New CSC Machine

2013-02-03T23:57:04Z

Sharvey: /* apt */

= Booting =

* Put the TFTP image in place (if dist-arch pair installed before, you may skip this).
e.g. extract http://mirror.csclub.uwaterloo.ca/ubuntu/dists/oneiric/main/installer-amd64/current/images/netboot/netboot.tar.gz to caffeine:/srv/tftp/oneiric-amd64

* Configure DHCP server; see caffeine:/etc/dhcp/dhcpd.conf. This allow caffeine to identify the host by its MAC address and give it the correct IP and boot image. e.g.
host bit-shifter {
hardware ethernet 6C:F0:49:08:49:48;
fixed-address 129.97.134.111;
next-server 129.97.134.17;
filename "precise-amd64/pxelinux.0";
}

* Force network boot in the BIOS. This may be called "Legacy LAN" or other such cryptic things. If this doesn't work, boot from CD or USB instead.

It is preferred to use the "alternate" Ubuntu installer image, based on debian-installer, instead of the Ubiquity installer. This installer supports software RAID and LVM out of the box, and will generally make your life easier. If installing Debian, this is the usual installer, so don't sweat it.

= Installing =

== debian-installer ==

At least in expert mode, you can choose a custom mirror (top of the countries list) and give the path for mirror directly. This will make installation super-fast compared to installing from anywhere else.

Please install to LVM volumes, as this is our standard configuration on all machines where possible. It allows more flexible partitioning across available volumes. Since GRUB 2, even /boot may be on LVM; this is the preferred configuration for simplicity, except when legacy partitioning setups make this inconvenient.

You may enable unattended upgrades, but do not enable Canonical's remote management service or any such nonsense. This is mostly a straightforward Debian/Ubuntu install.

== Ubiquity ==

Ubiquity is the Ubuntu GUI installer. For it to have lvm support, run:
apt-get install lvm2

If you still can't see the partitions (even if lvscan sees them, but no devices exist), run <tt>vgscan</tt> and <tt>vgchange -ay</tt> as root. Now the partitioner should be able to see them. We prefer to use LVM for partitions. Since GRUB 2, even /boot may be on LVM; this is the preferred configuration for simplicity, except when legacy partitioning setups make this inconvenient.

After installing with Ubiquity, you must also add LVM support to the newly installed system, and in particular its initramfs.

mount /dev/vg0/root /mnt
mount /dev/sda1 /mnt/boot
chroot /mnt
apt-get install lvm2

You should see an update-initramfs update. Reboot.

= After Installing =

== apt ==

If you did not during installation, change all references in <tt>/etc/apt/sources.list</tt> to use <tt>mirror</tt> instead of the usual mirrors.

Also add support for the CSC packages. Add the following to <tt>/etc/apt/sources.list.d/csclub.list</tt> (or copy from another host):

deb http://debian.csclub.uwaterloo.ca/ <distribution> main contrib non-free
deb-src http://debian.csclub.uwaterloo.ca/ <distribution> main contrib non-free

You'll also need the CSC archive signing key (if <tt>curl</tt> is not installed, install it).
curl -s http://debian.csclub.uwaterloo.ca/csclub.asc | apt-key add -

If you are running Debian, our package list installs some cross-compilers that are in the Emdebian repository. Install the package <tt>emdebian-archive-keyring</tt> and then add the following entry to <tt>/etc/apt/sources.list.d/emdebian.list</tt>:
deb http://mirror.csclub.uwaterloo.ca/emdebian/ squeeze main
deb-src http://mirror.csclub.uwaterloo.ca/emdebian/ squeeze main

You should now run <tt>apt-get update</tt> to reflect these changes.

Next, install <tt>inapt</tt> (it is in the CSC Debian archive). If it hasn't previously been built for the current platform, clone and build it (TODO: describe how to do this).

Clone <tt>~git/public/packages.git</tt>, update it if necessary (notably updating <tt>nodes.ia</tt> to reflect the distribution and role of the machine), then run:
inapt *.ia

(Due to a bug, if a warning is thrown, this will segfault. Until fixed, just temporarily remove whatever packages it complains about from the list.)

Warning: this will take a long time due to the large number of packages being installed. Some of the below can be done once the relevant packages are installed, but while other packages are still being installed.

