Difference between revisions of "Infrastructure"

From the Linux and Unix Users Group at Virginia Teck Wiki
Jump to: navigation, search
imported>Echarlie
(→‎Addressing)
 
(77 intermediate revisions by 5 users not shown)
Line 1: Line 1:
−
This page documents VTLUUG's infrastructure post-[[CVL eviction]]. It is intended as a scratch pad of
+
This page documents VTLUUG's infrastructure post-[[CVL eviction]].
−
sorts for organizing infrastructure changes, since [[Infrastructure:Log]] is incredibly out of date, and
 
−
there are a lot of details which must be sorted out before major infrastructure changes can be made.
 
  
 
== Physical Infrastructure ==
 
== Physical Infrastructure ==
−
''Main Article [[Infrastructure:Cyberdelia]], [[VTLUUG:Inventory]]''
+
=== NFS Hosts ===
 +
* [[Infrastructure:Dirtycow|dirtycow]] - Primary NFS server, 8x2TB raidz2 array
 +
* [[Infrastructure:Cyberdelia|cyberdelia]] - OFF, 7x1TB raidz2 array, sitting on shelf instead of shelf
  
−
[[Infrastructure:Cyberdelia|Cyberdelia]] is the only connected physical machine right now. It contains 48 GB of memory
+
=== VM Hosts ===
−
with 4 ethernet interfaces; only eth4 is connected and is attached to br0. All hosts are on the ECE network behind
+
* [[Infrastructure:Meltdown|meltdown]] - Primary VM/docker host
−
router.ece.vt.edu, a gateway featuring ARP proxying but no IPv6. For global DNS changes under ece.vt.edu, server
+
* [[Infrastructure:Spectre|spectre]] - Secondary VM/docker host, for example user VMs
−
room access, and getting hosts added to the ARP proxy, contact [mailto:rbrand7@vt.edu Brandon Russell]
+
 
 +
=== Router ===
 +
* [[Infrastructure:Shellshock|shellshock]] - 3 disk RAID1 array
 +
 
 +
All hosts are on our own 1 Gb/s port with [[Infrastructure:Shellshock|shellshock]], a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix.
  
 
Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move
 
Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move
−
some <!--[Who?]--> are calling [[gp:Cyber Auschwitz|Cyber Auschwitz]]. Contact itso-g@vt.edu for firewall exceptions.
+
[[User:echarlie|echarlie]] is calling [[gp:Cyber Auschwitz|Cyber Auschwitz]]. Contact itso-g@vt.edu for firewall exceptions.
−
When deploying new hosts, make ssh listen on both 2222 and 22. Acidburn currently listens on 443 as well.
+
When deploying new hosts, make ssh listen on both 2222 and 22. [[Infrastructure:Acidburn|Acidburn]] currently listens on 3128 as well.
  
−
Most other VTLUUG-owned servers are currently stored in [[user:dsetareh|Ali]]'s basement, with the exception of [[infrastructure:sunway|sunway]]
+
=== Other hosts ===
−
and a SuperMicro server, which were all transferred to WUVT. The list of these machines includes [[Infrastructure:Wood|Wood]],
+
* [[Infrastructure:Joey|joey]] used to be the router, but is no longer in use due to a failure of the single drive
−
[[Infrastructure:Temp88191|our router]], and a variety of other servers, including our old LXC hosts, the mirror, and a DEC Alpha server.
+
* [[Infrastructure:Wood|Wood]] is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs.
 +
* [[Infrastructure:Sunway|sunway]] and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members.
  
−
Some goals for once we get rackspace:
+
See [[VTLUUG:Strategic_plan]] for things we plan to do in the future.
−
* Acquire new servers
 
−
** Phase out older infrastructure
 
−
** Rebuild most existing servers, to clear out old accounts, old passwords, etc.
 
−
*** Assume that machines with installs which predate the current sysadmin are pwned
 
−
* Expand Tank on [[Infrastructure:Cyberdelia|cyberdelia]], as it is nearing full
 
−
** Current array is seven 1TB drives in a zraid array, equivalent to [[w:RAID#RAID 6|RAID 6]].
 
