Changeset 1693 for trunk/server/doc


Ignore:
Timestamp:
Oct 23, 2010, 8:07:08 AM (14 years ago)
Author:
ezyang
Message:
Merge Fedora 13 development back to trunk.
Location:
trunk
Files:
2 deleted
6 edited
4 copied

Legend:

Unmodified
Added
Removed

  • trunk

  • trunk/server/doc/install-fedora

    r1612 r1693  
    22----------------------------------------
    33
    4 1. Create the LVS partitions that the Scripts guest will use.
     4We use Kickstart to to initial Fedora configuration.  Installing a new
     5vanilla machine is as easy as:
    56
    6 Our classic setup is 50GB for the main, root partition (/) and
    7 10GB for our swap.  You can consult what things look like
    8 by using `lvdisplay`.  Our naming convention is server-name-root
    9 and server-name-swap.
     7    xm create scripts-server machine_name=$MACHINE install=fXX && console $MACHINE
    108
    11 Creating new LVS partitions is done with `lvcreate`:
     9The only prompt (near the beginning of the install process) should be
     10for the root password, and at the end, when it asks you to reboot.
     11Say yes, and the machine will power down, and then restart without
     12the install parameter:
    1213
    13     # Example values:
    14     # SERVERNAME=whole-enchilada
    15     # HOSTNAME=jay-leno
    16     lvcreate -n $SERVERNAME-root $HOSTNAME --size 50.00G
    17     lvcreate -n $SERVERNAME-swap $HOSTNAME --size 10.00G
    18 
    19 2. Acquire the network installation media for Fedora.
    20 
    21 Normally, you would download an ISO and kick off an installation
    22 by burning it to a CD and booting off of that.  Since we would like
    23 to make as minimal a Fedora install as possible, we use a different
    24 method. [XXX: Why do we actually do it this way?  It seems kind
    25 of convoluted]
    26 
    27 First, we need to create an appropriate installation directory,
    28 which contains the necessary kernel images and bootstrapping code.
    29 Navigate to a Fedora mirrors website, and find the correct release
    30 from the linux/releases directory, then grab the contents of
    31 Fedora/x86_64/os/isolinux.  For example, getting the Fedora 13 installer
    32 from mirrors.mit.edu would be:
    33 
    34     mkdir ~/f13-install
    35     cd ~/f13-install
    36     wget -r -nd ftp://mirrors.mit.edu/fedora/linux/releases/13/Fedora/x86_64/os/isolinux/
    37 
    38 You can then spin up a Xen image for installation with:
    39 
    40     xm create scripts-server machine_name=$HOSTNAME install=f13
    41 
    42 Note that the -install suffix was dropped.  Get a console with `xm
    43 console`.
    44 
    45 3. Tell Fedora where to get the real installer.
    46 
    47 You will now be in a curses installer interface.  Since you are doing
    48 a network install, you will need to configure your network and specify
    49 the URL to install.  Find the static hostname that you are planning
    50 to install to and get its information with:
    51 
    52     stella $HOSTNAME
    53 
    54 Manually configure its IP, disabling IPv6 for now [XXX I don't know how
    55 to configure that].  The network mask is 16, and you can check
    56 '/etc/resolv.conf' if you don't remember what MIT's DNS servers are.
    57 
    58 It will then ask you for an installation image.  Continuing with our
    59 F13 mirrors.mit.edu, the URL will look something like:
    60 
    61     ftp://mirrors.mit.edu/fedora/linux/releases/13/Fedora/x86_64/os
    62 
    63 4. Use VNC
    64 
    65 At this point, Fedora will ask you whether or not you want to use VNC
    66 to continue the installation.  Because Scripts has an unusual disk
    67 image setup, you will want to answer yes. [XXX: Unfortunately, this puts
    68 the VNC session on MITnet, so make sure you use a good password, and
    69 we should figure out to make it not do that].  Grab your favorite
    70 VNC client and login to $HOSTNAME:1
    71 
    72 5. Installation in VNC
    73 
    74 5.1. Disks to use
    75 
    76 We don't have any exotic devices (we did that at the host level,
    77 recall), so you can use normal configuration.  The scripts-server Xen
    78 configuration will have automatically selected the LVS partitions you
    79 created in Step 1, and you want both of them.
    80 
    81 5.2. Host
    82 
    83 The default hostname is all caps: we use lower-case, so lower-case the
    84 name before proceeding.
    85 
    86 5.3. Timezone
    87 
    88 Self explanatory
    89 
    90 5.4. Root password
    91 
    92 Use Scripts root password for a real install, and fake password
    93 otherwise. [XXX: Insecure over VNC? Argh!]
