Difference between revisions of "Mirror Setup Process"

From CSLabsWiki
Jump to: navigation, search
m (Installed and Configured APCUPSD)
 
(73 intermediate revisions by 3 users not shown)
Line 1: Line 1:
This page summarizes how [[Mirror]] was set up in Spring 2009.
+
[[Category:Server Setup Documentation]]
  
==Install==
+
This page summarizes how [[Old Mirror]] was set up in Spring 2014.
*Installed CentOS 5.3 x64.
 
**Partition Scheme
 
***
 
***
 
***
 
  
==Configuration==
+
=Install=
===Updated VM===
+
See [[Debian Server Setup]]
*Added RPMForge Yum Repository
 
**<code>rpm -Uhv http://apt.sw.be/redhat/el5/en/x86_64/rpmforge/RPMS//rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm</code>
 
***From [http://dag.wieers.com/rpm/FAQ.php#B2 Dag Wieers]
 
  
*<code>yum install yum-fastestmirror vim-enhanced gcc emacs-nox screen</code>
+
==Debian 7 x64==
*<code>yum update</code>
+
*71 GB  / - Software RAID 1
 +
*4GB Swap per OS Drive
  
===Created Users===
+
=Setup=
*Created user mccarrms
+
See [[Debian Server Setup]]
**<code>/usr/sbin/useradd -m mccarrms</code>
 
*Set password for mccarrms
 
**<code>passwd mccarrms</code>
 
*Created user ignazirj
 
**<code>/usr/sbin/useradd -m ignazirj</code>
 
*Set password for ignazirj
 
**<code>passwd ignazirj</code>
 
  
 +
==Raid==
 +
*sda sdb sdc sde sdg sdh
 +
*/dev/md2
 +
*Software RAID 10
 +
*/storage xfs
  
===Configured Sudo===
+
==Networking==
*<code>/usr/sbin/visudo</code>
 
  
<code><pre>
+
===eth2===
## Sudoers allows particular users to run various commands as
+
*Intel Corporation 82541PI Gigabit Ethernet Controller
## the root user, without needing the root password.
+
*HWADDR=00:1B:21:28:C8:48
 
+
*IPADDR=128.153.145.19
## Networking
 
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
 
 
 
## Installation and management of software
 
Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
 
 
 
## Services
 
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
 
 
 
## Updating the locate database
 
Cmnd_Alias LOCATE = /usr/sbin/updatedb
 
 
 
## Storage
 
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
 
 
 
## Delegating permissions
 
Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
 
 
 
## Processes
 
Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
 
 
 
## Drivers
 
Cmnd_Alias DRIVERS = /sbin/modprobe
 
 
 
## Shells
 
Cmnd_Alias SHELLS = /bin/sh, /bin/bash, /usr/bin/rsh, /bin/dash, /bin/rbash, /bin/su
 
 
 
## Users
 
Cmnd_Alias USERS = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/userhelper, /usr/sbin/usermod, /usr/sbin/usernetctl
 
 
 
Defaults    requiretty
 
 
 
Defaults    env_reset,tty_tickets,lecture=always,logfile=/var/log/sudo.log
 
Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
 
                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
 
                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
 
                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
 
                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
 
                        _XKB_CHARSET XAUTHORITY"
 
 
 
## Allow root to run any commands anywhere
 
root    ALL=(ALL)      ALL
 
%wheel  ALL=(ALL)      ALL
 
</pre></code>
 
 
 
===Configured Networks===
 
*Configured hostname in <code>/etc/sysconfig/network</code>
 
<code><pre>
 
NETWORKING=yes
 
NETWORKING_IPV6=no
 
HOSTNAME=mirror.clarkson.edu
 
GATEWAY=128.153.145.1
 
</pre></code>
 
 
 
*Verified eth0 configuration for Clarkson Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth0</code>
 
<code><pre>
 
# Intel Corporation 82541PI Gigabit Ethernet Controller
 
DEVICE=eth0
 
BOOTPROTO=static
 
BROADCAST=128.153.145.255
 
HWADDR=00:1B:21:28:C8:48
 
IPADDR=128.153.145.19
 
NETMASK=255.255.255.0
 
NETWORK=128.153.145.0
 
ONBOOT=yes
 
</pre></code>
 
  
*Verified eth1 configuration for the Server Room Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth1</code>
+
===eth1===
<code><pre>
+
*Intel Corporation 82566DM-2 Gigabit Network Connection
# Intel Corporation 82566DM-2 Gigabit Network Connection
+
*HWADDR=00:30:48:9A:DB:26
DEVICE=eth1
+
*IPADDR=10.0.1.36
BOOTPROTO=static
 
