View source for Animal Setup Process

This page summarizes how [[Animal]] was set up in Spring 2009.

==Install==
*Installed CentOS 5.3 x86.
**Partition Scheme
***100 MB /boot - Hardware RAID 1
***270 GB root_lvg - Logical Volume Group - Hardware RAID 1
****262 GB / (root_lvg-root_lv)
****4 GB /var (root_lvg-var_lv)
****4 GB swap (root_lvg-swap_lv)
***1.6 TB /mnt/raidA - Hardware RAID 10
***1.6 TB /mnt/raidB - Hardware RAID 10

===Kickstart File===
<code><pre>

</pre></code>

==Configuration==
===Updated VM===
*Added RPMForge Yum Repository
**<code>rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm</code>
***From [http://dag.wieers.com/rpm/FAQ.php#B2 Dag Wieers]

*<code>yum install yum-fastestmirror vim-enhanced gcc emacs-nox screen</code>
*<code>yum update</code>

===Created User===
*Created user mccarrms
**<code>/usr/sbin/useradd -m mccarrms</code>
*Set password for mccarrms
**<code>passwd mccarrms</code>

===Configured Sudo===
*<code>/usr/sbin/visudo</code>

<code><pre>
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.

#User_Alias ADMINS = mccarrms

## Networking
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database
Cmnd_Alias LOCATE = /usr/sbin/updatedb

## Storage
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp

## Processes
Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
Cmnd_Alias DRIVERS = /sbin/modprobe

## Shells
Cmnd_Alias SHELLS = /bin/sh, /bin/bash, /usr/bin/rsh, /bin/dash, /bin/rbash, /bin/su

## Users
Cmnd_Alias USERS = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/userhelper, /usr/sbin/usermod, /usr/sbin/usernetctl

Defaults    requiretty

Defaults    env_reset,tty_tickets,lecture=always,logfile=/var/log/sudo.log
Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
                        _XKB_CHARSET XAUTHORITY"

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
%wheel  ALL=(ALL)       ALL
%admins localhost=/sbin/shutdown -h now
</pre></code>

===Configured Networks===
*Configured hostname in <code>/etc/sysconfig/network</code>
<code><pre>
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=animal.cslabs.clarkson.edu
GATEWAY=128.153.145.1
</pre></code>

*Verified eth0 configuration for Clarkson Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth0</code>
<code><pre>
# Intel Corporation 82540EM Gigabit Ethernet Controller
DEVICE=eth0
BOOTPROTO=static
BROADCAST=128.153.145.255
HWADDR=00:C0:9F:2A:32:40
IPADDR=128.153.145.216
NETMASK=255.255.255.0
NETWORK=128.153.145.0
ONBOOT=yes
</pre></code>

*Verified eth1 configuration for the Internal Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth1</code>
<code><pre>
# Intel Corporation 82541PI Gigabit Ethernet Controller
DEVICE=eth1
BOOTPROTO=static
BROADCAST=10.0.0.255
HWADDR=00:1B:21:28:C8:46
IPADDR=10.0.0.19
NETMASK=255.255.255.0
NETWORK=10.0.0.0
ONBOOT=yes
</pre></code>

====Configured Hosts====
*Edited <code>/etc/hosts</code>
<code><pre>
127.0.0.1       localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
128.153.145.216 animal.cslabs.clarkson.edu animal.cslabs animal
10.0.0.19       animal.int.cslabs.clarkson.edu animal.int.cslabs animal.int
</pre></code>

====Configured DNS Servers====
*Edited <code>/etc/resolv.conf</code>
<code><pre>
search clarkson.edu
nameserver 128.153.0.254
nameserver 128.153.5.254
</pre></code>

===Configured IPtables===
<code><pre>
Due to the sensitivity of this material, this config file has been left off; however, the following rules are needed.
</pre></code>
*Restarted iptables
**<code>/etc/init.d/iptables restart</code>

===Configured SSH===
*Edited <code>/etc/ssh/sshd_config</code>
<code><pre>
Due to the sensitivity of this material, this config file has been left off.
</pre></code>
*Restarted sshd
**<code>/etc/init.d/sshd restart</code>

