Infrastructure

This page documents VTLUUG's infrastructure post-CVL eviction. It is intended as a scratch pad of sorts for organizing infrastructure changes, since Infrastructure:Log is incredibly out of date, and there are a lot of details which must be sorted out before major infrastructure changes can be made.

Physical Infrastructure

Cyberdelia is the only connected physical machine right now, besides our router. It contains 48 GB of memory with 4 ethernet interfaces; only eth4 is connected and is attached to br0. All hosts are on our own 1-gbit port with temp88191, a gateway featuring ARP proxying, and partial NDP proxying. For global DNS changes under ece.vt.edu, server room access, and getting hosts added to the ARP proxy, contact John Harris or Roddy Dehart.

Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move echarlie is calling Cyber Auschwitz. Contact itso-g@vt.edu for firewall exceptions. When deploying new hosts, make ssh listen on both 2222 and 22. Acidburn currently listens on 443 as well.

All other VTLUUG-owned servers are currently stored in pew's apartment, with the exception of sunway and a SuperMicro server, which were all transferred to WUVT. The list of these machines includes Wood, and a variety of other servers, including our old LXC hosts and the old mirror.

See Goals for things we plan to do in the future.

On the Network Architecture

Further Information: Infrastructure:Networking

A simple network diagram by mjh

We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.99.x.x/16 subnet and an IPv6 address assigned via SLAAC. In the future, it may be wise to bridge this network to an ethernet port on cyberdelia, so that a switch can be used to network our other services. When we have rackspace to do so, VPN/Iodine access to the internal network will be necessary.

In theory, services can be provided via a hidden service such as Tor, but that introduces other complications. Alternately, services can require use of the VPN on acidburn, Iodine, or ssh tunnelling, although all of these limit usage to members with a shell account. All of these have the benefit of NAT transversal, however.

Services

• Acidburn
  • Shell server
  • Email
  • Wadsworth
• Razor
  • LDAP
• Sczi
  • Website
    • Wiki
    • Main Page
    • linx
    • vtbash
• Cyberdelia
  • All the above services
  • VMs for projects
  • Tank
    • NFS

Acidburn and the website must be accessible through real services, and it is preferable that Cyberdelia is too. This means we must use our public IPv4 Addresses allotted by ECE.

Website details

Current Setup

All vtluug websites are run on nginx on sczi. These sites are currently functional:

• gobblerpedia.org
• hokieprivacy.org
• linx.vtluug.org
• vtluug.org
• wiki.vtluug.org (this redirects to vtluug.org/wiki/)
• bash.vtluug.org

All of these sites exclusively allow for the use of TLS connections. All services use automatically updated letsencrypt certs.

Main Page

The main VTLUUG page was scraped from the Internet Archive and added created as a github page at vtluug.github.io, and is reverse-proxied through sczi.

Wiki

The wiki currently runs fully on MediaWiki hosted on nginx. Postgres is used for the database and authentication is through LDAP. MediaWiki is running the current stable version as of March 2017, courtesy hard work by pew.

Gobblerpedia

Runs on the same Mediawiki instance as this wiki, with its schema in the same Postgres database. Currently, you can auth with LDAP, pre-existing accounts, or a Google account in the VT hosted domain.

Linx

Uses aam's linx, and is an identical implementation to his site linx.li. One of the few sites with a complete startup script. The maintenance is currently the responsibility of aam, however this is subject to change, pending his retaining root access on sczi.

Needs Restoration

These are VTLUUG services that haven't yet been properly restored:

• foodfor.vtluug.org - For Wadsworth's .pickfood and .foodvote commands. This is jpo's fault.
• tahoe.vtluug.org - mhazinsk's Tahoe-LAFS grid
• git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
• gitweb.vtluug.org - git hosting; previously gitweb
• map.vtluug.org - OSM (gobblerpedia still relies on this)
• users.vtluug.org - member hosting of acidburn home directories

PostgreSQL tables exist on milton for foodforus, jandc, mediawiki, mewsblu, sharedwiki, uniluug, vtluug_wiki, and wargame_bbs. More research is necessary to determine what these are for. There are also a collection of mySQL databases on milton which may be desirable to archive and store.

