Difference between revisions of "Infrastructure"
imported>Echarlie (→Current Setup) |
(→Current Setup) |
||
(152 intermediate revisions by 6 users not shown) | |||
Line 2: | Line 2: | ||
== Physical Infrastructure == | == Physical Infrastructure == | ||
− | [[Infrastructure:Cyberdelia| | + | === NFS Hosts === |
+ | * [[Infrastructure:Dirtycow|dirtycow]] - Primary NFS server, 8x2TB raidz2 array | ||
+ | * [[Infrastructure:Cyberdelia|cyberdelia]] - OFF, 7x1TB raidz2 array, sitting on shelf instead of shelf | ||
− | + | === VM Hosts === | |
+ | * [[Infrastructure:Meltdown|meltdown]] - Primary VM/docker host | ||
+ | * [[Infrastructure:Spectre|spectre]] - Secondary VM/docker host, for example user VMs | ||
− | + | === Router === | |
+ | * [[Infrastructure:Shellshock|shellshock]] - 3 disk RAID1 array | ||
+ | |||
+ | All hosts are on our own 1 Gb/s port with [[Infrastructure:Joey|joey]], a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix. | ||
+ | |||
+ | Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move | ||
+ | [[User:echarlie|echarlie]] is calling [[gp:Cyber Auschwitz|Cyber Auschwitz]]. Contact itso-g@vt.edu for firewall exceptions. | ||
+ | When deploying new hosts, make ssh listen on both 2222 and 22. [[Infrastructure:Acidburn|Acidburn]] currently listens on 3128 as well. | ||
+ | |||
+ | === Other hosts === | ||
+ | * [[Infrastructure:Wood|Wood]] is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs. | ||
+ | * [[Infrastructure:Sunway|sunway]] and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members. | ||
+ | |||
+ | See [[VTLUUG:Strategic_plan]] for things we plan to do in the future. | ||
== On the Network Architecture == | == On the Network Architecture == | ||
+ | ''Further Information: [[Infrastructure:Networking]] and [[Infrastructure:Network]]'' | ||
+ | |||
+ | [[File:Infra2019-network.png|thumb|500px|A simple network diagram by [[user:pew|pew]]. '''Update June 2021: Joey is dead, long live Joey. Shellshock is the new router. Cyberdelia is off.]] | ||
+ | |||
− | + | We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.98.x.x/16 subnet and an IPv6 address assigned via SLAAC. | |
+ | In the future, [[Infrastructure:IPsec|VPN]]/[[Iodine]] should be used. | ||
+ | |||
+ | In theory, services can be provided via a hidden service such as [[w:Tor|Tor]], but that introduces other complications. | ||
+ | Alternately, services can require use of the [[Infrastructure:IPsec|VPN]] on [[Infrastructure:Acidburn|acidburn]], | ||
+ | [[Iodine]], or [[Secure Shell|ssh tunnelling]], although all of these limit usage to members with a shell account. | ||
+ | All of these have the benefit of NAT transversal, however. | ||
== Services == | == Services == | ||
+ | ''Further information: [[:Category:Services]]'' | ||
− | + | * [[Infrastructure:Acidburn|acidburn]] | |
− | |||
− | * Acidburn | ||
** Shell server | ** Shell server | ||
** [[Email]] | ** [[Email]] | ||
** [[Wadsworth]] | ** [[Wadsworth]] | ||
− | * | + | * [[Infrastructure:Chimera|chimera]] |
− | ** | + | ** FreeIPA |
− | * | + | * [[Infrastructure:Sczi|Sczi]] |
** Website | ** Website | ||
*** Wiki | *** Wiki | ||
*** Main Page | *** Main Page | ||
− | |||
*** linx | *** linx | ||
− | *** | + | *** [https://bash.vtluug.org vtbash] |
− | * | + | * [[Infrastructure:Dirtycow|dirtycow]] |
− | + | ** Storage for all primary services | |
− | ** | + | ** NFS - ZFS pool name is cistern |
− | + | * [[Infrastructure:Meltdown|meltdown]] | |
− | ** | + | ** VM host for above services |
− | * | ||
− | ** | ||
