Difference between revisions of "Mirror Setup Process"

From CSLabsWiki
Jump to: navigation, search
m (added partition layout and kickstart file)
 
(71 intermediate revisions by 3 users not shown)
Line 1: Line 1:
This page summarizes how [[Mirror]] was set up in Spring 2009.
+
[[Category:Server Setup Documentation]]
  
==Install==
+
This page summarizes how [[Old Mirror]] was set up in Spring 2014.
*Installed CentOS 5.3 x64.
 
**Partition Scheme
 
***100 MB /boot - Software RAID 1
 
***73 GB root_lvg - Logical Volume Group Software RAID 1
 
****53 GB / (root_lvg-root_lv)
 
****10 GB /var (root_lvg-var_lv)
 
****10 GB swap (root_lvg-swap_lv)
 
***903 GB /mnt/raid - Software RAID 1
 
***1.8 TB /mnt/lvg_storage (storage_lvg-storage_lv)
 
***903 GB /mnt/storage1
 
***903 GB /mnt/storage2
 
  
===Kickstart File===
+
=Install=
<code><pre>
+
See [[Debian Server Setup]]
# Kickstart file automatically generated by anaconda.
 
 
 
install
 
cdrom
 
lang en_US.UTF-8
 
keyboard us
 
network --device eth0 --bootproto static --ip 128.153.145.19 --netmask 255.255.255.0 --gateway 128.153.145.1 --nameserver 128.153.0.254,128.153.5.254 --hostname mirror.clar
 
kson.edu
 
network --device eth1 --bootproto static --ip 10.0.1.36 --netmask 255.255.255.0 --gateway 128.153.145.1 --nameserver 128.153.0.254,128.153.5.254 --hostname mirror.clarkson.
 
edu
 
network --device eth2 --bootproto static --ip 10.0.0.14 --netmask 255.255.255.0 --gateway 128.153.145.1 --nameserver 128.153.0.254,128.153.5.254 --hostname mirror.clarkson.
 
edu
 
rootpw --iscrypted ENCRYPTED-PASSWORD-GOES-HERE
 
firewall --enabled --port=22:tcp
 
authconfig --enableshadow --enablemd5
 
selinux --enforcing
 
timezone --utc America/New_York
 
bootloader --location=partition --driveorder=hda,hdb,sda,sdc,sdb,sdd,sde,sdf --md5pass=ENCRYPTED-PASSWORD-GOES-HERE
 
# The following is the partition information you requested
 
# Note that any partitions you deleted are not expressed
 
# here so unless you clear all partitions first, this is
 
# not guaranteed to work
 
clearpart --linux
 
part raid.11 --size=100 --ondisk=hda
 
part raid.14 --size=100 --ondisk=hdb
 
part /mnt/storage2 --fstype ext3 --size=100 --grow --ondisk=sdf
 
part /mnt/storage1 --fstype ext3 --size=100 --grow --ondisk=sde
 
part pv.25 --size=100 --grow --ondisk=sdd
 
part pv.24 --size=100 --grow --ondisk=sdc
 
part raid.22 --size=100 --grow --ondisk=sdb
 
part raid.21 --size=100 --grow --ondisk=sda
 
part raid.13 --size=100 --grow --ondisk=hdb
 
part raid.12 --size=100 --grow --ondisk=hda
 
raid /boot --fstype ext3 --level=RAID1 --device=md0 raid.11 raid.14
 
raid pv.16 --fstype "physical volume (LVM)" --level=RAID1 --device=md1 raid.12 raid.13
 
raid /mnt/raid --fstype ext3 --level=RAID1 --device=md2 raid.21 raid.22
 
volgroup root_lvg --pesize=32768 pv.16
 
volgroup storage_lvg --pesize=32768 pv.24 pv.25
 
logvol swap --fstype swap --name=swap_lv --vgname=root_lvg --size=10240
 
logvol /var --fstype ext3 --name=var_lv --vgname=root_lvg --size=10240
 
logvol / --fstype ext3 --name=root_lv --vgname=root_lvg --size=55712
 
logvol /mnt/lvg_storage --fstype ext3 --name=storage_lv --vgname=storage_lvg --size=1907712
 
 
 
%packages
 
@core
 
@base
 
device-mapper-multipath
 
-NetworkManager
 
-bluez-utils
 
</pre></code>
 
 
 
==Configuration==
 
===Updated VM===
 
*Added RPMForge Yum Repository
 
**<code>rpm -Uhv http://apt.sw.be/redhat/el5/en/x86_64/rpmforge/RPMS//rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm</code>
 
***From [http://dag.wieers.com/rpm/FAQ.php#B2 Dag Wieers]
 
 
 
*<code>yum install yum-fastestmirror vim-enhanced gcc emacs-nox screen</code>
 
*<code>yum update</code>
 
 
 
