2014-11-19T02:45:32Z

Aechunt: Created page with "This page documents various random hardware around the office =Graphics Cards= ==#1: ASUS ENGT440/DI/1GD5== http://www.asus.com/ca-en/Graphics_Cards/ENGT440DI1GD5/specificat..."

Main Page

2014-11-19T02:36:28Z

Aechunt: /* Machine/System Documentation */

This is the Wiki of the [[Computer Science Club]]. Feel free to start adding pages and information.

[[Special:AllPages]]

== Guides ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Budget Guide]]
* [[Club Hosting]]
* [[Member Hosting]]
* [[Exec Manual]]
* [[Imapd Guide]]
* [[MEF Guide]]
* [[Office Policies]]
* [[Office Staff]]
* [[How to IRC]]
* [[Talks Guide]]
* [[SCS Guide]]
* [[Kerberos | Password Reset ]]
* [[Disk Drive RMA Process]]
</div>

== News and Events ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Meetings]]
* [[Talks]]
* [[Projects]]
* [[Industry Opportunities]]
</div>

== Machine/System Documentation ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Authentication]]
* [[Backups]]
* [[ceo]]
* [[DNS]]
* [[Debian Repository]]
* [[Digital Cutter]]
* [[Directory Services]]
* [[Electronics]]
* [[Hardware]]
* [[Kerberos]]
* [[Machine List]]
* [[Mail]]
* [[Mailing Lists]]
* [[Mirror]]
* [[Music]]
* [[MySQL]]
* [[NetApp]]
* [[New CSC Machine]]
* [[NFS/Kerberos]]
* [[OID Assignment]]
* [[Printing]]
* [[Robot Arm]]
* [[Scratch]]
* [[SNMP]]
* [[Serial Connections]]
* [[SSL]]
* [[Switches]]
* [[Sony Camera]]
* [[Syscom Todo]]
* [[Systems Committee]]
* [[TS-7800]]
* [[UID/GID Assignment]]
* [[User-data]]
* [[Webcams]]
* [[Webmail]]
* [[Website]]
* [[Virtualization]]
</div>

== Miscellaneous ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Budget]]
* [[Executive]]
* [[Past Executive]]
* [[Frosh]]
* [[History]]
* [[Library]]
* [[MEF Proposals]]
* [[Office Cleanup]]
* [[Projector]]
* [[Term Notes]]
</div> __NOTOC__

Syscom Todo

2014-11-19T02:32:06Z

Aechunt: /* General */

These are things that syscom should do eventually:

==General==
* Prepare MEF request for `sodium-benzoate` upgrades/replacement.
* Prepare MEF request for drives for cobalamin.
* Make roundcube use webauth, or else make webauth not tell you not to log into roundcube.
* Establish remote syslog
* Get UPS monitoring working across multiple systems
* `/users` backups
* Disaster recovery plan
* Put backup containers onto cobalamin
* Get an IP/KVM for the machine room which doesn't suck?
* Update the wiki.
* Get stuff for natural-flavours & install (e45lee)
* Sort through keyboards in the office
* Fix the webcam counter (jj2baile)
* mounting USB sticks - special permissions required, can they be relaxed?
* clean up wiki vandalism
* make uploading videos less painful

==When in the Machine Room==
* Rotate CPUs in `hfcs` to see if it's the CPU or the socket that's causing NMI issues.
* Set up binaerpilot.
* Make sure that the IPMI/console connections are correct, up-to-date, and working.
* Add "DO NO TURN ON" label to phlogiston

==Science Machine Room==
* Setup Cobalamin (space has already been set aside for us)

Sun 2900

2014-11-16T06:58:44Z

Aechunt: Created page with "This page documents some stuff about the Sun 2900(s) loaned from MFCF. ==RAID setup== These instructions for the RAID setup for <tt>honey</tt> come from Robyn Landers of MFCF..."

This page documents some stuff about the Sun 2900(s) loaned from MFCF.

==RAID setup==
These instructions for the RAID setup for <tt>honey</tt> come from Robyn Landers of MFCF.

To reconfigure, first need to unmap the existing LUNs from the host.
In the telnet session to the management port...

view and edit Host luns

There are two: CHL 1 ID 0 (Primary Controller) and CHL 3 ID 1
(Secondary Ctlr).
* choose CHL 1 ID 0
** this brings up LUN 0 (logical drive 0, 279GB RAID5) and LUN 1 (logical drive 1, same)
* choose LUN 0, and unmap it
* choose LUN 1, and unmap it
* checking CHL 3 ID 1, we find no LUNs there in the first place

Now reassign the drives.

view and edit Logical drives

There are two: LG (logical group?) P0, a RAID5 in "good' status, and LG P1, a RAID5 in "drv failed" status.
* choose P1 and delete logical drive
* go back out to "view and edit Drives" and now we see those drives are in LG_DRV "none", so far so good. Back to view and edit Logical drives.
* choose P0 and delete logical drive P0. All drives are now unassigned.
* choose the now-blank P0 and Create Logical Drive. Yep, it doesn't know RAID6, so choose RAID5. It puts up a list of all available disks. Hit Enter to select the ones we want. Chose 0 1 2 3, then next menu gives choice of Assign spare, so chose 12. Gives summary screen: RAID5, 4 drives, 1 spare, logical drive primary. Confirm. Accept several notifications about building it.
* repeat for new LG P1 using disks 5 8 9 10, with 13 as spare.

