Changeset 2066 for trunk/server/fedora/config

Timestamp:

Nov 22, 2011, 12:45:17 AM (13 years ago)

Author:

achernya

Message:

Merge branches/fc15-dev to trunk

Location:

trunk

Files:

• . (modified) (1 prop)
• server/fedora/config/etc/cron.d/check-filecaps (copied) (copied from branches/fc15-dev/server/fedora/config/etc/cron.d/check-filecaps)
• server/fedora/config/etc/cron.d/slapdagent (modified) (1 diff)
• server/fedora/config/etc/cron.d/whoisd (deleted)
• server/fedora/config/etc/hosts (modified) (2 diffs)
• server/fedora/config/etc/httpd/conf.d/scripts-special.conf (modified) (2 diffs)
• server/fedora/config/etc/httpd/conf.d/scripts-vhost-names.conf (modified) (1 diff)
• server/fedora/config/etc/httpd/conf.d/scripts-vhost.conf (modified) (1 diff)
• server/fedora/config/etc/krb.conf (deleted)
• server/fedora/config/etc/krb.realms (deleted)
• server/fedora/config/etc/krb5.conf (modified) (1 diff)
• server/fedora/config/etc/ldap.conf (deleted)
• server/fedora/config/etc/mock/scripts-fc15-i386.cfg (copied) (copied from branches/fc15-dev/server/fedora/config/etc/mock/scripts-fc15-i386.cfg)
• server/fedora/config/etc/mock/scripts-fc15-x86_64.cfg (copied) (copied from branches/fc15-dev/server/fedora/config/etc/mock/scripts-fc15-x86_64.cfg)
• server/fedora/config/etc/php.d/_scripts.ini (modified) (1 diff)
• server/fedora/config/etc/php.d/fileinfo.ini (copied) (copied from branches/fc15-dev/server/fedora/config/etc/php.d/fileinfo.ini)
• server/fedora/config/etc/php.d/phar.ini (copied) (copied from branches/fc15-dev/server/fedora/config/etc/php.d/phar.ini)
• server/fedora/config/etc/php.d/sqlite3.ini (copied) (copied from branches/fc15-dev/server/fedora/config/etc/php.d/sqlite3.ini)
• server/fedora/config/etc/php.d/tidy.ini (modified) (1 diff)
• server/fedora/config/etc/pki/tls/certs/nudelta.pem (copied) (copied from branches/fc15-dev/server/fedora/config/etc/pki/tls/certs/nudelta.pem) (1 prop)
• server/fedora/config/etc/postfix/main.cf (modified) (1 diff)
• server/fedora/config/etc/rc.d/rc.local (modified) (1 diff, 1 prop)
• server/fedora/config/etc/scripts/allowed-filecaps.list (copied) (copied from branches/fc15-dev/server/fedora/config/etc/scripts/allowed-filecaps.list)
• server/fedora/config/etc/scripts/allowed-setugid.list (modified) (1 diff)
• server/fedora/config/etc/ssh/shosts.equiv (modified) (2 diffs)
• server/fedora/config/etc/ssh/ssh_known_hosts (modified) (1 diff)
• server/fedora/config/etc/ssh/sshd_config (modified) (1 diff)
• server/fedora/config/etc/sysconfig/dirsrv (modified) (1 diff)
• server/fedora/config/etc/sysconfig/httpd (modified) (1 diff)
• server/fedora/config/etc/sysconfig/network-scripts/route-eth1 (modified) (1 diff)
• server/fedora/config/etc/sysconfig/openafs (modified) (1 diff)
• server/fedora/config/etc/sysconfig/sysstat (modified) (1 diff)
• server/fedora/config/etc/syslog-ng/d_zroot.pl (modified) (4 diffs)
• server/fedora/config/etc/syslog-ng/syslog-ng.conf (modified) (4 diffs)
• server/fedora/config/etc/yum.conf (modified) (1 diff)
• server/fedora/config/etc/yum.repos.d/scripts.repo (modified) (2 diffs)
• server/fedora/config/etc/yum/post-actions/capoverride.action (copied) (copied from branches/fc15-dev/server/fedora/config/etc/yum/post-actions/capoverride.action)
• server/fedora/config/etc/yum/post-actions/statoverride.action (modified) (1 diff)

trunk/server/fedora/config/etc/cron.d/slapdagent

@@ -1 +1 @@
 KRB5CCNAME=/var/run/dirsrv/krb5cc
 MAILTO=scripts-root@mit.edu
-0 */3 * * * fedora-ds /usr/kerberos/bin/kinit -k -t /etc/dirsrv/keytab ldap/$(hostname)
+0 */3 * * * fedora-ds /usr/bin/kinit -k -t /etc/dirsrv/keytab ldap/$(hostname)