    94 
    95 5.5 Formatting the disks
    96 
    97 You can find out what our existing setup looks like by consulting
    98 '/etc/fstab'.
    99 
    100 Select Custom, and select both disks for formatting.  Setup the larger
    101 disk as the boot partition.  Configure the partitions as follows:
    102 
    103     50GB
    104         Standard Partition
    105         Mount Point: /
    106         File System Type: ext3 (the default as of F13 is ext4, which
    107             cannot be mounted by the hosts and thus should not be used!)
    108         Additional Size Options: Fill to maximum allowable size (the
    109             Size parameter will not do anything in that case)
    110         Force to be primary partition
    111     10GB
    112         Standard Partition
    113         File System Type: swap
    114         Additional Size Options: Fill to maximum allowable size
    115 
    116 5.6 Bootloader
    117 
    118 Defaults are fine.
    119 
    120 5.7 Installation
    121 
    122 Do a minimal install (we will proceed to install the packages we care
    123 about), and add the normal F13 repository (testing and updates will be
    124 added when we bring in our /etc configuration).  Similarly, we will
    125 install the software we want later, so there is no need to do that now.
    126 
    127 5.8 Reboot
    128 
    129 When the install finishes, it will ask you to reboot.  This is fine, but
    130 since we created the VM image with install, upon reboot it will ask us
    131 to install again.  Let it reboot, then destroy the virtual machine.
    132 
    133     xm destroy $SERVERNAME
    134 
    135 6. New World Order
    136 
    137 Start up the VM without the install flag:
    138 
    139     xm create scripts-server machine_name=$SERVERNAME
    140 
    141 Use xm console to get a terminal, and proceed with the official install
    142 instructions.
    143 
    144     xm console $SERVERNAME
     14    xm create scripts-server machine_name=$MACHINE && console $MACHINE

  • trunk/server/doc/install-howto.sh

    r1687 r1693  
    11# This document is a how-to for installing a Fedora scripts.mit.edu server.
     2# It is semi-vaguely in the form of a shell script, but is not really
     3# runnable as it stands.
    24
    35set -e -x
    46
    5 [ -e /scripts-boot-count ] || echo 0 > /scripts-boot-count
    6 
    7 source_server="old-faithful.mit.edu"
    8 
    9 boot=${1:$(cat /scripts-boot-count)}
    10 
    11 # XXX: let 'branch' be the current svn branch you are on
    12 
    13 doreboot() {
    14     echo $(( $boot + 1 )) > /scripts-boot-count;
    15     shutdown -r now "Rebooting for step $(cat /scripts-boot-count)"
    16 }
    17 
    18 YUM() {
    19     NSS_NONLOCAL_IGNORE=1 yum "$@"
    20 }
    21 
    22 # Helper files for the install are located in server/fedora/config.
    23 
    24 # Start with a normal install of Fedora.
    25 
    26 if [ $boot = 0 ]; then
    27 # When the initial configuration screen comes up, under "Firewall
    28 # configuration", disable the firewall, and under "System services", leave
    29 # enabled (as of Fedora 9) acpid, anacron, atd, cpuspeed, crond,
    30 # firstboot, fuse, haldaemon, ip6tables, iptables, irqbalance,
    31 # kerneloops, mdmonitor, messagebus, microcode_ctl, netfs, network, nscd, ntpd,
    32 # sshd, udev-post, and nothing else.
    33     echo "--disabled" > /etc/sysconfig/system-config-firewall
    34     for i in NetworkManager avahi-daemon bluetooth cups isdn nfslock nfs pcscd restorecond rpcbind rpcgssd rpcidmapd sendmail; do
    35         chkconfig "$i" off
    36     done
    37 
    38 # Turn on network, so we can connect at boot
    39 chkconfig network on
    40 
    41 # Edit /etc/selinux/config so it has SELINUX=disabled and reboot.
    42     sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
    43     doreboot
    44 fi
    45 
    46 if [ $boot = 1 ]; then
    47 # Create a scripts-build user account, and set up rpm to build in
    48 # $HOME by doing a
    49 # cp config/home/scripts-build/.rpmmacros /home/scripts-build/
    50 # (If you just use the default setup, it will generate packages
    51 # in /usr/src/redhat.)
    52     adduser scripts-build
     7# Some commands should be run as the scripts-build user, not root.
