Difference between revisions of "Animal Setup Process"

Revision as of 19:00, 19 May 2009

This page summarizes how Animal was set up in Spring 2009.

Install

Installed CentOS 5.3 x86.
- Partition Scheme
  - 100 MB /boot - Hardware RAID 1
  - 270 GB root_lvg - Logical Volume Group - Hardware RAID 1
    - 262 GB / (root_lvg-root_lv)
    - 4 GB /var (root_lvg-var_lv)
    - 4 GB swap (root_lvg-swap_lv)
  - 1.6 TB /mnt/raidA - Hardware RAID 10
  - 1.6 TB /mnt/raidB - Hardware RAID 10

Kickstart File

Configuration

Updated VM

Added RPMForge Yum Repository
- rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
  - From Dag Wieers

yum install yum-fastestmirror vim-enhanced gcc emacs-nox screen
yum update

Created User

Created user mccarrms
- /usr/sbin/useradd -m mccarrms
Set password for mccarrms
- passwd mccarrms

Configured Sudo

/usr/sbin/visudo

## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.

#User_Alias ADMINS = mccarrms

## Networking
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database
Cmnd_Alias LOCATE = /usr/sbin/updatedb

## Storage
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp

## Processes
Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
Cmnd_Alias DRIVERS = /sbin/modprobe

## Shells
Cmnd_Alias SHELLS = /bin/sh, /bin/bash, /usr/bin/rsh, /bin/dash, /bin/rbash, /bin/su

## Users
Cmnd_Alias USERS = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/userhelper, /usr/sbin/usermod, /usr/sbin/usernetctl

Defaults    requiretty

Defaults    env_reset,tty_tickets,lecture=always,logfile=/var/log/sudo.log
Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
                        _XKB_CHARSET XAUTHORITY"

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
%wheel  ALL=(ALL)       ALL
%admins localhost=/sbin/shutdown -h now

Configured Networks

Configured hostname in /etc/sysconfig/network

NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=animal.cslabs.clarkson.edu
GATEWAY=128.153.145.1

Verified eth0 configuration for Clarkson Network in /etc/sysconfig/network-scripts/ifcfg-eth0

# Intel Corporation 82540EM Gigabit Ethernet Controller
DEVICE=eth0
BOOTPROTO=static
BROADCAST=128.153.145.255
HWADDR=00:C0:9F:2A:32:40
IPADDR=128.153.145.216
NETMASK=255.255.255.0
NETWORK=128.153.145.0
ONBOOT=yes

Verified eth1 configuration for the Internal Network in /etc/sysconfig/network-scripts/ifcfg-eth1

# Intel Corporation 82541PI Gigabit Ethernet Controller
DEVICE=eth1
BOOTPROTO=static
BROADCAST=10.0.0.255
HWADDR=00:1B:21:28:C8:46
IPADDR=10.0.0.19
NETMASK=255.255.255.0
NETWORK=10.0.0.0
ONBOOT=yes

Configured Hosts

Edited /etc/hosts

127.0.0.1       localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
128.153.145.216 animal.cslabs.clarkson.edu animal.cslabs animal
10.0.0.19       animal.int.cslabs.clarkson.edu animal.int.cslabs animal.int

Configured DNS Servers

Edited /etc/resolv.conf

search clarkson.edu
nameserver 128.153.0.254
nameserver 128.153.5.254

Configured IPtables

Due to the sensitivity of this material, this config file has been left off; however, the following rules are needed.

Restarted iptables
- /etc/init.d/iptables restart

Configured SSH

Edited /etc/ssh/sshd_config

Due to the sensitivity of this material, this config file has been left off.

Restarted sshd
- /etc/init.d/sshd restart

Set Up SSH Login Banner

Edited /etc/issue.net

            _            __
 ___ ____  (_)_ _  ___ _/ /
/ _ `/ _ \/ /  ' \/ _ `/ / 
\_,_/_//_/_/_/_/_/\_,_/_/