Now need to combine these two RAID5 LUNs into single logical volume.

view and edit logical Volumes
* table is empty
* select LV 0, create logical volume
* select both LGs, P0 and P1
* accept default write policy and logical volume assignment, create the LV
* now we have LV P0 consisting of 2 LDs

Next need to map this logical volume to the host.

view and edit Host luns
* select CHL 1 ID 0 (primary controller)
* select logical Volume
* select LUN 0
* only choice available is LV P0 that we just created. Select it.
* leave it as one big partition, not our job to chop it up at this level. Size is 418,506 MB
* only choice is Map Host LUN
* LV 0 partition 0 to channel 1, ID 0, LUN 0 which I assume will end up as c1t0d0 from Solaris p.o.v.

All done. RAIDs are initializing in the background. Next step is at the OS level to label and partition this single logical volume.
</blockquote>

2014-07-27T19:58:44Z

Aechunt:

= Booting =

* Put the TFTP image in place (if dist-arch pair installed before, you may skip this).
e.g. extract http://mirror.csclub.uwaterloo.ca/ubuntu/dists/oneiric/main/installer-amd64/current/images/netboot/netboot.tar.gz to caffeine:/srv/tftp/oneiric-amd64

* Force network boot in the BIOS. This may be called "Legacy LAN" or other such cryptic things. If this doesn't work, boot from CD or USB instead.

It is preferred to use the "alternate" Ubuntu installer image, based on debian-installer, instead of the Ubiquity installer. This installer supports software RAID and LVM out of the box, and will generally make your life easier. If installing Debian, this is the usual installer, so don't sweat it.

= Installing =

== debian-installer ==

At least in expert mode, you can choose a custom mirror (top of the countries list) and give the path for mirror directly. This will make installation super-fast compared to installing from anywhere else.

Please install to LVM volumes, as this is our standard configuration on all machines where possible. It allows more flexible partitioning across available volumes. Since GRUB 2, even /boot may be on LVM; this is the preferred configuration for simplicity, except when legacy partitioning setups make this inconvenient.

You may enable unattended upgrades, but do not enable Canonical's remote management service or any such nonsense. This is mostly a straightforward Debian/Ubuntu install.

== Ubiquity ==

Ubiquity is the Ubuntu GUI installer. For it to have lvm support, run:
apt-get install lvm2

If you still can't see the partitions (even if lvscan sees them, but no devices exist), run <tt>vgscan</tt> and <tt>vgchange -ay</tt> as root. Now the partitioner should be able to see them. We prefer to use LVM for partitions. Since GRUB 2, even /boot may be on LVM; this is the preferred configuration for simplicity, except when legacy partitioning setups make this inconvenient.

After installing with Ubiquity, you must also add LVM support to the newly installed system, and in particular its initramfs.

mount /dev/vg0/root /mnt
mount /dev/sda1 /mnt/boot
chroot /mnt
apt-get install lvm2

You should see an update-initramfs update. Reboot.

= After Installing =

Add the new machine's ip to /etc/hosts and propagate to all other machines (~syscom/bin/alldist).

== apt ==

If you did not during installation, change all references in <tt>/etc/apt/sources.list</tt> to use <tt>mirror</tt> instead of the usual mirrors.

Also add support for the CSC packages. Add the following to <tt>/etc/apt/sources.list.d/csclub.list</tt> (or copy from another host):

deb http://debian.csclub.uwaterloo.ca/ <distribution> main contrib non-free
deb-src http://debian.csclub.uwaterloo.ca/ <distribution> main contrib non-free

You'll also need the CSC archive signing key (if <tt>curl</tt> is not installed, install it).
curl -s http://debian.csclub.uwaterloo.ca/csclub.asc | apt-key add -

If you are running Debian, our package list installs some cross-compilers that are in the Emdebian repository. Install the package <tt>emdebian-archive-keyring</tt> and then add the following entry to <tt>/etc/apt/sources.list.d/emdebian.list</tt>:
deb http://mirror.csclub.uwaterloo.ca/emdebian/ squeeze main
deb-src http://mirror.csclub.uwaterloo.ca/emdebian/ squeeze main

You should now run <tt>apt-get update</tt> to reflect these changes.

Next, install <tt>inapt</tt> (it is in the CSC Debian archive). If it hasn't previously been built for the current platform, clone and build it (TODO: describe how to do this).