trunk/server/fedora/config/etc/hosts

@@ -18 +18 @@
 18.181.0.234    busy-beaver.mit.edu busy-beaver scripts7.mit.edu scripts7
 18.181.0.235    real-mccoy.mit.edu real-mccoy scripts8.mit.edu scripts8
-18.181.0.135    shining-armor.mit.edu shining-armor # scripts9.mit.edu scripts9
+18.181.0.135    shining-armor.mit.edu shining-armor scripts9.mit.edu scripts9
+18.181.0.141    golden-egg.mit.edu golden-egg scripts10.mit.edu scripts10
 
 172.21.0.57     better-mousetrap.mit.edu
@@ -29 +30 @@
 172.21.0.235    real-mccoy.mit.edu
 172.21.0.135    shining-armor.mit.edu
+172.21.0.141    golden-egg.mit.edu

trunk/server/fedora/config/etc/httpd/conf.d/scripts-special.conf

@@ -1 +1 @@
 Alias /__scripts/heartbeat /afs/athena.mit.edu/contrib/scripts/web_scripts/heartbeat
-Alias /__scripts/django/media /usr/lib/python2.6/site-packages/django/contrib/admin/media
+Alias /__scripts/django/media /usr/lib/python2.7/site-packages/django/contrib/admin/media
 Alias /__scripts /afs/athena.mit.edu/contrib/scripts/www
 
@@ -9 +9 @@
 </Directory>
 
-<Directory /usr/lib/python2.6/site-packages/django/contrib/admin/media>
+<Directory /usr/lib/python2.7/site-packages/django/contrib/admin/media>
     <Files *>
         SetHandler none

trunk/server/fedora/config/etc/httpd/conf.d/scripts-vhost-names.conf

@@ -1 +1 @@
 ServerName scripts.mit.edu
-ServerAlias scripts 18.181.0.43 scripts-vhosts.mit.edu scripts-vhosts 18.181.0.46 scripts-test.mit.edu scripts-test 18.181.0.229 better-mousetrap.mit.edu better-mousetrap b-m.mit.edu b-m scripts1.mit.edu scripts1 18.181.0.57 old-faithful.mit.edu old-faithful o-f.mit.edu o-f scripts2.mit.edu scripts2 18.181.0.53 bees-knees.mit.edu bees-knees b-k.mit.edu b-k sx-blade-4.mit.edu sx-blade-4 scripts3.mit.edu scripts3 18.181.0.167 cats-whiskers.mit.edu cats-whiskers c-w.mit.edu c-w scripts4.mit.edu scripts4 18.181.0.228 whole-enchilada.mit.edu whole-enchilada w-e.mit.edu w-e scripts5.mit.edu scripts5 18.181.0.236 pancake-bunny.mit.edu pancake-bunny p-b.mit.edu p-b scripts6.mit.edu scripts6 18.181.0.237 busy-beaver.mit.edu busy-beaver b-b.mit.edu b-b scripts7.mit.edu scripts7 18.181.0.234 real-mccoy.mit.edu real-mccoy r-m.mit.edu r-m scripts8.mit.edu scripts8 18.181.0.235 shining-armor.mit.edu shining-armor s-a.mit.edu s-a scripts9.mit.edu scripts9 18.181.0.135 localhost 127.0.0.1 ::1
+ServerAlias \
+    scripts 18.181.0.43 \
+    scripts-vhosts.mit.edu scripts-vhosts 18.181.0.46 \
+    scripts-test.mit.edu scripts-test 18.181.0.229 \
+    better-mousetrap.mit.edu better-mousetrap b-m.mit.edu b-m scripts1.mit.edu scripts1 18.181.0.57 \
+    old-faithful.mit.edu old-faithful o-f.mit.edu o-f scripts2.mit.edu scripts2 18.181.0.53 \
+    bees-knees.mit.edu bees-knees b-k.mit.edu b-k sx-blade-4.mit.edu sx-blade-4 scripts3.mit.edu scripts3 18.181.0.167 \
+    cats-whiskers.mit.edu cats-whiskers c-w.mit.edu c-w scripts4.mit.edu scripts4 18.181.0.228 \
+    whole-enchilada.mit.edu whole-enchilada w-e.mit.edu w-e scripts5.mit.edu scripts5 18.181.0.236 \
+    pancake-bunny.mit.edu pancake-bunny p-b.mit.edu p-b scripts6.mit.edu scripts6 18.181.0.237 \
+    busy-beaver.mit.edu busy-beaver b-b.mit.edu b-b scripts7.mit.edu scripts7 18.181.0.234 \
+    real-mccoy.mit.edu real-mccoy r-m.mit.edu r-m scripts8.mit.edu scripts8 18.181.0.235 \
+    shining-armor.mit.edu shining-armor s-a.mit.edu s-a scripts9.mit.edu scripts9 18.181.0.135 \
+    golden-egg.mit.edu golden-egg g-e.mit.edu g-e scripts10.mit.edu scripts10 18.181.0.141 \
+    localhost 127.0.0.1 ::1