−
** Do we want to buy disks to replace the current ones, to expand the array all at once, or deploy a new array in a new machine?
 
−
* Provide an LXC host (preferably on physical hardware)
 
−
** <code>joey</code> is still functional ([[User:echarlie|echarlie]] recently reinstalled). <code>phantomphreak</code> still needs a new HDD.
 
−
* Acquire an IPv6 prefix delegation, and either an IPv6 tunnel or something else
 
−
** Currently have this with HE
 
−
* Build a [[w:darknet|darknet]] for fail-over from the main network; perhaps run two OpenBSD boxes in [[w:Common Address Redundancy Protocol|CARP]].
 
−
* Relaunch and expand mirror.cc.vt.edu, ideally with redundancy.
 
  
 
== On the Network Architecture ==
 
== On the Network Architecture ==
−
''Further Information: [[Infrastructure:Networking]]''
+
''Further Information: [[Infrastructure:Networking]] and [[Infrastructure:Network]]''
 +
 
 +
[[File:Infra2019-network.png|thumb|500px|A simple network diagram by [[user:pew|pew]]. '''Update June 2021: Joey is dead, long live Joey. Shellshock is the new router. Cyberdelia is off.]]
  
−
[[File:Infra2016-network.png|thumb|500px|A simple network diagram by [[user:mjh|mjh]]]]
 
  
−
Because VTLUUG infra no longer has IPv6 access, we are limited by the IP addresses assigned to us, and what we
+
We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.98.x.x/16 subnet and an IPv6 address assigned via SLAAC.
−
can get through DHCP from ECE. As a consequence, all services which do not need to have a global IP should move
+
In the future, [[Infrastructure:IPsec|VPN]]/[[Iodine]] should be used.
−
to the internal network on the 10.99.x.x/16 subnet. In the future, it may be wise to bridge this network to an
 
−
ethernet port on cyberdelia, so that a switch can be used to network our other services. When we have rackspace
 
−
to do so, [[Infrastructure:IPsec|VPN]]/[[Iodine]] access to the internal network will be necessary.
 
  
−
In theory, services can be provided via a hidden service (read: [[Tor]]), but that introduces other complications.
+
In theory, services can be provided via a hidden service such as [[w:Tor|Tor]], but that introduces other complications.
−
Alternately, services can require use of the [[Infrastructure:IPsec|VPN]] on [[Infrastructure:acidburn|acidburn]],
+
Alternately, services can require use of the [[Infrastructure:IPsec|VPN]] on [[Infrastructure:Acidburn|acidburn]],
 
[[Iodine]], or [[Secure Shell|ssh tunnelling]], although all of these limit usage to members with a shell account.
 
[[Iodine]], or [[Secure Shell|ssh tunnelling]], although all of these limit usage to members with a shell account.
 
All of these have the benefit of NAT transversal, however.
 
All of these have the benefit of NAT transversal, however.
  
 
== Services ==
 
== Services ==
 +
''Further information: [[:Category:Services]]''
  
−
=== Critical ===
+
* [[Infrastructure:Acidburn|acidburn]]
−
 
 
−
* [[Infrastructure:Acidburn|Acidburn]]
 
 
** Shell server
 
** Shell server
 
** [[Email]]
 
** [[Email]]
 
** [[Wadsworth]]
 
** [[Wadsworth]]
−
* [[Infrastructure:Razor|Razor]]
+
** [[Iodine]]
−
** LDAP
+
* [[Infrastructure:Chimera|chimera]]
−
* [[Infrastructure:Milton|Milton]]/[[Infrastructure:Sczi|Sczi]]
+
** FreeIPA
 +
* [[Infrastructure:Sczi|Sczi]]
 