Clone <tt>~git/public/packages.git</tt>, update it if necessary (notably updating <tt>nodes.ia</tt> to reflect the distribution and role of the machine), then run:
inapt *.ia

(Due to a bug, if a warning is thrown, this will segfault. Until fixed, just temporarily remove whatever packages it complains about from the list.)

Warning: this will take a long time due to the large number of packages being installed. Some of the below can be done once the relevant packages are installed, but while other packages are still being installed.

Note that inapt current uninstalls NetworkManager, which is what Ubuntu uses by default to configure the network. Once this completes, open <tt>/etc/network/interfaces</tt> and set up a static networking configuration (otherwise, networking will not come back up on reboot). It should look something like this:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
address 129.97.134.xxx
netmask 255.255.255.0
gateway 129.97.134.1
network 129.97.134.0
broadcast 129.97.134.255
dns-nameservers 129.97.2.1 129.97.47.5 129.97.47.6
dns-search csclub.uwaterloo.ca uwaterloo.ca

For unattended upgrades in the future, install the <tt>unattended-upgrades</tt> package and copy <tt>/etc/apt/apt.conf</tt> from another host.

== Keys ==

If this is a reinstall of an existing host, copy back the SSH host keys and <tt>/etc/krb5.keytab</tt> from its former incarnation. Otherwise, create a new Kerberos principal and copy the keytab over, as follows (run from the host in question):
kadmin -p sysadmin/admin # or any other admin principal; the password for this one is the usual root password
addprinc -randkey host/[hostname].csclub.uwaterloo.ca
ktadd host/[hostname].csclub.uwaterloo.ca

This will generate a new principal (you can skip this step if one already exists) and add it to the local Kerberos keytab.

Also copy <tt>/etc/ssl/certs/GlobalSign_Intermediate_Root_SHA256_G2.pem</tt> from another host, as many of our services use a certificate issued by this CA.

== Configuration ==

=== General ===

The following config files are needed to work in the CSC environment (examples given below for an office terminal; perhaps refer to another host if preferred).

<tt>/etc/nsswitch.conf</tt>
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: files ldap
group: files ldap
shadow: files ldap
sudoers: files ldap

hosts: files dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

<tt>/etc/ldap/ldap.conf</tt>

# $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE dc=csclub, dc=uwaterloo, dc=ca
URI ldap://ldap1.csclub.uwaterloo.ca ldap://ldap2.csclub.uwaterloo.ca

SIZELIMIT 0

TLS_CACERT /etc/ssl/certs/GlobalSign_Intermediate_Root.pem
TLS_CACERTFILE /etc/ssl/certs/GlobalSign_Intermediate_Root.pem

SUDOERS_BASE ou=SUDOers,dc=csclub,dc=uwaterloo,dc=ca

(On Debian, also copy <tt>/etc/sudo-ldap.conf</tt>.)

<tt>/etc/nslcd.conf</tt>
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.

# The user and group nslcd should run as.
uid nslcd
gid nslcd

# The location at which the LDAP server(s) should be reachable.
uri ldap://ldap1.csclub.uwaterloo.ca
uri ldap://ldap2.csclub.uwaterloo.ca

# The search base that will be used for all queries.
base dc=csclub,dc=uwaterloo,dc=ca

# use the uniqueMember attribute for group membership
# (not applicable on Debian squeeze)
map group member uniqueMember

<tt>/etc/krb5.conf</tt>
[libdefaults]
default_realm = CSCLUB.UWATERLOO.CA
forwardable = true
proxiable = true
dns_lookup_kdc = false
dns_lookup_realm = false

[realms]
CSCLUB.UWATERLOO.CA = {
kdc = kdc1.csclub.uwaterloo.ca
kdc = kdc2.csclub.uwaterloo.ca
admin_server = kadmin.csclub.uwaterloo.ca
}
(rest omitted for brevity)

Update: <tt>allow_weak_crypto</tt> is basically a no-op in recent Kerberos versions - but this is not a problem as any linux kernel with version >= 2.6.38.2 can use any cipher available to the kernel to grab tickets from the KDC for the purpose of NFS sec=krb5. Notably, this means you can use ciphersuites less craptastic than des-cbc-crc (the only one that used to work prior to this kernel revision) for NFS sec=krb5 mounts. Therefore, <tt>allow_weak_crypto</tt> has been removed from /etc/krb5.conf on all our machines.

Furthermore, the lines <tt>dns_lookup_kdc</tt> and <tt>dns_lookup_realm</tt> have been added - they are needed to stop the KDC from throwing its arms in the air and giving up if IST's DNS servers ever explode - an event that has happened in the recent past far more often than I'd like it to.

Notably, <tt>allow_weak_crypto</tt> is currently needed to mount <tt>/users</tt> (/music and <tt>/scratch</tt> is sec=sys and thus will always mount, even when krb5 is down and/or broken). Otherwise, you will get a mysterious "permission denied" error (even though the server claims to have authenticated the mount successfully).

