SystemAdministration/TheRiseAndFallOfNewNodeManagement - Revision history

NCommander: /* Setting up LDAP */

2014-04-23T12:16:48Z

Setting up LDAP

← Older revision		Revision as of 12:16, 23 April 2014
Line 162:		Line 162:
	When asked configuration questions, here's what you enter:		When asked configuration questions, here's what you enter:

	* LDAP server identifer: ldap://ldap-server.li694-22/		* LDAP server identifer: ldap://ldap-server.li694-22/ ldap://ldap-slave01.li694-22/
	* Distiquished Name: dc=li694-22		* Distiquished Name: dc=li694-22
	* LDAP version to use: 3		* LDAP version to use: 3
Line 198:		Line 198:
	<pre>		<pre>
	#ssl start_tls		#ssl start_tls
			</pre>

			Open /etc/ldap/ldap.conf, and set the following:
			<pre>
			BASE dc=li694-22
			URI ldap://ldap-server.li694-22/ ldap://ldap-slave01.li694-22
	</pre>		</pre>

2014-03-28T02:48:35Z

Setup ACL

← Older revision		Revision as of 02:48, 28 March 2014
Line 245:		Line 245:

	<pre>		<pre>
	-:ALL EXCEPT root (sysops) (db) : ALL		-:ALL EXCEPT root (sysops) (db) (global_services) : ALL
	</pre>		</pre>

2014-03-28T02:46:44Z

← Older revision		Revision as of 02:46, 28 March 2014
Line 226:		Line 226:

	<pre>		<pre>
	%sysops ALL=NOPASSWD: ALL		%sysops ALL=(ALL) NOPASSWD: ALL
	</pre>		</pre>

Line 239:		Line 239:
	This file is a Debian-derivate ACL list controlling who can and can't login. The syntax is explained in the file, but here's an example		This file is a Debian-derivate ACL list controlling who can and can't login. The syntax is explained in the file, but here's an example
	<pre>		<pre>
	-:ALL EXCEPT root (firefighters) : ALL		-:ALL EXCEPT root (firefighters) (global_services): ALL
	</pre>		</pre>

Line 247:		Line 247:
	-:ALL EXCEPT root (sysops) (db) : ALL		-:ALL EXCEPT root (sysops) (db) : ALL
	</pre>		</pre>

			Every machine should allow access to global_services so that service that need to pop into a shell can get in.

	== Setup SSH ==		== Setup SSH ==
Line 410:		Line 412:

	Confirm you can SSH freely between nodes, and you're done		Confirm you can SSH freely between nodes, and you're done

			== Install Nagios Plugins ==

			We use a fork of nagios for service monitoring. Setup is done on boron (sentinal.soylentnews.org), but the short version is you just need to install the plugins locally, then setup service monitoring via the icinga config files. This is a one liner.

			<pre>$ sudo apt-get install nagios-plugins nagios-plugins-extra</pre>

	== Cleanup ==		== Cleanup ==

2014-03-23T10:13:38Z

Setting up Kerberos (KRB5)

← Older revision		Revision as of 10:13, 23 March 2014
Line 389:		Line 389:
	WARNING: no policy specified for host/carbon.li694-22@LI694-22; defaulting to no policy		WARNING: no policy specified for host/carbon.li694-22@LI694-22; defaulting to no policy
	add_principal: Principal or policy already exists while creating "host/carbon.li694-22@LI694-22".		add_principal: Principal or policy already exists while creating "host/carbon.li694-22@LI694-22".
	kadmin: ~~ktabb~~ -randkey host/carbon.li694-22@LI694-22		kadmin: ktadd -randkey host/carbon.li694-22@LI694-22
	(lots of information)		(lots of information)
	kadmin: quit		kadmin: quit

2014-03-23T10:07:50Z

Setting up Kerberos (KRB5)

@@ Line 360: / Line 360: @@
 </pre>
-If you got a ticket, you're done with kerberos, now its time for round 2 with SSH's config, you need to edit both the client and server settings this time.
+If you got a ticket, you're done with user configuration.
 <pre>

2014-03-23T08:43:37Z

Setting up Kerberos (KRB5)

← Older revision		Revision as of 08:43, 23 March 2014
Line 372:		Line 372:
	<pre>		<pre>
	Set the following in /etc/ssh/ssh_config (under Hosts *)		Set the following in /etc/ssh/ssh_config (under Hosts *)
	~~GSSAPIAuthentication~~ yes		GSSAPIDelegateCredentials yes
	~~GSSAPIDelegateCredentials no~~
	</pre>		</pre>

2014-03-23T08:27:14Z

@@ Line 57: / Line 57: @@
 boron
 root@localhost:~# cat /etc/hosts
-.0.0.1	localhost
+.0.0.1	boron.li684-22 boron localhost
 LDAP-IP         ldap-server.li694-22
@@ Line 339: / Line 338: @@
 ssh start/running, process 5752
 </pre>
 == Cleanup ==

2014-03-23T07:43:15Z

Cleanup

← Older revision		Revision as of 07:43, 23 March 2014
Line 341:		Line 341:

	== Cleanup ==		== Cleanup ==

			Now install pwgen:

			<pre>
			apt-get install pwgen
			</pre>

	Generate a new root password with pwgen (i.e. pwgen 50 1), and set it		Generate a new root password with pwgen (i.e. pwgen 50 1), and set it

2014-03-23T07:33:38Z

Upgrading SSH

← Older revision		Revision as of 07:33, 23 March 2014
Line 280:		Line 280:
	<pre>The following packages will be upgraded:		<pre>The following packages will be upgraded:
	openssh-client openssh-server</pre>		openssh-client openssh-server</pre>

			Note: You can ignore the following error while installing it:

			<pre>/var/lib/dpkg/info/openssh-server.postinst: 295: /var/lib/dpkg/info/openssh-server.postinst: deb-systemd-helper: not found</pre>

	=== Setting Up SSH-LDAP Authetication ===		=== Setting Up SSH-LDAP Authetication ===

2014-03-23T07:24:38Z

Setting up LDAP

← Older revision		Revision as of 07:24, 23 March 2014
Line 181:		Line 181:
	Now, take the slapd_ca.pem, and stick it in /usr/share/ca-certificates/li694-22 (you have to make this folder)		Now, take the slapd_ca.pem, and stick it in /usr/share/ca-certificates/li694-22 (you have to make this folder)

	Open up /etc/ca-~~certifiates~~.conf in your favorite editor, add the following to the end		Open up /etc/ca-certificates.conf in your favorite editor, add the following to the end
	<pre>		<pre>
	li694-22/slapd_ca.pem		li694-22/slapd_ca.pem