Configured Password Requirements

Edited /etc/login.defs

MAIL_DIR        /var/spool/mail

PASS_MAX_DAYS   360
PASS_MIN_DAYS   0
PASS_MIN_LEN    8
PASS_WARN_AGE   60

UID_MIN                   500
UID_MAX                 60000

GID_MIN                   500
GID_MAX                 60000

CREATE_HOME     yes

UMASK           077

USERGROUPS_ENAB yes

MD5_CRYPT_ENAB yes

ENCRYPT_METHOD MD5

Added Custom PATH Variables

Added the following to /etc/profile

PATH=$PATH:/usr/sbin:/sbin
export PATH

Modified Root's Crontab

crontab -e

# Used to update locate database
0 * * * * /usr/bin/updatedb

Set Up & Configured NTP

Installed NTP
- yum install ntp

Edited /etc/ntp.conf

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

restrict 127.0.0.1
restrict -6 ::1

restrict tick.clarkson.edu mask 255.255.255.255 nomodify notrap noquery
restrict tock.clarkson.edu mask 255.255.255.255 nomodify notrap noquery

server tick.clarkson.edu
server tock.clarkson.edu

server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 10

driftfile /var/lib/ntp/drift

keys /etc/ntp/keys

Edited /etc/ntp/step-tickers

tick.clarkson.edu
tock.clarkson.edu

Configured ntpd to start on boot
- /sbin/chkconfig --levels 2345 ntpd on

Started ntpd
- /etc/init.d/ntpd start

Configured ntpd to Sync Hardware Clock

Edited /etc/sysconfig/ntpd

# Drop root to id 'ntp:ntp' by default.
OPTIONS="-u ntp:ntp -p /var/run/ntpd.pid"

# Set to 'yes' to sync hw clock after successful ntpdate
SYNC_HWCLOCK=yes

# Additional options for ntpdate
NTPDATE_OPTIONS=""

Installed and Configured APCUPSD

This package is used to monitor the UPS which Animal is plugged into and is used to shutdown the system in the event of a power failure.

Installed and configured `apcupsd`

Checked that the UPS was detected
- cat /proc/bus/usb/devices

T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=1.5 MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=051d ProdID=0002 Rev= 1.01
S:  Manufacturer=American Power Conversion
S:  Product=Back-UPS RS 1500 LCD FW:839.H7 .D USB FW:H7
S:  SerialNumber=JB0802018548
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  2mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
E:  Ad=81(I) Atr=03(Int.) MxPS=   6 Ivl=100ms

Installed apcupsd
- yum install apcupsd

Edited /etc/apcupsd/apcupsd.conf

Configured apcupsd to start on boot
- /sbin/chkconfig --levels 2345 apcupsd on

Started apcupsd
- /etc/init.d/apcupsd start

Configured Aliases

Edited /etc/aliases

#
#  Aliases in this file will NOT be expanded in the header from
#  Mail, but WILL be visible over networks or from /bin/mail.
#
#       >>>>>>>>>>      The program "newaliases" must be run after
#       >> NOTE >>      this file is updated for any changes to
#       >>>>>>>>>>      show through to sendmail.
#

