbook]]	+	#REDIRECT [[Infrastructure:Sysadmin Handbook]]

← Older revision		Revision as of 08:38, 3 January 2019
Line 1:		Line 1:
−	~~Once the wiki is unfucked, migrate this along with [[Infrastructure:Host Deployment Guide]] to~~ [[~~Infrastructure:~~Sysadmin Handbook]]	+	#REDIRECT [[Sysadmin Handbook]]
−
−	~~This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19.~~
−
−	~~== Networks ==~~
−	~~We ''should'' have the following networks in place:~~
−
−	* Cyberdelia br0 on eth4 <--> eth1 on temp88191. This is the main LUUG network.
−	** 10.0.0.1/22 for VTLUUG NAT (echarlie thinks we should only use a /24)
−	** IPv6 via NDP proxying (static hosts configured in /root/scripts/router/ipv6/setup_ipv6.sh, but things should work without)
−	** Global IPv4s via ARP proxying (edit /root/scripts/router/ipv4/Nat and edit $Inside_Hosts). Gateway is 128.173.88.1/22.
−	* Internal VM network (10.99.0.1/24). This is useful for sharing NFS insecurely, but be aware it only works on cyberdelia. If we get more VM hosts, they won't be able to use it without network reconfiguration. Several hosts also use this for LDAP
−	* "Internet" (a CNS portal) <--> eth0 on temp88191. LUUG only has one of these, and port security is probably enabled.
−
−	~~Most of our hosts consist of a "LUUG network" eth0 as the default route and an internal network for eth1.~~
−
−	~~DNS/DHCP:~~
−	* I think echarlie manages vtluug.org DNS? (It's on namecheap. we should unfuck this)
−	* jkh and Roddy own ece.vt.edu. DNS updates don't happen. echarlie can add IPv6-only records if needed to wuvt.vt.edu so we have PTRs.
−	* temp88191 runs DHCP and dnsmasq on eth1 (that is, 10.0.0.1/22). Edit /etc/dnsmasq.conf, add your static entries, and restart dnsmasq.
−
−	~~== Auth ==~~
−	* <code>apt-get -y install sssd-ldap nscd</code>
−	* <code>vim /etc/sssd/sssd.conf</code>
−	~~<pre>~~
−	~~[sssd]~~
−	~~config_file_version = 2~~
−	~~services = nss, pam~~
−	~~domains = LDAP~~
−	~~debug_level = 5~~
−
−	~~[nss]~~
−	~~filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd~~
−	~~homedir_substring = /home~~
−
−	~~[domain/LDAP]~~
−	~~id_provider = ldap~~
−	~~auth_provider = ldap~~
−	~~ldap_search_base = dc=vtluug,dc=org~~
−	~~ldap_tls_reqcert = allow~~
−	~~ldap_uri = ldaps://razor.vtluug.org~~
−	~~</pre>~~
−
−	~~== Storage ==~~
−	* <code>apt-get -y install nfs-common</code>
−	* <code>vim /etc/idmap.conf</code>
−	~~<pre>~~
−	~~[General]~~
−
−	~~Verbosity = 0~~
−	~~Pipefs-Directory = /run/rpc_pipefs~~
−	~~# set your own domain here, if it differs from FQDN minus hostname~~
−	~~# Domain = localdomain~~
−	~~Domain = vtluug.org~~
−
−	~~[Mapping]~~
−
−	~~Nobody-User = nobody~~
−	~~Nobody-Group = nogroup~~
−	~~</pre>~~
−	* <code>vim /etc/fstab</code>
−	~~<pre>~~
−	~~10.99.0.1:/tank/nfs/home /home nfs soft,auto,nodev 0 0~~
−	~~10.99.0.1:/tank/nfs/share /tank/nfs/share nfs soft,auto,nodev,nosuid 0 0~~
−	~~10.99.0.1:/tank/nfs/scratch /tank/nfs/scratch nfs soft,auto,nodev,nosuid 0 0~~
−	~~10.99.0.1:/tank/nfs/files /tank/nfs/files nfs soft,auto,nodev,nosuid 0 0~~
−	~~</pre>~~
−	* <code>mkdir -p /tank/nfs/{share,scratch,files}</code>
−	* <code>systemctl restart sssd</code>
−	* <code>mount -a</code>
−
−	~~== Testing ==~~
−	~~To verify that this worked: <code>su</code> to your user, <code>cd</code>, and you should be able to modify your files.~~
−
−	~~== See Also ==~~
−	* [[Proxy NDP]]
−	* [[Infrastructure:Cyberdelia]]
−	* [[Infrastructure:Temp88191]]
−	* [[Infrastructure 2017]]
−
−	~~[[Category:Infrastructure]]~~
−	~~[[Category:Needs restoration~~]]