     8
     9alias asbuild="sudo -u scripts-build"
     10
     11# Old versions of this install document advised setting
     12# NSS_NONLOCAL_IGNORE=1 anytime you're setting up anything, e.g. using
     13# yum, warning that useradd will query LDAP in a stupid way that makes
     14# it hang forever.  As of Fedora 13, this does not seem to be a problem,
     15# so it's been removed from the instructions.  If an install is hanging,
     16# though, try adding NSS_NONLOCAL_IGNORE.
     17
     18# This is actually just "pick an active scripts server".  It can't be
     19# scripts.mit.edu because our networking config points that domain
     20# at localhost, and if our server is not setup at that point things
     21# will break.
     22source_server="cats-whiskers.mit.edu"
     23
     24# 'branch' is the current svn branch you are on.  You want to
     25# use trunk if your just installing a new server, and branches/fcXX-dev
     26# if your preparing a server on a new Fedora release.
     27branch="trunk"
     28
     29# 'server' is the public hostname of your server, for SCP'ing files
     30# to and from.
     31server=YOUR-SERVER-NAME-HERE
     32
     33# Start with a Scripts kickstarted install of Fedora (install-fedora)
     34
     35# Take updates, reboot if there's a kernel update.
     36
     37    yum update
     38
     39# Get rid of network manager
     40    yum remove NetworkManager
    5341
    5442# Check out the scripts.mit.edu svn repository. Configure svn not to cache
    5543# credentials.
    5644
    57     YUM install -y subversion
    58 
    59     cd /srv
    60     svn co svn://$source_server/$branch repository
    61 
    62     sed -i 's/^(# *)*store-passwords.*/store-passwords = no/' /root/.subversion/config
    63     sed -i 's/^(# *)*store-auth-creds.*/store-auth-creds = no/' /root/.subversion/config
    64 # The same tweaks should be made on /home/scripts-build/.subversion/config
    65 # once it exists (do something with svn as scripts-build)
    66 
    67     chown -R scripts-build /srv/repository
    68 
    69 # cd to server/fedora in the svn repository.
    70     cd /srv/repository/server/fedora
    71 
    72 # Run "make install-deps" to install various prereqs.  Nonstandard
    73 # deps are in /mit/scripts/rpm.
    74     YUM install -y make
    75     make install-deps
    76 
    77 # Install bind
    78     YUM install -y bind
     45# Copy over root's dotfiles from one of the other machines.
     46# Perhaps a useful change is to remove the default aliases
     47    cd /root
     48    ls -l .bashrc
     49    ls -l .ldapvirc
     50    ls -l .screenrc
     51    ls -l .ssh
     52    ls -l .vimrc
     53    ls -l .k5login
     54    # Trying to scp from server to server won't work, as scp
     55    # will attempt to negotiate a server-to-server connection.
     56    # Instead, scp to your trusted machine as a temporary file,
     57    # and then push to the other server
     58scp -r root@$source_server:~/{.bashrc,.ldapvirc,.screenrc,.ssh,.vimrc,.k5login} .
     59scp -r {.bashrc,.ldapvirc,.screenrc,.ssh,.vimrc,.k5login} root@$server:~
     60
     61# Install the initial set of credentials (to get Kerberized logins once
     62# krb5 is installed).  Otherwise, SCP'ing things in will be annoying.
     63#   o You probably installed the machine keytab long ago
     64    ls -l /etc/krb5.keytab
     65#     Use ktutil to combine the host/scripts.mit.edu and
     66#     host/scripts-vhosts.mit.edu keys with host/this-server.mit.edu in
     67#     the keytab.  Do not use 'k5srvutil change' on the combined keytab
     68#     or you'll break the other servers. (real servers only).  Be
     69#     careful about writing out the keytab: if you write it to an
     70#     existing file the keys will just get appended.  The correct
     71#     credential list should look like:
     72#       ktutil:  l
     73#       slot KVNO Principal
     74#       ---- ---- ---------------------------------------------------------------------
     75#          1    5 host/old-faithful.mit.edu@ATHENA.MIT.EDU
     76#          2    3 host/scripts-vhosts.mit.edu@ATHENA.MIT.EDU
     77#          3    2      host/scripts.mit.edu@ATHENA.MIT.EDU
     78#   o Replace the ssh host keys with the ones common to all scripts servers (real servers only)
     79    ls -l /etc/ssh/*key*
     80#     You can do that with:
     81scp root@$source_server:/etc/ssh/*key* .