− | + | [[Infrastructure:Acidburn|acidburn]] and the website ''must'' be accessible through real services, and it is preferable other hosts are too. This means we must use our public IPv4 & IPv6 Addresses allotted by ECE. | |
− | |||
− | |||
− | |||
− | |||
== Website details == | == Website details == | ||
− | |||
=== Current Setup === | === Current Setup === | ||
− | + | All vtluug websites are run on nginx on [[Infrastructure:Sczi|sczi]]. These sites are currently functional: | |
− | All vtluug websites are run on nginx on | ||
* gobblerpedia.org | * gobblerpedia.org | ||
* hokieprivacy.org | * hokieprivacy.org | ||
− | |||
− | |||
* vtluug.org | * vtluug.org | ||
− | * wiki.vtluug.org ( | + | * wiki.vtluug.org (redirects to vtluug.org/wiki/) |
− | + | * bash.vtluug.org | |
− | + | * vtluug.org/users/~$user | |
− | |||
− | + | All of these sites exclusively allow for the use of TLS connections. All services use automatically updated | |
− | + | letsencrypt certs. | |
− | |||
==== Main Page ==== | ==== Main Page ==== | ||
− | + | The main VTLUUG page was scraped from the [[w:Internet Archive|Internet Archive]] and added created as a github page at | |
− | + | [https://vtluug.github.io vtluug.github.io], and is reverse-proxied through [[Infrastructure:Sczi|sczi]]. | |
− | |||
− | |||
− | |||
==== Wiki ==== | ==== Wiki ==== | ||
+ | The wiki currently runs fully on MediaWiki hosted on nginx using a [https://github.com/vtluug/mediawiki-docker modified version of the official mediawiki docker image]. You can auth with the admin account, [[User:wiki-admin|wiki-admin]] or a Google account. See note on [[Main_page]] about why LDAP isn't working yet. | ||
− | + | ===== Gobblerpedia ===== | |
− | + | Runs on the same Mediawiki instance as this wiki. Similarly to LUUGWiki, only Google accounts or the admin user are supported logins. | |
− | === | + | === Needs Restoration === |
− | + | These are VTLUUG services that haven't yet been properly restored: | |
− | + | * [https://github.com/mutantmonkey/foodforus foodfor.vtluug.org] - For [[Wadsworth]]'s .pickfood and .foodvote commands. This is [[User:Timelord|jpo's]] fault. | |
− | + | * tahoe.vtluug.org - [[user:mjh|mhazinsk's]] Tahoe-LAFS grid | |
− | + | * git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend | |
− | + | * gitweb.vtluug.org - git hosting; previously gitweb | |
− | + | * [https://github.com/vtluug/campusmap map.vtluug.org] - [[Openstreetmap|OSM]] based map of VT | |
=== Historically === | === Historically === | ||
− | + | See [[Dead_projects]] for historic information | |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | [[ | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | === | + | === Goals === |
− | + | See [[VTLUUG:Strategic_plan#Web_Services]] for future goals involving web services | |
− | |||
== Addressing == | == Addressing == | ||
− | VTLUUG currently has DNS | + | VTLUUG currently has DNS with gandi.net. Message officers for access (please don't be scared :D). |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | + | We currently hold the IPv6 prefix <code>2001:470:8:6d9::/64</code> from HE's allocation due to our tunnel. | |
+ | When CNS finally sets up prefix-delegation, we might be able to get something from <code>2607:b400::/32</code>, | ||
+ | which is VT's largest allocation. | ||
− | + | {{:Infrastructure:Network}} | |
− | |||
[[Category:Infrastructure]] | [[Category:Infrastructure]] | ||
− | [[Category:VTLUUG Projects | + | [[Category:VTLUUG:Projects]] |
− | |||
[[Category:Featured content]] | [[Category:Featured content]] |
Latest revision as of 16:23, 13 June 2021
This page documents VTLUUG's infrastructure post-CVL eviction.
