Changeset 2246 for trunk/server/doc

Timestamp:

Jun 27, 2012, 10:29:47 PM (12 years ago)

Author:

ezyang

Message:

Reintegrate Fedora 17 development branch into trunk.

Location:

trunk

Files:

• . (modified) (1 prop)
• server/doc/install-howto.sh (modified) (6 diffs)
• server/doc/install-ldap (modified) (4 diffs)
• server/doc/upgrade-tips (modified) (3 diffs)

trunk/server/doc/install-howto.sh

@@ -77 +77 @@
 #   XXX We should make Kickstart work for test servers too
 
+# Make sure selinux is disabled
+    selinuxenabled || echo "selinux not enabled"
+
 # Take updates, reboot if there's a kernel update.
     yum update -y
@@ -96 +99 @@
     \cp -a etc /
     chmod 0440 /etc/sudoers
+    grub2-mkconfig -o /boot/grub2/grub.cfg
 
 # [TEST] You'll need to fix some config now.  See bottom of document.
+
+# Stop /etc/resolv.conf from getting repeatedly overwritten by
+# purging DNS servers from ifcfg-eth0 and ifcfg-eth1
+    vim /etc/sysconfig/network-scripts/ifcfg-eth0
+    vim /etc/sysconfig/network-scripts/ifcfg-eth1
 
 # Make sure network is working.  Kickstart should have
@@ -246 +255 @@
     gem install $(gem list --no-version | grep -Fxvf - gem.txt)
     # Also, we need to install the old rails version
-    gem install -v=2.3.5 rails
+    gem install -v=2.3.14 rails
 # These are in /usr
 
@@ -340 +349 @@
     cat install-ldap
 
-# Enable lots of services
+# Enable lots of services (currently in /etc checkout)
     systemctl enable openafs-client.service
-    systemctl enable dirsrv.service
+    systemctl enable dirsrv.target
     systemctl enable nslcd.service
     systemctl enable nscd.service
     systemctl enable postfix.service
-    systemctl enable nrpe.service
+    systemctl enable nrpe.service # chkconfig'd
     systemctl enable httpd.service # not for [WIZARD]
 
     systemctl start openafs-client.service
-    systemctl start dirsrv.service
+    systemctl start dirsrv.target
     systemctl start nslcd.service
     systemctl start nscd.service
@@ -360 +369 @@
 # among others, 'amd64_fedoraX_scripts' (vary X) and 'scripts'. If it's
 # not, you probably did a distro upgrade and should update
-# /etc/sysconfig/openafs (XXX this is wrong: figuring out new
-# systemd world order).
+# tokensys (server/common/oursrc/tokensys/scripts-afsagent-startup.in)
     fs sysname
 
@@ -374 +382 @@
 # (Note: this errors on XeTeX which is ok.)
     fmtutil-sys --all
+
+# Check for unwanted setuid/setgid binaries
+    find / -xdev -not -perm -o=x -prune -o -type f -perm /ug=s -print | grep -Fxvf /etc/scripts/allowed-setugid.list 
 
 # Fix etc by making sure none of our config files got overwritten

trunk/server/doc/install-ldap

@@ +1 @@
+# b
 # To set up a new LDAP server:
 
@@ -14 +15 @@
 
 # Move the schema back
-cp -R /etc/dirsrv/slapd-scripts.bak/{.svn,*} /etc/dirsrv/slapd-scripts
+cp -R /etc/dirsrv/slapd-scripts.bak/* /etc/dirsrv/slapd-scripts
 rm -Rf /etc/dirsrv/slapd-scripts.bak
 
+# Check and make sure the sysconfig references the correct keytab
+svn revert /etc/sysconfig/dirsrv-scripts
+
 # Turn dirsrv off:
-systemctl stop dirsrv.service
+systemctl stop dirsrv@scripts.service
 
 # Apply the following configuration changes.  If you're editing
@@ -52 +56 @@
 EOF;
 
-systemctl start dirsrv.service
+systemctl start dirsrv@scripts.service
 
 ldapvi -b cn=config
@@ -221 +225 @@
 nsDS5ReplicaBindDN: uid=ldap/shining-armor.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
 nsDS5ReplicaBindDN: uid=ldap/golden-egg.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/miracle-cure.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/lucky-star.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
 nsds5ReplicaPurgeDelay: 604800
 nsds5ReplicaLegacyConsumer: off

trunk/server/doc/upgrade-tips

@@ -172 +172 @@
 --------------------
 
+XXX out of date
 Update /etc/sysconfig/openafs with an extra amd64_fedoraX_scripts and
 amd64_fedoraX sysname.  The format should be evident from the existing
 entries.  [XXX There might be other things you want]
 
-6. Testing critical infrastructure
+6. Bind to scripts-test
+-----------------------
+
+First, make sure no other servers are bound to scripts-test (try ping).
+Then, create /etc/sysconfig/network-scripts/ifcfg-eth0:0 based off of
+/etc/sysconfig/network-scripts/ifcfg-eth0 but with the scripts-test
+IP address 18.181.0.229.  Run `ifup eth0:0` to complete the change.
+
+7. Testing critical infrastructure
 ----------------------------------
 
@@ -188 +197 @@
     - http://pony.scripts.mit.edu
 
-7. Extra stuff
+8. Extra stuff
 --------------
 
@@ -202 +211 @@
 emptying their .ini files in /etc/php.d.
 
-8. Sending announcements
+9. Sending announcements
 ------------------------