trunk/server/fedora/config/etc/httpd/conf.d/scripts-vhost.conf

@@ -1 +1 @@
 DocumentRoot /afs/athena.mit.edu/contrib/scripts/web_scripts/home
 SuExecUserGroup scripts users
+UserDir enabled
 UserDir web_scripts
 # Comment the following line out to take the machine out of the LVS pool

trunk/server/fedora/config/etc/krb5.conf

@@ -1 +1 @@
 [libdefaults]
+        allow_weak_crypto = true
         default_realm = ATHENA.MIT.EDU
 # The following krb5.conf variables are only for MIT Kerberos.

trunk/server/fedora/config/etc/php.d/_scripts.ini

@@ -3 +3 @@
 cgi.force_redirect = 0
 memory_limit = 1024M
+date.timezone = America/New_York

trunk/server/fedora/config/etc/php.d/tidy.ini

@@ -1 @@
-

trunk/server/fedora/config/etc/postfix/main.cf

@@ -17 +17 @@
 recipient_delimiter = +
 inet_interfaces = all
-readme_directory = /usr/share/doc/postfix-2.7.4/README_FILES
-sample_directory = /usr/share/doc/postfix-2.7.4/samples
+readme_directory = /usr/share/doc/postfix-2.8.5/README_FILES
+sample_directory = /usr/share/doc/postfix-2.8.5/samples
 sendmail_path = /usr/sbin/sendmail
 html_directory = no

trunk/server/fedora/config/etc/rc.d/rc.local

@@ -3 +3 @@
 touch /var/lock/subsys/local
 
-if [ -r "/afs/athena.mit.edu" ]; then
-        /sbin/service postfix start
-fi
-
 /bin/mkdir -pm 1773 /tmp/sessions

trunk/server/fedora/config/etc/scripts/allowed-setugid.list

@@ -1 @@
-/bin/ping
-/bin/ping6
 /sbin/pam_timestamp_check
 /sbin/unix_chkpwd

trunk/server/fedora/config/etc/ssh/shosts.equiv

@@ -8 +8 @@
 shining-armor.mit.edu
 whole-enchilada.mit.edu
+golden-egg.mit.edu
 172.21.0.53
 172.21.0.57
@@ -17 +18 @@
 172.21.0.135
 172.21.0.236
+172.21.0.141

trunk/server/fedora/config/etc/ssh/ssh_known_hosts

@@ -8 +8 @@
 whole-enchilada.mit.edu,whole-enchilada,w-e.mit.edu,w-e,scripts5.mit.edu,scripts5,18.181.0.236,172.21.0.236 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
 shining-armor.mit.edu,shining-armor,s-a.mit.edu,s-a,scripts9.mit.edu,scripts9,18.181.0.135,172.21.0.135 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+golden-egg.mit.edu.golden-egg,g-e.mit.edu,g-e,scripts10.mit.edu,scripts10,18.181.0.141,172.21.0.141 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==

trunk/server/fedora/config/etc/ssh/sshd_config

@@ -20 +20 @@
 IgnoreRhosts yes
 IgnoreUserKnownHosts yes
-DenyUsers root@old-faithful.mit.edu root@better-mousetrap.mit.edu root@bees-knees.mit.edu root@cats-whiskers.mit.edu root@pancake-bunny.mit.edu root@busy-beaver.mit.edu root@real-mccoy.mit.edu root@whole-enchilada.mit.edu root@shining-armor.mit.edu
+DenyUsers root@old-faithful.mit.edu root@better-mousetrap.mit.edu root@bees-knees.mit.edu root@cats-whiskers.mit.edu root@pancake-bunny.mit.edu root@busy-beaver.mit.edu root@real-mccoy.mit.edu root@whole-enchilada.mit.edu root@shining-armor.mit.edu root@golden-egg.mit.edu