Historically

See Infrastructure:Deprecated_Infrastructure#Web_Services for historic information

Goals

See Goals#Web_Services for future goals involving web services

Addressing

VTLUUG currently has DNS with namecheap, however all domains have been re-registered with gandi under vtluug's own account, to replace the mixture of mutantmonkey-holdings and vtluug-held domains on multiple different registrars.

We currently hold the IPv6 prefix 2001:470:8:6d9::/64 from HE's allocation due to our tunnel. When CNS finally sets up prefix-delegation, we might be able to get something from 2607:b400::/32, which is VT's largest allocation.

IF YOU CHANGE/ADD/REMOVE SOMETHING HERE CHANGE IT IN Inventory AND/OR Deprecated_Inventory TOO

This page describes specifics about VTLUUG's current network. For an overview, see Infrastructure:Networking

Addresses

ECE DNS	VTLUUG DNS	IPv4	Private Internal IPv4	IPv6
luug.ece.vt.edu	sczi.vtluug.org	128.173.88.78	10.98.0.11	2607:b400:6:cc80:0:aff:fe62:b
luug0.ece.vt.edu	dirtycow.vtluug.org	128.173.89.244	10.98.0.7	2607:b400:6:cc80:21e:c9ff:feef:13f8
luug1.ece.vt.edu	acidburn.vtluug.org	128.173.89.245	10.98.0.12	2607:b400:6:cc80:0:aff:fe62:c
luug2.ece.vt.edu	meltdown.vtluug.org	128.173.89.246	10.98.0.3	2607:b400:6:cc80:0:aff:fe62:3
luug3.ece.vt.edu	chimera.vtluug.org	128.173.89.247	10.98.0.10	2607:b400:6:cc80:0:aff:fe62:a
luug4.ece.vt.edu	mjh.ece.vt.edu	128.173.88.104	10.98.0.254	2607:b400:0006:cc80:0230:48ff:fe7e:28da
luug5.ece.vt.edu	router.vtluug.org	128.173.88.191	10.98.0.1	2001:468:c80:6103:211:43ff:fe30:a72
N/A	nikonwormhole.vtluug.org	128.173.88.135	10.98.0.21	2607:b400:6:cc80:0:aff:fe62:e
mirror.ece.vt.edu	N/A *Not sure if we can actually use this IP*	128.173.88.82	N/A	N/A
N/A	switch.private.vtluug.org (Internal v4 only)	N/A	10.98.0.2	N/A
N/A	spectre.vtluug.org	N/A	10.98.0.4	2607:b400:6:cc80:0:aff:fe62:4
N/A	cyberdelia.vtluug.org	N/A	10.98.0.6	2607:b400:0006:cc80:0215:17ff:fe12:7670
N/A	shellshock.vtluug.org	N/A	10.98.0.8	2607:b400:6:cc80:215:17ff:fe12:7670

See Deprecated_Network for historical information.

VTLUUG

Addresses

IPv6

• SLAAC on 2607:b400:0006:cc80::/64

IPv4

• 10.98.0.0/16: internal NAT
  • Static IPs: 10.98.0.0/24
  • DHCP: 10.98.1.0 - 10.98.1.150
  • Iodine: 10.98.10.0/24
• 128.173.88.1/22: publicly accessible hosts

All hosts have an internal address (static or DHCP) and some hosts also have a globally accessible address.

DNS

Shellshock also functions as DNS server for internal hosts

• 10.99.0.1
• 2607:b400:0006:cc80::1

VT's DNS

CNS maintains a few DNS servers on campus

• yardbird.cns.vt.edu, 2001:468:c80:2101:0:100:0:22, 198.82.247.34
• jeru.cns.vt.edu, 2001:468:c80:4101:0:100:0:42, 198.82.247.66
• milo.cns.vt.edu, 2001:468:c80:6101:0:100:0:62, 198.82.247.98

See Also

• Contact Brandon Russell to get authoritative DNS entries added for *.ece.vt.edu
• network liasions