welcome: please sign in

Diff for "SetupNewMachines"

Differences between revisions 13 and 32 (spanning 19 versions)
⇤ ← Revision 13 as of 2008-03-02 20:09:42 →
Size: 4820
Editor: dhcp-37-70
Comment:
← Revision 32 as of 2008-03-02 20:45:36 → ⇥
Size: 7650
Editor: dhcp-37-70
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
This is just a rough sketch for now; we will expand it soon.
Line 5: Line 3:
=== Out Of Band Access === === Set Up Out Of Band Access ===
Line 13: Line 11:
Functions 1+2 are typically provided by kvm.hcoop.net; assuming you plan on going with that, you should connect the server's keyboard and video to the kvm switch. Functions 1+2 are typically provided by {{{kvm.hcoop.net}}} (see KvmAccess); assuming you plan on going with that, you should connect the server's keyboard and video to the kvm switch.
Line 25: Line 23:
=== Kernel Compilation === === Compile a Kernel ===
Line 29: Line 27:
=== AFS Client === === Install the AFS Client ===
Line 31: Line 29:
You should install the {{{openafs-client}}}, {{{openafs-krb5}}}, {{{openafs-modules-source}}}, {{{openafs-dbg}}}, {{{openafs-doc}}}, {{{libopenafs-dev}}}, {{{fsr}}}, and {{{libpam-afs-session}}} packages from {{{/afs/hcoop.net/common/debian/}}}. Here is a block of commands to cut and paste if you are lazy: First, give our preferences to {{{debconf}}}:
Line 34: Line 32:
  apt-get install libpam-krb5 krb5-user libkrb5-dev
  cd /tmp		   debconf openafs-client/thiscell HCOOP.NET
  debconf openafs-client/dynroot true
  debconf openafs-client/cachesize 500000 # cache size in kB; default is way too small
}}}

You should install the {{{module-assistant}}}, {{{build-essential}}}, {{{module-init-tools}}}, {{{openafs-client}}}, {{{openafs-krb5}}}, {{{openafs-modules-source}}}, {{{openafs-dbg}}}, {{{openafs-doc}}}, {{{libopenafs-dev}}}, packages from {{{/afs/hcoop.net/common/debian/}}}. Here is a block of commands to cut and paste if you are lazy:

{{{
  apt-get install krb5-user libkrb5-dev module-assistant build-essential module-init-tools
  mkdir -p /tmp/openafs-packages
  cd /tmp/openafs-packages
Line 37: Line 44:
  scp ssh.hcoop.net:/afs/hcoop.net/common/debian/libpam-afs-session/\*.deb ./
  scp ssh.hcoop.net:/afs/hcoop.net/common/debian/fsr/\*.deb ./
Line 45: Line 50:
    libopenafs-dev*.deb \
    fsr*.deb \
    libpam-afs-session*.deb
}}}

Also be sure to

{{{
  apt-get install module-assistant build-essential module-init-tools		     libopenafs-dev*.deb
  cd /tmp
  rm -rf /tmp/openafs-packages
Line 76: Line 75:
Do this and check that /afs shows up. Do this and check that {{{/afs}}} shows up.
Line 78: Line 77:
=== runit === === Install Packages ===
Line 80: Line 79:
The runit package is useful for launching and monitoring daemons with '''clean process state'''. This is often important when dealing with tokens and pags. Now that afs is up, you can easily install packages. The block of commands below installs the set of packages which must be on every hcoop server (this list will be expanded as necessary).
Line 82: Line 81:
=== dnscache === {{{
  dpkg -i /afs/hcoop.net/common/debian/libnss-ptdb/*.deb
  dpkg -i /afs/hcoop.net/common/debian/libpam-afs-session/*.deb
  dpkg -i /afs/hcoop.net/common/debian/libpam-krb5/*.deb
  dpkg -i /afs/hcoop.net/common/debian/fsr/*.deb
}}}
Line 84: Line 88:
You can install the dnscache package to make the server self-sufficient for dns resolution purposes (it acts as a tiny dns server just for localhost). This improves the reliability of the overall infrastructure. The first three packages are explained below; the last one is the {{{fsr}}} command (recursive "{{{fs}}}").
Line 86: Line 90:
There is a copy of this package in /afs/megacz.com/debian/; the author of the software recently changed its license, so it will be a standard package in the next release of debian (it may even be in etch-backports already). === Configure Kerberos ===
Line 88: Line 92:
Starting dnscache via runit is often a good idea; this ensures that it starts early in the boot process and that it is restarted if it dies for any reason. You should copy {{{/etc/krb5.conf}}} from deleuze to the new server. This is VERY IMPORTANT. What is NOT in this file is also almost as important as what IS in this file, so think three times before adding or removing anything.
Line 90: Line 94:
=== /etc/krb5.conf === === Configure Name Service ===
Line 92: Line 96:
You should copy /etc/krb5.conf from deleuze to the new server. This is VERY IMPORTANT. What is NOT in this file is also almost as important as what IS in this file, so think three times before adding or removing anything. The {{{libnss-ptdb}}} package lets linux use the AFS {{{ptserver}}} (protection server) as a name service. The {{{ptserver}}} keeps track of all the users in AFS. A "name service" is Linux's mechanism for answering these four queries:
Line 94: Line 98:
=== configuring pam ===  1. the userid for a given username
 2. the username for a userid
 3. the home directory for a user
 4. the shell for a user
 5. what groups a user is in