===Created Users===
 
*Created user mccarrms
 
**<code>/usr/sbin/useradd -m mccarrms</code>
 
*Set password for mccarrms
 
**<code>passwd mccarrms</code>
 
*Created user ignazirj
 
**<code>/usr/sbin/useradd -m ignazirj</code>
 
*Set password for ignazirj
 
**<code>passwd ignazirj</code>
 
 
 
 
 
===Configured Sudo===
 
*<code>/usr/sbin/visudo</code>
 
 
 
<code><pre>
 
## Sudoers allows particular users to run various commands as
 
## the root user, without needing the root password.
 
 
 
## Networking
 
Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
 
 
 
## Installation and management of software
 
Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
 
 
 
## Services
 
Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
 
 
 
## Updating the locate database
 
Cmnd_Alias LOCATE = /usr/sbin/updatedb
 
  
## Storage
+
==Debian 7 x64==
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
+
*71 GB  / - Software RAID 1
 +
*4GB Swap per OS Drive
  
## Delegating permissions
+
=Setup=
Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
+
See [[Debian Server Setup]]
  
## Processes
+
==Raid==
Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
+
*sda sdb sdc sde sdg sdh
 +
*/dev/md2
 +
*Software RAID 10
 +
*/storage xfs
  
## Drivers
+
==Networking==
Cmnd_Alias DRIVERS = /sbin/modprobe
 
  
## Shells
+
===eth2===
Cmnd_Alias SHELLS = /bin/sh, /bin/bash, /usr/bin/rsh, /bin/dash, /bin/rbash, /bin/su
+
*Intel Corporation 82541PI Gigabit Ethernet Controller
 +
*HWADDR=00:1B:21:28:C8:48
 +
*IPADDR=128.153.145.19
  
## Users
+
===eth1===
Cmnd_Alias USERS = /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/userhelper, /usr/sbin/usermod, /usr/sbin/usernetctl
+
*Intel Corporation 82566DM-2 Gigabit Network Connection
 +
*HWADDR=00:30:48:9A:DB:26
 +
*IPADDR=10.0.1.36
  
Defaults    requiretty
+
===eth3===
 +
*Intel Corporation 82573L Gigabit Ethernet Controller
 +
*HWADDR=00:30:48:9A:DB:27
 +
*IPADDR=10.0.0.14
  
Defaults    env_reset,tty_tickets,lecture=always,logfile=/var/log/sudo.log
+
==Set Up SSH Login Banner==
Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
+
/etc/issue.net
                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
 
                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
 
                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
 
                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
 
                        _XKB_CHARSET XAUTHORITY"
 
 
 
## Allow root to run any commands anywhere
 
root    ALL=(ALL)      ALL
 
%wheel  ALL=(ALL)      ALL
 
</pre></code>
 
 
 
===Configured Networks===
 
*Configured hostname in <code>/etc/sysconfig/network</code>
 
<code><pre>
 
NETWORKING=yes
 
NETWORKING_IPV6=no
 
HOSTNAME=mirror.clarkson.edu
 
GATEWAY=128.153.145.1
 
</pre></code>
 
 
 
*Verified eth0 configuration for Clarkson Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth0</code>
 
<code><pre>
 
# Intel Corporation 82541PI Gigabit Ethernet Controller
 
DEVICE=eth0
 
BOOTPROTO=static
 
BROADCAST=128.153.145.255
 
HWADDR=00:1B:21:28:C8:48
 
IPADDR=128.153.145.19
 
NETMASK=255.255.255.0
 
NETWORK=128.153.145.0
 
ONBOOT=yes
 
</pre></code>
 
 
 
*Verified eth1 configuration for the Server Room Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth1</code>
 
<code><pre>
 
# Intel Corporation 82566DM-2 Gigabit Network Connection
 
DEVICE=eth1
 
BOOTPROTO=static
 
BROADCAST=10.0.1.255
 
HWADDR=00:30:48:9A:DB:26
 
IPADDR=10.0.1.36
 
NETMASK=255.255.255.0
 
NETWORK=10.0.1.0
 
ONBOOT=yes
 
</pre></code>
 
 
 
*Verified eth2 configuration for the Internal Network in <code>/etc/sysconfig/network-scripts/ifcfg-eth2</code>
 
<code><pre>
 
# Intel Corporation 82573L Gigabit Ethernet Controller
 
DEVICE=eth2
 
BOOTPROTO=static
 
BROADCAST=10.0.0.255
 
HWADDR=00:30:48:9A:DB:27
 
IPADDR=10.0.0.14
 
NETMASK=255.255.255.0
 
NETWORK=10.0.0.0
 
ONBOOT=yes
 
</pre></code>
 
 
 
====Configured Hosts====
 
*Edited <code>/etc/hosts</code>
 
<code><pre>
 
127.0.0.1      localhost.localdomain localhost
 
::1            localhost6.localdomain6 localhost6
 
128.153.145.19  mirror.clarkson.edu mirror.cslabs.clarkson.edu mirror.cslabs mirror
 
10.0.1.36      mirror.sr.cslabs.clarkson.edu mirror.sr.cslabs mirror.sr
 
10.0.0.14      mirror.int.cslabs.clarkson.edu mirror.int.cslabs mirror.int
 
</pre></code>
 
 
 
====Configured DNS Servers====
 
*Edited <code>/etc/resolv.conf</code>
 
<code><pre>
 
search clarkson.edu
 
nameserver 128.153.0.254
 
nameserver 128.153.5.254
 
</pre></code>
 
 
 
===Configured IPtables===
 
<code><pre>
 
Due to the sensitivity of this material, this config file has been left off; however, the following rules are needed.
 