     82scp *key* root@$server:/etc/ssh/
     83    service sshd reload
    7984
    8085# Check out the scripts /etc configuration
     86    # backslash to make us not use the alias
    8187    cd /root
    82     svn co svn://scripts.mit.edu/$branch/server/fedora/config/etc etc
    83     # backslash to make us not use the alias
    8488    \cp -a etc /
     89    chmod 0440 /etc/sudoers
    8590
    8691# NOTE: You will have just lost DNS resolution and the ability
    … …  
    9095# you have named.
    9196
    92     service named start
    93     chkconfig named on
    94 
    95 # In the case of the Kerberos libraries, you'll be told that
    96 # there are conflicting files with the 64-bit versions of the packages,
    97 # which we scriptsify.  You'll have to use --force to install those
    98 # rpms despite the conflicts.  After doing that, you may want to
    99 # install the corresponding 64-bit scriptsified versions again, just
    100 # to be safe in case the 32-bit versions overwrite files that differ.
    101 # When you try this, it will complain that you already have the same
    102 # version installed; again, you'll need to use --force to do it anyway.
    103 
    104 # We need yumdownloader to force some RPMs
    105     # XXX: This might be wrong. Sanity check what packages ou
    106     # have when done
    107     YUM install -y yum-utils
    108     yumdownloader krb5-libs
    109     # XXX: These version numbers are hardcoded, need some cli-fu to generalize
    110     rpm -i krb5-libs-*.i586.rpm
    111     rpm -U --force krb5-libs-*.scripts.1138.x86_64.rpm
    112 
    113 # env NSS_NONLOCAL_IGNORE=1 yum install scripts-base
    114     YUM install -y scripts-base
    115 
    116 # Remember to set NSS_NONLOCAL_IGNORE=1 anytime you're setting up
    117 # anything, e.g. using yum. Otherwise useradd will query LDAP in a stupid way
    118 # that makes it hang forever. (This is why we're using YUM, not yum)
    119 
    120 # Reload the iptables config to take down the restrictive firewall
    121     service iptables restart
    122 
    123 # Copy over root's dotfiles from one of the other machines.
    124 # Perhaps a useful change is to remove the default aliases
    125     # On 2009-07-01, the dotfiles to transfer where:
    126     #   .bashrc .ldapvirc (<- HAS PRIVILEDGED DATA)
    127     #   .screenrc .ssh (<- directory) .vimrc
    128     # Trying to scp from server to server won't work, as scp
    129     # will attempt to negotiate a server-to-server connection.
    130     # Instead, scp to your trusted machine as a temporary file,
    131     # and then push to the other server
    132     # You'll need some way to authenticate to the server, and since
    133     # password logins are disabled, you'll need some way of
    134     # temporarily giving yourself credentials.  On a test server,
    135     # reenabling password authentication is ok: frob /etc/pam.d/sshd
    136     # and reverse apply r1068.
     97# NOTE: You can get password SSH back by editing /etc/ssh/sshd_config (allow
     98# password auth) and /etc/pam.d/sshd (comment out the first three auth
     99# lines).  However, you should have the Kerberos credentials in place
     100# so as soon as you install the full set of Scripts packages, you'll get
     101# Kerberized logins.
     102
     103# Make sure network is working.  If this is a new server name, you'll
     104# need to add it to /etc/hosts and
     105# /etc/sysconfig/network-scripts/route-eth1.  Kickstart should have
     106# configured eth0 and eth1 correctly; use service network restart
     107# to add the new routes in route-eth1.
     108    service network restart
     109    route
     110    ifconfig
     111    cat /etc/hosts
     112    cat /etc/sysconfig/network-scripts/route-eth1
     113
     114# This is the point at which you should start updating scriptsified
     115# packages for a new Fedora release.  Consult 'upgrade-tips' for more
     116# information.
     117    yum install -y scripts-base
     118    # Some of these packages are naughty and clobber some of our files
     119    cd /etc
     120    svn revert resolv.conf hosts sysconfig/openafs
    137121
    138122# Replace rsyslog with syslog-ng by doing:
    139123    rpm -e --nodeps rsyslog
    140     YUM install -y syslog-ng
     124    yum install -y syslog-ng
    141125    chkconfig syslog-ng on
    142126
    143 # Install various dependencies of the scripts system, including
    144 # glibc-devel.i586 (ezyang: already installed for me),
    145 # python-twisted-core (ditto), mod_fcgid, nrpe, nagios-plugins-all.
    146     YUM install -y mod_fcgid
    147     YUM install -y nrpe
    148     YUM install -y nagios-plugins-all
    149 
    150 # Disable NetworkManager with chkconfig NetworkManager off. Configure
    151 # networking on the front end and back end, and the routing table to send
    152 # traffic over the back end. Make sure that chkconfig reports "network" on, so
    153 # that the network will still be configured at next boot.