To make {{{ptserver}}} our primary choice for name service, edit {{{/etc/nsswitch.conf}}} and change the following three lines to look like this:

{{{
passwd: ptdb files
group: afspag files
shadow: files
}}}

=== Configure PAM ===

PAM is the mechanism used by Linux to do the following:

 1. decide if somebody is who they say they are (authentication; in our case via kerberos)
 2. set up ''sessions'' (in the case of AFS, this means creating PAGs)
 3. change passwords (in our case, changing the password in the KDC)
Line 98: Line 122:
Mostly this consists of copying mire's /etc/pam.d/*, although it would be a good idea to state precisely which parts of that need to be copied. Mostly this consists of copying mire's {{{/etc/pam.d/*}}}, although it would be a good idea to state precisely which parts of that need to be copied.
Line 100: Line 124:
=== configuring ssh to get tokens+tickets === === Configure SSH ===
Line 119: Line 143:
Then these lines to /etc/ssh/sshd_config: Then these lines to {{{/etc/ssh/sshd_config}}}:
Line 127: Line 151:

=== Optional Steps ===

==== Performance-Tune the OpenAFS Client ====

FIXME: AdamM needs to fill this in

==== runit ====
The runit package is a mechanism for starting, stopping, and monitoring daemons. It is an alternative to the traditional {{{/etc/init.d}}} and {{{start-stop-daemon}}} scheme. Its chief advantages are:

  1. It launches daemons with '''clean process state'''; the daemon inherits nothing from the administrator invoking the start/stop command because the daemon is not forked as a child of the administrator's shell (rather, a request is sent {{{runit}}} daemon asking it to fork the daemon). This is very important when dealing with tokens and pags.
  2. Runit monitors the processes that it forks, and restarts them if they die.
  3. Runit eliminates the need for pidfiles and the associated risk of starting multiple copies of a daemon.

{{{
   apt-get install runit
}}}
When you move a process from {{{/etc/init.d/}}} control to {{{runit}}} supervision, you should inform debian that you have done so:
{{{
  # assuming /var/service/$SERVICE/run is the runit script
  dpkg-divert --rename /etc/init.d/$SERVICE
  ln -s /usr/bin/sv /etc/init.d/$SERVICE
}}}
This will cause invocations of {{{/etc/init.d/script {start|stop} }}} to do "the right thing".

==== dnscache ====

You can install the dnscache package to make the server self-sufficient for dns resolution purposes (it acts as a tiny dns server just for localhost). This improves the reliability of the overall infrastructure. There is a copy of this package in {{{/afs/megacz.com/debian/dnscache/}}}; the author of the software recently changed its license, so it will be a standard package in the next release of debian (it may even be in etch-backports already; when it is, this paragraph should be updated to recommend that instead).

Starting dnscache via runit is often a good idea; this ensures that it starts early in the boot process and that it is restarted if it dies for any reason.

These steps are listed in approximately the order in which they should be performed; please try to maintain that.

1. Set Up Out Of Band Access

All machines owned by hcoop should, if possible, have some out-of-band mechanism for:

  1. Keyboard access
  2. Screen access
  3. Power-cycling

Functions 1+2 are typically provided by kvm.hcoop.net (see KvmAccess); assuming you plan on going with that, you should connect the server's keyboard and video to the kvm switch.

Each server has its own solution for 3, usually in the form of a "service processor". You should investigate and document the appropriate service processor settings. If the service processor requires its own IP address, you should name it foo-sp.hcoop.net where foo.hcoop.net is the name of the server.

2. Add a DNS entry for the server

Straightforward.

3. Install Debian

We use Debian. Install it.

4. Compile a Kernel

It is generally a good idea for hcoop to compile its own kernels. Regarding statically-compiled kernels, see StaticallyCompiledKernels for some opinions.

5. Install the AFS Client

First, give our preferences to debconf: 

  debconf openafs-client/thiscell  HCOOP.NET
  debconf openafs-client/dynroot   true
  debconf openafs-client/cachesize 500000      # cache size in kB; default is way too small

You should install the module-assistant, build-essential, module-init-tools, openafs-client, openafs-krb5, openafs-modules-source, openafs-dbg, openafs-doc, libopenafs-dev, packages from /afs/hcoop.net/common/debian/. Here is a block of commands to cut and paste if you are lazy: 

  apt-get install krb5-user libkrb5-dev module-assistant build-essential module-init-tools
  mkdir -p /tmp/openafs-packages
  cd /tmp/openafs-packages
  scp ssh.hcoop.net:/afs/hcoop.net/common/debian/openafs/1.4.6/\*.deb      ./
  dpkg -i \
    openafs-client*.deb         \
    openafs-krb5*.deb           \
    openafs-modules-source*.deb \
    openafs-dbg*.deb            \
    openafs-doc*.deb            \
    libopenafs-dev*.deb         
  cd /tmp
  rm -rf /tmp/openafs-packages

Once these packages are installed, you will want to run 

  module-assistant a-i -t openafs-modules

... assuming you compiled your own kernel and the compiled kernel tree resides in /usr/src/linux. If this is not the case, you are on your own.