** Website
 
** Website
−
*** Wiki
+
*** [https://hokieprivacy.org hokieprivacy]
−
*** Main Page
+
*** [https://bash.vtluug.org vtbash]
−
*** snapfeed
+
*** [https://vtluug.org Main Site]
−
*** linx
+
*** This wiki and [[gp:Main Page|Gobblerpedia]]
−
*** public file shares
+
*** dex, for authing with the wikis
−
** git
+
*** https://vtluug.org/users/~$user - User homepages
−
* [[Infrastructure:Cyberdelia|Cyberdelia]]
+
*** [https://search.vtluug.org 4get] a metasearch engine
−
** All the above services
+
*** [https://git.vtluug.org Gitea] a Github-esque git server with dex/LUUG OpenID auth
−
** VMs for projects
+
*** [https://element.vtluug.org element], a Matrix client
−
** other services
+
* [[Infrastructure:Nikonwormhole|nikonwormhole]]
−
** Tank
+
** AdGuard DNS blackhole
−
*** NFS
+
* [[Infrastructure:Dirtycow|dirtycow]]
−
*** milton_srv (website files)
+
** Storage for all primary services
 +
** NFS - ZFS pool name is cistern
 +
* [[Infrastructure:Meltdown|meltdown]]
 +
** VM host for above services
  
−
[[Infrastructure:Acidburn|Acidburn]] and the website ''must'' be accessible through real services, and it is preferable that [[Infrastructure:Cyberdelia|Cyberdelia]] is too. This means we must use our public IPv4 Addresses allotted by ECE.
+
[[Infrastructure:Acidburn|acidburn]] and the website ''must'' be accessible through real services, and it is preferable other hosts are too. This means we must use our public IPv4 & IPv6 Addresses allotted by ECE.
−
 
 
−
=== Other (not all functional) ===
 
−
* [[Tahoe-LAFS]]
 
−
** Should be on hidden service.
 
−
* Jitsi Meet
 
−
** Should be public
 
−
* User websites
 
−
** Hosted on [[Infrastructure:Milton|Milton]]/[[Infrastructure:Sczi|Sczi]], so will be public
 
−
** Of course, domain owners have to set up their DNS correctly.
 
−
* Diaspora*
 
−
** use of public or hidden service doesn't matter, assuming it ''can'' be run as a [https://groups.google.com/forum/#!topic/diaspora-discuss/mhAOXarEJuc hidden service].
 
−
* [[Iodine]]
 
−
** On acidburn. Relies on Acidburn being listed as NS for <code>iod.vtluug.org</code>
 
−
* [[Infrastructure:IPsec|IPsec Tunnel]]
 
−
** On acidburn
 
  
 
== Website details ==
 
== Website details ==
−
''Main article: [[Infrastructure:Milton]], [[Infrastructure:Sczi]]''
 
 
=== Current Setup ===
 
=== Current Setup ===
−
 
+
All vtluug websites are run on nginx on [[Infrastructure:Sczi|sczi]]. These sites are currently functional:
−
All vtluug websites are run on nginx on milton. These sites are currently functional:
 
 
* gobblerpedia.org
 
* gobblerpedia.org
 
* hokieprivacy.org
 
* hokieprivacy.org
−
* linx.vtluug.org
 
 
* vtluug.org
 
* vtluug.org
−
* wiki.vtluug.org (this redirects to vtluug.org/wiki/)
+
* wiki.vtluug.org (redirects to vtluug.org/wiki/)
−
 
+
* bash.vtluug.org
−
All of these sites exclusively allow for the use of TLS connections. Hokie Privacy has a cert from letsencrypt,
+
* vtluug.org/users/~$user
−
while all other services are verified by StartCom.
 
  
−
Currently, milton has '''no startup script''' for the website. If things go down, someone has to run
+
All of these sites exclusively allow for the use of TLS connections. All services use automatically updated
−
<pre>root@milton:/srv/http/vtluug.org# sudo -u www-data uwsgi --yaml uwsgi.yml</pre>
+
letsencrypt certs.
−
in a tmux session, to restart [https://uwsgi-docs.readthedocs.org/en/latest/ uWSGI]. It is also
 
−
unlikely that nginx will start properly because of weird dependencies on uWSGI, though it can be started with
 
−
<pre># /etc/init.d/nginx restart</pre>
 
  
 
==== Main Page ====
 
==== Main Page ====
−
The main VTLUUG page has a lot of cruft from lack of maintenance. There is a non-functional drupal
+
The main VTLUUG page was scraped from the [[w:Internet Archive|Internet Archive]] and added created as a github page at
−
backend, the wsgi apps that do nothing more than reload from the git repo for the site, and some
+
[https://vtluug.github.io vtluug.github.io], and is reverse-proxied through [[Infrastructure:Sczi|sczi]].
−
django serving little-to-no content.
 