Contents
Physical Infrastructure
NFS Hosts
- dirtycow - Primary NFS server, 8x2TB raidz2 array
- cyberdelia - OFF, 7x1TB raidz2 array, sitting on shelf instead of shelf
VM Hosts
Router
- shellshock - 3 disk RAID1 array
All hosts are on our own 1 Gb/s port with joey, a gateway featuring ARP proxying, and full delegation of the 2607:b400:6:cc80/64 prefix.
Virginia Tech has started blocking inbound ports 22 and 3389 and outbound port 25 at the campus border, in a move echarlie is calling Cyber Auschwitz. Contact itso-g@vt.edu for firewall exceptions. When deploying new hosts, make ssh listen on both 2222 and 22. Acidburn currently listens on 3128 as well.
Other hosts
- Wood is sitting in our rack turned off because we don't have a use for it currently. It is in a 4U case capable of fitting several GPUs.
- sunway and a SuperMicro server were all transferred to WUVT. Older hosts have either been thrown out or given to members.
See VTLUUG:Strategic_plan for things we plan to do in the future.
On the Network Architecture
Further Information: Infrastructure:Networking and Infrastructure:Network
![](/w/images/thumb/2/27/Infra2019-network.png/500px-Infra2019-network.png)
We currently have some services with public IPv4 address, and all hosts have an internal IPv4 address on the 10.98.x.x/16 subnet and an IPv6 address assigned via SLAAC.
In the future, VPN/Iodine should be used.
In theory, services can be provided via a hidden service such as Tor, but that introduces other complications. Alternately, services can require use of the VPN on acidburn, Iodine, or ssh tunnelling, although all of these limit usage to members with a shell account. All of these have the benefit of NAT transversal, however.
Services
Further information: Category:Services
- acidburn
- chimera
- FreeIPA
- Sczi
- Website
- Wiki
- Main Page
- linx
- vtbash
- Website
- dirtycow
- Storage for all primary services
- NFS - ZFS pool name is cistern
- meltdown
- VM host for above services
acidburn and the website must be accessible through real services, and it is preferable other hosts are too. This means we must use our public IPv4 & IPv6 Addresses allotted by ECE.
Website details
Current Setup
All vtluug websites are run on nginx on sczi. These sites are currently functional:
- gobblerpedia.org
- hokieprivacy.org
- vtluug.org
- wiki.vtluug.org (redirects to vtluug.org/wiki/)
- bash.vtluug.org
- vtluug.org/users/~$user
All of these sites exclusively allow for the use of TLS connections. All services use automatically updated letsencrypt certs.
Main Page
The main VTLUUG page was scraped from the Internet Archive and added created as a github page at vtluug.github.io, and is reverse-proxied through sczi.
Wiki
The wiki currently runs fully on MediaWiki hosted on nginx using a modified version of the official mediawiki docker image. You can auth with the admin account, wiki-admin or a Google account. See note on Main_page about why LDAP isn't working yet.
Gobblerpedia
Runs on the same Mediawiki instance as this wiki. Similarly to LUUGWiki, only Google accounts or the admin user are supported logins.
Needs Restoration
These are VTLUUG services that haven't yet been properly restored:
- foodfor.vtluug.org - For Wadsworth's .pickfood and .foodvote commands. This is jpo's fault.
- tahoe.vtluug.org - mhazinsk's Tahoe-LAFS grid
- git.vtluug.org - git hosting; previously a redirect to gitweb with gitosis as the SSH backend
- gitweb.vtluug.org - git hosting; previously gitweb
- map.vtluug.org - OSM based map of VT
Historically
See Dead_projects for historic information
Goals
See VTLUUG:Strategic_plan#Web_Services for future goals involving web services
Addressing
VTLUUG currently has DNS with gandi.net. Message officers for access (please don't be scared :D).
