source: branches/fc13-dev/server/doc/ @ 1676

Last change on this file since 1676 was 1676, checked in by andersk, 13 years ago
Avoid xargs (so stdin works), and use grep instead of parsing diff output
File size: 15.0 KB
1# This document is a how-to for installing a Fedora server.
2# It is semi-vaguely in the form of a shell script, but is not really
3# runnable as it stands.
5set -e -x
7# Some commands should be run as the scripts-build user, not root.
9alias asbuild="sudo -u scripts-build"
11# Old versions of this install document advised setting
12# NSS_NONLOCAL_IGNORE=1 anytime you're setting up anything, e.g. using
13# yum, warning that useradd will query LDAP in a stupid way that makes
14# it hang forever.  As of Fedora 13, this does not seem to be a problem,
15# so it's been removed from the instructions.  If an install is hanging,
16# though, try adding NSS_NONLOCAL_IGNORE.
18# This is actually just "pick an active scripts server".  It can't be
19# because our networking config points that domain
20# at localhost, and if our server is not setup at that point things
21# will break.
24# 'branch' is the current svn branch you are on.  You want to
25# use trunk if your just installing a new server, and branches/fcXX-dev
26# if your preparing a server on a new Fedora release.
29# 'server' is the public hostname of your server, for SCP'ing files
30# to and from.
33# Start with a Scripts kickstarted install of Fedora (install-fedora)
35# Take updates, reboot if there's a kernel update.
37    yum update
39# Check out the svn repository. Configure svn not to cache
40# credentials.
42# Copy over root's dotfiles from one of the other machines.
43# Perhaps a useful change is to remove the default aliases
44    cd /root
45    ls -l .bashrc
46    ls -l .ldapvirc
47    ls -l .screenrc
48    ls -l .ssh
49    ls -l .vimrc
50    ls -l .k5login
51    # Trying to scp from server to server won't work, as scp
52    # will attempt to negotiate a server-to-server connection.
53    # Instead, scp to your trusted machine as a temporary file,
54    # and then push to the other server
55scp -r root@$source_server:~/{.bashrc,.ldapvirc,.screenrc,.ssh,.vimrc,.k5login} .
56scp -r {.bashrc,.ldapvirc,.screenrc,.ssh,.vimrc,.k5login} root@$server:~
58# Install the initial set of credentials (to get Kerberized logins once
59# krb5 is installed).  Otherwise, SCP'ing things in will be annoying.
60#   o You probably installed the machine keytab long ago
61    ls -l /etc/krb5.keytab
62#     Use ktutil to combine the host/ and
63#     host/ keys with host/ in
64#     the keytab.  Do not use 'k5srvutil change' on the combined keytab
65#     or you'll break the other servers. (real servers only).  Be
66#     careful about writing out the keytab: if you write it to an
67#     existing file the keys will just get appended.  The correct
68#     credential list should look like:
69#       ktutil:  l
70#       slot KVNO Principal
71#       ---- ---- ---------------------------------------------------------------------
72#          1    5 host/
73#          2    3 host/
74#          3    2      host/
75#   o Replace the ssh host keys with the ones common to all scripts servers (real servers only)
76    ls -l /etc/ssh/*key*
77#     You can do that with:
78scp root@$source_server:/etc/ssh/*key* .
79scp *key* root@$server:/etc/ssh/
80    service sshd reload
82# Check out the scripts /etc configuration
83    # backslash to make us not use the alias
84    cd /root
85    \cp -a etc /
87# NOTE: You will have just lost DNS resolution and the ability
88# to do password SSH in.  If you managed to botch this step without
89# having named setup, you can do a quick fix by frobbing /etc/resolv.conf
90# with a non address for the DNS server.  Be sure to revert it once
91# you have named.
93# NOTE: You can get password SSH back by editing /etc/ssh/sshd_config (allow
94# password auth) and /etc/pam.d/sshd (comment out the first three auth
95# lines).  However, you should have the Kerberos credentials in place
96# so as soon as you install the full set of Scripts packages, you'll get
97# Kerberized logins.