−
 
 
−
It currently appears that the main vtluug page (mostly written in php), is or was managed from
 
−
[https://vtluug.org/atrium Drupal] as a backend, but for that to function, mysql needs to be running.
 
−
uWSGI, django, and PHP appear make up most of the important features of the website in unknown ways.
 
−
 
 
−
In short, [[user:echarlie|echarlie]] doesn't want to try to maintain what is in place, but would rather
 
−
start from scratch and the existing HTML for the website.
 
−
 
 
−
The site currently runs on milton, but is reverse-proxied through sczi for TLSv1.2 support.
 
  
 
==== Wiki ====
 
==== Wiki ====
−
 
+
The wiki currently runs fully on MediaWiki hosted on nginx using a [https://github.com/vtluug/mediawiki-docker modified version of the official mediawiki docker image]. You can auth with the admin account, [[User:wiki-admin|wiki-admin]] or a Google account. See note on [[Main_page]] about why LDAP isn't working yet.
−
The wiki currently runs fully on MediaWiki hosted on nginx (as opposed to the default include of apache2,
 
−
demanded by the Debian package). Postgres is used for the database management, AFAIK, and authentication
 
−
is through LDAP. MediaWiki is a dated git version from the stablerepository, as of March 2016, however
 
−
updating is more complicated than a git pull. [[user:echarlie|echarlie]] ran a database update in mid-March.
 
−
 
 
−
The wiki currently runs on milton, but is reverse-proxied through sczi for TLSv1.2 support.
 
  
 
===== Gobblerpedia =====
 
===== Gobblerpedia =====
 +
Runs on the same Mediawiki instance as this wiki. Similarly to LUUGWiki, only Google accounts or the admin user are supported logins.
  
−
All but disabled currently, due to spam. Runs on MediaWiki on milton.
+
=== Needs Restoration ===
−
 
 
−
==== Linx ====
 
−
 
 
−
Uses [[User:andreim|aam]]'s [https://github.com/andreimarcu/linx-server linx], and is an identical implementation to his site
 
−
[https://linx.li linx.li]. One of the few sites with a complete startup script. The maintenance is currently the responsibility
 
−
of aam, however this is subject to change, pending his retaining root access on sczi.
 
−
 
 
−
Runs on sczi.
 
−
 
 
−
=== Historically ===
 
−
 
 
−
Beyond these, we have data and nginx configurations for these (deprecated) sites, which
 
−
were previously hosted on milton:
 
−
 
 
−
==== Needs Restoration ====
 
 
These are VTLUUG services that haven't yet been properly restored:
 
These are VTLUUG services that haven't yet been properly restored:
−
* foodfor.vtluug.org - For [[Wadsworth]]'s .pickfood and .foodvote commands. This is [[User:Timelord|jpo's]] fault.
+
* [https://github.com/mutantmonkey/foodforus foodfor.vtluug.org] - For [[Wadsworth]]'s .pickfood and .foodvote commands. This is [[User:Timelord|jpo's]] fault.
 
* tahoe.vtluug.org - [[user:mjh|mhazinsk's]] Tahoe-LAFS grid
 
* tahoe.vtluug.org - [[user:mjh|mhazinsk's]] Tahoe-LAFS grid
 
* git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
 
* git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
 
* gitweb.vtluug.org - git hosting; previously gitweb
 
* gitweb.vtluug.org - git hosting; previously gitweb
−
* map.vtluug.org - [[Openstreetmap|OSM]]
+
* [https://github.com/vtluug/campusmap map.vtluug.org] - [[Openstreetmap|OSM]] based map of VT
−
* vtbash.org - VT QDB
 
−
* users.vtluug.org - member hosting of acidburn home directories
 
  
−
==== Deprecated ====
+
=== Historically ===
−
These are no longer needed but we should preserve the data/config:
 
−
* ccdc.vtluug.org - website used for the [[Collegiate Cyber Defense Competition]] in the spring of 2011.
 
