source: branches/fc13-dev/server/doc/install-howto.sh @ 2553

Last change on this file since 2553 was 1692, checked in by ezyang, 14 years ago
Documentation updates.
File size: 15.3 KB
Line 
1# This document is a how-to for installing a Fedora scripts.mit.edu server.
2# It is semi-vaguely in the form of a shell script, but is not really
3# runnable as it stands.
4
5set -e -x
6
7# Some commands should be run as the scripts-build user, not root.
8
9alias asbuild="sudo -u scripts-build"
10
11# Old versions of this install document advised setting
12# NSS_NONLOCAL_IGNORE=1 anytime you're setting up anything, e.g. using
13# yum, warning that useradd will query LDAP in a stupid way that makes
14# it hang forever.  As of Fedora 13, this does not seem to be a problem,
15# so it's been removed from the instructions.  If an install is hanging,
16# though, try adding NSS_NONLOCAL_IGNORE.
17
18# This is actually just "pick an active scripts server".  It can't be
19# scripts.mit.edu because our networking config points that domain
20# at localhost, and if our server is not setup at that point things
21# will break.
22source_server="cats-whiskers.mit.edu"
23
24# 'branch' is the current svn branch you are on.  You want to
25# use trunk if your just installing a new server, and branches/fcXX-dev
26# if your preparing a server on a new Fedora release.
27branch="trunk"
28
29# 'server' is the public hostname of your server, for SCP'ing files
30# to and from.
31server=YOUR-SERVER-NAME-HERE
32
33# Start with a Scripts kickstarted install of Fedora (install-fedora)
34
35# Take updates, reboot if there's a kernel update.
36    yum update -y
37
38# Get rid of network manager
39    yum remove NetworkManager
40
41# Copy over root's dotfiles from one of the other machines.
42# Perhaps a useful change is to remove the default aliases
43    cd /root
44    ls -l .bashrc
45    ls -l .ldapvirc
46    ls -l .screenrc
47    ls -l .ssh
48    ls -l .vimrc
49    ls -l .k5login
50    # Trying to scp from server to server won't work, as scp
51    # will attempt to negotiate a server-to-server connection.
52    # Instead, scp to your trusted machine as a temporary file,
53    # and then push to the other server
54scp -r root@$source_server:~/{.bashrc,.ldapvirc,.screenrc,.ssh,.vimrc,.k5login} .
55scp -r {.bashrc,.ldapvirc,.screenrc,.ssh,.vimrc,.k5login} root@$server:~
56
57# Install the initial set of credentials (to get Kerberized logins once
58# krb5 is installed).  Otherwise, SCP'ing things in will be annoying.
59#   o You probably installed the machine keytab long ago
60    ls -l /etc/krb5.keytab
61#     Use ktutil to combine the host/scripts.mit.edu and
62#     host/scripts-vhosts.mit.edu keys with host/this-server.mit.edu in
63#     the keytab.  Do not use 'k5srvutil change' on the combined keytab
64#     or you'll break the other servers. (real servers only).  Be
65#     careful about writing out the keytab: if you write it to an
66#     existing file the keys will just get appended.  The correct
67#     credential list should look like:
68#       ktutil:  l
69#       slot KVNO Principal
70#       ---- ---- ---------------------------------------------------------------------
71#          1    5 host/old-faithful.mit.edu@ATHENA.MIT.EDU
72#          2    3 host/scripts-vhosts.mit.edu@ATHENA.MIT.EDU
73#          3    2      host/scripts.mit.edu@ATHENA.MIT.EDU
74#   o Replace the ssh host keys with the ones common to all scripts servers (real servers only)
75    ls -l /etc/ssh/*key*
76#     You can do that with:
77scp root@$source_server:/etc/ssh/*key* .
78scp *key* root@$server:/etc/ssh/
79    service sshd reload
80
81# Check out the scripts /etc configuration
82    # backslash to make us not use the alias
83    cd /root
84    \cp -a etc /
85    chmod 0440 /etc/sudoers
86
87# NOTE: You will have just lost DNS resolution and the ability
88# to do password SSH in.  If you managed to botch this step without
89# having named setup, you can do a quick fix by frobbing /etc/resolv.conf
90# with a non 127.0.0.1 address for the DNS server.  Be sure to revert it once
91# you have named.
