Ubuntu: Difference between revisions

From DaqWiki
Jump to navigation Jump to search
Line 753: Line 753:
* emacs -nw /etc/rc.local ### add this:
* emacs -nw /etc/rc.local ### add this:
<pre>
<pre>
# enable NAT from private network (eth1) to external network (eth0)
# /etc/rc.local


/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE
iptables -L -v
iptables -L -v
/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
 
/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
#/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
#/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
#iptables -L -v
 
iptables -L -v
iptables -L -v
sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv4.ip_forward=1
sysctl -a | grep forward
#sysctl -a | grep forward


# enable restrictive firewall rules
/etc/firewall-rfc1918.sh


/etc/firewall-rfc1918.sh
# end
/etc/firewall.sh
</pre>
</pre>

Revision as of 17:32, 22 January 2020

About Ubuntu

AAA


Ubuntu version

lsb_release -a
uname -a

Ubuntu installer

  • download the latest Ubuntu LTS desktoip installer iso image
  • dd the image to a USB key
  • boot from USB key in legacy mode (NOT UEFI - may have to select this in the BIOS boot menu - F8 for ASUS, F11 for Supermicro)
  • follow the instruction
  • create user "wheel" with the usual root password
  • run through the installation, reboot
  • login as user wheel
  • open terminal, run "sudo /bin/bash", enter the root password, you now have the root shell
  • run nm-connection-editor to configure the network
  • after network is up (can ping ladd00), continue with post-installation steps below

Install instructions

prepare

apt-get update
apt-get upgrade

install time synchronization

apt-get -y install chrony
echo server time1 iburst >> /etc/chrony/chrony.conf
echo server time2 iburst >> /etc/chrony/chrony.conf
echo server time3 iburst >> /etc/chrony/chrony.conf
systemctl disable systemd-timesyncd.service
systemctl stop systemd-timesyncd.service
systemctl disable ntp
systemctl stop ntp
systemctl enable chrony
systemctl restart chrony
chronyc sources
chronyc tracking

install email server

dpkg-reconfigure postfix ### or
apt-get install postfix ### select "satellite system", enter full hostname "xxx.triumf.ca", enter "smtp.triumf.ca"
echo olchansk@triumf.ca >> ~root/.forward
mailx root
test
^D

install missing packages

yes | apt-get -y install ssh
yes | apt-get -y install git subversion g++
yes | apt-get -y install libz-dev sqlite sqlite3 libsqlite3-dev libmysqlclient-dev unixodbc-dev
yes | apt-get -y install sqliteman
yes | apt-get -y install libssl-dev
yes | apt-get -y install sysstat smartmontools # also installs postfix
yes | apt-get -y install emacs xemacs21
yes | apt-get -y install mutt # email client
yes | apt-get -y install liblz4-tool pbzip2
yes | apt-get -y install libc6-dev-i386 # otherwise no /usr/include/sys/types.h
yes | apt-get -y install libreadline-dev
yes | apt-get -y install chromium-browser chromium-codecs-ffmpeg-extra
yes | apt-get -y install ubuntu-mate-themes
yes | apt-get -y install minicom
yes | apt-get -y install screen
yes | apt-get -y install rsync strace net-tools
yes | apt-get -y install emacs xemacs21

install ganglia

yes | apt-get -y install ganglia-monitor
systemctl enable ganglia-monitor
cd ~root/git/scripts
git pull
cp etc/gmond-ubuntu.conf /etc/ganglia/gmond.conf
systemctl restart ganglia-monitor
systemctl status ganglia-monitor
ps -efw | grep gmond

install gonodeinfo

yes | apt-get -y install golang
mkdir ~/git
cd ~/git
git clone https://bitbucket.org/dd1/gonodeinfo.git
cd gonodeinfo
git pull
make
make install # install gonodeinfo agent
cd ~ # this is important
  • edit /etc/gonodeinfo.conf
  • change "Description", "Location", "User" and "Administrator" as appropriate (or delete them)
  • change "Servers" to read: Servers: ladd00.triumf.ca:8601
  • run gonodeinfo
  • if error is "connection refused". go to the nodeinfo server to add this client to the access control list:
  • on the gonodeinfo server: run gonodereceive -a daq13
  • try gonodeinfo again, there should be no error
  • on the gonodeinfo server: run gonodereport, look at the web pages, the new machine should be listed now

install libz.so.1 for CentOS compatibility

yes | apt-get -y install zlib1g
yes | apt-get -y install zlib1g:i386 libc6:i386 libgcc1:i386 gcc-6-base:i386

install libpng12.so.0 for Quartus compatibility

(does not work anymore!!!)