−
* nagios.vtluug.org - was used for monitoring for a period but not kept up-to-date; the primary issue was that infrastructure, being hosted on the same server, tended to fail all at once
 
−
* uniluug.org - deprecated project [[uniluug]]
 
−
* security.ece.vt.edu - REDACTED
 
−
* wargame.vtluug.org - vtluug's wargame pre-vtcsec
 
−
* munin.vtluug.org - former attempt at monitoring
 
−
* webchat.vtluug.org - channel webchat; version of the service still runs on the vtluug website as an embeded frame from freenode's website. This should be disabled.
 
−
* cdn.vtluug.org - member website
 
−
* randynance.info - member website
 
−
* jessicaandchristopher.net - member website
 
−
* vtcybersecurity.org - member website from pre-csec days
 
  
−
Prior to the current site, which was written in Python using Django starting in 2010 and deployed in 2011, the VTLUUG website was a
+
See [[Dead_projects]] for historic information
−
WordPress instance. The files for this still exist. Much of the original django deployment was highly dynamic, with an identi.ca
 
−
feed, automatic calendar updates, and other features.
 
  
−
Additional files and configuration data exist for multiple versions of dokuwiki and mediawiki. There are also files for a NewsBlur installation which was never functional, and "bitcoin," the purpose of which is unknown.
+
=== Goals ===
−
 
+
See [[VTLUUG:Strategic_plan#Web_Services]] for future goals involving web services
−
A static version of vtbash.org is hosted at [https://vtluug.org/bash/index.html https://vtluug.org/bash/index.html].
 
−
 
 
−
Until recently, VTLUUG ran a Gopher server on Milton, with a small welcome page and access to /files. Git hosting was also provided; authenticated access was over SSH with [https://github.com/tv42/gitosis gitosis] and public access was via Gitweb and the insecure Git protocol.
 
−
 
 
−
vtluug.org/public/$user/ was previously a source directory of files placed in a user's $HOME/public directory on NFS.
 
−
<!--When? I thought it was always users.vtluug.org? -- I don't think it matters. the point is that this ''was'' a feature-->
 
−
 
 
−
VTLUUG members also ran '''mirror.ece.vt.edu''', although it was never an official VTLUUG project. The IPv4 allocation for this domain is still available.
 
−
 
 
−
PostgreSQL tables exist on milton for foodforus, jandc, mediawiki, mewsblu, sharedwiki, uniluug, vtluug_wiki, and wargame_bbs. More
 
−
research is necessary to determine what these are for. There are also a collection of mySQL databases on milton which may
 
−
be desirable to archive and store.
 
−
 
 
−
=== Considerations for the future ===
 
−
 
 
−
It would be preferable to keep all existing sites functional. [[user:andreim|Aam]] suggested the use of [https://caddyserver.com/ caddy]
 
−
to replace nginx, especially on static sites, because it provides automatic letsencrypt. Most likely, this will not be used, though,
 
−
in favour of manually configuring letsencrypt (because caddy is not in the repositories).
 
−
 
 
−
It is also important to ensure there are '''startup scripts''' for sczi, so that a reboot of it doesn't result in a 10-hour website outage.
 
−
 
 
−
==== TLS Encryption ====
 
−
All sites should move to automatic letsencrypt certificates within the next few months. letsencrypt is still in beta, but it provides fully functional
 
−
and low-hassle 3-month certificates. They will have integration for nginx soon, which will decrease the complexity of getting certs.
 
−
 
 
−
The version of OpenSSL on milton does not support TLSv1.1 or TLSv1.2
 
−
 
 
−
It may also be of interest to the club to revive [[monkeysphere]] signing on the servers.
 
−
 
 
−
==== Project Hosting ====
 
−
 
 
−
Most vtluug internal projects (e.g. HokiePrivacy) are currently hosted on git repositories on milton. How to move forwards with these is still
 
−
indeterminate.
 