BROADCAST=10.0.1.255
 
HWADDR=00:30:48:9A:DB:26
 
IPADDR=10.0.1.36
 
NETMASK=255.255.255.0
 
NETWORK=10.0.1.0
 
ONBOOT=yes
 
</pre></code>
 
  
*Verified eth2 configuration for the Internal Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth2</code>
+
===eth3===
<code><pre>
+
*Intel Corporation 82573L Gigabit Ethernet Controller
# Intel Corporation 82573L Gigabit Ethernet Controller
+
*HWADDR=00:30:48:9A:DB:27
DEVICE=eth2
+
*IPADDR=10.0.0.14
BOOTPROTO=static
 
BROADCAST=10.0.0.255
 
HWADDR=00:30:48:9A:DB:27
 
IPADDR=10.0.0.14
 
NETMASK=255.255.255.0
 
NETWORK=10.0.0.0
 
ONBOOT=yes
 
</pre></code>
 
  
====Configured Hosts====
+
==Set Up SSH Login Banner==
*Edited <code>/etc/hosts</code>
+
/etc/issue.net
<code><pre>
 
127.0.0.1      localhost.localdomain localhost
 
::1            localhost6.localdomain6 localhost6
 
128.153.145.19  mirror.clarkson.edu mirror.cslabs.clarkson.edu mirror.cslabs mirror
 
10.0.1.36      mirror.sr.cslabs.clarkson.edu mirror.sr.cslabs mirror.sr
 
10.0.0.14      mirror.int.cslabs.clarkson.edu mirror.int.cslabs mirror.int
 
</pre></code>
 
 
 
====Configured DNS Servers====
 
*Edited <code>/etc/resolv.conf</code>
 
<code><pre>
 
search clarkson.edu
 
nameserver 128.153.0.254
 
nameserver 128.153.5.254
 
</pre></code>
 
 
 
===Configured IPtables===
 
<code><pre>
 
Due to the sensitivity of this material, this config file has been left off; however, the following rules are needed.
 
</pre></code>
 
*Restarted iptables
 
**<code>/etc/init.d/iptables restart</code>
 
 
 
===Configured SSH===
 
*Edited <code>/etc/ssh/sshd_config</code>
 
<code><pre>
 
Due to the sensitivity of this material, this config file has been left off.
 
</pre></code>
 
*Restarted sshd
 
**<code>/etc/init.d/sshd restart</code>
 
 
 
====Set Up SSH Login Banner====
 
*Edited <code>/etc/issue.net</code>
 
 
<code><pre>
 
<code><pre>
 
         _                 
 
         _                 
Line 170: Line 45:
 
                            
 
                            
 
</pre></code>
 
</pre></code>
 +
==SSHD config==
 +
uncomment
 +
Banner /etc/issue.net
  
===Configured Password Requirements===
+
==Installed nginx==
*Edited <code>/etc/login.defs</code>
+
apt-get install install nginx
<code><pre>
 
MAIL_DIR        /var/spool/mail
 
 
 
PASS_MAX_DAYS  360
 
PASS_MIN_DAYS  0
 
PASS_MIN_LEN    8
 
PASS_WARN_AGE  60
 
  
UID_MIN                  500
+
==Configure rsync to run as a daemon==
UID_MAX                60000
+
*Installed <code>xinetd</code>
 +
apt-get install rsync
  
GID_MIN                  500
+
*Configured rsync /etc/rsyncd.conf
GID_MAX                60000
 
 
 
CREATE_HOME    yes
 
 
 
UMASK          077
 
 
 
USERGROUPS_ENAB yes
 
 
 
MD5_CRYPT_ENAB yes
 
 
 
ENCRYPT_METHOD MD5
 
</pre></code>
 
 
 