Note that inapt current uninstalls NetworkManager, which is what Ubuntu uses by default to configure the network. Once this completes, open <tt>/etc/network/interfaces</tt> and set up a static networking configuration (otherwise, networking will not come back up on reboot). It should look something like this:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
address 129.97.134.xxx
netmask 255.255.255.0
gateway 129.97.134.1
network 129.97.134.0
broadcast 129.97.134.255
dns-nameservers 129.97.2.1 129.97.47.5 129.97.47.6
dns-search csclub.uwaterloo.ca uwaterloo.ca

For unattended upgrades in the future, install the <tt>unattended-upgrades</tt> package and copy <tt>/etc/apt/apt.conf</tt> from another host.

== Keys ==

If this is a reinstall of an existing host, copy back the SSH host keys and <tt>/etc/krb5.keytab</tt> from its former incarnation. Otherwise, create a new Kerberos principal and copy the keytab over, as follows (run from the host in question):
kadmin -p sysadmin/admin # or any other admin principal; the password for this one is the usual root password
addprinc -randkey host/[hostname].csclub.uwaterloo.ca
ktadd host/[hostname].csclub.uwaterloo.ca

This will generate a new principal (you can skip this step if one already exists) and add it to the local Kerberos keytab.

Also copy <tt>/etc/ssl/certs/GlobalSign_Intermediate_Root.pem</tt> from another host, as many of our services use a certificate issued by this CA.

== Configuration ==

=== General ===

The following config files are needed to work in the CSC environment (examples given below for an office terminal; perhaps refer to another host if preferred).

<tt>/etc/nsswitch.conf</tt>
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: files ldap
group: files ldap
shadow: files
sudoers: files ldap

hosts: files dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

netgroup: nis

<tt>/etc/ldap/ldap.conf</tt>
# $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE dc=csclub, dc=uwaterloo, dc=ca
URI ldaps://ldap1.csclub.uwaterloo.ca ldaps://ldap2.csclub.uwaterloo.ca

SIZELIMIT 0

TLS_CACERT /etc/ssl/certs/GlobalSign_Intermediate_Root.pem
TLS_CACERTFILE /etc/ssl/certs/GlobalSign_Intermediate_Root.pem

SUDOERS_BASE ou=SUDOers,dc=csclub,dc=uwaterloo,dc=ca

(On Debian, also copy <tt>/etc/sudo-ldap.conf</tt>.)

<tt>/etc/nslcd.conf</tt>
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.

# The user and group nslcd should run as.
uid nslcd
gid nslcd

# The location at which the LDAP server(s) should be reachable.
uri ldap://ldap1.csclub.uwaterloo.ca
uri ldap://ldap2.csclub.uwaterloo.ca

# The search base that will be used for all queries.
base dc=csclub,dc=uwaterloo,dc=ca

# use the uniqueMember attribute for group membership
# (not applicable on Debian squeeze)
map group member uniqueMember

<tt>/etc/krb5.conf</tt>
[libdefaults]
default_realm = CSCLUB.UWATERLOO.CA
forwardable = true
proxiable = true

# remove this once NFS mounts without it
allow_weak_crypto = true

[realms]
CSCLUB.UWATERLOO.CA = {
kdc = kdc1.csclub.uwaterloo.ca
kdc = kdc2.csclub.uwaterloo.ca
admin_server = kadmin.csclub.uwaterloo.ca
}
(rest omitted for brevity)

Notably, <tt>allow_weak_crypto</tt> is currently needed to mount <tt>/users</tt> (though oddly, not <tt>/scratch</tt>. /music is sec=sys and thus will always mount, even when krb5 is down and/or broken). Otherwise, you will get a mysterious "permission denied" error (even though the server claims to have authenticated the mount successfully).

<tt>/etc/pam.d/common-account</tt>
#
# /etc/pam.d/common-account - authorization settings common to all services
#

# here are the per-package modules (the "Primary" block)
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
# here's the fallback if no module succeeds
account requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the "Additional" block)
account required pam_krb5.so minimum_uid=10000
# end of pam-auth-update config

# Make sure the user is up to date. System accounts and syscom are exempt.
account [success=2 default=ignore] pam_succeed_if.so quiet uid < 10000
account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup syscom
account required pam_csc.so

This file is notably different on syscom-only hosts. Look at an existing syscom-only host to see the difference.

Alter <tt>/etc/default/nfs-common</tt> to enable <tt>statd</tt>, and more importantly <tt>gssd</tt> (needed for Kerberos NFS mounts). Start both daemons manually for now.

Add <tt>/users</tt>, <tt>/music</tt> and <tt>/scratch</tt> to <tt>/etc/fstab</tt> (as appropriate for the machine's role), make their mount points and mount them. Note that /music is sec=sys whereas /users and /scratch are both sec=krb5 (with exceptions granted on a case-by-case basis for servers only, office terminals are always sec=krb5 for security reasons).