    154 # ezyang: For me, NetworkManager was not installed at this point, and
    155 # we had already done the basic config for networking front end and
    156 # back end (because I wanted ssh access, and not just conserver access)
    157 
    158 # Fix the openafs /usr/vice/etc <-> /etc/openafs mapping by changing
    159 #  /usr/vice/etc/cacheinfo to contain:
    160 #       /afs:/usr/vice/cache:10000000
    161 # Also fix ThisCell to contain athena.mit.edu in both directories
    162 # WARNING: if you're installing a test server, this needs to be much
    163 # smaller; the max filesize on XVM is 10GB.  Pick something like
    164 # 500000
     127# Fix the openafs /usr/vice/etc <-> /etc/openafs mapping.
    165128    echo "/afs:/usr/vice/cache:10000000" > /usr/vice/etc/cacheinfo
    166     # ezyang: ThisCell on b-k and c-w don't have anything special
    167     # written here
    168 # If you're making a test server, some of the AFS parameters are
    169 # kind of retarded (and if you're low on disk space, will actually
    170 # exhaust our inodes).
    171 # Edit the parameters in /etc/sysconfig/openafs
    172 
    173 # Figure out why Zephyr isn't working. Most recently, it was because there
    174 # was a 64-bit RPM installed; remove it and install Joe's 32-bit one
    175     YUM erase -y mit-zephyr
    176     # mit-zephyr has a spurious dependency on mit-krb-config
    177     yumdownloader mit-zephyr.i386
    178     # if deps change, this breaks
    179     YUM install -y libXaw.i586 libXext.i586 libXmu.i586 ncurses-libs.i586 readline.i586
    180     rpm -i --nodeps mit-zephyr-2.1-6-linux.i386.rpm
    181     # test if it worked by sending an un-authed message
    182     zwrite -d -c scripts -i test
    183 
    184 # Install the athena-base, athena-lprng, and athena-lprng-misc RPMs
    185 # from the Athena 9 build (these are present in our yum repo).  Note
    186 # that you will have to use --nodeps for at least one of the lprng
    187 # ones because it thinks it needs the Athena hesiod RPM.  It doesn't
    188 # really.  Before doing this, run it without --nodeps and arrange to
    189 # install the rest of the things it really does depend on.  This will
    190 # include a bunch of 32-bit rpms; go ahead and install the .i586 versions
    191 # of them.
    192     YUM install -y athena-base
    193     YUM install -y athena-lprng
    194     yumdownloader athena-lprng-misc
    195     # ezyang: I couldn't find any deps for this that existed in the repos
    196     # You might get a "find: `/usr/athena/info': No such file or directory"
    197     # error; this is fine
    198     rpm -i --nodeps athena-lprng-misc-9.4-0.i386.rpm
     129    echo "athena.mit.edu" > /usr/vice/etc/ThisCell
     130
     131# [TEST SERVER] If you're installing a test server, this needs to be
     132# much smaller; the max filesize on XVM is 10GB.  Pick something like
     133# 500000. Also, some of the AFS parameters are kind of retarded (and if
     134# you're low on disk space, will actually exhaust our inodes).  Edit
     135# these parameters in /etc/sysconfig/openafs
     136
     137# Test that zephyr is working
     138    chkconfig zhm on
     139    service zhm start
     140    echo 'Test!' | zwrite -d -c scripts -i test
    199141
    200142# Install the full list of RPMs that users expect to be on the
    201143# scripts.mit.edu servers.
    202 
    203 # on another server, run:
    204144rpm -qa --queryformat "%{Name}.%{Arch}\n" | sort > packages.txt
    205145# arrange for packages.txt to be passed to the server, then run:
    206     # notice that yum is not capitalized
    207     # Also notice skip-broken
    208     cat packages.txt | NSS_NONLOCAL_IGNORE=1 xargs yum install -y --skip-broken
     146# --skip-broken will (usually) prevent you from having to sit through
     147# several minutes of dependency resolution until it decides that
     148# it can't install /one/ package.
     149    yum install -y --skip-broken $(cat packages.txt)
    209150
    210151# Check which packages are installed on your new server that are not
    … …  
    212153# on the new machine.  Otherwise, aside from bloat, you may end up
    213154# with undesirable things for security, like sendmail.