===Added Custom PATH Variables===
 
*Added the following to <code>/etc/profile</code>
 
 
<code><pre>
 
<code><pre>
PATH=$PATH:/usr/sbin:/sbin
+
uid = nobody
export PATH
+
gid = nogroup
</pre></code>
+
use chroot = yes
 +
max connections = 20
 +
pid file = /var/run/rsyncd.pid
 +
motd file = /etc/rsyncd.motd
 +
log file = /var/log/rsync.log
 +
transfer logging = yes
 +
log format = %t %a %m %f %b
 +
syslog facility = local3
 +
timeout = 900
 +
dont compress = *.gz *.tgz *.zip *.z *.Z *.rpm *.deb *.bz2
 +
refuse options = checksum
  
===Modified Root's Crontab===
+
[name]
*<code>crontab -e</code>
+
  comment = Name of Repository
<code><pre>
+
  path = /storage/repository
# Used to update locate database
+
  exclude = lost+found/
0 * * * * /usr/bin/updatedb
+
  read only = true
</pre></code>
+
  ignore nonreadable = yes</pre></code>
  
===Set Up & Configured NTP===
+
*Created rsync motd /etc/rsyncd.motd
*Installed NTP
 
**<code>yum install ntp</code>
 
 
 
*Edited <code>/etc/ntp.conf</code>
 
 
<code><pre>
 
<code><pre>
restrict default kod nomodify notrap nopeer noquery
+
###############################################################
restrict -6 default kod nomodify notrap nopeer noquery
 
  
restrict 127.0.0.1
+
The Clarkson University mirror is located in Potsdam, NY, US.
restrict -6 ::1
 
  
restrict tick.clarkson.edu mask 255.255.255.255 nomodify notrap noquery
+
This mirror is operated by the Clarkson Open Source Institute.
restrict tock.clarkson.edu mask 255.255.255.255 nomodify notrap noquery
+
http://cosi.clarkson.edu/
  
server tick.clarkson.edu
+
If you have any questions or problems, please email
server tock.clarkson.edu
+
mirror-admin@cslabs.clarkson.edu.
  
server  127.127.1.0    # local clock
+
Recent changes can be found at
fudge  127.127.1.0 stratum 10
+
http://status.cslabs.clarkson.edu/tag/mirror.
  
driftfile /var/lib/ntp/drift
+
###############################################################
 
 
keys /etc/ntp/keys
 
 
</pre></code>
 
</pre></code>
  
*Edited <code>/etc/ntp/step-tickers</code>
+
==Set Up Fedora Mirror Manager==
<code><pre>
+
*Installed mirrormanager
tick.clarkson.edu
+
cd /usr/local/sbin
tock.clarkson.edu
+
git clone git://git.fedorahosted.org/mirrormanager/
</pre></code>
+
ln -s /usr/local/sbin/mirrormanager/client/report_mirror /usr/local/sbin/report_mirror
 +
  
*Configured ntpd to start on boot
+
*Configured mirrormanager
**<code>/sbin/chkconfig --levels 35 ntpd on</code>
+
**Modified /etc/mirrormanager-client/report_mirror.conf
 
 
*Started ntpd
 
**<code>/etc/init.d/ntpd start</code>
 
 
 
====Configured ntpd to Sync Hardware Clock====
 
*Edited <code>/etc/sysconfig/ntpd</code>
 
<code><pre>
 
# Drop root to id 'ntp:ntp' by default.
 
OPTIONS="-u ntp:ntp -p /var/run/ntpd.pid"
 
 
 
# Set to 'yes' to sync hw clock after successful ntpdate
 
SYNC_HWCLOCK=yes
 
 
 
# Additional options for ntpdate
 
NTPDATE_OPTIONS=""
 
</pre></code>
 
 
 
===Installed and Configured [http://www.apcupsd.org/ APCUPSD]===
 
This package is used to monitor the UPS which [[Mirror]] is plugged into and is used to shutdown the system in the event of a power failure.
 
 
 
====Configured to Power On when Power is Restored====
 
*Edited the BIOS to have <code>Restore on AC/Power Loss</code> set to <code>Power On</code>.
 