</pre></code>
 
*Restarted iptables
 
**<code>/etc/init.d/iptables restart</code>
 
 
 
===Configured SSH===
 
*Edited <code>/etc/ssh/sshd_config</code>
 
<code><pre>
 
Due to the sensitivity of this material, this config file has been left off.
 
</pre></code>
 
*Restarted sshd
 
**<code>/etc/init.d/sshd restart</code>
 
 
 
====Set Up SSH Login Banner====
 
*Edited <code>/etc/issue.net</code>
 
 
<code><pre>
 
<code><pre>
 
         _                 
 
         _                 
Line 229: Line 45:
 
                            
 
                            
 
</pre></code>
 
</pre></code>
 +
==SSHD config==
 +
uncomment
 +
Banner /etc/issue.net
  
===Configured Password Requirements===
+
==Installed nginx==
*Edited <code>/etc/login.defs</code>
+
apt-get install install nginx
<code><pre>
 
MAIL_DIR        /var/spool/mail
 
 
 
PASS_MAX_DAYS  360
 
PASS_MIN_DAYS  0
 
PASS_MIN_LEN    8
 
PASS_WARN_AGE  60
 
 
 
UID_MIN                  500
 
UID_MAX                60000
 
 
 
GID_MIN                  500
 
GID_MAX                60000
 
 
 
CREATE_HOME    yes
 
 
 
UMASK          077
 
 
 
USERGROUPS_ENAB yes
 
 
 
MD5_CRYPT_ENAB yes
 
 
 
ENCRYPT_METHOD MD5
 
</pre></code>
 
 
 
===Added Custom PATH Variables===
 
*Added the following to <code>/etc/profile</code>
 
<code><pre>
 
PATH=$PATH:/usr/sbin:/sbin
 
export PATH
 
</pre></code>
 
 
 
===Modified Root's Crontab===
 
*<code>crontab -e</code>
 
<code><pre>
 
# Used to update locate database
 
0 * * * * /usr/bin/updatedb
 
</pre></code>
 
  
===Set Up & Configured NTP===
+
==Configure rsync to run as a daemon==
*Installed NTP
+
*Installed <code>xinetd</code>
**<code>yum install ntp</code>
+
apt-get install rsync
  
*Edited <code>/etc/ntp.conf</code>
+
*Configured rsync /etc/rsyncd.conf
 
<code><pre>
 
<code><pre>
restrict default kod nomodify notrap nopeer noquery
+
uid = nobody
restrict -6 default kod nomodify notrap nopeer noquery
+
gid = nogroup
 +
use chroot = yes
 +
max connections = 20
 +
pid file = /var/run/rsyncd.pid
 +
motd file = /etc/rsyncd.motd
 +
log file = /var/log/rsync.log
 +
transfer logging = yes
 +
log format = %t %a %m %f %b
 +
syslog facility = local3
 +
timeout = 900
 +
dont compress = *.gz *.tgz *.zip *.z *.Z *.rpm *.deb *.bz2
 +
refuse options = checksum
  
restrict 127.0.0.1
+
[name]
restrict -6 ::1
+
  comment = Name of Repository
 +
  path = /storage/repository
 +
  exclude = lost+found/
 +
  read only = true
 +
  ignore nonreadable = yes</pre></code>
  
restrict tick.clarkson.edu mask 255.255.255.255 nomodify notrap noquery
+
*Created rsync motd /etc/rsyncd.motd
restrict tock.clarkson.edu mask 255.255.255.255 nomodify notrap noquery
 
 
 
server tick.clarkson.edu
 
server tock.clarkson.edu
 
 
 
server  127.127.1.0    # local clock
 
fudge  127.127.1.0 stratum 10
 
 
 
driftfile /var/lib/ntp/drift
 
 
 
keys /etc/ntp/keys
 
</pre></code>
 
 
 
*Edited <code>/etc/ntp/step-tickers</code>
 
 
<code><pre>
 
<code><pre>
tick.clarkson.edu
+
###############################################################
tock.clarkson.edu
 
</pre></code>
 
  
*Configured ntpd to start on boot
+
The Clarkson University mirror is located in Potsdam, NY, US.
**<code>/sbin/chkconfig --levels 2345 ntpd on</code>
 
  
*Started ntpd
+
This mirror is operated by the Clarkson Open Source Institute.
**<code>/etc/init.d/ntpd start</code>
+
http://cosi.clarkson.edu/
  
====Configured ntpd to Sync Hardware Clock====
+
If you have any questions or problems, please email
*Edited <code>/etc/sysconfig/ntpd</code>
+
mirror-admin@cslabs.clarkson.edu.
<code><pre>
 
# Drop root to id 'ntp:ntp' by default.
 
OPTIONS="-u ntp:ntp -p /var/run/ntpd.pid"
 
  
# Set to 'yes' to sync hw clock after successful ntpdate
+
Recent changes can be found at
SYNC_HWCLOCK=yes
+
http://status.cslabs.clarkson.edu/tag/mirror.
  
