|
Size: 2944
Comment:
|
Size: 3738
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| This is just a rough sketch for now; we will expand it soon. | |
| Line 2: | Line 3: |
| This is just a rough sketch for now; we will expand it soon. | These steps are listed in approximately the order in which they should be performed; please try to maintain that. |
| Line 8: | Line 9: |
| 1. Keyboard access 2. Screen access 3. Power-cycling |
1. Keyboard access 2. Screen access 3. Power-cycling |
| Line 15: | Line 16: |
=== Add a DNS entry for the server === Straightforward. |
|
| Line 28: | Line 33: |
| {{{ | |
| Line 29: | Line 35: |
| }}} | |
| Line 32: | Line 39: |
| {{{ | |
| Line 33: | Line 41: |
| }}} | |
| Line 38: | Line 47: |
| {{{ | |
| Line 39: | Line 49: |
| }}} | |
| Line 42: | Line 53: |
| {{{ | |
| Line 43: | Line 55: |
| }}} | |
| Line 66: | Line 79: |
| You will need to create a "host principal" for the new server; if you are setting up {{{server.hcoop.net}}}, then it must have the name {{{ host/server.hcoop.net@HCOOP.NET }}} Add this principal to the KDC like this: {{{ ssh deleuze sudo kadmin.local ank -randkey host/server.hcoop.net@HCOOP.NET ktadd -k /tmp/krb5.keytab exit }}} Then copy {{{/tmp/krb5.keytab}}} to {{{/etc/}}} on the new server, make sure it is owned by {{{root:root}}} and {{{chmod go-rwx}}} it. Also don't forget to erase {{{/tmp/krb5.keytab}}} on deleuze. |
|
| Line 68: | Line 99: |
| {{{ | |
| Line 72: | Line 104: |
| }}} |
This is just a rough sketch for now; we will expand it soon.
These steps are listed in approximately the order in which they should be performed; please try to maintain that.
1. Service Processor
All machines owned by hcoop should, if possible, have some out-of-band mechanism for:
- Keyboard access
- Screen access
- Power-cycling
Functions 1+2 are typically provided by kvm.hcoop.net; assuming you plan on going with that, you should connect the server's keyboard and video to the kvm switch.
Each server has its own solution for 3, usually in the form of a "service processor". You should investigate and document the appropriate service processor settings. If the service processor requires its own IP address, you should name it foo-sp.hcoop.net where foo.hcoop.net is the name of the server.
2. Add a DNS entry for the server
Straightforward.
3. Install Debian
We use Debian. Install it.
4. Kernel Compilation
It is generally a good idea for hcoop to compile its own kernels. Regarding statically-compiled kernels, see StaticallyCompiledKernels for some opinions.
5. AFS Client
You should install the openafs-client, openafs-krb5, openafs-modules-source, openafs-dbg, openafs-doc, and libpam-afs-session packages from /afs/hcoop.net/common/debian/. Also be sure to
apt-get install module-assistant build-essential module-init-tools
Once these packages are installed, you will want to run
module-assistant a-i -t openafs-modules
... assuming you compiled your own kernel and the compiled kernel tree resides in /usr/src/linux. If this is not the case, you are on your own.
If the command above completes, it will have created and installed a .deb containing the kernel module. You may need to run
/etc/init.d/module-init-tools start
to refresh whatever module wonkery linux maintains in obscure locations. Once this is figured out (if all else fails, reboot) you should be able to
/etc/init.d/openafs-client start
Do this and check that /afs shows up.
6. runit
The runit package is useful for launching and monitoring daemons with clean process state. This is often important when dealing with tokens and pags.
7. dnscache
You can install the dnscache package to make the server self-sufficient for dns resolution purposes (it acts as a tiny dns server just for localhost). This improves the reliability of the overall infrastructure.
8. /etc/krb5.conf
You should copy /etc/krb5.conf from deleuze to the new server. This is VERY IMPORTANT. What is NOT in this file is also almost as important as what IS in this file, so think three times before adding or removing anything.
9. configuring pam
FIXME
Mostly this consists of copying mire's /etc/pam.d/*, although it would be a good idea to state precisely which parts of that need to be copied.
10. configuring ssh to get tokens+tickets
You will need to create a "host principal" for the new server; if you are setting up server.hcoop.net, then it must have the name
host/server.hcoop.net@HCOOP.NET
Add this principal to the KDC like this:
ssh deleuze sudo kadmin.local ank -randkey host/server.hcoop.net@HCOOP.NET ktadd -k /tmp/krb5.keytab exit
Then copy /tmp/krb5.keytab to /etc/ on the new server, make sure it is owned by root:root and chmod go-rwx it. Also don't forget to erase /tmp/krb5.keytab on deleuze.
Add these lines to /etc/ssh/sshd_config:
GssapiKeyExchange yes GssapiAuthentication yes GSSAPICleanupCredentials no UsePAM yes