 
 
====Installed and configured <code>apcupsd</code>====
 
*Installed <code>apcupsd</code>
 
**<code>yum install apcupsd</code>
 
 
 
*Edited <code>/etc/apcupsd/apcupsd.conf</code>
 
 
<code><pre>
 
<code><pre>
## apcupsd.conf v1.1 ##
+
[global]
 
+
# if enabled=0, no data is sent to the database
UPSNAME ups3
+
enabled=1
 
+
# server= is the URL to the MirrorManager XML-RPC interface
UPSCABLE ether
+
server=https://admin.fedoraproject.org/mirrormanager/xmlrpc
 
 
UPSTYPE net
 
DEVICE 128.153.145.215:3551
 
 
 
LOCKFILE /var/lock
 
 
 
SCRIPTDIR /etc/apcupsd
 
 
 
PWRFAILDIR /etc/apcupsd
 
 
 
NOLOGINDIR /etc
 
 
 
ONBATTERYDELAY 6
 
 
 
BATTERYLEVEL 10
 
 
 
MINUTES 15
 
 
 
TIMEOUT 0
 
 
 
ANNOY 300
 
 
 
ANNOYDELAY 60
 
 
 
NOLOGON disable
 
 
 
KILLDELAY 0
 
 
 
NETSERVER on
 
 
 
NISIP 127.0.0.1
 
 
 
NISPORT 3551
 
 
 
EVENTSFILE /var/log/apcupsd.events
 
 
 
EVENTSFILEMAX 10
 
 
 
UPSCLASS standalone
 
  
UPSMODE disable
 
  
STATTIME 0
+
[site]
 +
# if enabled=0, no data about this site is sent to the database
 +
enabled=1
 +
# Name and Password fields need to match the Site name and password
 +
# fields you entered for your Site in the MirrorManager database at
 +
# https://admin.fedoraproject.org/mirrormanager
 +
name=Clarkson University
 +
password=<PASSWORD GOES HERE>
  
STATFILE /var/log/apcupsd.status
+
[host]
 +
# if enabled=0, no data about this host is sent to the database
 +
enabled=1
 +
# Name field need to match the Host name field you entered for your
 +
# Host in the MirrorManager database at
 +
# https://admin.fedoraproject.org/mirrormanager
 +
name=mirror.clarkson.edu
 +
# if user_active=0, no data about this category is given to the public
 +
# This can be used to toggle between serving and not serving data,
 +
# such enabled during the nighttime (when you have more idle bandwidth
 +
# available) and disabled during the daytime.
 +
# By not specifying user_active, the database will not be updated.
 +
# user_active=1
  
LOGSTATS off
+
[stats]
 +
# Stats are only sent when run with the -s option
 +
# and when this section is enabled.
 +
# This feature is not presently implemented
 +
enabled=0
 +
apache=/var/log/httpd/access_log
 +
vsftpd=/var/log/vsftpd.log
 +
# remember to enable log file and transfer logging in rsyncd.conf
 +
rsyncd=/var/log/rsyncd.log
  
DATATIME 0
 
 
SELFTEST 336
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/offbattery</code>
+
# Content Categories
<code><pre>
+
# These sections match the Categories for content tracked by MirrorManager.
#!/bin/sh
 
 
#
 
#
# This shell script if placed in /etc/apcupsd
+
# enabled=1 means information about this category will be sent to the database.
# will be called by /etc/apcupsd/apccontrol when the
+
# enabled=0, no data about this host is sent to the database. If the
# UPS goes back on to the mains after a power failure.
+
# database already has information for you for this Category, it will
# We send an email message to root to notify him.
+
# remain unchanged.  This can be used to update the database after you
 +
# have manually synced some infrequently-updated content, such as
 +
# historical releases.
 
#
 
#
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
+
# path= is the path on your local disk to the top-level directory for this Category
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Linux]
MSG="$HOSTNAME Power has returned"
+
enabled=1
#
+
path=/usr/share/nginx/www/fedora/linux
(
+
 
  echo "Subject: $MSG"
+
[Fedora EPEL]
  echo " "
+
enabled=1
  echo "$MSG"
+
path=/usr/share/nginx/www/epel
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/onbattery</code>
+
# lesser used categories below
<code><pre>
 
#!/bin/sh
 
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when the UPS
 
# goes on batteries.
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Web]
MSG="$HOSTNAME Power Failure !!!"
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/fedora/web
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/commfailure</code>
+
[Fedora Secondary Arches]
<code><pre>
+
enabled=0
#!/bin/sh
+
path=/usr/share/nginx/www/pub/fedora-secondary
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when apcupsd
 
# loses contact with the UPS (i.e. the serial connection is not responding).
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Other]
MSG="$HOSTNAME Communications with UPS lost"
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/alt
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/commok</code>
+
# historical content
<code><pre>
 