# Additional options for ntpdate
+
###############################################################
NTPDATE_OPTIONS=""
 
 
</pre></code>
 
</pre></code>
  
===Installed and Configured [http://www.apcupsd.org/ APCUPSD]===
+
==Set Up Fedora Mirror Manager==
This package is used to monitor the UPS which [[Mirror]] is plugged into and is used to shutdown the system in the event of a power failure.
+
*Installed mirrormanager
 
+
cd /usr/local/sbin
====Configured to Power On when Power is Restored====
+
git clone git://git.fedorahosted.org/mirrormanager/
*Edited the BIOS to have <code>Restore on AC/Power Loss</code> set to <code>Power On</code>.
+
ln -s /usr/local/sbin/mirrormanager/client/report_mirror /usr/local/sbin/report_mirror
 
+
====Installed and configured <code>apcupsd</code>====
 
*Installed <code>apcupsd</code>
 
**<code>yum install apcupsd</code>
 
  
*Edited <code>/etc/apcupsd/apcupsd.conf</code>
+
*Configured mirrormanager
 +
**Modified /etc/mirrormanager-client/report_mirror.conf
 
<code><pre>
 
<code><pre>
## apcupsd.conf v1.1 ##
+
[global]
 
+
# if enabled=0, no data is sent to the database
UPSNAME ups3
+
enabled=1
 +
# server= is the URL to the MirrorManager XML-RPC interface
 +
server=https://admin.fedoraproject.org/mirrormanager/xmlrpc
  
UPSCABLE ether
 
  
UPSTYPE net
+
[site]
DEVICE 128.153.145.215:3551
+
# if enabled=0, no data about this site is sent to the database
 +
enabled=1
 +
# Name and Password fields need to match the Site name and password
 +
# fields you entered for your Site in the MirrorManager database at
 +
# https://admin.fedoraproject.org/mirrormanager
 +
name=Clarkson University
 +
password=<PASSWORD GOES HERE>
  
LOCKFILE /var/lock
+
[host]
 +
# if enabled=0, no data about this host is sent to the database
 +
enabled=1
 +
# Name field need to match the Host name field you entered for your
 +
# Host in the MirrorManager database at
 +
# https://admin.fedoraproject.org/mirrormanager
 +
name=mirror.clarkson.edu
 +
# if user_active=0, no data about this category is given to the public
 +
# This can be used to toggle between serving and not serving data,
 +
# such enabled during the nighttime (when you have more idle bandwidth
 +
# available) and disabled during the daytime.
 +
# By not specifying user_active, the database will not be updated.
 +
# user_active=1
  
SCRIPTDIR /etc/apcupsd
+
[stats]
 +
# Stats are only sent when run with the -s option
 +
# and when this section is enabled.
 +
# This feature is not presently implemented
 +
enabled=0
 +
apache=/var/log/httpd/access_log
 +
vsftpd=/var/log/vsftpd.log
 +
# remember to enable log file and transfer logging in rsyncd.conf
 +
rsyncd=/var/log/rsyncd.log
  
PWRFAILDIR /etc/apcupsd
 
  
NOLOGINDIR /etc
+
# Content Categories
 
+
# These sections match the Categories for content tracked by MirrorManager.
ONBATTERYDELAY 6
 
 
 
BATTERYLEVEL 10
 
 
 
MINUTES 15
 
 
 
TIMEOUT 0
 
 
 
ANNOY 300
 
 
 
ANNOYDELAY 60
 
 
 
NOLOGON disable
 
 
 
KILLDELAY 0
 
 
 
NETSERVER on
 
 
 
NISIP 127.0.0.1
 
 
 
NISPORT 3551
 
 
 
EVENTSFILE /var/log/apcupsd.events
 
 
 
EVENTSFILEMAX 10
 
 
 
UPSCLASS standalone
 
 
 
UPSMODE disable
 
 
 
STATTIME 0
 
 
 
STATFILE /var/log/apcupsd.status
 
 
 
LOGSTATS off
 
 
 
DATATIME 0
 
 
 
SELFTEST 336
 
</pre></code>
 
 
 
*Edited <code>/etc/apcupsd/offbattery</code>
 
<code><pre>
 
#!/bin/sh
 
 
#
 
#
# This shell script if placed in /etc/apcupsd
+
# enabled=1 means information about this category will be sent to the database.
# will be called by /etc/apcupsd/apccontrol when the
+
# enabled=0, no data about this host is sent to the database. If the
# UPS goes back on to the mains after a power failure.
+
# database already has information for you for this Category, it will
# We send an email message to root to notify him.
+
# remain unchanged.  This can be used to update the database after you
 +
# have manually synced some infrequently-updated content, such as
 +
# historical releases.
 