<tt>/etc/pam.d/common-account</tt>
#
# /etc/pam.d/common-account - authorization settings common to all services
#

# here are the per-package modules (the "Primary" block)
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
# here's the fallback if no module succeeds
account requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the "Additional" block)
account required pam_krb5.so minimum_uid=10000
# end of pam-auth-update config

# Make sure the user is up to date. System accounts and syscom are exempt.
account [success=2 default=ignore] pam_succeed_if.so quiet uid < 10000
account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup syscom
account required pam_csc.so

This file is notably different on syscom-only hosts. Look at an existing syscom-only host to see the difference.

Alter <tt>/etc/default/nfs-common</tt> to enable <tt>statd</tt>, and more importantly <tt>gssd</tt> (needed for Kerberos NFS mounts). Start both daemons manually for now.

Add <tt>/users</tt>, <tt>/music</tt> and <tt>/scratch</tt> to <tt>/etc/fstab</tt> (as appropriate for the machine's role), make their mount points and mount them. Note that <tt>/music</tt> and <tt>/scratch</tt> are sec=sys whereas /users is sec=krb5 (with exceptions granted on a case-by-case basis for servers only, office terminals are always sec=krb5 for security reasons).

To allow single sign-on as <tt>root</tt> (primarily useful for pushing files to all machines simultaneously), put the following in <tt>/root/.k5login</tt>:
sysadmin/admin@CSCLUB.UWATERLOO.CA

Also copy the following files from another CSC host:
* <tt>/etc/ssh/ssh_config</tt> and <tt>/etc/ssh/sshd_config</tt> (for single sign-on)
* <tt>/etc/ssh/ssh_known_hosts</tt> (to remove hostkey warnings within our network)
* <tt>/etc/hosts</tt> (for host tab completion and emergency name resolution)

=== Display Manager ===

LightDM (with unity-greeter) is the current display manager of choice for CSC office terminals. Copy <tt>/etc/lightdm/lightdm.conf</tt> and <tt>/etc/lightdm/users.conf</tt> from another CSC machine to configure it properly. If kdm or another display manager gets installed, please ensure that you continue to choose LightDM as the default display manager.

Please leave AccountsService enabled, as LightDM and certain parts of the GNOME packages work better when it is available.

The Unity greeter configuration is now in gsettings. We currently have a novelty wallpaper configured. To configure this, copy <tt>/usr/local/share/backgrounds/tarkin.png</tt> from another machine and run:

sudo -u lightdm dbus-launch gsettings set com.canonical.unity-greeter background /usr/local/share/backgrounds/tarkin.png

=== Audio ===

On an office terminal, copy <tt>/etc/pulse/default.pa</tt> from another office terminal.

If this is to be the machine that actually plays audio (currently <tt>nullsleep</tt>), the setup is slightly more complicated. You'll need to set up MPD and PulseAudio to receive connections, and store the PulseAudio cookie in <tt>~audio</tt>, with appropriate permissions so that only the <tt>audio</tt> group can access it. If this is a new audio machine, you'll also need to change <tt>default.pa</tt> on all office terminals to point to it.

=== Tweaks ===

On Ubuntu precise, even when <tt>gnome-keyring</tt> is uninstalled, it leaves a config file behind that causes error messages. Remove <tt>/etc/pkcs11/modules/gnome-keyring-module</tt> to fix this.

On Ubuntu saucy or newer, edit <tt>/etc/sysctl.d/10-magic-sysrq</tt> at change the value 244.

== Records ==

You probably already created the host in the University IPAM system beforehand. If not, please do so.

Please also add the host to the [[Machine List]] here on the Wiki, and to <tt>/users/syscom/csc-machines</tt> (and <tt>csc-office-machines</tt>, if applicable).

== Munin (System Monitoring) ==

If the new machine is not a container, you probably want to have it participate in the Munin cluster. Run <tt>apt-get install munin-node</tt> to install the monitoring client, then
edit the file /etc/munin/munin-node.conf. Look for a line that says <tt>allow ^127\.0\.0\.1$</tt> and add the following on a new line immediately below it:
<tt>allow ^129\.97\.134\.51$</tt> (this is the IP address for munin.csclub). Save the file, then <tt>/etc/init.d/munin-node restart</tt> and <tt>update-rc.d munin-node defaults</tt>.

Then, ssh into munin.csclub and edit the file /etc/munin/munin.conf and add the following lines to the end:
<tt>

[NEW-MACHINE-NAME.csclub] <br/>
addr 129.97.134.### <br />
use_node_name yes

</tt>

= New Distribution =

If you're adding a new distribution, there a couple of steps you'll need to take in updating the CSClub Debian repository on [[Machine_List#sodium_benzoate|sodium-benzoate/mirror]].

The steps to add a new Debian release (in the examples, jessie) is as follows, modify as necessary:

=== Step 0: Create a GPG key ===

Use "gpg --gen-key" or something like that. Skip this if you already have one.