−
 
 
−
For public hosting, there has been some conversation about using [https://github.com/gogits/gogs Go Git Service (gogs)], for public,
 
−
www-viewable git repositories.
 
−
 
 
−
==== Gobblerpedia ====
 
−
 
 
−
[[gp:Main page|Gobblerpedia]] is effectively non-functional because account creation was disabled to
 
−
prevent spam. This needs to be addressed by adding captchas which are Blacksburg-specific, limiting
 
−
account creation access to local IP addresses, '''or''' enabling some form of LUUG-managed account
 
−
creation. One suggestion was using CAS/Login services to authenticate, however that makes it difficult
 
−
for Blacksburg residents to add content, and has other disadvantages.
 
−
 
 
−
==== VTLUUG Main Page ====
 
−
 
 
−
This needs to be kept up-to-date, and have some way of adding calendar information. [[user:Echarlie|echarlie]]
 
−
would like a simple static site with some clean CSS, to avoid the clusterf*ck that is re-enabling uwsgi at the
 
−
current time.
 
−
 
 
−
==== VTLUUG Wiki ====
 
−
 
 
−
Meeting creation script needs to be re-implemented.
 
  
 
== Addressing ==
 
== Addressing ==
−
''Main article: [[Infrastructure:Network]]''
+
VTLUUG currently has DNS with gandi.net. Message officers for access (please don't be scared :D).
−
 
 
−
VTLUUG currently has DNS with namecheap, however all domains have been re-registered with gandi under
 
−
vtluug's own account, to replace the mixture of mutantmonkey-holdings and vtluug-held domains on multiple
 
−
different registrars.
 
  
 
We currently hold the IPv6 prefix <code>2001:470:8:6d9::/64</code> from HE's allocation due to our tunnel.
 
We currently hold the IPv6 prefix <code>2001:470:8:6d9::/64</code> from HE's allocation due to our tunnel.
Line 249: Line 116:
 
which is VT's largest allocation.
 
which is VT's largest allocation.
  
−
An important limitation of the HE tunnel is that they block port 25 by default.
+
{{:Infrastructure:Network}}
−
 
 
−
https://linx.vtluug.org/ips1.txt
 
−
 
 
−
{| class="wikitable"
 
−
!globally addressable
 
−
!ECE DNS
 
−
!Name
 
−
!fucntion
 
−
!internal address
 
−
|-
 
−
| 128.173.88.78
 
−
| luug.ece.vt.edu.
 
−
| [[Infrastructure:sczi|sczi]]
 
−
| New webserver
 
−
| <!--10.99.0.27??--> 10.99.0.150 (Currently DHCP)
 
−
|-
 
−
| 128.173.89.244
 
−
| luug0.ece.vt.edu
 
−
| [[Infrastructure:cyberdelia|cyberdelia]]
 
−
| VM Host
 
−
| 10.99.0.1
 
−
|-
 
−
|128.173.89.245
 
−
| luug1.ece.vt.edu.     
 
−
| [[Infrastructure:acidburn|acidburn]]
 
−
| shell server. Also has MX record for vtluug.org and NS for iod.vtluug.org
 
−
| 10.99.0.4
 
−
|-
 
−
| 128.173.89.246
 
−
| luug2.ece.vt.edu.
 
−
| [[Infrastructure:milton|milton]]
 
−
| Old webserver
 
−
| 10.99.0.2
 
−
|-
 
−
| 128.173.89.247
 
−
| luug3.ece.vt.edu.
 
−
| [[Infrastructure:razor|razor]]
 
−
| LDAP
 
−
| 10.99.0.15
 
−
|-
 
−
| 128.173.88.104
 
−
| luug4.ece.vt.edu
 
−
| pfsense
 
−
| HE tunnel runs through here
 
−
| 10.99.0.104
 
−
|-
 
−
| 128.173.88.36
 
−
| mirror.ece.vt.edu.
 
−
| mirror
 
−
| not in use
 
−
|
 
−
|-
 
−
| 128.173.88.191
 
−
| luug5.ece.vt.edu.
 