#!/bin/sh
 
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when apcupsd
 
# restores contact with the UPS (i.e. the serial connection is restored).
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Core]
MSG="$HOSTNAME Communications with UPS restored"
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/fedora/linux/core
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/changeme</code>
+
[Fedora Extras]
<code><pre>
+
enabled=0
#!/bin/sh
+
path=/usr/share/nginx/www/pub/fedora/linux/extras
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when apcupsd
 
# detects that the battery should be replaced.
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Archive]
MSG="$HOSTNAME UPS battery needs changing NOW."
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/fedora-archive
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
 
</pre></code>
 
</pre></code>
  
*Configured <code>apcupsd</code> to start on boot
+
*Added cron entries for root
**<code>/sbin/chkconfig --levels 2345 apcupsd on</code>
 
 
 
*Started <code>apcupsd</code>
 
**<code>/etc/init.d/apcupsd start</code>
 
 
 
===Installed Apache===
 
*Installed <code>httpd</code>
 
**<code>yum install httpd</code>
 
 
 
*Modified <code>/etc/httpd/conf/httpd.conf</code>
 
 
<code><pre>
 
<code><pre>
ServerTokens Prod
+
# Dir sizes
 +
0 0 * * * /usr/local/bin/dir_sizes.sh
  
ServerRoot "/etc/httpd"
+
# backup
 +
45 0 * * * /bin/nice -n 19 /usr/bin/ionice -c2 -n7 /usr/local/bin/backup.sh
  
PidFile run/httpd.pid
+
10 0 * * * /usr/local/sbin/report_mirror
 
 
Timeout 120
 
 
 
KeepAlive Off
 
 
 
MaxKeepAliveRequests 100
 
 
 
KeepAliveTimeout 15
 
 
 
<IfModule prefork.c>
 
StartServers      8
 
MinSpareServers    5
 
MaxSpareServers  20
 
ServerLimit      256
 
MaxClients      150
 
MaxRequestsPerChild  1000
 
</IfModule>
 
 
 
<IfModule worker.c>
 
StartServers        2
 
MaxClients        150
 
MinSpareThreads    25
 
MaxSpareThreads    75
 
ThreadsPerChild    25
 
MaxRequestsPerChild  0
 
</IfModule>
 
 
 
Listen 80
 
 
 