To allow single sign-on as <tt>root</tt> (primarily useful for pushing files to all machines simultaneously), put the following in <tt>/root/.k5login</tt>:
sysadmin/admin@CSCLUB.UWATERLOO.CA

Also copy the following files from another CSC host:
* <tt>/etc/ssh/ssh_config</tt> and <tt>/etc/ssh/sshd_config</tt> (for single sign-on)
* <tt>/etc/ssh/ssh_known_hosts</tt> (to remove hostkey warnings within our network)
* <tt>/etc/hosts</tt> (for host tab completion and emergency name resolution)

=== Display Manager ===

LightDM (with unity-greeter) is the current display manager of choice for CSC office terminals. Copy <tt>/etc/lightdm/lightdm.conf</tt> and <tt>/etc/lightdm/users.conf</tt> from another CSC machine to configure it properly. If kdm or another display manager gets installed, please ensure that you continue to choose LightDM as the default display manager.

Please leave AccountsService enabled, as LightDM and certain parts of the GNOME packages work better when it is available.

The Unity greeter configuration is now in gsettings. We currently have a novelty wallpaper configured. To configure this, copy <tt>/usr/local/share/backgrounds/tarkin.png</tt> from another machine and run:

sudo -u lightdm dbus-launch gsettings set com.canonical.unity-greeter background /usr/local/share/backgrounds/tarkin.png

=== Tweaks ===

On Ubuntu precise, even when <tt>gnome-keyring</tt> is uninstalled, it leaves a config file behind that causes error messages. Remove <tt>/etc/pkcs11/modules/gnome-keyring-module</tt> to fix this.

== Records ==

You probably already created the host in the University IPAM system beforehand. If not, please do so.

Please also add the host to the [[Machine List]] here on the Wiki, and to <tt>/users/syscom/csc-machines</tt> (and <tt>csc-office-machines</tt>, if applicable).

= New Distribution =

If new distribution, create in conf/distributions AND conf/uploaders, and do rrr-update as well as rrr-incoming.
(TODO: expand this to describe building and pushing core CSC packages)

NetApp

2013-02-03T18:57:56Z

Sharvey: /* Commands */

2012-05-14T20:27:57Z

Sharvey:

= Setting up CUPS, the printing subsystem =
# Install <tt>cups</tt>.
# Go to <tt>http://localhost:631/</tt>. Go to 'Add Printer'. You may need to supply the root username/password.
# Click 'Internet Printing Protocol (ipp)'. CSC doesn't have any local printers, chances are all printers are connected via LAN. If it is LAN, then it is ipp.
# Enter connection, name, and description of the printer.

== MathSoc Printer ==

# Go to [http://welcome.solutions.brother.com/bsc/public_s/id/linux/en/download_prn.html#MFC-9970CDW the Brother site] and grab the cupswrapper and lpr drivers.
# Install the drivers with <tt>dpkg</tt>. You may need to use <tt>--force architecture</tt> on a 64-bit machine; don't worry, the package is actually arch-independent.
# Printer Connection: <tt>ipp://lp-mc3038.mathsoc.uwaterloo.ca/ipp</tt>
# Name: MathSoc
# Description: The colour printer in MathSoc. Printing is 10 cents per double-sided black and white sheet, and 30 cents per colour side.
# Brand: Brother
# Make: MFC 9770CDW
# Default options: make sure that Color is set to Mono and Two-sided printing is set to Long-edge.

== ljp_3016 printer ==

# Printer Connection: <tt>ipp://print.cs.uwaterloo.ca/printers/ljp_3016</tt>
# Name: ljp_3016
# Description: Main Math Printers
# Location: MC 3016
# Brand: HP
# Make: LaserJet 4250 Foomatic/Postscript
# Default options: make sure that two-sided printing is set to long-edge
'''NOTE: If the brand/make is not available for selection, don't download any third-party drivers. These drivers are available in apt. Find them there.'''

Printing

2012-05-14T20:24:42Z

Sharvey:

Printing

2012-05-14T20:24:24Z

Sharvey:

To set up printing to the MathSoc printer, do the following steps:

= Setting up CUPS, the printing subsystem =
# Install <tt>cups</tt>.
# Go to <tt>http://localhost:631/</tt>. Go to 'Add Printer'. You may need to supply the root username/password.
# Click 'Internet Printing Protocol (ipp)'. CSC doesn't have any local printers, chances are all printers are connected via LAN. If it is LAN, then it is ipp.
# Enter connection, name, and description of the printer.
#

