SAC:Standard System Setup - Revision history

Strk at 07:43, 24 April 2025

2025-04-24T07:43:19Z

2016-05-04T10:25:40Z

Fail2ban

2011-10-04T02:47:00Z

2011-09-28T05:28:09Z

Request a new VM

2011-09-28T05:27:23Z

2011-09-28T05:26:15Z

First Login

2011-09-28T05:25:19Z

Enable LDAP

2011-09-28T04:31:20Z

2011-09-28T04:29:07Z

Request a new VM

2011-09-28T04:28:48Z

@@ Line 51: / Line 51: @@
 == Awstats ==
 See ? page on server usage tracking.
 [[Category:Infrastructure]]

@@ Line 44: / Line 44: @@
 = Recommended Options =
 == Fail2ban ==
-A tool to prevent excessive scanning for user/passwords into the system.
- sudo apt-get install fail2ban
+A tool to prevent excessive scanning for user/passwords in the system, for preventing brute force ssh logins, for catching nasty Apache requests and the like.
- sudo nano /etc/fail2ban/jail.conf
- #set the default of allowed attempts to 5, this is also where you can set the time until next attempt
+See [[SAC:fail2ban]]
 == Awstats ==
 See ? page on server usage tracking.
 [[Category:Infrastructure]]

@@ Line 42: / Line 42: @@
 We typically try to put OSGeo stuff under a /osgeo directory broken down by project or service.
+= Recommended Options =
 [[Category:Infrastructure]]

@@ Line 3: / Line 3: @@
 = Request a new VM =
-A support request should be made to OSU OSL support *after* discussion and agreement within SAC.
+A support request should be made to OSU OSL support ''after'' discussion and agreement within SAC.
 Details will be needed on the disk space, memory and the machine on which it should be established.  See [[SAC Service Status]] to get a sense of the machines available and what is already running on them.  The support request should be made to support at osuosl.org.

← Older revision		Revision as of 05:27, 28 September 2011
Line 29:		Line 29:

	Note that proper functioning of LDAP service also depends on having the proper SSL certificates installed as described in [[SAC:SSLCert]]. Normally this should be setup on the base vm, and copied to new VMs.		Note that proper functioning of LDAP service also depends on having the proper SSL certificates installed as described in [[SAC:SSLCert]]. Normally this should be setup on the base vm, and copied to new VMs.
		+
		+	= Setting up Backups =
		+
		+	... to be added ...
		+
		+	= Enabling munin =
		+
		+	... to be added ...
		+
		+	= File System Layout =
		+
		+	We typically try to put OSGeo stuff under a /osgeo directory broken down by project or service.
		+

	[[Category:Infrastructure]]		[[Category:Infrastructure]]

@@ Line 13: / Line 13: @@
 = First Login =
-New VMs will only allow root logins by [[SAC:Primary Administrators|SAC Primary Administrators]] with the correct ssh keys setup.
+New VMs will only allow root logins by [[SAC:Primary Administrators|SAC Primary Administrators]] with the correct ssh keys setup, but they should also support regular LDAP logins for anyone in the "sac" shell group with sudo access preconfigured for primary administrators.
 = Enable LDAP =

@@ Line 17: / Line 17: @@
 = Enable LDAP =
-As per [[SAC:Setup LDAP Authentication]] instructions setup LDAP access for the appropriate group (sac, telascience, etc) on the newly created VM.
+See [[SAC:LDAP]] for information on how the OSGeo LDAP server works.
-... ??
+By default new VMs should support login by members of the [https://www.osgeo.org/cgi-bin/auth/ldap_shell.py?group=sac "SAC" LDAP Shell] group.  Allowed groups can be changed primarily
 [[Category:Infrastructure]]

@@ Line 10: / Line 10: @@
 New VMs are made by cloning the "Base VM", and reconfiguring the memory and disk space.  The
 Base VM is not normally running, but when it is it will be at base.osgeo.osuosl.org.  When policy changes are made on how the base system should be configured for all VMs, they should also be applied to this base VM.
 = Enable LDAP =
 As per [[SAC:Setup LDAP Authentication]] instructions setup LDAP access for the appropriate group (sac, telascience, etc) on the newly created VM.
 ... ??

@@ Line 4: / Line 4: @@
 A support request should be made to OSU OSL support *after* discussion and agreement within SAC.
-Details will be needed on the disk space, memory and the machine on which it should be established.  See [[SAC Server Status]] to get a sense of the machines available and what is already running on them.  The support request should be made to support at osuosl.org.
+Details will be needed on the disk space, memory and the machine on which it should be established.  See [[SAC Service Status]] to get a sense of the machines available and what is already running on them.  The support request should be made to support at osuosl.org.
 = Base VM =

@@ Line 1: / Line 1: @@
-= Enable LDAP =
+This document pertains how to setup a new VM at [[OSL|OSU OSL]].
-As per [[SAC:Setup LDAP Authentication]] instructions using authconfig.
+= Request a new VM =
-Also need to update /etc/sudoers file like this:
+A support request should be made to OSU OSL support *after* discussion and agreement within SAC.
- (need to work out how to use LDAP Admin group to identify access to sudoers file)
+= Base VM =
-= YUM Update =
+New VMs are made by cloning the "Base VM", and reconfiguring the memory and disk space.  The
- sudo yum check-update
+= Enable LDAP =
-= Disable SELinux =
+As per [[SAC:Setup LDAP Authentication]] instructions setup LDAP access for the appropriate group (sac, telascience, etc) on the newly created VM.
-On some systems it may be desired to disable SELinux.  This
+... ??
 [[Category:Infrastructure]]