=== Step 1: Add to Uploaders ===

The /srv/debian/conf/uploaders file on mirror contains the list of people who can upload. Add your GPG key id to this file. Use "gpg --list-secret-keys" to find out the key ID. You also need to import your key into the mirror's gpg homedir as follows:

gpg --export $KEYID | sudo env GNUPGHOME=/srv/debian/gpg gpg --import

You only need to do this step once.

=== Step 2: Add Distro ===

Add a new section to /srv/debian/conf/distributions:

Origin: CSC
Label: Debian
Codename: '''jessie'''
Architectures: alpha amd64 i386 mips mipsel sparc powerpc armel source
Components: main contrib non-free
Uploaders: uploaders
Update: dell chrome
SignWith: yes
Log: jessie.log
--changes notifier

And update the '''Allow''' line in /srv/debian/conf/incoming:

Allow: '''jessie>jessie''' oldstable>squeeze stable>wheezy lucid>lucid maverick>maverick oneiric>oneiric precise>precise quantal>quantal

=== Step 3: Update from Sources ===

Run:

sudo env GNUPGHOME=/srv/debian/gpg rrr-update

If all went well you should see the new distribution listed at http://debian.csclub.uwaterloo.ca/dists/

=== Step 4: CSC Packages ===

Now that we've got our new distribution set up we need to generate our packages and have them uploaded. Namely, ceo, libpam-csc & inapt. Using libpam-csc as an example:

Get the package:

git clone ~git/public/libpam-csc.git
cd libpam-csc

Update change log:

EMAIL=[you]@csclub.uwaterloo.ca NAME="Your Name" dch -i

Update as necessary, i.e:

libpam-csc (1.10'''jessie0''') '''jessie'''; urgency=low

* Packaging for jessie.

-- Your Name <[you]@csclub.uwaterloo.ca> Thu, 10 Oct 2013 22:08:48 -0400

Build! (You may need to install various dependencies, which it will yell at you if you don't have.)

debuild -k'''YOURKEYID'''

Yay, it built now let's upload it to the repo. The build process which create a PACKAGE.changes file in the parent directory (replace PACKAGE with the actual package name).

dupload libpam-csc_1.10jessie0_amd64.changes

Finally, log into mirror and type "sudo rrr-incoming". This is supposed to happen once every few minutes however it is always faster to run it manually.

And you're done. Just repeat the previous bit for other csc packages.

New CSC Machine

2014-07-27T19:58:03Z

Aechunt:

= Booting =

* Put the TFTP image in place (if dist-arch pair installed before, you may skip this).
e.g. extract http://mirror.csclub.uwaterloo.ca/ubuntu/dists/oneiric/main/installer-amd64/current/images/netboot/netboot.tar.gz to caffeine:/srv/tftp/oneiric-amd64

* Force network boot in the BIOS. This may be called "Legacy LAN" or other such cryptic things. If this doesn't work, boot from CD or USB instead.

It is preferred to use the "alternate" Ubuntu installer image, based on debian-installer, instead of the Ubiquity installer. This installer supports software RAID and LVM out of the box, and will generally make your life easier. If installing Debian, this is the usual installer, so don't sweat it.

= Installing =

== debian-installer ==

At least in expert mode, you can choose a custom mirror (top of the countries list) and give the path for mirror directly. This will make installation super-fast compared to installing from anywhere else.

Please install to LVM volumes, as this is our standard configuration on all machines where possible. It allows more flexible partitioning across available volumes. Since GRUB 2, even /boot may be on LVM; this is the preferred configuration for simplicity, except when legacy partitioning setups make this inconvenient.

You may enable unattended upgrades, but do not enable Canonical's remote management service or any such nonsense. This is mostly a straightforward Debian/Ubuntu install.

== Ubiquity ==

Ubiquity is the Ubuntu GUI installer. For it to have lvm support, run:
apt-get install lvm2

If you still can't see the partitions (even if lvscan sees them, but no devices exist), run <tt>vgscan</tt> and <tt>vgchange -ay</tt> as root. Now the partitioner should be able to see them. We prefer to use LVM for partitions. Since GRUB 2, even /boot may be on LVM; this is the preferred configuration for simplicity, except when legacy partitioning setups make this inconvenient.

After installing with Ubiquity, you must also add LVM support to the newly installed system, and in particular its initramfs.

mount /dev/vg0/root /mnt
mount /dev/sda1 /mnt/boot
chroot /mnt
apt-get install lvm2

You should see an update-initramfs update. Reboot.

= After Installing =

Add the new machine's ip to /etc/hosts and propagate to all other machines (~syscom/bin/alldist).

== apt ==

If you did not during installation, change all references in <tt>/etc/apt/sources.list</tt> to use <tt>mirror</tt> instead of the usual mirrors.