== MathSoc Printer ==

# Go to [http://welcome.solutions.brother.com/bsc/public_s/id/linux/en/download_prn.html#MFC-9970CDW the Brother site] and grab the cupswrapper and lpr drivers.
# Install the drivers with <tt>dpkg</tt>. You may need to use <tt>--force architecture</tt> on a 64-bit machine; don't worry, the package is actually arch-independent.
# Printer Connection: <tt>ipp://lp-mc3038.mathsoc.uwaterloo.ca/ipp</tt>
# Name: MathSoc
# Description: The colour printer in MathSoc. Printing is 10 cents per double-sided black and white sheet, and 30 cents per colour side.
# Brand: Brother
# Make: MFC 9770CDW
# Default options: make sure that Color is set to Mono and Two-sided printing is set to Long-edge.

== ljp_3016 printer ==

# Printer Connection: <tt>ipp://print.cs.uwaterloo.ca/printers/ljp_3016</tt>
# Name: ljp_3016
# Description: Main Math Printers
# Location: MC 3016
# Brand: HP
# Make: LaserJet 4250 Foomatic/Postscript
# Default options: make sure that two-sided printing is set to long-edge

User:Sharvey

2012-05-14T20:14:52Z

Sharvey: Created page with "I am the great sharvey!!!"

I am the great sharvey!!!

Robot Arm

2011-12-19T20:53:01Z

Sharvey: /* External Links */

= Hardware =
The arm is a [http://www.lynxmotion.com/c-130-al5d.aspx Lynxmotion AL5D].

= Operation =
Currently the arm is controlled by interfacing directly with /dev/ttySx or /dev/ttyUSBx . The syntax for controlling this is by sending the following string to the board:
<pre>
#<servo id> P<position> S<speed> T<time>
</pre>

S, T are optional as far as we are aware.

Key:
* <servo id> - id of the servo being controlled (includes jaw)
* <position> - servo rotation position, generally between (500,2500)
* <speed> - speed of rotation; leaving this off generates fast movement, 400 seems like a "safe" value?
* <time> - time it takes to rotate to position?

== Servo key and degree of motion ==
* 0 - ???
* 1 - ???
* 2 - ???
* 3 - ???
* 4 - ???
* 5 - ???

= Purpose =
The current purpose of the robot arm is to make an entity that can play chess against a human.

= External Links =
* a manual
* j3parker's [http://csclub.uwaterloo.ca/~j3parker/arm.png 3D model of the arm]

Robot Arm

2011-12-19T20:51:03Z

Sharvey: /* Operation */

Robot Arm

2011-12-19T20:45:14Z

Sharvey: /* Operation */

Robot Arm

2011-12-19T20:44:57Z

Sharvey: Created page with "= Hardware = The arm is a [http://www.lynxmotion.com/c-130-al5d.aspx Lynxmotion AL5D]. = Operation = Currently the arm is controlled by interfacing directly with /dev/ttySx or /…"

Main Page

2011-12-19T20:37:04Z

Sharvey: /* Machine/System Documentation */

This is the Wiki of the [[Computer Science Club]]. Feel free to start adding pages and information.

== Guides ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Budget Guide]]
* [[Club Hosting]]
* [[Member Hosting]]
* [[Exec Manual]]
* [[Imapd Guide]]
* [[MEF Guide]]
* [[Office Staff]]
* [[Talks Guide]]
* [[SCS Guide]]
</div>

== News and Events ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Meetings]]
* [[Talks]]
* [[Projects]]
* [[Industry Opportunities]]
</div>

== Machine/System Documentation ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Authentication]]
* [[Backups]]
* [[ceo]]
* [[Conserver]]
* [[DNS]]
* [[Debian Repository]]
* [[Digital Cutter]]
* [[Directory Services]]
* [[Machine List]]
* [[Mail]]
* [[Mailing Lists]]
* [[Mirror]]
* [[MySQL]]
* [[OID Assignment]]
* [[Robot Arm]]
* [[Scratch]]
* [[SNMP]]
* [[Serial Connections]]
* [[SSL]]
* [[Switches]]
* [[Sony Camera]]
* [[Systems Committee]]
* [[TS-7800]]
* [[UID/GID Assignment]]
* [[User-data]]
* [[Webcams]]
* [[Webmail]]
* [[Website]]
* [[Virtualization]]
</div>

== Miscellaneous ==
<div style="-webkit-column-count:3; -moz-column-count:3; column-count:3;">
* [[Budget]]
* [[Executive]]
* [[Frosh]]
* [[History]]
* [[Library]]
* [[MEF Proposals]]
* [[Office Policies]]
* [[Projector]]
* [[Term Notes]]
</div> __NOTOC__