#
 
#
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
+
# path= is the path on your local disk to the top-level directory for this Category
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Linux]
MSG="$HOSTNAME Power has returned"
+
enabled=1
#
+
path=/usr/share/nginx/www/fedora/linux
(
+
 
  echo "Subject: $MSG"
+
[Fedora EPEL]
  echo " "
+
enabled=1
  echo "$MSG"
+
path=/usr/share/nginx/www/epel
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/onbattery</code>
+
# lesser used categories below
<code><pre>
 
#!/bin/sh
 
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when the UPS
 
# goes on batteries.
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Web]
MSG="$HOSTNAME Power Failure !!!"
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/fedora/web
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/commfailure</code>
+
[Fedora Secondary Arches]
<code><pre>
+
enabled=0
#!/bin/sh
+
path=/usr/share/nginx/www/pub/fedora-secondary
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when apcupsd
 
# loses contact with the UPS (i.e. the serial connection is not responding).
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Other]
MSG="$HOSTNAME Communications with UPS lost"
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/alt
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/commok</code>
+
# historical content
<code><pre>
 
#!/bin/sh
 
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when apcupsd
 
# restores contact with the UPS (i.e. the serial connection is restored).
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Core]
MSG="$HOSTNAME Communications with UPS restored"
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/fedora/linux/core
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
</pre></code>
 
  
*Edited <code>/etc/apcupsd/changeme</code>
+
[Fedora Extras]
<code><pre>
+
enabled=0
#!/bin/sh
+
path=/usr/share/nginx/www/pub/fedora/linux/extras
#
 
# This shell script if placed in /etc/apcupsd
 
# will be called by /etc/apcupsd/apccontrol when apcupsd
 
# detects that the battery should be replaced.
 
# We send an email message to root to notify him.
 
#
 
SYSADMIN=mccarrms@gmail.com,emergency@cslabs.clarkson.edu
 
APCUPSD_MAIL="/bin/mail"
 
  
HOSTNAME=`hostname`
+
[Fedora Archive]
MSG="$HOSTNAME UPS battery needs changing NOW."
+
enabled=0
#
+
path=/usr/share/nginx/www/pub/fedora-archive
(
 
  echo "Subject: $MSG"
 
  echo " "
 
  echo "$MSG"
 
  echo " "
 
  /sbin/apcaccess status
 
) | $APCUPSD_MAIL -s "$MSG" $SYSADMIN
 
exit 0
 
 
</pre></code>
 
</pre></code>
  
*Configured <code>apcupsd</code> to start on boot
+
*Added cron entries for root
**<code>/sbin/chkconfig --levels 2345 apcupsd on</code>
 
 
 
*Started <code>apcupsd</code>
 
**<code>/etc/init.d/apcupsd start</code>
 
 
 
===Installed Apache===
 
*Installed <code>httpd</code>
 
**<code>yum install httpd</code>
 
 
 
*Modified <code>/etc/httpd/conf/httpd.conf</code>
 
 
<code><pre>
 
<code><pre>
ServerTokens Prod
+
# Dir sizes
 +
0 0 * * * /usr/local/bin/dir_sizes.sh
  
ServerRoot "/etc/httpd"
+
# backup
 +
45 0 * * * /bin/nice -n 19 /usr/bin/ionice -c2 -n7 /usr/local/bin/backup.sh
  
PidFile run/httpd.pid
+
10 0 * * * /usr/local/sbin/report_mirror
 
 
Timeout 120
 
 
 
KeepAlive Off
 
 
 
MaxKeepAliveRequests 100
 
 
 
KeepAliveTimeout 15
 
 
 
<IfModule prefork.c>
 
StartServers      8
 
MinSpareServers    5
 
MaxSpareServers  20
 
ServerLimit      256
 
MaxClients      150
 
MaxRequestsPerChild  1000
 
</IfModule>
 
 
 
<IfModule worker.c>
 
StartServers        2
 
MaxClients        150
 
MinSpareThreads    25
 
MaxSpareThreads    75
 
ThreadsPerChild    25
 
MaxRequestsPerChild  0
 
</IfModule>
 
 
 
Listen 80
 
 
 