If the command above completes, it will have created and installed a .deb containing the kernel module. You may need to run 

  /etc/init.d/module-init-tools start

to refresh whatever module wonkery linux maintains in obscure locations. Once this is figured out (if all else fails, reboot) you should be able to 

  /etc/init.d/openafs-client start

Do this and check that /afs shows up.

6. Install Packages

Now that afs is up, you can easily install packages. The block of commands below installs the set of packages which must be on every hcoop server (this list will be expanded as necessary). 

  dpkg -i /afs/hcoop.net/common/debian/libnss-ptdb/*.deb
  dpkg -i /afs/hcoop.net/common/debian/libpam-afs-session/*.deb
  dpkg -i /afs/hcoop.net/common/debian/libpam-krb5/*.deb
  dpkg -i /afs/hcoop.net/common/debian/fsr/*.deb

The first three packages are explained below; the last one is the fsr command (recursive "fs").

7. Configure Kerberos

You should copy /etc/krb5.conf from deleuze to the new server. This is VERY IMPORTANT. What is NOT in this file is also almost as important as what IS in this file, so think three times before adding or removing anything.

8. Configure Name Service

The libnss-ptdb package lets linux use the AFS ptserver (protection server) as a name service. The ptserver keeps track of all the users in AFS. A "name service" is Linux's mechanism for answering these four queries:

  1. the userid for a given username
  2. the username for a userid
  3. the home directory for a user
  4. the shell for a user
  5. what groups a user is in

To make ptserver our primary choice for name service, edit /etc/nsswitch.conf and change the following three lines to look like this: 

passwd:         ptdb   files
group:          afspag files
shadow:                files

9. Configure PAM

PAM is the mechanism used by Linux to do the following:

  1. decide if somebody is who they say they are (authentication; in our case via kerberos)

  2. set up sessions (in the case of AFS, this means creating PAGs)

  3. change passwords (in our case, changing the password in the KDC)

FIXME

Mostly this consists of copying mire's /etc/pam.d/*, although it would be a good idea to state precisely which parts of that need to be copied.

10. Configure SSH

You will need to create a "host principal" for the new server; if you are setting up server.hcoop.net, then it must have the name 

   host/server.hcoop.net@HCOOP.NET

Add this principal to the KDC like this (execute these commands on the new server, as root, while holding admin tokens): 

   kadmin -r HCOOP.NET
     ank -randkey host/server.hcoop.net@HCOOP.NET
     ktadd -k /etc/krb5.keytab
     quit
   chown root:root /etc/krb5.keytab
   chmod go-rwx /etc/krb5.keytab

Then these lines to /etc/ssh/sshd_config: 

  GssapiKeyExchange yes
  GssapiAuthentication yes
  GSSAPICleanupCredentials no
  UsePAM yes

11. Optional Steps

11.1. Performance-Tune the OpenAFS Client

FIXME: AdamM needs to fill this in

11.2. runit

The runit package is a mechanism for starting, stopping, and monitoring daemons. It is an alternative to the traditional /etc/init.d and start-stop-daemon scheme. Its chief advantages are:

  1. It launches daemons with clean process state; the daemon inherits nothing from the administrator invoking the start/stop command because the daemon is not forked as a child of the administrator's shell (rather, a request is sent runit daemon asking it to fork the daemon). This is very important when dealing with tokens and pags.

  2. Runit monitors the processes that it forks, and restarts them if they die.
  3. Runit eliminates the need for pidfiles and the associated risk of starting multiple copies of a daemon. 

   apt-get install runit

When you move a process from /etc/init.d/ control to runit supervision, you should inform debian that you have done so: 

  # assuming /var/service/$SERVICE/run is the runit script
  dpkg-divert --rename /etc/init.d/$SERVICE
  ln -s /usr/bin/sv /etc/init.d/$SERVICE

This will cause invocations of /etc/init.d/script {start|stop}  to do "the right thing".

11.3. dnscache

You can install the dnscache package to make the server self-sufficient for dns resolution purposes (it acts as a tiny dns server just for localhost). This improves the reliability of the overall infrastructure. There is a copy of this package in /afs/megacz.com/debian/dnscache/; the author of the software recently changed its license, so it will be a standard package in the next release of debian (it may even be in etch-backports already; when it is, this paragraph should be updated to recommend that instead).

Starting dnscache via runit is often a good idea; this ensures that it starts early in the boot process and that it is restarted if it dies for any reason.

SetupNewMachines (last edited 2012-12-20 21:13:00 by ClintonEbadi)