We currently hold the IPv6 prefix 2001:470:8:6d9::/64
from HE's allocation due to our tunnel.
When CNS finally sets up prefix-delegation, we might be able to get something from 2607:b400::/32
,
which is VT's largest allocation.
IF YOU CHANGE/ADD/REMOVE SOMETHING HERE CHANGE IT IN Inventory AND/OR Deprecated_Inventory TOO
This page describes specifics about VTLUUG's current network. For an overview, see Infrastructure:Networking
Addresses
ECE DNS | VTLUUG DNS | IPv4 | Private Internal IPv4 | IPv6 |
---|---|---|---|---|
luug.ece.vt.edu | sczi.vtluug.org | 128.173.88.78 | 10.98.0.11 | 2607:b400:6:cc80:0:aff:fe62:b |
luug0.ece.vt.edu | dirtycow.vtluug.org | 128.173.89.244 | 10.98.0.7 | 2607:b400:6:cc80:21e:c9ff:feef:13f8 |
luug1.ece.vt.edu | acidburn.vtluug.org | 128.173.89.245 | 10.98.0.12 | 2607:b400:6:cc80:0:aff:fe62:c |
luug2.ece.vt.edu | meltdown.vtluug.org | 128.173.89.246 | 10.98.0.3 | 2607:b400:6:cc80:0:aff:fe62:3 |
luug3.ece.vt.edu | chimera.vtluug.org | 128.173.89.247 | 10.98.0.10 | 2607:b400:6:cc80:0:aff:fe62:a |
luug4.ece.vt.edu | mjh.ece.vt.edu | 128.173.88.104 | 10.98.0.254 | 2607:b400:0006:cc80:0230:48ff:fe7e:28da |
luug5.ece.vt.edu | router.vtluug.org | 128.173.88.191 | 10.98.0.1 | 2001:468:c80:6103:211:43ff:fe30:a72 |
mirror.ece.vt.edu | N/A *Not sure if we can actually use this IP* | 128.173.88.82 | N/A | N/A |
N/A | switch.private.vtluug.org (Internal v4 only) | N/A | 10.98.0.2 | N/A |
N/A | spectre.vtluug.org | N/A | 10.98.0.4 | 2607:b400:6:cc80:0:aff:fe62:4 |
N/A | cyberdelia.vtluug.org | N/A | 10.98.0.6 | 2607:b400:0006:cc80:0215:17ff:fe12:7670 |
N/A | shellshock.vtluug.org | N/A | 10.98.0.8 | 2607:b400:6:cc80:215:17ff:fe12:7670 |
See Deprecated_Network for historical information.
VTLUUG
Addresses
IPv6
- SLAAC on 2607:b400:0006:cc80::/64
IPv4
- 10.98.0.0/16: internal NAT
- Static IPs: 10.98.0.0/24
- DHCP: 10.98.1.0 - 10.98.1.150
- Iodine: 10.98.10.0/24
- 128.172.88.1/22: publicly accessible hosts
All hosts have an internal address (static or DHCP) and some hosts also have a globally accessible address.
DNS
joey also functions as DNS server for internal hosts
- 10.99.0.1
- 2607:b400:0006:cc80::1
VT's DNS
CNS maintains a few DNS servers on campus
- yardbird.cns.vt.edu, 2001:468:c80:2101:0:100:0:22, 198.82.247.34
- jeru.cns.vt.edu, 2001:468:c80:4101:0:100:0:42, 198.82.247.66
- milo.cns.vt.edu, 2001:468:c80:6101:0:100:0:62, 198.82.247.98
See Also
- Contact Brandon Russell to get authoritative DNS entries added for *.ece.vt.edu
- network liasions