92
93# NOTE: You can get password SSH back by editing /etc/ssh/sshd_config (allow
94# password auth) and /etc/pam.d/sshd (comment out the first three auth
95# lines).  However, you should have the Kerberos credentials in place
96# so as soon as you install the full set of Scripts packages, you'll get
97# Kerberized logins.
98
99# Make sure network is working.  If this is a new server name, you'll
100# need to add it to /etc/hosts and
101# /etc/sysconfig/network-scripts/route-eth1.  Kickstart should have
102# configured eth0 and eth1 correctly; use service network restart
103# to add the new routes in route-eth1.
104    service network restart
105    route
106    ifconfig
107    cat /etc/hosts
108    cat /etc/sysconfig/network-scripts/route-eth1
109
110# This is the point at which you should start updating scriptsified
111# packages for a new Fedora release.  Consult 'upgrade-tips' for more
112# information.
113    yum install -y scripts-base
114    # Some of these packages are naughty and clobber some of our files
115    cd /etc
116    svn revert resolv.conf hosts sysconfig/openafs
117
118# Replace rsyslog with syslog-ng by doing:
119    rpm -e --nodeps rsyslog
120    yum install -y syslog-ng
121    chkconfig syslog-ng on
122
123# Fix the openafs /usr/vice/etc <-> /etc/openafs mapping.
124    echo "/afs:/usr/vice/cache:10000000" > /usr/vice/etc/cacheinfo
125    echo "athena.mit.edu" > /usr/vice/etc/ThisCell
126
127# [TEST SERVER] If you're installing a test server, this needs to be
128# much smaller; the max filesize on XVM is 10GB.  Pick something like
129# 500000. Also, some of the AFS parameters are kind of retarded (and if
130# you're low on disk space, will actually exhaust our inodes).  Edit
131# these parameters in /etc/sysconfig/openafs
132
133# Test that zephyr is working
134    chkconfig zhm on
135    service zhm start
136    echo 'Test!' | zwrite -d -c scripts -i test
137
138# Install the full list of RPMs that users expect to be on the
139# scripts.mit.edu servers.
140rpm -qa --queryformat "%{Name}.%{Arch}\n" | sort > packages.txt
141# arrange for packages.txt to be passed to the server, then run:
142# --skip-broken will (usually) prevent you from having to sit through
143# several minutes of dependency resolution until it decides that
144# it can't install /one/ package.
145    yum install -y --skip-broken $(cat packages.txt)
146
147# Make sure sendmail isn't installed
148    yum remove sendmail
149
150# Check which packages are installed on your new server that are not
151# in the snapshot, and remove ones that aren't needed for some reason
152# on the new machine.  Otherwise, aside from bloat, you may end up
153# with undesirable things for security, like sendmail.
154    rpm -qa --queryformat "%{Name}.%{Arch}\n" | grep -v kernel | sort > newpackages.txt
155    diff -u packages.txt newpackages.txt | grep -v kernel | less
156    # here's a cute script that removes all extra packages
157    yum erase -y $(grep -Fxvf packages.txt newpackages.txt)
158
159# We need an upstream version of cgi which we've packaged ourselves, but
160# it doesn't work with the haskell-platform package which expects
161# explicit versions.  So temporarily rpm -e the package, and then
162# install it again after you install haskell-platform.  [Note: You
163# probably won't need this in Fedora 15 or something, when the Haskell
164# Platform gets updated.]
165    rpm -e ghc-cgi-devel ghc-cgi
166    yum install -y haskell-platform
167    yumdownloader ghc-cgi
168    yumdownloader ghc-cgi-devel
169    rpm -i ghc-cgi*1.8.1*.rpm
170
171# Check out the scripts /usr/vice/etc configuration
172    cd /root/vice
173    \cp -a etc /usr/vice
174
175# Install the full list of perl modules that users expect to be on the
176# scripts.mit.edu servers.
177    cd /root
178    export PERL_MM_USE_DEFAULT=1
179    cpan # this is interactive, enter the next two lines
180        o conf prerequisites_policy follow
181        o conf commit
182# on a reference server
183perldoc -u perllocal | grep head2 | cut -f 3 -d '<' | cut -f 1 -d '|' | sort -u | perl -ne 'chomp; print "notest install $_\n" if system("rpm -q --whatprovides \"perl($_)\" >/dev/null 2>/dev/null")' > perl-packages.txt
184# arrange for perl-packages.txt to be transferred to server
185    cat perl-packages.txt | perl -MCPAN -e shell
186
187# Install the Python eggs and Ruby gems and PEAR/PECL doohickeys that are on
188# the other scripts.mit.edu servers and do not have RPMs.