99# Make sure network is working.  If this is a new server name, you'll
100# need to add it to /etc/hosts and
101# /etc/sysconfig/network-scripts/route-eth1.  Kickstart should have
102# configured eth0 and eth1 correctly; use service network restart
103# to add the new routes in route-eth1.
104    service network restart
105    route
106    ifconfig
107    cat /etc/hosts
108    cat /etc/sysconfig/network-scripts/route-eth1
110# This is the point at which you should start updating scriptsified
111# packages for a new Fedora release.  Consult 'upgrade-tips' for more
112# information.
113    yum install -y scripts-base
114    # Some of these packages are naughty and clobber some of our files
115    cd /etc
116    svn revert resolv.conf hosts sysconfig/openafs
118# Replace rsyslog with syslog-ng by doing:
119    rpm -e --nodeps rsyslog
120    yum install -y syslog-ng
121    chkconfig syslog-ng on
123# Fix the openafs /usr/vice/etc <-> /etc/openafs mapping.
124    echo "/afs:/usr/vice/cache:10000000" > /usr/vice/etc/cacheinfo
125    echo "" > /usr/vice/etc/ThisCell
127# [TEST SERVER] If you're installing a test server, this needs to be
128# much smaller; the max filesize on XVM is 10GB.  Pick something like
129# 500000. Also, some of the AFS parameters are kind of retarded (and if
130# you're low on disk space, will actually exhaust our inodes).  Edit
131# these parameters in /etc/sysconfig/openafs
133# Test that zephyr is working
134    chkconfig zhm on
135    service zhm start
136    echo 'Test!' | zwrite -d -c scripts -i test
138# Install the full list of RPMs that users expect to be on the
139# servers.
140rpm -qa --queryformat "%{Name}.%{Arch}\n" | sort > packages.txt
141# arrange for packages.txt to be passed to the server, then run:
142# --skip-broken will (usually) prevent you from having to sit through
143# several minutes of dependency resolution until it decides that
144# it can't install /one/ package.
145    yum install -y --skip-broken $(cat packages.txt)
147# Check which packages are installed on your new server that are not
148# in the snapshot, and remove ones that aren't needed for some reason
149# on the new machine.  Otherwise, aside from bloat, you may end up
150# with undesirable things for security, like sendmail.
151    rpm -qa --queryformat "%{Name}.%{Arch}\n" | grep -v kernel | sort > newpackages.txt
152    diff -u packages.txt newpackages.txt | grep -v kernel | less
153    # here's a cute script that removes all extra packages
154    yum erase -y $(grep -Fxvf packages.txt newpackages.txt)
156# We need an upstream version of cgi which we've packaged ourselves, but
157# it doesn't work with the haskell-platform package which expects
158# explicit versions.  So temporarily rpm -e the package, and then
159# install it again after you install haskell-platform.  [Note: You
160# probably won't need this in Fedora 15 or something, when the Haskell
161# Platform gets updated.]
162    rpm -e ghc-cgi-devel ghc-cgi
163    yum install -y haskell-platform
164    yumdownloader ghc-cgi
165    yumdownloader ghc-cgi-devel
166    rpm -i ghc-cgi*1.8.1*.rpm
168# Check out the scripts /usr/vice/etc configuration
169    cd /root/vice
170    \cp -a etc /usr/vice
172# Install the full list of perl modules that users expect to be on the
173# servers.
174    cd /root
175    export PERL_MM_USE_DEFAULT=1
176    cpan # this is interactive, enter the next two lines
177        o conf prerequisites_policy follow
178        o conf commit
179# on a reference server
180perldoc -u perllocal | grep head2 | cut -f 3 -d '<' | cut -f 1 -d '|' | sort -u | perl -ne 'chomp; print "notest install $_\n" if system("rpm -q --whatprovides \"perl($_)\" >/dev/null 2>/dev/null")' > perl-packages.txt
181# arrange for perl-packages.txt to be transferred to server
182    cat perl-packages.txt | perl -MCPAN -e shell
184# Install the Python eggs and Ruby gems and PEAR/PECL doohickeys that are on
185# the other servers and do not have RPMs.