LoadModule auth_basic_module modules/mod_auth_basic.so
 
LoadModule auth_digest_module modules/mod_auth_digest.so
 
LoadModule authn_file_module modules/mod_authn_file.so
 
LoadModule authn_alias_module modules/mod_authn_alias.so
 
LoadModule authn_anon_module modules/mod_authn_anon.so
 
LoadModule authn_dbm_module modules/mod_authn_dbm.so
 
LoadModule authn_default_module modules/mod_authn_default.so
 
LoadModule authz_host_module modules/mod_authz_host.so
 
LoadModule authz_user_module modules/mod_authz_user.so
 
LoadModule authz_owner_module modules/mod_authz_owner.so
 
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
 
LoadModule authz_dbm_module modules/mod_authz_dbm.so
 
LoadModule authz_default_module modules/mod_authz_default.so
 
LoadModule ldap_module modules/mod_ldap.so
 
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
 
LoadModule include_module modules/mod_include.so
 
LoadModule log_config_module modules/mod_log_config.so
 
LoadModule logio_module modules/mod_logio.so
 
LoadModule env_module modules/mod_env.so
 
LoadModule ext_filter_module modules/mod_ext_filter.so
 
LoadModule mime_magic_module modules/mod_mime_magic.so
 
LoadModule expires_module modules/mod_expires.so
 
LoadModule deflate_module modules/mod_deflate.so
 
LoadModule headers_module modules/mod_headers.so
 
LoadModule usertrack_module modules/mod_usertrack.so
 
LoadModule setenvif_module modules/mod_setenvif.so
 
LoadModule mime_module modules/mod_mime.so
 
LoadModule dav_module modules/mod_dav.so
 
LoadModule status_module modules/mod_status.so
 
LoadModule autoindex_module modules/mod_autoindex.so
 
LoadModule info_module modules/mod_info.so
 
LoadModule dav_fs_module modules/mod_dav_fs.so
 
LoadModule vhost_alias_module modules/mod_vhost_alias.so
 
LoadModule negotiation_module modules/mod_negotiation.so
 
LoadModule dir_module modules/mod_dir.so
 
LoadModule actions_module modules/mod_actions.so
 
LoadModule speling_module modules/mod_speling.so
 
LoadModule userdir_module modules/mod_userdir.so
 
LoadModule alias_module modules/mod_alias.so
 
LoadModule rewrite_module modules/mod_rewrite.so
 
LoadModule proxy_module modules/mod_proxy.so
 
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
 
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
 
LoadModule proxy_http_module modules/mod_proxy_http.so
 
LoadModule proxy_connect_module modules/mod_proxy_connect.so
 
LoadModule cache_module modules/mod_cache.so
 
LoadModule suexec_module modules/mod_suexec.so
 
LoadModule disk_cache_module modules/mod_disk_cache.so
 
LoadModule file_cache_module modules/mod_file_cache.so
 
LoadModule mem_cache_module modules/mod_mem_cache.so
 
LoadModule cgi_module modules/mod_cgi.so
 
LoadModule version_module modules/mod_version.so
 
 
 
Include conf.d/*.conf
 
 
 
User apache
 
Group apache
 
 
 
ServerAdmin mirror-admin@cslabs.clarkson.edu
 
 
 
UseCanonicalName Off
 
 
 
DocumentRoot "/var/www/html"
 
 
 
<Directory />
 
    Options FollowSymLinks
 
    AllowOverride None
 
</Directory>
 
 
 
<Directory "/var/www/html">
 
    Options Indexes FollowSymLinks
 
    AllowOverride None
 
    Order allow,deny
 
    Allow from all
 
</Directory>
 
 
 
<IfModule mod_userdir.c>
 
    UserDir disable
 
</IfModule>
 
 
 
DirectoryIndex index.html index.html.var
 
 
 
AccessFileName .htaccess
 
 
 
<Files ~ "^\.ht">
 
    Order allow,deny
 
    Deny from all
 
</Files>
 
 
 
TypesConfig /etc/mime.types
 
 
 
DefaultType text/plain
 
 
 
<IfModule mod_mime_magic.c>
 
#  MIMEMagicFile /usr/share/magic.mime
 
    MIMEMagicFile conf/magic
 
</IfModule>
 
 
 
HostnameLookups Off
 
 
 
ErrorLog logs/error_log
 
 
 
LogLevel warn
 
 
 
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
 
LogFormat "%h %l %u %t \"%r\" %>s %b" common
 
LogFormat "%{Referer}i -> %U" referer
 
LogFormat "%{User-agent}i" agent
 
 
 
CustomLog logs/access_log combined
 
 
 
ServerSignature On
 
 
 
Alias /icons/ "/var/www/icons/"
 
 
 
<Directory "/var/www/icons">
 
    Options Indexes MultiViews
 
    AllowOverride None
 
    Order allow,deny
 
    Allow from all
 
</Directory>
 
 
 
<IfModule mod_dav_fs.c>
 
    # Location of the WebDAV lock database.
 
    DAVLockDB /var/lib/dav/lockdb
 
</IfModule>
 
 
 
ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
 
 
 
<Directory "/var/www/cgi-bin">
 
    AllowOverride None
 
    Options None
 
    Order allow,deny
 
    Allow from all
 
</Directory>
 
 
 
IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable
 
 
 
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
 
 
 
AddIconByType (TXT,/icons/text.gif) text/*
 
AddIconByType (IMG,/icons/image2.gif) image/*
 
AddIconByType (SND,/icons/sound2.gif) audio/*
 
AddIconByType (VID,/icons/movie.gif) video/*
 
 
 
AddIcon /icons/binary.gif .bin .exe
 
AddIcon /icons/binhex.gif .hqx
 
AddIcon /icons/tar.gif .tar
 
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
 
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
 
AddIcon /icons/a.gif .ps .ai .eps
 
AddIcon /icons/layout.gif .html .shtml .htm .pdf
 
AddIcon /icons/text.gif .txt
 
AddIcon /icons/c.gif .c
 
AddIcon /icons/p.gif .pl .py
 
AddIcon /icons/f.gif .for
 
AddIcon /icons/dvi.gif .dvi
 
AddIcon /icons/uuencoded.gif .uu
 
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
 
AddIcon /icons/tex.gif .tex
 
AddIcon /icons/bomb.gif core
 
 
 
AddIcon /icons/back.gif ..
 