trunk/server/fedora/config/etc/sysconfig/dirsrv

@@ -32 +32 @@
 # slapdagent cronjob) -- geofft 30 October 2010
 KRB5CCNAME=/var/run/dirsrv/krb5cc; export KRB5CCNAME
-/usr/kerberos/bin/kinit -k -t "$KRB5_KTNAME" ldap/"$(hostname)"
+/usr/bin/kinit -k -t "$KRB5_KTNAME" ldap/"$(hostname)"
 chown --reference="$KRB5_KTNAME" "$KRB5CCNAME"
 

trunk/server/fedora/config/etc/sysconfig/httpd

@@ -21 +21 @@
 #
 #HTTPD_LANG=C
+
+#
+# When stopping the server a 10 second timeout is allowed before
+# forcibly terminating the parent process (with a SIGKILL signal).
+# To allow a longer delay, set the STOP_TIMEOUT variable.
+#
+#STOP_TIMEOUT=10
+#

trunk/server/fedora/config/etc/sysconfig/network-scripts/route-eth1

@@ -12 +12 @@
 18.181.0.235 via 172.21.0.235
 18.181.0.135 via 172.21.0.135
+18.181.0.141 via 172.21.0.141

trunk/server/fedora/config/etc/sysconfig/openafs

@@ -1 +1 @@
 AFSD_ARGS="-afsdb -dynroot -fakestat-all -stat 25000 -daemons 100 -volumes 4000 -files 400000 -chunksize 19"
 BOSSERVER_ARGS=
-
-postinit () {
-        /sbin/sysctl -q afs.GCPAGs=0
-        /usr/bin/fs setcrypt on
-        case "$(lsb_release -cs)" in
-          Moonshine)
-            /usr/bin/fs sysname 'amd64_fedora7_scripts' 'scripts' 'amd64_fedora7' 'amd64_linux26' 'i386_rhel4' 'i386_rhel3' 'i386_rh9' 'i386_linux26' 'i386_linux24' 'i386_linux22' 'i386_linux3' 'i386_linux2' 'i386_linux1' ;;
-          Sulphur)
-            /usr/bin/fs sysname 'amd64_fedora9_scripts' 'amd64_fedora7_scripts' 'scripts' 'amd64_fedora9' 'amd64_fedora7' 'amd64_linux26' 'i386_deb40' 'i386_rhel4' 'i386_rhel3' 'i386_rh9' 'i386_linux26' 'i386_linux24' 'i386_linux22' 'i386_linux3' 'i386_linux2' ;;
-          Leonidas)
-            /usr/bin/fs sysname 'amd64_fedora11_scripts' 'amd64_fedora9_scripts' 'amd64_fedora7_scripts' 'scripts' 'amd64_fedora11' 'amd64_fedora9' 'amd64_fedora7' 'amd64_linux26' 'i386_deb50' 'i386_deb40' 'i386_rhel4' 'i386_rhel3' 'i386_rh9' 'i386_linux26' 'i386_linux24' 'i386_linux22' 'i386_linux3' 'i386_linux2' ;;
-          Goddard)
-            /usr/bin/fs sysname 'amd64_fedora13_scripts' 'amd64_fedora11_scripts' 'amd64_fedora9_scripts' 'amd64_fedora7_scripts' 'scripts' 'amd64_fedora13' 'amd64_fedora11' 'amd64_fedora9' 'amd64_fedora7' 'amd64_linux26' 'i386_deb50' 'i386_deb40' 'i386_rhel4' 'i386_rhel3' 'i386_rh9' 'i386_linux26' 'i386_linux24' 'i386_linux22' 'i386_linux3' 'i386_linux2' ;;
-          *)
-            echo "Warning: unknown platform. AFS sysname not set."
-        esac
-        /usr/bin/fs setcell -nosuid -c athena
-}
-AFS_POST_INIT=postinit

trunk/server/fedora/config/etc/sysconfig/sysstat

@@ -1 @@
-# How long to keep log files (days), maximum is a month
+# sysstat-9.0.6.1 configuration file.
+
+# How long to keep log files (in days).
+# If value is greater than 28, then log files are kept in
+# multiple directories, one for each month.
 HISTORY=30
+
+# Compress (using gzip or bzip2) sa and sar files older than (in days):
+COMPRESSAFTER=10
+
+# Parameters for system activity collector (see sadc man-page) which
+# are used for the generation of log files
+SADC_OPTIONS="-S DISK"

trunk/server/fedora/config/etc/syslog-ng/d_zroot.pl

@@ -32 +32 @@
 sub buildKeyMap($) {
     my ($file) = @_;
-    open (KEYS, $file) or warn "Couldn't open $file: $!";
+    open (KEYS, $file) or (warn "Couldn't open $file: $!\n" and return);
     while (<KEYS>) {
         chomp;
@@ -58 +58 @@
 buildKeyMap("/root/.ssh/authorized_keys2");
 