186# The general mode of operation will be to run the "list" command
187# on both servers, see what the differences are, check if those diffs
188# are packaged up as rpms, and install them (rpm if possible, native otherwise)
189# - Look at /usr/lib/python2.6/site-packages and
190#           /usr/lib64/python2.6/site-packages for Python eggs and modules.
191#   There will be a lot of gunk that was installed from packages;
192#   easy-install.pth in /usr/lib/ will tell you what was easy_installed.
193#   First use 'yum search' to see if the relevant package is now available
194#   as an RPM, and install that if it is.  If not, then use easy_install.
195#   Pass -Z to easy_install to install them unzipped, as some zipped eggs
196#   want to be able to write to ~/.python-eggs.  (Also makes sourcediving
197#   easier.)
198    cat /usr/lib/python2.6/site-packages/easy-install.pth
199# - Look at `gem list` for Ruby gems.
200#   Again, use 'yum search' and prefer RPMs, but failing that, 'gem install'.
201#       ezyang: rspec-rails depends on rspec, and will override the Yum
202#       package, so... don't use that RPM yet
203gem list --no-version > gem.txt
204    gem install $(gem list --no-version | grep -Fxvf - gem.txt)
205# - Look at `pear list` for Pear fruits (or whatever they're called).
206#   Yet again, 'yum search' for RPMs before resorting to 'pear install'.  Note
207#   that for things in the beta repo, you'll need 'pear install package-beta'.
208#   (you might get complaints about the php_scripts module; ignore them)
209pear list | tail -n +4 | cut -f 1 -d " " > pear.txt
210    pear config-set preferred_state beta
211    pear channel-update
212    pear install $(pear list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pear.txt)
213# - Look at `pecl list` for PECL things.  'yum search', and if you must,
214#   'pecl install' needed items. If it doesn't work, try 'pear install
215#   pecl/foo' or 'pecl install foo-beta' or those two combined.
216pecl list | tail -n +4 | cut -f 1 -d " " > pecl.txt
217    pecl install --nodeps $(pecl list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pecl.txt)
219# Setup some Python config
220    echo 'import site, os.path; site.addsitedir(os.path.expanduser("~/lib/python2.6/site-packages"))' > /usr/lib/python2.6/site-packages/00scripts-home.pth
222# Install the credentials.  There are a lot of things to remember here.
223# Be sure to make sure the permissions match up (ls -l on an existing
224# server!).
225scp root@$source_server:{/etc/{sql-mit-edu.cfg.php,daemon.keytab,pki/tls/private/scripts.key,signup-ldap-pw,whoisd-password},/home/logview/.k5login} .
226scp daemon.keytab signup-ldap-pw whoisd-password sql-mit-edu.cfg.php root@$server:/etc
227scp scripts.key root@$server:/etc/pki/tls/private
228scp .k5login root@$server:/home/logview
229    chown afsagent:afsagent /etc/daemon.keytab
230#   o The daemon.scripts keytab (will be daemon.scripts-test for test)
231    ls -l /etc/daemon.keytab
232#   o The SSL cert private key (real servers only)
233    ls -l /etc/pki/tls/private/scripts.key
234#   o The LDAP password for the signup process (real servers only)
235    ls -l /etc/signup-ldap-pw
236#   o The whoisd password (real servers only)
237    ls -l /etc/whoisd-password
238#   o Make sure logview's .k5login is correct (real servers only)
239    cat /home/logview/.k5login
241# Spin up OpenAFS.  This will fail if there's been a new kernel since
242# when you last tried.  In that case, you can hold on till later to
243# start OpenAFS.  This will take a little bit of time;
244    service openafs-client start
246# Check that fs sysname is correct.  You should see, among others,
247# 'amd64_fedoraX_scripts' (vary X) and 'scripts'. If it's not, you
248# probably did a distro upgrade and should update /etc/sysconfig/openafs.