AddIcon /icons/hand.right.gif README
 
AddIcon /icons/folder.gif ^^DIRECTORY^^
 
AddIcon /icons/blank.gif ^^BLANKICON^^
 
 
 
DefaultIcon /icons/unknown.gif
 
 
 
ReadmeName README.html
 
HeaderName HEADER.html
 
 
 
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
 
 
 
AddLanguage ca .ca
 
AddLanguage cs .cz .cs
 
AddLanguage da .dk
 
AddLanguage de .de
 
AddLanguage el .el
 
AddLanguage en .en
 
AddLanguage eo .eo
 
AddLanguage es .es
 
AddLanguage et .et
 
AddLanguage fr .fr
 
AddLanguage he .he
 
AddLanguage hr .hr
 
AddLanguage it .it
 
AddLanguage ja .ja
 
AddLanguage ko .ko
 
AddLanguage ltz .ltz
 
AddLanguage nl .nl
 
AddLanguage nn .nn
 
AddLanguage no .no
 
AddLanguage pl .po
 
AddLanguage pt .pt
 
AddLanguage pt-BR .pt-br
 
AddLanguage ru .ru
 
AddLanguage sv .sv
 
AddLanguage zh-CN .zh-cn
 
AddLanguage zh-TW .zh-tw
 
 
 
LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW
 
 
 
ForceLanguagePriority Prefer Fallback
 
 
 
AddDefaultCharset UTF-8
 
 
 
AddType application/x-compress .Z
 
AddType application/x-gzip .gz .tgz
 
 
 
AddHandler type-map var
 
 
 
AddType text/html .shtml
 
AddOutputFilter INCLUDES .shtml
 
 
 
Alias /error/ "/var/www/error/"
 
 
 
<IfModule mod_negotiation.c>
 
<IfModule mod_include.c>
 
    <Directory "/var/www/error">
 
        AllowOverride None
 
        Options IncludesNoExec
 
        AddOutputFilter Includes html
 
        AddHandler type-map var
 
        Order allow,deny
 
        Allow from all
 
        LanguagePriority en es de fr
 
        ForceLanguagePriority Prefer Fallback
 
    </Directory>
 
 
 
</IfModule>
 
</IfModule>
 
 
 
BrowserMatch "Mozilla/2" nokeepalive
 
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
 
BrowserMatch "RealPlayer 4\.0" force-response-1.0
 
BrowserMatch "Java/1\.0" force-response-1.0
 
BrowserMatch "JDK/1\.0" force-response-1.0
 
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
 
BrowserMatch "MS FrontPage" redirect-carefully
 
BrowserMatch "^WebDrive" redirect-carefully
 
BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
 
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
 
BrowserMatch "^XML Spy" redirect-carefully
 
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
 
 
</pre></code>
 
</pre></code>
  
*Removed unneeded files
 
**<code>rm /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/proxy_ajp.conf</code>
 
 
*Configured Apache to start on boot
 
**<code>/sbin/chkconfig --levels 345 httpd on</code>
 
 
*Started Apache
 
**<code>/etc/init.d/httpd start</code>
 
  
[[Category:Documentation]]
+
[[mirror rsync setup|Setup Rsync Scripts]]
[[Category:Infrastructure]]
 

Latest revision as of 22:05, 27 April 2016


This page summarizes how Old Mirror was set up in Spring 2014.

Install

See Debian Server Setup

Debian 7 x64

  • 71 GB / - Software RAID 1
  • 4GB Swap per OS Drive

Setup

See Debian Server Setup

Raid

  • sda sdb sdc sde sdg sdh
  • /dev/md2
  • Software RAID 10
  • /storage xfs

Networking

eth2

  • Intel Corporation 82541PI Gigabit Ethernet Controller
  • HWADDR=00:1B:21:28:C8:48
  • IPADDR=128.153.145.19

eth1

  • Intel Corporation 82566DM-2 Gigabit Network Connection
  • HWADDR=00:30:48:9A:DB:26
  • IPADDR=10.0.1.36

eth3

  • Intel Corporation 82573L Gigabit Ethernet Controller
  • HWADDR=00:30:48:9A:DB:27
  • IPADDR=10.0.0.14

Set Up SSH Login Banner

/etc/issue.net

         _                 
  __ _  (_)__________  ____
 /  ' \/ / __/ __/ _ \/ __/
/_/_/_/_/_/ /_/  \___/_/   
                           