====Set Up SSH Login Banner====
*Edited <code>/etc/issue.net</code>
<code><pre>

</pre></code>

===Configured Password Requirements===
*Edited <code>/etc/login.defs</code>
<code><pre>
MAIL_DIR        /var/spool/mail

PASS_MAX_DAYS   360
PASS_MIN_DAYS   0
PASS_MIN_LEN    8
PASS_WARN_AGE   60

UID_MIN                   500
UID_MAX                 60000

GID_MIN                   500
GID_MAX                 60000

CREATE_HOME     yes

UMASK           077

USERGROUPS_ENAB yes

MD5_CRYPT_ENAB yes

ENCRYPT_METHOD MD5
</pre></code>

===Added Custom PATH Variables===
*Added the following to <code>/etc/profile</code>
<code><pre>
PATH=$PATH:/usr/sbin:/sbin
export PATH
</pre></code>

===Modified Root's Crontab===
*<code>crontab -e</code>
<code><pre>
# Used to update locate database
0 * * * * /usr/bin/updatedb
</pre></code>

===Set Up & Configured NTP===
*Installed NTP
**<code>yum install ntp</code>

*Edited <code>/etc/ntp.conf</code>
<code><pre>
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

restrict 127.0.0.1
restrict -6 ::1

restrict tick.clarkson.edu mask 255.255.255.255 nomodify notrap noquery
restrict tock.clarkson.edu mask 255.255.255.255 nomodify notrap noquery

server tick.clarkson.edu
server tock.clarkson.edu

server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 10

driftfile /var/lib/ntp/drift

keys /etc/ntp/keys
</pre></code>

*Edited <code>/etc/ntp/step-tickers</code>
<code><pre>
tick.clarkson.edu
tock.clarkson.edu
</pre></code>

*Configured ntpd to start on boot
**<code>/sbin/chkconfig --levels 2345 ntpd on</code>

*Started ntpd
**<code>/etc/init.d/ntpd start</code>

====Configured ntpd to Sync Hardware Clock====
*Edited <code>/etc/sysconfig/ntpd</code>
<code><pre>
# Drop root to id 'ntp:ntp' by default.
OPTIONS="-u ntp:ntp -p /var/run/ntpd.pid"

# Set to 'yes' to sync hw clock after successful ntpdate
SYNC_HWCLOCK=yes

# Additional options for ntpdate
NTPDATE_OPTIONS=""
</pre></code>

===Installed and Configured [http://www.apcupsd.org/ APCUPSD]===
This package is used to monitor the UPS which [[Animal]] is plugged into and is used to shutdown the system in the event of a power failure.

====Installed and configured <code>apcupsd</code>====

*Checked that the UPS was detected
**<code>cat /proc/bus/usb/devices</code>
<code><pre>
T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=1.5 MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=051d ProdID=0002 Rev= 1.01
S:  Manufacturer=American Power Conversion
S:  Product=Back-UPS RS 1500 LCD FW:839.H7 .D USB FW:H7
S:  SerialNumber=JB0802018548
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  2mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
E:  Ad=81(I) Atr=03(Int.) MxPS=   6 Ivl=100ms
</pre></code>

*Installed <code>apcupsd</code>
**<code>yum install apcupsd</code>

*Edited <code>/etc/apcupsd/apcupsd.conf</code>
<code><pre>

</pre></code>

*Configured <code>apcupsd</code> to start on boot
**<code>/sbin/chkconfig --levels 2345 apcupsd on</code>

*Started <code>apcupsd</code>
**<code>/etc/init.d/apcupsd start</code>

===Configured Aliases===
*Edited <code>/etc/aliases</code>
<code><pre>
#
#  Aliases in this file will NOT be expanded in the header from
#  Mail, but WILL be visible over networks or from /bin/mail.
#
#       >>>>>>>>>>      The program "newaliases" must be run after
#       >> NOTE >>      this file is updated for any changes to
#       >>>>>>>>>>      show through to sendmail.
#