LoadModule auth_basic_module modules/mod_auth_basic.so
 
LoadModule auth_digest_module modules/mod_auth_digest.so
 
LoadModule authn_file_module modules/mod_authn_file.so
 
LoadModule authn_alias_module modules/mod_authn_alias.so
 
LoadModule authn_anon_module modules/mod_authn_anon.so
 
LoadModule authn_dbm_module modules/mod_authn_dbm.so
 
LoadModule authn_default_module modules/mod_authn_default.so
 
LoadModule authz_host_module modules/mod_authz_host.so
 
LoadModule authz_user_module modules/mod_authz_user.so
 
LoadModule authz_owner_module modules/mod_authz_owner.so
 
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
 
LoadModule authz_dbm_module modules/mod_authz_dbm.so
 
LoadModule authz_default_module modules/mod_authz_default.so
 
LoadModule ldap_module modules/mod_ldap.so
 
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
 
LoadModule include_module modules/mod_include.so
 
LoadModule log_config_module modules/mod_log_config.so
 
LoadModule logio_module modules/mod_logio.so
 
LoadModule env_module modules/mod_env.so
 
LoadModule ext_filter_module modules/mod_ext_filter.so
 
LoadModule mime_magic_module modules/mod_mime_magic.so
 
LoadModule expires_module modules/mod_expires.so
 
LoadModule deflate_module modules/mod_deflate.so
 
LoadModule headers_module modules/mod_headers.so
 
LoadModule usertrack_module modules/mod_usertrack.so
 
LoadModule setenvif_module modules/mod_setenvif.so
 
LoadModule mime_module modules/mod_mime.so
 
LoadModule dav_module modules/mod_dav.so
 
LoadModule status_module modules/mod_status.so
 
LoadModule autoindex_module modules/mod_autoindex.so
 
LoadModule info_module modules/mod_info.so
 
LoadModule dav_fs_module modules/mod_dav_fs.so
 
LoadModule vhost_alias_module modules/mod_vhost_alias.so
 
LoadModule negotiation_module modules/mod_negotiation.so
 
LoadModule dir_module modules/mod_dir.so
 
LoadModule actions_module modules/mod_actions.so
 
LoadModule speling_module modules/mod_speling.so
 
LoadModule userdir_module modules/mod_userdir.so
 
LoadModule alias_module modules/mod_alias.so
 
LoadModule rewrite_module modules/mod_rewrite.so
 
LoadModule proxy_module modules/mod_proxy.so
 
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
 
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
 
LoadModule proxy_http_module modules/mod_proxy_http.so
 
LoadModule proxy_connect_module modules/mod_proxy_connect.so
 
LoadModule cache_module modules/mod_cache.so
 
LoadModule suexec_module modules/mod_suexec.so
 
LoadModule disk_cache_module modules/mod_disk_cache.so
 
LoadModule file_cache_module modules/mod_file_cache.so
 
LoadModule mem_cache_module modules/mod_mem_cache.so
 
LoadModule cgi_module modules/mod_cgi.so
 
LoadModule version_module modules/mod_version.so
 
 
 
Include conf.d/*.conf
 
 
 
User apache
 
Group apache
 
 
 
ServerAdmin mirror-admin@cslabs.clarkson.edu
 
 
 
UseCanonicalName Off
 
 
 
DocumentRoot "/var/www/html"
 
 
 
<Directory />
 
    Options FollowSymLinks
 
    AllowOverride None
 
</Directory>
 
 
 
<Directory "/var/www/html">
 
    Options Indexes FollowSymLinks
 
    AllowOverride None
 
    Order allow,deny
 
    Allow from all
 
</Directory>
 
 
 
<IfModule mod_userdir.c>
 
    UserDir disable
 
</IfModule>
 
 
 
DirectoryIndex index.html index.html.var
 
 
 
AccessFileName .htaccess
 
 
 
<Files ~ "^\.ht">
 
    Order allow,deny
 
    Deny from all
 
</Files>
 
 
 
TypesConfig /etc/mime.types
 
 
 
DefaultType text/plain
 
 
 
<IfModule mod_mime_magic.c>
 
#  MIMEMagicFile /usr/share/magic.mime
 
    MIMEMagicFile conf/magic
 
</IfModule>
 
 
 
HostnameLookups Off
 
 
 
ErrorLog logs/error_log
 
 
 
LogLevel warn
 
 
 
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
 
LogFormat "%h %l %u %t \"%r\" %>s %b" common
 
LogFormat "%{Referer}i -> %U" referer
 
LogFormat "%{User-agent}i" agent
 
 
 
CustomLog logs/access_log combined
 
 
 
ServerSignature On
 
 
 
Alias /icons/ "/var/www/icons/"
 
 
 
<Directory "/var/www/icons">
 
    Options Indexes MultiViews
 
    AllowOverride None
 
    Order allow,deny
 
    Allow from all
 
</Directory>
 
 
 
<IfModule mod_dav_fs.c>
 
    # Location of the WebDAV lock database.
 
    DAVLockDB /var/lib/dav/lockdb
 
</IfModule>
 
 
 
ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
 
 
 
<Directory "/var/www/cgi-bin">
 
    AllowOverride None
 
    Options None
 
    Order allow,deny
 
    Allow from all
 
</Directory>
 
 
 
IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable
 
 
 
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
 
 
 