wget http://ftp.ca.debian.org/debian/pool/main/libp/libpng/libpng12-0_1.2.50-2+deb8u2_amd64.deb
dpkg --install libpng12-0_1.2.50-2+deb8u2_amd64.deb

install packages for building ROOT

apt-get -y install libx11-dev libxpm-dev libxft-dev libxext-dev libpng-dev libjpeg-dev xlibmesa-glu-dev libxml2-dev libgsl-dev cmake

install desktop environments

  • install MATE desktop
yes | apt-get -y install ubuntu-mate-core ubuntu-mate-desktop
yes | apt-get -y install ubuntu-mate-themes
  • install Cinnamon desktop
### not needed 18.04 LTS ### add-apt-repository ppa:embrosyn/cinnamon
yes | apt update
yes | apt-get -y install cinnamon
  • install KDE desktop
yes | apt-get -y install kubuntu-desktop
  • install Lxqt desktop
yes | apt-get -y install lxqt
  • install Xfce4 desktop
yes | apt-get -y install xfce4

install ROOT

Please install ROOT per instructions at http://root.cern.ch.

NOTE1: The ROOT package available from Ubuntu repositories is severely out of date and cannot be used with MIDAS and ROOTANA. ### DO NOT DO THIS! apt-get install root-system

NOTE2: as of 2017-Jan-09, ROOT binary kits for Ubuntu do not work (use GCC 5 instead of GCC6), build from source instead.

Install x2go

x2go instructions, thanks to Art O.

add-apt-repository ppa:x2go/stable
apt-get update
apt-get install x2goserver x2goserver-xsession

Post installation

  • setup hostname
xemacs -nw /etc/hostname ### add .triumf.ca to the hostname if it is missing
  • install Konstantin's scripts
mkdir ~root/git
cd ~root/git
git clone https://ladd00.triumf.ca/~olchansk/git/scripts.git
cd scripts
git pull
  • enable root login from ladd00
ssh localhost
CTRL-C
/bin/cp ~root/git/scripts/etc/authorized_keys ~root/.ssh/
  • enable automatic updates 1
sudo apt-get install unattended-upgrades
xemacs -nw /etc/apt/apt.conf.d/50unattended-upgrades ### uncomment "-updates", uncomment "::Mail "root"", uncomment allowed-origins -security and -updates
  • enable automatic updates 2

add this to: xemacs -nw /etc/apt/apt.conf.d/10periodic

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";

NIS instructions

  • apt-get -y install portmap nis ### will ask for NIS domain (LADD-NIS)
  • ypwhich -m
  • edit /etc/default/nis
    • set "NISSERVER=slave"
    • set "YPSERVARGS=-p800"
  • edit /etc/yp.conf", comment-out everything, add "domain LADD-NIS server localhost"
  • /usr/lib/yp/ypinit -s ladd00
  • systemctl restart nis
  • ypwhich -m
  • ypcat -k passwd
  • apt-get -y install autofs
  • systemctl enable autofs
  • vi /etc/nsswitch.conf ### add the automount line, modify the passwd, group and shadow lines to read this:
passwd: files nis
group: files nis
shadow: files nis
automount:  files nis
  • systemctl restart autofs
  • enable hourly update of NIS maps
cd ~/git/scripts/etc
git pull
ln -s $PWD/ypxfr-cron-hourly /etc/cron.hourly
  • ### NOT NEEDED sudo vi /etc/idmapd.conf ### add line: "Domain = triumf.ca"
  • reboot

Fix systemd NIS breakage

there is a delay in ssh logins for normal users. "ssh -v" shows the delay is after "pledge...". this fix removes the delay.