← Older revision		Revision as of 01:13, 3 January 2018
Line 1:		Line 1:
−	Once the wiki is unfucked, migrate this along with [[Infrastructure:Host Deployment Guide]] to [[~~Infarstructure~~:Sysadmin Handbook]]	+	Once the wiki is unfucked, migrate this along with [[Infrastructure:Host Deployment Guide]] to [[Infrastructure:Sysadmin Handbook]]

	This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19.		This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19.

← Older revision		Revision as of 01:12, 3 January 2018
Line 1:		Line 1:
−	Once the wiki is unfucked, migrate this along with [[Infrastructure:Host Deployment Guide]]	+	Once the wiki is unfucked, migrate this along with [[Infrastructure:Host Deployment Guide]] to [[Infarstructure:Sysadmin Handbook]]
		+
	This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19.		This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19.

← Older revision		Revision as of 08:32, 2 January 2018
Line 78:		Line 78:
	* [[Infrastructure 2017]]		* [[Infrastructure 2017]]

−	[[~~category~~:Infrastructure]]	+	[[Category:Infrastructure]]
		+	[[Category:Needs restoration]]

@@ Line 1: / Line 1: @@
 This covers setup of a Debian 9 VM on cyberdelia. This is current as of 2017-08-19.
@@ Line 75: / Line 76: @@
 * [[Infrastructure:Cyberdelia]]
 * [[Infrastructure:Temp88191]]
 * [[Infrastructure 2017]]
 [[category:Infrastructure]]

← Older revision		Revision as of 05:00, 19 August 2017
Line 70:		Line 70:
	== Testing ==		== Testing ==
	To verify that this worked: <code>su</code> to your user, <code>cd</code>, and you should be able to modify your files.		To verify that this worked: <code>su</code> to your user, <code>cd</code>, and you should be able to modify your files.
		+
		+	== See Also ==
		+	* [[Proxy NDP]]
		+	* [[Infrastructure:Cyberdelia]]
		+	* [[Infrastructure:Temp88191]]
		+	* [[Infrastructure:Host Deployment Guide]] (outdated)
		+	* [[Infrastructure 2017]]
		+
		+	[[category:Infrastructure]]

@@ Line 5: / Line 5: @@
 * Cyberdelia br0 on eth4 <--> eth1 on temp88191. This is the main LUUG network.
-** 10.0.0.1/22 for VTLUUG NAT
+** 10.0.0.1/22 for VTLUUG NAT (echarlie thinks we should only use a /24)
-** IPv6 via NDP proxying
+** IPv6 via NDP proxying (static hosts configured in /root/scripts/router/ipv6/setup_ipv6.sh, but things should work without)
 ** Global IPv4s via ARP proxying (edit /root/scripts/router/ipv4/Nat and edit $Inside_Hosts). Gateway is 128.173.88.1/22.
-* Internal VM network (10.99.0.1/24). This is useful for sharing NFS insecurely, but be aware it only works on cyberdelia. If we get more VM hosts, they won't be able to use it without network reconfiguration.
+* Internal VM network (10.99.0.1/24). This is useful for sharing NFS insecurely, but be aware it only works on cyberdelia. If we get more VM hosts, they won't be able to use it without network reconfiguration. Several hosts also use this for LDAP
-* "Internet" (a CNS portal) <--> eth0 on temp88191. LUUG only has one of these, and port security is enabled.
+* "Internet" (a CNS portal) <--> eth0 on temp88191. LUUG only has one of these, and port security is probably enabled.
 Most of our hosts consist of a "LUUG network" eth0 as the default route and an internal network for eth1.
 DNS/DHCP:
-* I think echarlie manages vtluug.org DNS?
+* I think echarlie manages vtluug.org DNS? (It's on namecheap. we should unfuck this)
-* jkh and Roddy own ece.vt.edu. DNS updates take time to perform
+* jkh and Roddy own ece.vt.edu. DNS updates don't happen. echarlie can add IPv6-only records if needed to wuvt.vt.edu so we have PTRs.
 * temp88191 runs DHCP and dnsmasq on eth1 (that is, 10.0.0.1/22). Edit /etc/dnsmasq.conf, add your static entries, and restart dnsmasq.