    214     rpm -qa --queryformat "%{Name}.%{Arch}\n" | sort > newpackages.txt
    215     diff -u packages.txt newpackages.txt  | less
    216     # if all went well, you'll probably see multiple kernel versions
    217     # as the only diff
    218     # ezyang: I got exim installed as another package
     155    rpm -qa --queryformat "%{Name}.%{Arch}\n" | grep -v kernel | sort > newpackages.txt
     156    diff -u packages.txt newpackages.txt | grep -v kernel | less
    219157    # here's a cute script that removes all extra packages
    220     diff -u packages.txt newpackages.txt  | grep '+' | cut -c2- | grep -v "@" | grep -v "++" | xargs yum erase -y
     158    yum erase -y $(grep -Fxvf packages.txt newpackages.txt)
     159
     160# We need an upstream version of cgi which we've packaged ourselves, but
     161# it doesn't work with the haskell-platform package which expects
     162# explicit versions.  So temporarily rpm -e the package, and then
     163# install it again after you install haskell-platform.  [Note: You
     164# probably won't need this in Fedora 15 or something, when the Haskell
     165# Platform gets updated.]
     166    rpm -e ghc-cgi-devel ghc-cgi
     167    yum install -y haskell-platform
     168    yumdownloader ghc-cgi
     169    yumdownloader ghc-cgi-devel
     170    rpm -i ghc-cgi*1.8.1*.rpm
    221171
    222172# Check out the scripts /usr/vice/etc configuration
    223     cd /root
    224     mkdir vice
    225     cd vice
    226     svn co svn://scripts.mit.edu/trunk/server/fedora/config/usr/vice/etc etc
     173    cd /root/vice
    227174    \cp -a etc /usr/vice
    228175
    229176# Install the full list of perl modules that users expect to be on the
    230177# scripts.mit.edu servers.
    231 # - export PERL_MM_USE_DEFAULT=1
    232 # - Run 'cpan', accept the default configuration, and do 'o conf
    233 #   prerequisites_policy follow'.
    234 # - Parse the output of perldoc -u perllocal | grep head2 on an existing
    235 #   server, and "notest install" them from the cpan prompt.
    236 # TO DO THIS:
    237 # On another server, run:
    238 # perldoc -u perllocal | grep head2 | cut -f 3 -d '<' | cut -f 1 -d '|' | sort -u | perl -ne 'chomp; print "notest install $_\n" if system("rpm -q --whatprovides \"perl($_)\" >/dev/null 2>/dev/null")' > /mit/scripts/config/perl-packages.txt
    239 # Then on the server you're installing,
    240 #    cat perl-packages.txt | perl -MCPAN -e shell
     178    cd /root
    241179    export PERL_MM_USE_DEFAULT=1
    242     # XXX: Some interactive gobbeldygook
    243     cpan
     180    cpan # this is interactive, enter the next two lines
    244181        o conf prerequisites_policy follow
    245182        o conf commit
    … …  
    257194#           /usr/lib64/python2.6/site-packages for Python eggs and modules.
    258195#   There will be a lot of gunk that was installed from packages;
    259 #   easy-install.pth will tell you what was easy_installed.
     196#   easy-install.pth in /usr/lib/ will tell you what was easy_installed.
    260197#   First use 'yum search' to see if the relevant package is now available
    261198#   as an RPM, and install that if it is.  If not, then use easy_install.
    … …  
    263200#   want to be able to write to ~/.python-eggs.  (Also makes sourcediving
    264201#   easier.)
     202    cat /usr/lib/python2.6/site-packages/easy-install.pth
    265203# - Look at `gem list` for Ruby gems.
    266204#   Again, use 'yum search' and prefer RPMs, but failing that, 'gem install'.
    267205#       ezyang: rspec-rails depends on rspec, and will override the Yum
    268206#       package, so... don't use that RPM yet
     207gem list --no-version > gem.txt
     208    gem install $(gem list --no-version | grep -Fxvf - gem.txt)
    269209# - Look at `pear list` for Pear fruits (or whatever they're called).
    270210#   Yet again, 'yum search' for RPMs before resorting to 'pear install'.  Note
    271211#   that for things in the beta repo, you'll need 'pear install package-beta'.
    272212#   (you might get complaints about the php_scripts module; ignore them)
     213pear list | tail -n +4 | cut -f 1 -d " " > pear.txt
     214    pear config-set preferred_state beta
     215    pear channel-update pear.php.net
     216    pear install $(pear list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pear.txt)
    273217# - Look at `pecl list` for PECL things.  'yum search', and if you must,
    274218#   'pecl install' needed items. If it doesn't work, try 'pear install
    275219#   pecl/foo' or 'pecl install foo-beta' or those two combined.
    276     # Automating this... will require a lot of batonning between
    277     # the servers. Probably best way to do it is to write an actual
    278     # script.