−
| [[Infrastructure:Temp88191|router]]
 
−
| not in use
 
−
|
 
−
|-
 
−
|None
 
−
| 172.16.10.13
 
−
| archiveteam-warrior
 
−
| [http://archiveteam.org/index.php?title=ArchiveTeam_Warrior Archive Team Warrior]
 
−
|
 
−
|}
 
−
 
 
−
== Deprecated IPs ==
 
−
IPs we were using at some point (by reclaiming CVL IPs, etc), or are mentioned in /etc/exports on Cyberdelia
 
−
* 128.173.88.161 (security.ece.vt.edu) - was once milton's IP until luug IPs got routed behind router.ece.vt.edu.
 
−
* 128.173.88.145 (cvl05.ece.vt.edu) - was once snapfeed's IP, reclaimed by bmckagen.
 
−
* 128.173.88.131 (dog.ece.vt.edu) - we have a Sun box labeled "dog.ece.vt.edu" but the IP appears to be in use now for VMware ESXi. It can be arped from cyberdelia.
 
−
 
 
  
 
[[Category:Infrastructure]]
 
[[Category:Infrastructure]]
 
[[Category:VTLUUG:Projects]]
 
[[Category:VTLUUG:Projects]]
−
[[Category:2016]]
 
 
[[Category:Featured content]]
 
[[Category:Featured content]]

Latest revision as of 20:41, 5 November 2024

This page documents VTLUUG's infrastructure post-CVL eviction.

Physical Infrastructure

NFS Hosts

  • dirtycow - Primary NFS server, 8x2TB raidz2 array
  • cyberdelia - OFF, 7x1TB raidz2 array, sitting on shelf instead of shelf

VM Hosts

  • meltdown - Primary VM/docker host
  • spectre - Secondary VM/docker host, for example user VMs

Router

All hosts are on our own 1 Gb/s port with shellshock, a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix.

Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move echarlie is calling Cyber Auschwitz. Contact itso-g@vt.edu for firewall exceptions. When deploying new hosts, make ssh listen on both 2222 and 22. Acidburn currently listens on 3128 as well.

Other hosts

  • joey used to be the router, but is no longer in use due to a failure of the single drive
  • Wood is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs.
  • sunway and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members.

See VTLUUG:Strategic_plan for things we plan to do in the future.

On the Network Architecture

Further Information: Infrastructure:Networking and Infrastructure:Network

A simple network diagram by pew. Update June 2021: Joey is dead, long live Joey. Shellshock is the new router. Cyberdelia is off.


We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.98.x.x/16 subnet and an IPv6 address assigned via SLAAC. In the future, VPN/Iodine should be used.

In theory, services can be provided via a hidden service such as Tor, but that introduces other complications. Alternately, services can require use of the VPN on acidburn, Iodine, or ssh tunnelling, although all of these limit usage to members with a shell account. All of these have the benefit of NAT transversal, however.

Services

Further information: Category:Services

acidburn and the website must be accessible through real services, and it is preferable other hosts are too. This means we must use our public IPv4 & IPv6 Addresses allotted by ECE.

Website details

Current Setup

All vtluug websites are run on nginx on sczi. These sites are currently functional:

  • gobblerpedia.org
  • hokieprivacy.org
  • vtluug.org
  • wiki.vtluug.org (redirects to vtluug.org/wiki/)
  • bash.vtluug.org
  • vtluug.org/users/~$user

All of these sites exclusively allow for the use of TLS connections. All services use automatically updated letsencrypt certs.

Main Page

The main VTLUUG page was scraped from the Internet Archive and added created as a github page at vtluug.github.io, and is reverse-proxied through sczi.

Wiki

The wiki currently runs fully on MediaWiki hosted on nginx using a modified version of the official mediawiki docker image. You can auth with the admin account, wiki-admin or a Google account. See note on Main_page about why LDAP isn't working yet.

Gobblerpedia

Runs on the same Mediawiki instance as this wiki. Similarly to LUUGWiki, only Google accounts or the admin user are supported logins.