Also add support for the CSC packages. Add the following to <tt>/etc/apt/sources.list.d/csclub.list</tt> (or copy from another host):

deb http://debian.csclub.uwaterloo.ca/ <distribution> main contrib non-free
deb-src http://debian.csclub.uwaterloo.ca/ <distribution> main contrib non-free

You'll also need the CSC archive signing key (if <tt>curl</tt> is not installed, install it).
curl -s http://debian.csclub.uwaterloo.ca/csclub.asc | apt-key add -

If you are running Debian, our package list installs some cross-compilers that are in the Emdebian repository. Install the package <tt>emdebian-archive-keyring</tt> and then add the following entry to <tt>/etc/apt/sources.list.d/emdebian.list</tt>:
deb http://mirror.csclub.uwaterloo.ca/emdebian/ squeeze main
deb-src http://mirror.csclub.uwaterloo.ca/emdebian/ squeeze main

You should now run <tt>apt-get update</tt> to reflect these changes.

Next, install <tt>inapt</tt> (it is in the CSC Debian archive). If it hasn't previously been built for the current platform, clone and build it (TODO: describe how to do this).

Clone <tt>~git/public/packages.git</tt>, update it if necessary (notably updating <tt>nodes.ia</tt> to reflect the distribution and role of the machine), then run:
inapt *.ia

(Due to a bug, if a warning is thrown, this will segfault. Until fixed, just temporarily remove whatever packages it complains about from the list.)

Warning: this will take a long time due to the large number of packages being installed. Some of the below can be done once the relevant packages are installed, but while other packages are still being installed.

Note that inapt current uninstalls NetworkManager, which is what Ubuntu uses by default to configure the network. Once this completes, open <tt>/etc/network/interfaces</tt> and set up a static networking configuration (otherwise, networking will not come back up on reboot). It should look something like this:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
address 129.97.134.xxx
netmask 255.255.255.0
gateway 129.97.134.1
network 129.97.134.0
broadcast 129.97.134.255
dns-nameservers 129.97.2.1 129.97.47.5 129.97.47.6
dns-search csclub.uwaterloo.ca uwaterloo.ca

For unattended upgrades in the future, install the <tt>unattended-upgrades</tt> package and copy <tt>/etc/apt/apt.conf</tt> from another host.

== Keys ==

If this is a reinstall of an existing host, copy back the SSH host keys and <tt>/etc/krb5.keytab</tt> from its former incarnation. Otherwise, create a new Kerberos principal and copy the keytab over, as follows (run from the host in question):
kadmin -p sysadmin/admin # or any other admin principal; the password for this one is the usual root password
addprinc -randkey host/[hostname].csclub.uwaterloo.ca
ktadd host/[hostname].csclub.uwaterloo.ca

This will generate a new principal (you can skip this step if one already exists) and add it to the local Kerberos keytab.

Also copy <tt>/etc/ssl/certs/GlobalSign_Intermediate_Root_SHA256_G2.pem</tt> from another host, as many of our services use a certificate issued by this CA.

== Configuration ==

=== General ===

The following config files are needed to work in the CSC environment (examples given below for an office terminal; perhaps refer to another host if preferred).

<tt>/etc/nsswitch.conf</tt>
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: files ldap
group: files ldap
shadow: files ldap
sudoers: files ldap

hosts: files dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

<tt>/etc/ldap/ldap.conf</tt>

# $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE dc=csclub, dc=uwaterloo, dc=ca
URI ldap://ldap1.csclub.uwaterloo.ca ldap://ldap2.csclub.uwaterloo.ca

SIZELIMIT 0

TLS_CACERT /etc/ssl/certs/GlobalSign_Intermediate_Root.pem
TLS_CACERTFILE /etc/ssl/certs/GlobalSign_Intermediate_Root.pem

SUDOERS_BASE ou=SUDOers,dc=csclub,dc=uwaterloo,dc=ca

(On Debian, also copy <tt>/etc/sudo-ldap.conf</tt>.)

<tt>/etc/nslcd.conf</tt>
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.

# The user and group nslcd should run as.
uid nslcd
gid nslcd

# The location at which the LDAP server(s) should be reachable.
uri ldap://ldap1.csclub.uwaterloo.ca
uri ldap://ldap2.csclub.uwaterloo.ca

# The search base that will be used for all queries.
base dc=csclub,dc=uwaterloo,dc=ca

# use the uniqueMember attribute for group membership
# (not applicable on Debian squeeze)
map group member uniqueMember

<tt>/etc/krb5.conf</tt>
[libdefaults]
default_realm = CSCLUB.UWATERLOO.CA
forwardable = true
proxiable = true
dns_lookup_kdc = false
dns_lookup_realm = false

[realms]
CSCLUB.UWATERLOO.CA = {
kdc = kdc1.csclub.uwaterloo.ca
kdc = kdc2.csclub.uwaterloo.ca
admin_server = kadmin.csclub.uwaterloo.ca
}
(rest omitted for brevity)

Update: <tt>allow_weak_crypto</tt> is basically a no-op in recent Kerberos versions - but this is not a problem as any linux kernel with version >= 2.6.38.2 can use any cipher available to the kernel to grab tickets from the KDC for the purpose of NFS sec=krb5. Notably, this means you can use ciphersuites less craptastic than des-cbc-crc (the only one that used to work prior to this kernel revision) for NFS sec=krb5 mounts. Therefore, <tt>allow_weak_crypto</tt> has been removed from /etc/krb5.conf on all our machines.