     220pecl list | tail -n +4 | cut -f 1 -d " " > pecl.txt
     221    pecl install --nodeps $(pecl list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pecl.txt)
    279222
    280223# Setup some Python config
    281224    echo 'import site, os.path; site.addsitedir(os.path.expanduser("~/lib/python2.6/site-packages"))' > /usr/lib/python2.6/site-packages/00scripts-home.pth
    282225
    283 # Install the credentials.  There are a lot of things to remember here:
    284 #   o This will be different if you're setting up our build/update server.
    285 #   o You probably installed the machine keytab long ago
    286     ls -l /etc/krb5.keytab
    287 #   o Use ktutil to combine the host/scripts.mit.edu and
    288 #     host/scripts-vhosts.mit.edu keys with host/this-server.mit.edu in
    289 #     the keytab.  Do not use 'k5srvutil change' on the combined keytab
    290 #     or you'll break the other servers. (real servers only)
    291 #   o The daemon.scripts keytab
     226# Install the credentials.  There are a lot of things to remember here.
     227# Be sure to make sure the permissions match up (ls -l on an existing
     228# server!).
     229scp root@$source_server:{/etc/{sql-mit-edu.cfg.php,daemon.keytab,pki/tls/private/scripts.key,signup-ldap-pw,whoisd-password},/home/logview/.k5login} .
     230scp daemon.keytab signup-ldap-pw whoisd-password sql-mit-edu.cfg.php root@$server:/etc
     231scp scripts.key root@$server:/etc/pki/tls/private
     232scp .k5login root@$server:/home/logview
     233    chown afsagent:afsagent /etc/daemon.keytab
     234#   o The daemon.scripts keytab (will be daemon.scripts-test for test)
    292235    ls -l /etc/daemon.keytab
    293236#   o The SSL cert private key (real servers only)
     237    ls -l /etc/pki/tls/private/scripts.key
    294238#   o The LDAP password for the signup process (real servers only)
    295 #   o The SQL password for the signup process (real servers only)
     239    ls -l /etc/signup-ldap-pw
    296240#   o The whoisd password (real servers only)
    297 #   o The LDAP keytab for this server, which will be used later (real servers only)
    298 #   o Replace the ssh host keys with the ones common to all scripts servers (real servers only)
    299 #   o You'll install an LDAP certificate signed by the scripts CA later (real servers only)
    300 #   o Make sure root's .k5login is correct
    301     cat /root/.k5login
     241    ls -l /etc/whoisd-password
    302242#   o Make sure logview's .k5login is correct (real servers only)
    303 
    304 # If you are setting up a test server, pay attention to
     243    cat /home/logview/.k5login
     244
     245# Spin up OpenAFS.  This will fail if there's been a new kernel since
     246# when you last tried.  In that case, you can hold on till later to
     247# start OpenAFS.  This will take a little bit of time;
     248    service openafs-client start
     249
     250# Check that fs sysname is correct.  You should see, among others,
     251# 'amd64_fedoraX_scripts' (vary X) and 'scripts'. If it's not, you
     252# probably did a distro upgrade and should update /etc/sysconfig/openafs.
     253    fs sysname
     254
     255# [TEST SERVER] If you are setting up a test server, pay attention to
    305256# /etc/sysconfig/network-scripts and do not bind scripts' IP address.
    306257# You will also need to modify:
    … …  
    322273# XXX: someone should write sed scripts to do this
    323274
    324 # If you are setting up a test server, afsagent's cronjob will attempt
    325 # to be renewing with the wrong credentials (daemon.scripts). Change this:
     275# [TEST SERVER] If you are setting up a test server, afsagent's cronjob
     276# will attempt to be renewing with the wrong credentials
     277# (daemon.scripts). Change this:
    326278    vim /home/afsagent/renew # replace all mentions of daemon.scripts.mit.edu
    327279
    328 # Install 389-ds-base and set up replication (see ./HOWTO-SETUP-LDAP
    329 #   and ./389-ds-enable-ssl-and-kerberos.diff).
     280# Set up replication (see ./install-ldap).
     281# You'll need the LDAP keytab for this server: be sure to chown it
     282# fedora-ds after you create the fedora-ds user
     283    ls -l /etc/dirsrv/keytab
     284    cat install-ldap
    330285
    331286# Make the services dirsrv, nslcd, nscd, postfix, and httpd start at
    332287# boot. Run chkconfig to make sure the set of services to be run is
    333288# correct.