# Basic system aliases -- these MUST be present.
mailer-daemon:  postmaster
postmaster:     logwatch@cslabs.clarkson.edu

# General redirections for pseudo accounts.
bin:            logwatch@cslabs.clarkson.edu
daemon:         logwatch@cslabs.clarkson.edu
adm:            logwatch@cslabs.clarkson.edu
lp:             logwatch@cslabs.clarkson.edu
sync:           logwatch@cslabs.clarkson.edu
shutdown:       logwatch@cslabs.clarkson.edu
halt:           logwatch@cslabs.clarkson.edu
mail:           logwatch@cslabs.clarkson.edu
news:           logwatch@cslabs.clarkson.edu
uucp:           logwatch@cslabs.clarkson.edu
operator:       logwatch@cslabs.clarkson.edu
games:          logwatch@cslabs.clarkson.edu
gopher:         logwatch@cslabs.clarkson.edu
ftp:            logwatch@cslabs.clarkson.edu
nobody:         logwatch@cslabs.clarkson.edu
radiusd:        logwatch@cslabs.clarkson.edu
nut:            logwatch@cslabs.clarkson.edu
dbus:           logwatch@cslabs.clarkson.edu
vcsa:           logwatch@cslabs.clarkson.edu
canna:          logwatch@cslabs.clarkson.edu
wnn:            logwatch@cslabs.clarkson.edu
rpm:            logwatch@cslabs.clarkson.edu
nscd:           logwatch@cslabs.clarkson.edu
pcap:           logwatch@cslabs.clarkson.edu
apache:         logwatch@cslabs.clarkson.edu
webalizer:      logwatch@cslabs.clarkson.edu
dovecot:        logwatch@cslabs.clarkson.edu
fax:            logwatch@cslabs.clarkson.edu
quagga:         logwatch@cslabs.clarkson.edu
radvd:          logwatch@cslabs.clarkson.edu
pvm:            logwatch@cslabs.clarkson.edu
amanda:         logwatch@cslabs.clarkson.edu
privoxy:        logwatch@cslabs.clarkson.edu
ident:          logwatch@cslabs.clarkson.edu
named:          logwatch@cslabs.clarkson.edu
xfs:            logwatch@cslabs.clarkson.edu
gdm:            logwatch@cslabs.clarkson.edu
mailnull:       logwatch@cslabs.clarkson.edu
postgres:       logwatch@cslabs.clarkson.edu
sshd:           logwatch@cslabs.clarkson.edu
smmsp:          logwatch@cslabs.clarkson.edu
postfix:        logwatch@cslabs.clarkson.edu
netdump:        logwatch@cslabs.clarkson.edu
ldap:           logwatch@cslabs.clarkson.edu
squid:          logwatch@cslabs.clarkson.edu
ntp:            logwatch@cslabs.clarkson.edu
mysql:          logwatch@cslabs.clarkson.edu
desktop:        logwatch@cslabs.clarkson.edu
rpcuser:        logwatch@cslabs.clarkson.edu
rpc:            logwatch@cslabs.clarkson.edu
nfsnobody:      logwatch@cslabs.clarkson.edu

ingres:         logwatch@cslabs.clarkson.edu
system:         logwatch@cslabs.clarkson.edu
toor:           logwatch@cslabs.clarkson.edu
manager:        logwatch@cslabs.clarkson.edu
dumper:         logwatch@cslabs.clarkson.edu
abuse:          logwatch@cslabs.clarkson.edu

newsadm:        news
newsadmin:      news
usenet:         news
ftpadm:         ftp
ftpadmin:       ftp
ftp-adm:        ftp
ftp-admin:      ftp
www:            webmaster
webmaster:      logwatch@cslabs.clarkson.edu
noc:            logwatch@cslabs.clarkson.edu
security:       logwatch@cslabs.clarkson.edu
hostmaster:     logwatch@cslabs.clarkson.edu
info:           postmaster
marketing:      postmaster
sales:          postmaster
support:        postmaster


# trap decode to catch security attacks
decode:         logwatch@cslabs.clarkson.edu

# Person who should get roots's mail
root:           logwatch@cslabs.clarkson.edu
</pre></code>

*Updated aliases
**<code>/usr/bin/newaliases</code>

[[Category:Documentation]]
[[Category:Infrastructure]]