AddIconByType (TXT,/icons/text.gif) text/*
 
AddIconByType (IMG,/icons/image2.gif) image/*
 
AddIconByType (SND,/icons/sound2.gif) audio/*
 
AddIconByType (VID,/icons/movie.gif) video/*
 
 
 
AddIcon /icons/binary.gif .bin .exe
 
AddIcon /icons/binhex.gif .hqx
 
AddIcon /icons/tar.gif .tar
 
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
 
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
 
AddIcon /icons/a.gif .ps .ai .eps
 
AddIcon /icons/layout.gif .html .shtml .htm .pdf
 
AddIcon /icons/text.gif .txt
 
AddIcon /icons/c.gif .c
 
AddIcon /icons/p.gif .pl .py
 
AddIcon /icons/f.gif .for
 
AddIcon /icons/dvi.gif .dvi
 
AddIcon /icons/uuencoded.gif .uu
 
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
 
AddIcon /icons/tex.gif .tex
 
AddIcon /icons/bomb.gif core
 
 
 
AddIcon /icons/back.gif ..
 
AddIcon /icons/hand.right.gif README
 
AddIcon /icons/folder.gif ^^DIRECTORY^^
 
AddIcon /icons/blank.gif ^^BLANKICON^^
 
 
 
DefaultIcon /icons/unknown.gif
 
 
 
ReadmeName README.html
 
HeaderName HEADER.html
 
 
 
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
 
 
 
AddLanguage ca .ca
 
AddLanguage cs .cz .cs
 
AddLanguage da .dk
 
AddLanguage de .de
 
AddLanguage el .el
 
AddLanguage en .en
 
AddLanguage eo .eo
 
AddLanguage es .es
 
AddLanguage et .et
 
AddLanguage fr .fr
 
AddLanguage he .he
 
AddLanguage hr .hr
 
AddLanguage it .it
 
AddLanguage ja .ja
 
AddLanguage ko .ko
 
AddLanguage ltz .ltz
 
AddLanguage nl .nl
 
AddLanguage nn .nn
 
AddLanguage no .no
 
AddLanguage pl .po
 
AddLanguage pt .pt
 
AddLanguage pt-BR .pt-br
 
AddLanguage ru .ru
 
AddLanguage sv .sv
 
AddLanguage zh-CN .zh-cn
 
AddLanguage zh-TW .zh-tw
 
 
 
LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW
 
 
 
ForceLanguagePriority Prefer Fallback
 
 
 
AddDefaultCharset UTF-8
 
 
 
AddType application/x-compress .Z
 
AddType application/x-gzip .gz .tgz
 
 
 
AddHandler type-map var
 
 
 
AddType text/html .shtml
 
AddOutputFilter INCLUDES .shtml
 
 
 
Alias /error/ "/var/www/error/"
 
 
 
<IfModule mod_negotiation.c>
 
<IfModule mod_include.c>
 
    <Directory "/var/www/error">
 
        AllowOverride None
 
        Options IncludesNoExec
 
        AddOutputFilter Includes html
 
        AddHandler type-map var
 
        Order allow,deny
 
        Allow from all
 
        LanguagePriority en es de fr
 
        ForceLanguagePriority Prefer Fallback
 
    </Directory>
 
 
 
</IfModule>
 
</IfModule>
 
 
 
BrowserMatch "Mozilla/2" nokeepalive
 
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
 
BrowserMatch "RealPlayer 4\.0" force-response-1.0
 
BrowserMatch "Java/1\.0" force-response-1.0
 
BrowserMatch "JDK/1\.0" force-response-1.0
 
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
 
BrowserMatch "MS FrontPage" redirect-carefully
 
BrowserMatch "^WebDrive" redirect-carefully
 
BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
 
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
 
BrowserMatch "^XML Spy" redirect-carefully
 
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
 
 
</pre></code>
 
</pre></code>
  
*Removed unneeded files
 
**<code>rm /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/proxy_ajp.conf</code>
 
 
*Configured Apache to start on boot
 
**<code>/sbin/chkconfig --levels 345 httpd on</code>
 
 
*Started Apache
 
**<code>/etc/init.d/httpd start</code>
 
  
[[Category:Documentation]]
+
[[mirror rsync setup|Setup Rsync Scripts]]
[[Category:Infrastructure]]
 

Latest revision as of 21:05, 27 April 2016


This page summarizes how Old Mirror was set up in Spring 2014.