     289    service nslcd start
     290    service nscd start
     291    service postfix start
     292    service httpd start
    334293    chkconfig dirsrv on
    335294    chkconfig nslcd on
    … …  
    341300    chkconfig nrpe on
    342301
     302# Check sql user credentials (needs to be done after LDAP is setup)
     303    chown sql /etc/sql-mit-edu.cfg.php
     304
    343305# Postfix doesn't actually deliver mail; fix this
    344306    cd /etc/postfix
    … …  
    349311
    350312# Run fmtutil-sys --all, which does something that makes TeX work.
     313# (Note: this errors on XeTeX which is ok.)
    351314    fmtutil-sys --all
    352     # ezyang: I got errors on xetex
    353315
    354316# Ensure that PHP isn't broken:
    … …  
    356318    chmod 01777 /tmp/sessions
    357319
    358 # Ensure fcgid isn't broken
    359     chmod 755 /var/run/mod_fcgid # ezyang: I suspect this is no longer necessary
     320# Ensure fcgid isn't broken (should be 755)
     321    ls -ld /var/run/mod_fcgid
    360322
    361323# Fix etc by making sure none of our config files got overwritten
    362324    cd /etc
    363     svn status | grep M
    364     # ezyang: I had to revert krb5.conf (not with latest), nsswitch.conf and sysconfig/openafs
     325    svn status -q
     326    # Some usual candidates for clobbering include nsswitch.conf and
     327    # sysconfig/openafs
    365328
    366329# ThisCell got clobbered, replace it with athena.mit.edu
    … …  
    368331
    369332# Reboot the machine to restore a consistent state, in case you
    370 # changed anything.
    371     # ezyang: When I rebooted, the following things happened:
    372     #   o Starting kdump failed (this is ok)
    373     #   o postfix mailbombed us
    374     #   o firstboot configuration screen popped up (ignored; manually will do
    375     #     chkconfig after the fact)
    376 
    377 # (Optional) Beat your head against a wall.
    378 
    379 # Possibly perform other steps that I've neglected to put in this
    380 # document.
    381 #   o For some reason, syslog-ng wasn't turning on automatically, so we weren't
    382 #     getting spew
    383 
    384 # Some info about changing hostnames: it appears to be in:
     333# changed anything. (Note: Starting kdump fails (this is ok))
     334
     335# [OPTIONAL] Your machine's hostname is baked in at install time;
     336# in the rare case you need to change it: it appears to be in:
    385337#   o /etc/sysconfig/network
    386338#   o your lvm thingies; probably don't need to edit
    387339
    388 # More stuff for test servers
     340# [TEST SERVER] More stuff for test servers
    389341#   - You need a self-signed SSL cert.  Generate with:
    390342    openssl req -new -x509 -keyout /etc/pki/tls/private/scripts.key -out /etc/pki/tls/certs/scripts.cert -nodes
    … …  
    394346#     be an accepted vhost name
    395347#   - Look at the old test server and see what config changes are floating around
     348
     349# XXX: our SVN checkout should be updated to use scripts.mit.edu
     350# (repository and etc) once serving actually works.
     351    cd /etc
     352    svn switch --relocate svn://$source_server/ svn://scripts.mit.edu/
     353    cd /usr/vice/etc
     354    svn switch --relocate svn://$source_server/ svn://scripts.mit.edu/
     355    cd /srv/repository
     356    asbuild svn switch --relocate svn://$source_server/ svn://scripts.mit.edu/
     357    asbuild svn up # verify scripts.mit.edu works

  • trunk/server/doc/install-xen

    r1241 r1693  
    4343    git clone ssh://scripts@scripts.mit.edu/mit/scripts/git/xen.git /etc/xen
    4444
     45# setup conserver
     46    cat /etc/conserver/console.cf # add the correct entires here
     47    visudo # add conservr to sudoers list with:
     48        conservr ALL=(ALL) NOPASSWD: /usr/sbin/xm console *

  • trunk/server/doc/kernel-build-howto

    r630 r1693  
    1919[root@old-faithful ~]# rpm -ivh kernel-vanilla{,-devel}-2.6.23.8-28.scripts1.fc7.x86_64.rpm
    2020
     21You can build kernel-firmware, which is a bunch of binary blobs for
     22hardware, by running the mock build with --arch=noarch.
     23
    2124<Build kmod-openafs>
    2225

  • trunk/server/doc/package-build-howto

    r1558 r1693  
    146146      overwrite any changes you made in place).
    147147
     148Tips
     149====
     150
     151    * Don't try to build a 32-bit package without building the 64-bit
     152      package as well.
Note: See TracChangeset for help on using the changeset viewer.