# Basic system aliases -- these MUST be present.
mailer-daemon:  postmaster
postmaster:     logwatch@cslabs.clarkson.edu

# General redirections for pseudo accounts.
bin:            logwatch@cslabs.clarkson.edu
daemon:         logwatch@cslabs.clarkson.edu
adm:            logwatch@cslabs.clarkson.edu
lp:             logwatch@cslabs.clarkson.edu
sync:           logwatch@cslabs.clarkson.edu
shutdown:       logwatch@cslabs.clarkson.edu
halt:           logwatch@cslabs.clarkson.edu
mail:           logwatch@cslabs.clarkson.edu
news:           logwatch@cslabs.clarkson.edu
uucp:           logwatch@cslabs.clarkson.edu
operator:       logwatch@cslabs.clarkson.edu
games:          logwatch@cslabs.clarkson.edu
gopher:         logwatch@cslabs.clarkson.edu
ftp:            logwatch@cslabs.clarkson.edu
nobody:         logwatch@cslabs.clarkson.edu
radiusd:        logwatch@cslabs.clarkson.edu
nut:            logwatch@cslabs.clarkson.edu
dbus:           logwatch@cslabs.clarkson.edu
vcsa:           logwatch@cslabs.clarkson.edu
canna:          logwatch@cslabs.clarkson.edu
wnn:            logwatch@cslabs.clarkson.edu
rpm:            logwatch@cslabs.clarkson.edu
nscd:           logwatch@cslabs.clarkson.edu
pcap:           logwatch@cslabs.clarkson.edu
apache:         logwatch@cslabs.clarkson.edu
webalizer:      logwatch@cslabs.clarkson.edu
dovecot:        logwatch@cslabs.clarkson.edu
fax:            logwatch@cslabs.clarkson.edu
quagga:         logwatch@cslabs.clarkson.edu
radvd:          logwatch@cslabs.clarkson.edu
pvm:            logwatch@cslabs.clarkson.edu
amanda:         logwatch@cslabs.clarkson.edu
privoxy:        logwatch@cslabs.clarkson.edu
ident:          logwatch@cslabs.clarkson.edu
named:          logwatch@cslabs.clarkson.edu
xfs:            logwatch@cslabs.clarkson.edu
gdm:            logwatch@cslabs.clarkson.edu
mailnull:       logwatch@cslabs.clarkson.edu
postgres:       logwatch@cslabs.clarkson.edu
sshd:           logwatch@cslabs.clarkson.edu
smmsp:          logwatch@cslabs.clarkson.edu
postfix:        logwatch@cslabs.clarkson.edu
netdump:        logwatch@cslabs.clarkson.edu
ldap:           logwatch@cslabs.clarkson.edu
squid:          logwatch@cslabs.clarkson.edu
ntp:            logwatch@cslabs.clarkson.edu
mysql:          logwatch@cslabs.clarkson.edu
desktop:        logwatch@cslabs.clarkson.edu
rpcuser:        logwatch@cslabs.clarkson.edu
rpc:            logwatch@cslabs.clarkson.edu
nfsnobody:      logwatch@cslabs.clarkson.edu

ingres:         logwatch@cslabs.clarkson.edu
system:         logwatch@cslabs.clarkson.edu
toor:           logwatch@cslabs.clarkson.edu
manager:        logwatch@cslabs.clarkson.edu
dumper:         logwatch@cslabs.clarkson.edu
abuse:          logwatch@cslabs.clarkson.edu

newsadm:        news
newsadmin:      news
usenet:         news
ftpadm:         ftp
ftpadmin:       ftp
ftp-adm:        ftp
ftp-admin:      ftp
www:            webmaster
webmaster:      logwatch@cslabs.clarkson.edu
noc:            logwatch@cslabs.clarkson.edu
security:       logwatch@cslabs.clarkson.edu
hostmaster:     logwatch@cslabs.clarkson.edu
info:           postmaster
marketing:      postmaster
sales:          postmaster
support:        postmaster


# trap decode to catch security attacks
decode:         logwatch@cslabs.clarkson.edu

# Person who should get roots's mail
root:           logwatch@cslabs.clarkson.edu

Updated aliases
- /usr/bin/newaliases

@@ Line 157: / Line 157: @@
 *Edited <code>/etc/issue.net</code>
 <code><pre>
+            _            __
+ ___ ____  (_)_ _  ___ _/ /
+/ _ `/ _ \/ /  ' \/ _ `/ /
+\_,_/_//_/_/_/_/_/\_,_/_/
 </pre></code>

Difference between revisions of "Animal Setup Process"

Revision as of 19:00, 19 May 2009

Contents

Install

Kickstart File

Configuration

Updated VM

Created User

Configured Sudo

Configured Networks

Configured Hosts

Configured DNS Servers

Configured IPtables

Configured SSH

Set Up SSH Login Banner

Configured Password Requirements

Added Custom PATH Variables

Modified Root's Crontab

Set Up & Configured NTP

Configured ntpd to Sync Hardware Clock

Installed and Configured APCUPSD

Installed and configured `apcupsd`

Configured Aliases

Navigation menu

Views

Personal tools

Navigation

Search

Tools

Difference between revisions of "Animal Setup Process"

Revision as of 19:00, 19 May 2009

Contents

Install

Kickstart File

Configuration

Updated VM

Created User

Configured Sudo

Configured Networks

Configured Hosts

Configured DNS Servers

Configured IPtables

Configured SSH

Set Up SSH Login Banner

Configured Password Requirements

Added Custom PATH Variables

Modified Root's Crontab

Set Up & Configured NTP

Configured ntpd to Sync Hardware Clock

Installed and Configured APCUPSD

Installed and configured apcupsd

Configured Aliases

Navigation menu

Search

Installed and configured `apcupsd`