SSHD config

uncomment

Banner /etc/issue.net

Installed nginx

apt-get install install nginx

Configure rsync to run as a daemon

  • Installed xinetd
apt-get install rsync
  • Configured rsync /etc/rsyncd.conf
uid = nobody
gid = nogroup
use chroot = yes
max connections = 20
pid file = /var/run/rsyncd.pid
motd file = /etc/rsyncd.motd
log file = /var/log/rsync.log
transfer logging = yes
log format = %t %a %m %f %b
syslog facility = local3
timeout = 900
dont compress = *.gz *.tgz *.zip *.z *.Z *.rpm *.deb *.bz2
refuse options = checksum

[name]
  comment = Name of Repository
  path = /storage/repository
  exclude = lost+found/
  read only = true
  ignore nonreadable = yes
  • Created rsync motd /etc/rsyncd.motd
###############################################################

The Clarkson University mirror is located in Potsdam, NY, US.

This mirror is operated by the Clarkson Open Source Institute.
http://cosi.clarkson.edu/

If you have any questions or problems, please email
mirror-admin@cslabs.clarkson.edu.

Recent changes can be found at
http://status.cslabs.clarkson.edu/tag/mirror.

###############################################################

Set Up Fedora Mirror Manager

  • Installed mirrormanager
cd /usr/local/sbin
git clone git://git.fedorahosted.org/mirrormanager/
ln -s /usr/local/sbin/mirrormanager/client/report_mirror /usr/local/sbin/report_mirror

  • Configured mirrormanager
    • Modified /etc/mirrormanager-client/report_mirror.conf
[global]
# if enabled=0, no data is sent to the database
enabled=1
# server= is the URL to the MirrorManager XML-RPC interface
server=https://admin.fedoraproject.org/mirrormanager/xmlrpc


[site]
# if enabled=0, no data about this site is sent to the database
enabled=1
# Name and Password fields need to match the Site name and password
# fields you entered for your Site in the MirrorManager database at
# https://admin.fedoraproject.org/mirrormanager
name=Clarkson University
password=<PASSWORD GOES HERE>

[host]
# if enabled=0, no data about this host is sent to the database
enabled=1
# Name field need to match the Host name field you entered for your
# Host in the MirrorManager database at
# https://admin.fedoraproject.org/mirrormanager
name=mirror.clarkson.edu
# if user_active=0, no data about this category is given to the public
# This can be used to toggle between serving and not serving data,
# such enabled during the nighttime (when you have more idle bandwidth
# available) and disabled during the daytime.
# By not specifying user_active, the database will not be updated.
# user_active=1

[stats]
# Stats are only sent when run with the -s option
# and when this section is enabled.
# This feature is not presently implemented
enabled=0
apache=/var/log/httpd/access_log
vsftpd=/var/log/vsftpd.log
# remember to enable log file and transfer logging in rsyncd.conf
rsyncd=/var/log/rsyncd.log


# Content Categories
# These sections match the Categories for content tracked by MirrorManager.
#
# enabled=1 means information about this category will be sent to the database.
# enabled=0, no data about this host is sent to the database.  If the
# database already has information for you for this Category, it will
# remain unchanged.  This can be used to update the database after you
# have manually synced some infrequently-updated content, such as
# historical releases.
#
# path= is the path on your local disk to the top-level directory for this Category

[Fedora Linux]
enabled=1
path=/usr/share/nginx/www/fedora/linux

[Fedora EPEL]
enabled=1
path=/usr/share/nginx/www/epel

# lesser used categories below

[Fedora Web]
enabled=0
path=/usr/share/nginx/www/pub/fedora/web

[Fedora Secondary Arches]
enabled=0
path=/usr/share/nginx/www/pub/fedora-secondary

[Fedora Other]
enabled=0
path=/usr/share/nginx/www/pub/alt

# historical content

[Fedora Core]
enabled=0
path=/usr/share/nginx/www/pub/fedora/linux/core

[Fedora Extras]
enabled=0
path=/usr/share/nginx/www/pub/fedora/linux/extras

[Fedora Archive]
enabled=0
path=/usr/share/nginx/www/pub/fedora-archive
  • Added cron entries for root
# Dir sizes
0 0 * * * /usr/local/bin/dir_sizes.sh

# backup
45 0 * * * /bin/nice -n 19 /usr/bin/ionice -c2 -n7 /usr/local/bin/backup.sh

10 0 * * * /usr/local/sbin/report_mirror


Setup Rsync Scripts