Needs Restoration

These are VTLUUG services that haven't yet been properly restored:

  • foodfor.vtluug.org - For Wadsworth's .pickfood and .foodvote commands. This is jpo's fault.
  • tahoe.vtluug.org - mhazinsk's Tahoe-LAFS grid
  • git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
  • gitweb.vtluug.org - git hosting; previously gitweb
  • map.vtluug.org - OSM based map of VT

Historically

See Dead_projects for historic information

Goals

See VTLUUG:Strategic_plan#Web_Services for future goals involving web services

Addressing

VTLUUG currently has DNS with gandi.net. Message officers for access (please don't be scared :D).

We currently hold the IPv6 prefix 2001:470:8:6d9::/64 from HE's allocation due to our tunnel. When CNS finally sets up prefix-delegation, we might be able to get something from 2607:b400::/32, which is VT's largest allocation.

IF YOU CHANGE/ADD/REMOVE SOMETHING HERE CHANGE IT IN Inventory AND/OR Deprecated_Inventory TOO

This page describes specifics about VTLUUG's current network. For an overview, see Infrastructure:Networking

Addresses

ECE DNS VTLUUG DNS IPv4 Private Internal IPv4 IPv6
luug.ece.vt.edu sczi.vtluug.org 128.173.88.78 10.98.0.11 2607:b400:6:cc80:0:aff:fe62:b
luug0.ece.vt.edu dirtycow.vtluug.org 128.173.89.244 10.98.0.7 2607:b400:6:cc80:21e:c9ff:feef:13f8
luug1.ece.vt.edu acidburn.vtluug.org 128.173.89.245 10.98.0.12 2607:b400:6:cc80:0:aff:fe62:c
luug2.ece.vt.edu meltdown.vtluug.org 128.173.89.246 10.98.0.3 2607:b400:6:cc80:0:aff:fe62:3
luug3.ece.vt.edu chimera.vtluug.org 128.173.89.247 10.98.0.10 2607:b400:6:cc80:0:aff:fe62:a
luug4.ece.vt.edu mjh.ece.vt.edu 128.173.88.104 10.98.0.254 2607:b400:0006:cc80:0230:48ff:fe7e:28da
luug5.ece.vt.edu router.vtluug.org 128.173.88.191 10.98.0.1 2001:468:c80:6103:211:43ff:fe30:a72
N/A nikonwormhole.vtluug.org 128.173.88.135 10.98.0.21 2607:b400:6:cc80:0:aff:fe62:e
mirror.ece.vt.edu N/A *Not sure if we can actually use this IP* 128.173.88.82 N/A N/A
N/A switch.private.vtluug.org (Internal v4 only) N/A 10.98.0.2 N/A
N/A spectre.vtluug.org N/A 10.98.0.4 2607:b400:6:cc80:0:aff:fe62:4
N/A cyberdelia.vtluug.org N/A 10.98.0.6 2607:b400:0006:cc80:0215:17ff:fe12:7670
N/A shellshock.vtluug.org N/A 10.98.0.8 2607:b400:6:cc80:215:17ff:fe12:7670

See Deprecated_Network for historical information.

VTLUUG

Addresses

IPv6
  • SLAAC on 2607:b400:0006:cc80::/64
IPv4
  • 10.98.0.0/16: internal NAT
    • Static IPs: 10.98.0.0/24
    • DHCP: 10.98.1.0 - 10.98.1.150
    • Iodine: 10.98.10.0/24
  • 128.173.88.1/22: publicly accessible hosts

All hosts have an internal address (static or DHCP) and some hosts also have a globally accessible address.

DNS

Shellshock also functions as DNS server for internal hosts

  • 10.99.0.1
  • 2607:b400:0006:cc80::1

VT's DNS

CNS maintains a few DNS servers on campus

  • yardbird.cns.vt.edu, 2001:468:c80:2101:0:100:0:22, 198.82.247.34
  • jeru.cns.vt.edu, 2001:468:c80:4101:0:100:0:42, 198.82.247.66
  • milo.cns.vt.edu, 2001:468:c80:6101:0:100:0:62, 198.82.247.98

See Also

Retrieved from "https://vtluug.org/w/index.php?title=Infrastructure&oldid=7944"