-while (1) {
-    my @message = scalar(<>);
+my @message;
+
+while (my $line = <>) {
+    @message = $line;
     eval {
         local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required
@@ -80 +82 @@
         } elsif ($message =~ m|Root (\S+) shell|) {
             sendmsg($message);
-        } elsif ($message =~ m|session \S+ for user (\S+)|) {
-            sendmsg($message) if exists $USERS{$1};
+        } elsif ($message =~ m|pam_unix\(([^:]+):session\): session \S+ for user (\S+)|) {
+            sendmsg($message) if $1 ne "cron" and exists $USERS{$2};
         } elsif ($message =~ m|^Found matching (\w+) key: (\S+)|) {
             if ($sshkeys{$2}) {
@@ -117 +119 @@
         } elsif ($message =~ m|^ *root : TTY=|) {
         } elsif ($message =~ m|^Set /proc/self/oom_adj to |) {
+        } elsif ($message =~ m|^fatal: mm_request_receive: read: Connection reset by peer$|) {
         } else {
             sendmsg($message, "scripts-spew");

trunk/server/fedora/config/etc/syslog-ng/syslog-ng.conf

@@ +1 @@
+@version:3.2
+
 # syslog-ng configuration file.
 #
@@ -8 +10 @@
 
 options {
-        sync (0);
+        flush_lines (0);
         time_reopen (10);
         log_fifo_size (1000);
@@ -16 +18 @@
         create_dirs (no);
         keep_hostname (yes);
+        stats_freq (0);
 };
 
 source s_sys {
-        file ("/proc/kmsg" log_prefix("kernel: "));
+        file ("/proc/kmsg" program_override("kernel: "));
         unix-stream ("/dev/log");
         internal();
@@ -28 +31 @@
 destination d_mesg { file("/var/log/messages"); };
 destination d_auth { file("/var/log/secure"); };
-destination d_mail { file("/var/log/maillog" sync(10)); };
+destination d_mail { file("/var/log/maillog" flush_lines(10)); };
 destination d_spol { file("/var/log/spooler"); };
 destination d_boot { file("/var/log/boot.log"); };

trunk/server/fedora/config/etc/yum.conf

@@ -9 +9 @@
 plugins=1
 metadata_expire=1800
-installonlypkgs=kernel kernel-devel kmod-openafs
+installonlypkgs=kernel kernel-devel kmod-openafs ghc-cgi ghc-cgi-devel
 
 # PUT YOUR REPOS HERE OR IN separate files named file.repo

trunk/server/fedora/config/etc/yum.repos.d/scripts.repo

@@ -1 +1 @@
 [scripts]
 name=Scripts
-baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc13/
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc15/
 enabled=1
 gpgcheck=0
@@ -7 +7 @@
 [scripts-testing]
 name=Scripts Testing
-baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc13-testing/
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc15-testing/
 enabled=0
 gpgcheck=0

trunk/server/fedora/config/etc/yum/post-actions/statoverride.action

@@ -22 +22 @@
 /usr/bin/write:install:chmod ug-s /usr/bin/write
 /usr/bin/Xorg:install:chmod ug-s /usr/bin/Xorg
-/usr/kerberos/bin/ksu:install:chmod ug-s /usr/kerberos/bin/ksu
+/usr/bin/ksu:install:chmod ug-s /usr/bin/ksu
 /usr/lib64/nspluginwrapper/plugin-config:install:chmod ug-s /usr/lib64/nspluginwrapper/plugin-config
 /usr/lib64/vte/gnome-pty-helper:install:chmod ug-s /usr/lib64/vte/gnome-pty-helper
+/usr/libexec/kde4/kpac_dhcp_helper:install:chmod ug-s /usr/libexec/kde4/kpac_dhcp_helper
 /usr/sbin/ccreds_chkpwd:install:chmod ug-s /usr/sbin/ccreds_chkpwd
 /usr/sbin/userisdnctl:install:chmod ug-s /usr/sbin/userisdnctl
 /usr/sbin/usernetctl:install:chmod ug-s /usr/sbin/usernetctl
+/usr/bin/pkexec:install:chmod ug-s /usr/bin/pkexec