Furthermore, the lines <tt>dns_lookup_kdc</tt> and <tt>dns_lookup_realm</tt> have been added - they are needed to stop the KDC from throwing its arms in the air and giving up if IST's DNS servers ever explode - an event that has happened in the recent past far more often than I'd like it to.

Notably, <tt>allow_weak_crypto</tt> is currently needed to mount <tt>/users</tt> (/music and <tt>/scratch</tt> is sec=sys and thus will always mount, even when krb5 is down and/or broken). Otherwise, you will get a mysterious "permission denied" error (even though the server claims to have authenticated the mount successfully).

<tt>/etc/pam.d/common-account</tt>
#
# /etc/pam.d/common-account - authorization settings common to all services
#

# here are the per-package modules (the "Primary" block)
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
# here's the fallback if no module succeeds
account requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the "Additional" block)
account required pam_krb5.so minimum_uid=10000
# end of pam-auth-update config

# Make sure the user is up to date. System accounts and syscom are exempt.
account [success=2 default=ignore] pam_succeed_if.so quiet uid < 10000
account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup syscom
account required pam_csc.so

This file is notably different on syscom-only hosts. Look at an existing syscom-only host to see the difference.

Alter <tt>/etc/default/nfs-common</tt> to enable <tt>statd</tt>, and more importantly <tt>gssd</tt> (needed for Kerberos NFS mounts). Start both daemons manually for now.

Add <tt>/users</tt>, <tt>/music</tt> and <tt>/scratch</tt> to <tt>/etc/fstab</tt> (as appropriate for the machine's role), make their mount points and mount them. Note that <tt>/music</tt> and <tt>/scratch</tt> are sec=sys whereas /users is sec=krb5 (with exceptions granted on a case-by-case basis for servers only, office terminals are always sec=krb5 for security reasons).

To allow single sign-on as <tt>root</tt> (primarily useful for pushing files to all machines simultaneously), put the following in <tt>/root/.k5login</tt>:
sysadmin/admin@CSCLUB.UWATERLOO.CA

Also copy the following files from another CSC host:
* <tt>/etc/ssh/ssh_config</tt> and <tt>/etc/ssh/sshd_config</tt> (for single sign-on)
* <tt>/etc/ssh/ssh_known_hosts</tt> (to remove hostkey warnings within our network)
* <tt>/etc/hosts</tt> (for host tab completion and emergency name resolution)

=== Display Manager ===

LightDM (with unity-greeter) is the current display manager of choice for CSC office terminals. Copy <tt>/etc/lightdm/lightdm.conf</tt> and <tt>/etc/lightdm/users.conf</tt> from another CSC machine to configure it properly. If kdm or another display manager gets installed, please ensure that you continue to choose LightDM as the default display manager.

Please leave AccountsService enabled, as LightDM and certain parts of the GNOME packages work better when it is available.

The Unity greeter configuration is now in gsettings. We currently have a novelty wallpaper configured. To configure this, copy <tt>/usr/local/share/backgrounds/tarkin.png</tt> from another machine and run:

sudo -u lightdm dbus-launch gsettings set com.canonical.unity-greeter background /usr/local/share/backgrounds/tarkin.png

=== Audio ===

On an office terminal, copy <tt>/etc/pulse/default.pa</tt> from another office terminal.

If this is to be the machine that actually plays audio (currently <tt>nullsleep</tt>), the setup is slightly more complicated. You'll need to set up MPD and PulseAudio to receive connections, and store the PulseAudio cookie in <tt>~audio</tt>, with appropriate permissions so that only the <tt>audio</tt> group can access it.

=== Tweaks ===

On Ubuntu precise, even when <tt>gnome-keyring</tt> is uninstalled, it leaves a config file behind that causes error messages. Remove <tt>/etc/pkcs11/modules/gnome-keyring-module</tt> to fix this.

On Ubuntu saucy or newer, edit <tt>/etc/sysctl.d/10-magic-sysrq</tt> at change the value 244.

== Records ==

You probably already created the host in the University IPAM system beforehand. If not, please do so.

Please also add the host to the [[Machine List]] here on the Wiki, and to <tt>/users/syscom/csc-machines</tt> (and <tt>csc-office-machines</tt>, if applicable).

== Munin (System Monitoring) ==

If the new machine is not a container, you probably want to have it participate in the Munin cluster. Run <tt>apt-get install munin-node</tt> to install the monitoring client, then
edit the file /etc/munin/munin-node.conf. Look for a line that says <tt>allow ^127\.0\.0\.1$</tt> and add the following on a new line immediately below it:
<tt>allow ^129\.97\.134\.51$</tt> (this is the IP address for munin.csclub). Save the file, then <tt>/etc/init.d/munin-node restart</tt> and <tt>update-rc.d munin-node defaults</tt>.