189# The general mode of operation will be to run the "list" command
190# on both servers, see what the differences are, check if those diffs
191# are packaged up as rpms, and install them (rpm if possible, native otherwise)
192# - Look at /usr/lib/python2.6/site-packages and
193#           /usr/lib64/python2.6/site-packages for Python eggs and modules.
194#   There will be a lot of gunk that was installed from packages;
195#   easy-install.pth in /usr/lib/ will tell you what was easy_installed.
196#   First use 'yum search' to see if the relevant package is now available
197#   as an RPM, and install that if it is.  If not, then use easy_install.
198#   Pass -Z to easy_install to install them unzipped, as some zipped eggs
199#   want to be able to write to ~/.python-eggs.  (Also makes sourcediving
200#   easier.)
201cat /usr/lib/python2.6/site-packages/easy-install.pth | grep "^./" | cut -c3- | cut -f1 -d- . egg.txt
202    cat egg.txt | xargs easy_install -Z
203# - Look at `gem list` for Ruby gems.
204#   Again, use 'yum search' and prefer RPMs, but failing that, 'gem install'.
205#       ezyang: rspec-rails depends on rspec, and will override the Yum
206#       package, so... don't use that RPM yet
207gem list --no-version > gem.txt
208    gem install $(gem list --no-version | grep -Fxvf - gem.txt)
209# - Look at `pear list` for Pear fruits (or whatever they're called).
210#   Yet again, 'yum search' for RPMs before resorting to 'pear install'.  Note
211#   that for things in the beta repo, you'll need 'pear install package-beta'.
212#   (you might get complaints about the php_scripts module; ignore them)
213pear list | tail -n +4 | cut -f 1 -d " " > pear.txt
214    pear config-set preferred_state beta
215    pear channel-update pear.php.net
216    pear install $(pear list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pear.txt)
217# - Look at `pecl list` for PECL things.  'yum search', and if you must,
218#   'pecl install' needed items. If it doesn't work, try 'pear install
219#   pecl/foo' or 'pecl install foo-beta' or those two combined.
220pecl list | tail -n +4 | cut -f 1 -d " " > pecl.txt
221    pecl install --nodeps $(pecl list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pecl.txt)
222
223# Setup some Python config
224    echo 'import site, os.path; site.addsitedir(os.path.expanduser("~/lib/python2.6/site-packages"))' > /usr/lib/python2.6/site-packages/00scripts-home.pth
225
226# Install the credentials.  There are a lot of things to remember here.
227# Be sure to make sure the permissions match up (ls -l on an existing
228# server!).
229scp root@$source_server:{/etc/{sql-mit-edu.cfg.php,daemon.keytab,pki/tls/private/scripts.key,signup-ldap-pw,whoisd-password},/home/logview/.k5login} .
230scp daemon.keytab signup-ldap-pw whoisd-password sql-mit-edu.cfg.php root@$server:/etc
231scp scripts.key root@$server:/etc/pki/tls/private
232scp .k5login root@$server:/home/logview
233    chown afsagent:afsagent /etc/daemon.keytab
234#   o The daemon.scripts keytab (will be daemon.scripts-test for test)
235    ls -l /etc/daemon.keytab
236#   o The SSL cert private key (real servers only)
237    ls -l /etc/pki/tls/private/scripts.key
238#   o The LDAP password for the signup process (real servers only)
239    ls -l /etc/signup-ldap-pw
240#   o The whoisd password (real servers only)
241    ls -l /etc/whoisd-password
242#   o Make sure logview's .k5login is correct (real servers only)
243    cat /home/logview/.k5login
244
245# Spin up OpenAFS.  This will fail if there's been a new kernel since
246# when you last tried.  In that case, you can hold on till later to
247# start OpenAFS.  This will take a little bit of time;
248    service openafs-client start
249
250# Check that fs sysname is correct.  You should see, among others,
251# 'amd64_fedoraX_scripts' (vary X) and 'scripts'. If it's not, you
252# probably did a distro upgrade and should update /etc/sysconfig/openafs.
253    fs sysname
254
255# [TEST SERVER] If you are setting up a test server, pay attention to
256# /etc/sysconfig/network-scripts and do not bind scripts' IP address.