Install

See Debian Server Setup

Debian 7 x64

  • 71 GB / - Software RAID 1
  • 4GB Swap per OS Drive

Setup

See Debian Server Setup

Raid

  • sda sdb sdc sde sdg sdh
  • /dev/md2
  • Software RAID 10
  • /storage xfs

Networking

eth2

  • Intel Corporation 82541PI Gigabit Ethernet Controller
  • HWADDR=00:1B:21:28:C8:48
  • IPADDR=128.153.145.19

eth1

  • Intel Corporation 82566DM-2 Gigabit Network Connection
  • HWADDR=00:30:48:9A:DB:26
  • IPADDR=10.0.1.36

eth3

  • Intel Corporation 82573L Gigabit Ethernet Controller
  • HWADDR=00:30:48:9A:DB:27
  • IPADDR=10.0.0.14

Set Up SSH Login Banner

/etc/issue.net

         _                 
  __ _  (_)__________  ____
 /  ' \/ / __/ __/ _ \/ __/
/_/_/_/_/_/ /_/  \___/_/   
                           

SSHD config

uncomment

Banner /etc/issue.net

Installed nginx

apt-get install install nginx

Configure rsync to run as a daemon

  • Installed xinetd
apt-get install rsync
  • Configured rsync /etc/rsyncd.conf
uid = nobody
gid = nogroup
use chroot = yes
max connections = 20
pid file = /var/run/rsyncd.pid
motd file = /etc/rsyncd.motd
log file = /var/log/rsync.log
transfer logging = yes
log format = %t %a %m %f %b
syslog facility = local3
timeout = 900
dont compress = *.gz *.tgz *.zip *.z *.Z *.rpm *.deb *.bz2
refuse options = checksum

[name]
  comment = Name of Repository
  path = /storage/repository
  exclude = lost+found/
  read only = true
  ignore nonreadable = yes
  • Created rsync motd /etc/rsyncd.motd
###############################################################

The Clarkson University mirror is located in Potsdam, NY, US.

This mirror is operated by the Clarkson Open Source Institute.
http://cosi.clarkson.edu/

If you have any questions or problems, please email
mirror-admin@cslabs.clarkson.edu.

Recent changes can be found at
http://status.cslabs.clarkson.edu/tag/mirror.

###############################################################

Set Up Fedora Mirror Manager

  • Installed mirrormanager
cd /usr/local/sbin
git clone git://git.fedorahosted.org/mirrormanager/
ln -s /usr/local/sbin/mirrormanager/client/report_mirror /usr/local/sbin/report_mirror

  • Configured mirrormanager
    • Modified /etc/mirrormanager-client/report_mirror.conf
[global]
# if enabled=0, no data is sent to the database
enabled=1
# server= is the URL to the MirrorManager XML-RPC interface
server=https://admin.fedoraproject.org/mirrormanager/xmlrpc


[site]
# if enabled=0, no data about this site is sent to the database
enabled=1
# Name and Password fields need to match the Site name and password
# fields you entered for your Site in the MirrorManager database at
# https://admin.fedoraproject.org/mirrormanager
name=Clarkson University
password=<PASSWORD GOES HERE>

[host]
# if enabled=0, no data about this host is sent to the database
enabled=1
# Name field need to match the Host name field you entered for your
# Host in the MirrorManager database at
# https://admin.fedoraproject.org/mirrormanager
name=mirror.clarkson.edu
# if user_active=0, no data about this category is given to the public
# This can be used to toggle between serving and not serving data,
# such enabled during the nighttime (when you have more idle bandwidth
# available) and disabled during the daytime.
# By not specifying user_active, the database will not be updated.
# user_active=1

[stats]
# Stats are only sent when run with the -s option
# and when this section is enabled.
# This feature is not presently implemented
enabled=0
apache=/var/log/httpd/access_log
vsftpd=/var/log/vsftpd.log
# remember to enable log file and transfer logging in rsyncd.conf
rsyncd=/var/log/rsyncd.log


# Content Categories
# These sections match the Categories for content tracked by MirrorManager.
#
# enabled=1 means information about this category will be sent to the database.
# enabled=0, no data about this host is sent to the database.  If the
# database already has information for you for this Category, it will
# remain unchanged.  This can be used to update the database after you
# have manually synced some infrequently-updated content, such as
# historical releases.
#
# path= is the path on your local disk to the top-level directory for this Category

[Fedora Linux]
enabled=1
path=/usr/share/nginx/www/fedora/linux

[Fedora EPEL]
enabled=1
path=/usr/share/nginx/www/epel

# lesser used categories below

[Fedora Web]
enabled=0
path=/usr/share/nginx/www/pub/fedora/web

[Fedora Secondary Arches]
enabled=0
path=/usr/share/nginx/www/pub/fedora-secondary

[Fedora Other]
enabled=0
path=/usr/share/nginx/www/pub/alt

# historical content

[Fedora Core]
enabled=0
path=/usr/share/nginx/www/pub/fedora/linux/core

[Fedora Extras]
enabled=0
path=/usr/share/nginx/www/pub/fedora/linux/extras

[Fedora Archive]
enabled=0
path=/usr/share/nginx/www/pub/fedora-archive
  • Added cron entries for root
# Dir sizes
0 0 * * * /usr/local/bin/dir_sizes.sh

# backup
45 0 * * * /bin/nice -n 19 /usr/bin/ionice -c2 -n7 /usr/local/bin/backup.sh

10 0 * * * /usr/local/sbin/report_mirror


Setup Rsync Scripts