Then, ssh into munin.csclub and edit the file /etc/munin/munin.conf and add the following lines to the end:
<tt>

[NEW-MACHINE-NAME.csclub] <br/>
addr 129.97.134.### <br />
use_node_name yes

</tt>

= New Distribution =

If you're adding a new distribution, there a couple of steps you'll need to take in updating the CSClub Debian repository on [[Machine_List#sodium_benzoate|sodium-benzoate/mirror]].

The steps to add a new Debian release (in the examples, jessie) is as follows, modify as necessary:

=== Step 0: Create a GPG key ===

Use "gpg --gen-key" or something like that. Skip this if you already have one.

=== Step 1: Add to Uploaders ===

The /srv/debian/conf/uploaders file on mirror contains the list of people who can upload. Add your GPG key id to this file. Use "gpg --list-secret-keys" to find out the key ID. You also need to import your key into the mirror's gpg homedir as follows:

gpg --export $KEYID | sudo env GNUPGHOME=/srv/debian/gpg gpg --import

You only need to do this step once.

=== Step 2: Add Distro ===

Add a new section to /srv/debian/conf/distributions:

Origin: CSC
Label: Debian
Codename: '''jessie'''
Architectures: alpha amd64 i386 mips mipsel sparc powerpc armel source
Components: main contrib non-free
Uploaders: uploaders
Update: dell chrome
SignWith: yes
Log: jessie.log
--changes notifier

And update the '''Allow''' line in /srv/debian/conf/incoming:

Allow: '''jessie>jessie''' oldstable>squeeze stable>wheezy lucid>lucid maverick>maverick oneiric>oneiric precise>precise quantal>quantal

=== Step 3: Update from Sources ===

Run:

sudo env GNUPGHOME=/srv/debian/gpg rrr-update

If all went well you should see the new distribution listed at http://debian.csclub.uwaterloo.ca/dists/

=== Step 4: CSC Packages ===

Now that we've got our new distribution set up we need to generate our packages and have them uploaded. Namely, ceo, libpam-csc & inapt. Using libpam-csc as an example:

Get the package:

git clone ~git/public/libpam-csc.git
cd libpam-csc

Update change log:

EMAIL=[you]@csclub.uwaterloo.ca NAME="Your Name" dch -i

Update as necessary, i.e:

libpam-csc (1.10'''jessie0''') '''jessie'''; urgency=low

* Packaging for jessie.

-- Your Name <[you]@csclub.uwaterloo.ca> Thu, 10 Oct 2013 22:08:48 -0400

Build! (You may need to install various dependencies, which it will yell at you if you don't have.)

debuild -k'''YOURKEYID'''

Yay, it built now let's upload it to the repo. The build process which create a PACKAGE.changes file in the parent directory (replace PACKAGE with the actual package name).

dupload libpam-csc_1.10jessie0_amd64.changes

Finally, log into mirror and type "sudo rrr-incoming". This is supposed to happen once every few minutes however it is always faster to run it manually.

And you're done. Just repeat the previous bit for other csc packages.

Office Policies

2013-12-12T16:26:24Z

Aechunt:

The following are the day-to-day policies for running the CSC Office. They are set down by the Office Manager or, should there not be a current Office Manager, by the Secretary.

# There must be an office staff member present in the office at all times when it is open.
# The office should be an inviting environment. Don't be excessively rude or loud; try not to make others uncomfortable. Use common sense.
# If someone leaves their terminal unlocked, don't do anything that might get them angry at you. Don't violate their privacy.
# Desks and wheely chairs are primarily for use with office terminals; if you are sitting in/at one and are not using the terminal, anyone may kick you out to use the terminal.
# Chairs are for people, not bags.
# If you leave your terminal and don't announce that you're coming back, or are gone for more than 5 minutes, someone else can take it.
# No sleeping in the office.
# No sex in the office.
# No playing games in the office unless for the purpose of an assignment or if you are writing one.
## This rule may be relaxed outside of business hours, if the office is not being kept open solely to play games and if the games are not interfering with or annoying people with better things to do.
# Nothing illegal in the office.
# The office is not your locker; don't leave things here, especially during business hours when space is at a premium.
# The office is not your pantry; don't leave food here, especially if it contains common allergens.
# Clean up your rubbish.
# The stapler may be used only inside the office, or for club business.
# The office phone is primarily for club business. You may use it for emergencies and brief calls, but do not use it excessively or to conduct business.
# Don't play music when you aren't in the office. It's OK to leave with music queued up.
# Share the music queue.
# During business hours, music must be kept at a reasonable volume.
# If issues arise, office staff are expected to be the adults and deal with them professionally, rather than making problems worse.
# Any significant incidents, including harassment, must be reported to the Office Manager, even if they get resolved.

(Business hours are 8:30 AM - 5:30 PM)

[[Category:Policy]]