257# You will also need to modify:
258#   o /etc/ldap.conf
259#       add: host scripts.mit.edu
260#   o /etc/nss-ldapd.conf
261#       replace: uri *****
262#       with: uri ldap://scripts.mit.edu/
263#   o /etc/openldap/ldap.conf
264#       add: URI ldap://scripts.mit.edu/
265#            BASE dc=scripts,dc=mit,dc=edu
266#   o /etc/httpd/conf.d/vhost_ldap.conf
267#       replace: VhostLDAPUrl ****
268#       with: VhostLDAPUrl "ldap://scripts.mit.edu/ou=VirtualHosts,dc=scripts,dc=mit,dc=edu"
269#   o /etc/postfix/virtual-alias-{domains,maps}-ldap.cf
270#       replace: server_host *****
271#       with: server_host = ldap://scripts.mit.edu
272# to use scripts.mit.edu instead of localhost.
273# XXX: someone should write sed scripts to do this
274
275# [TEST SERVER] If you are setting up a test server, afsagent's cronjob
276# will attempt to be renewing with the wrong credentials
277# (daemon.scripts). Change this:
278    vim /home/afsagent/renew # replace all mentions of daemon.scripts.mit.edu
279
280# Set up replication (see ./install-ldap).
281# You'll need the LDAP keytab for this server: be sure to chown it
282# fedora-ds after you create the fedora-ds user
283    ls -l /etc/dirsrv/keytab
284    cat install-ldap
285
286# Make the services dirsrv, nslcd, nscd, postfix, and httpd start at
287# boot. Run chkconfig to make sure the set of services to be run is
288# correct.
289    service nslcd start
290    service nscd start
291    service postfix start
292    service httpd start
293    chkconfig dirsrv on
294    chkconfig nslcd on
295    chkconfig nscd on
296    chkconfig postfix on
297    chkconfig httpd on
298
299# nrpe is required for nagios alerts
300    chkconfig nrpe on
301
302# Check sql user credentials (needs to be done after LDAP is setup)
303    chown sql /etc/sql-mit-edu.cfg.php
304
305# Postfix doesn't actually deliver mail; fix this
306    cd /etc/postfix
307    postmap virtual
308
309# Munin might not be monitoring packages that were installed after it
310    munin-node-configure --suggest --shell | sh
311
312# Run fmtutil-sys --all, which does something that makes TeX work.
313# (Note: this errors on XeTeX which is ok.)
314    fmtutil-sys --all
315
316# Ensure that PHP isn't broken:
317    mkdir /tmp/sessions
318    chmod 01777 /tmp/sessions
319
320# Ensure fcgid isn't broken (should be 755)
321    ls -ld /var/run/mod_fcgid
322
323# Fix etc by making sure none of our config files got overwritten
324    cd /etc
325    svn status -q
326    # Some usual candidates for clobbering include nsswitch.conf and
327    # sysconfig/openafs
328
329# ThisCell got clobbered, replace it with athena.mit.edu
330    echo "athena.mit.edu" > /usr/vice/etc/ThisCell
331
332# Reboot the machine to restore a consistent state, in case you
333# changed anything. (Note: Starting kdump fails (this is ok))
334
335# [OPTIONAL] Your machine's hostname is baked in at install time;
336# in the rare case you need to change it: it appears to be in:
337#   o /etc/sysconfig/network
338#   o your lvm thingies; probably don't need to edit
339
340# [TEST SERVER] More stuff for test servers
341#   - You need a self-signed SSL cert.  Generate with:
342    openssl req -new -x509 -keyout /etc/pki/tls/private/scripts.key -out /etc/pki/tls/certs/scripts.cert -nodes
343#     Also make /etc/pki/tls/certs/ca.pem match up
344#   - Make (/etc/aliases) root mail go to /dev/null, so we don't spam people
345#   - Edit /etc/httpd/conf.d/scripts-vhost-names.conf to have scripts-fX-test.xvm.mit.edu
346#     be an accepted vhost name
347#   - Look at the old test server and see what config changes are floating around
348
349# XXX: our SVN checkout should be updated to use scripts.mit.edu
350# (repository and etc) once serving actually works.
351    cd /etc
352    svn switch --relocate svn://$source_server/ svn://scripts.mit.edu/
353    cd /usr/vice/etc
354    svn switch --relocate svn://$source_server/ svn://scripts.mit.edu/
355    cd /srv/repository
356    asbuild svn switch --relocate svn://$source_server/ svn://scripts.mit.edu/
357    asbuild svn up # verify scripts.mit.edu works
Note: See TracBrowser for help on using the repository browser.