249    fs sysname
251# [TEST SERVER] If you are setting up a test server, pay attention to
252# /etc/sysconfig/network-scripts and do not bind scripts' IP address.
253# You will also need to modify:
254#   o /etc/ldap.conf
255#       add: host
256#   o /etc/nss-ldapd.conf
257#       replace: uri *****
258#       with: uri ldap://
259#   o /etc/openldap/ldap.conf
260#       add: URI ldap://
261#            BASE dc=scripts,dc=mit,dc=edu
262#   o /etc/httpd/conf.d/vhost_ldap.conf
263#       replace: VhostLDAPUrl ****
264#       with: VhostLDAPUrl "ldap://,dc=scripts,dc=mit,dc=edu"
265#   o /etc/postfix/virtual-alias-{domains,maps}
266#       replace: server_host *****
267#       with: server_host = ldap://
268# to use instead of localhost.
269# XXX: someone should write sed scripts to do this
271# [TEST SERVER] If you are setting up a test server, afsagent's cronjob
272# will attempt to be renewing with the wrong credentials
273# (daemon.scripts). Change this:
274    vim /home/afsagent/renew # replace all mentions of
276# Set up replication (see ./install-ldap).
277# You'll need the LDAP keytab for this server: be sure to chown it
278# fedora-ds after you create the fedora-ds user
279    ls -l /etc/dirsrv/keytab
280    cat install-ldap
282# Make the services dirsrv, nslcd, nscd, postfix, and httpd start at
283# boot. Run chkconfig to make sure the set of services to be run is
284# correct.
285    chkconfig dirsrv on
286    chkconfig nslcd on
287    chkconfig nscd on
288    chkconfig postfix on
289    chkconfig httpd on
291# Check sql user credentials (needs to be done after LDAP is setup)
292    chown sql /etc/sql-mit-edu.cfg.php
294# Postfix doesn't actually deliver mail; fix this
295    cd /etc/postfix
296    postmap virtual
298# Munin might not be monitoring packages that were installed after it
299    munin-node-configure --suggest --shell | sh
301# Run fmtutil-sys --all, which does something that makes TeX work.
302# (Note: this errors on XeTeX which is ok.)
303    fmtutil-sys --all
305# Ensure that PHP isn't broken:
306    mkdir /tmp/sessions
307    chmod 01777 /tmp/sessions
309# Ensure fcgid isn't broken (should be 755)
310    ls -l /var/run/mod_fcgid
312# Fix etc by making sure none of our config files got overwritten
313    cd /etc
314    svn status -q
315    # Some usual candidates for clobbering include nsswitch.conf and
316    # sysconfig/openafs
318# ThisCell got clobbered, replace it with
319    echo "" > /usr/vice/etc/ThisCell
321# Reboot the machine to restore a consistent state, in case you
322# changed anything. (Note: Starting kdump fails (this is ok))
324# [OPTIONAL] Your machine's hostname is baked in at install time;
325# in the rare case you need to change it: it appears to be in:
326#   o /etc/sysconfig/network
327#   o your lvm thingies; probably don't need to edit
329# [TEST SERVER] More stuff for test servers
330#   - You need a self-signed SSL cert.  Generate with:
331    openssl req -new -x509 -keyout /etc/pki/tls/private/scripts.key -out /etc/pki/tls/certs/scripts.cert -nodes
332#     Also make /etc/pki/tls/certs/ca.pem match up
333#   - Make (/etc/aliases) root mail go to /dev/null, so we don't spam people
334#   - Edit /etc/httpd/conf.d/scripts-vhost-names.conf to have
335#     be an accepted vhost name
336#   - Look at the old test server and see what config changes are floating around
338# XXX: our SVN checkout should be updated to use
339# (repository and etc) once serving actually works.
340    cd /etc
341    svn switch --relocate svn://$source_server/ svn://
342    cd /usr/vice/etc
343    svn switch --relocate svn://$source_server/ svn://
344    cd /srv/repository
345    asbuild svn switch --relocate svn://$source_server/ svn://
346    asbuild svn up # verify works
Note: See TracBrowser for help on using the repository browser.