systemd developers think that we should not use NIS and made sure there are problems if we do. To give them credit, they do offer a workaround. Read this: https://github.com/poettering/systemd/commit/695fe4078f0df6564a1be1c4a6a9e8a640d23b67

mkdir /etc/systemd/system/systemd-logind.service.d
echo -e "[Service]\nIPAddressDeny=\n" > /etc/systemd/system/systemd-logind.service.d/local.conf
systemctl daemon-reload
systemctl cat systemd-logind.service

Install sddm display manager (DO NOT DO THIS)

  • apt-get install sddm
  • apt-get install sddm-theme-"*"
  • create sddm.conf:
root@daqubuntu:~# more /etc/sddm.conf
[Theme]
Current=maldives
root@daqubuntu:~# 
  • dpkg-reconfigure lightdm (select sddm)
  • reboot

Configure lightdm display manager

  • enable it
systemctl disable gdm
systemctl disable sddm
systemctl enable lightdm
  • make the MATE desktop as default
cd ~root/git/scripts/
git pull
/bin/cp -v etc/lightdm_default_mate.conf /etc/lightdm/lightdm.conf.d/
  • enable login by NIS users
/bin/cp -v etc/lightdm_enable_nis_login.conf /etc/lightdm/lightdm.conf.d/
  • restart lightdm
systemctl restart lightdm

Install libpng12.so.0

Quartus 16 needs libpng12:

wget http://mirrors.kernel.org/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.54-1ubuntu1_amd64.deb
dpkg --install libpng12-0_1.2.54-1ubuntu1_amd64.deb

Install google-chrome

Instructions from here: https://www.ubuntuupdates.org/ppa/google_chrome?dist=stable

wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add -
sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'
apt-get update
apt-get install google-chrome-stable

Disable unwanted services

systemctl disable mpd
systemctl disable snapd
systemctl disable ModemManager

Install apache httpd proxy for midas and elog

This will configure the HTTPS/SSL certificate using "certbot" and "letsencrypt" and configure an HTTPS web server using apache2.

First, configure apache2:

  • execute these commands:
apt install apache2
cd /etc/apache2
  • create new file conf-available/ssl-daq14.conf # use actual hostname instead of daq14
SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
  • create new file sites-available/daq14-ssl.conf # use actual hostname instead of daq14
<IfModule mod_ssl.c>
    <VirtualHost *:443>
        ServerName daq14.triumf.ca
        DocumentRoot /var/www/html
        ErrorLog /var/log/apache2/daq14.log
        SSLEngine on
        # note SSLProtocol, SSLCipherSuite and some other settings are overwritten by /etc/letsencrypt/options-ssl-apache.conf
        SSLProtocol all -SSLv2 -SSLv3
        SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA:!RC4
        ## use port specified in elogd.cfg
        #ProxyPass /elog/ http://localhost:8082/ retry=1 
        ## use mhttpd port
        #ProxyPass /      http://localhost:8080/ retry=1 
        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
        <Location />
            SSLRequireSSL
            AuthType Basic
            AuthName "DAQ password protected site"
            Require valid-user
            # create password file: touch /etc/apache2/htpasswd
            # to add new user or change password: htpasswd /etc/apache2/htpasswd username
            AuthUserFile /etc/apache2/htpasswd
        </Location>
    </VirtualHost>
</IfModule>
  • stop apache2 from listening on port 80: edit /etc/apache2/ports.conf, comment-out the line "Listen 80"
  • stop apache2 from listening on port 80: edit /etc/apache2/ports.conf, comment-out the line "Listen 80"
  • enable ssl module
  • enable new configurations
  • check that there are no syntax problems
a2enmod ssl
a2enmod headers
a2enmod proxy
a2enmod proxy_http
a2enconf ssl-daq14
a2ensite daq14-ssl
apache2ctl configtest
  • enable and start apache2:
systemctl enable apache2
systemctl restart apache2
systemctl status apache2
  • apache2 may fail to start, look in /var/log/apache2/error.log and /var/log/apache2/daq14.log
  • if it says "Failed to configure ... certificate", proceed to the step for setting certbot.
  • try to access https://daq14.triumf.ca
    • you should see a complaint about self-signed certificate
    • you should see a request for password (do not login yet)
    • if you get "connection refused", HTTPS port 443 may need to be enabled in the local firewall, look at documentation for ufw.

Second, configure certbot:

(Note: as of 2018-01-18 certbot requires use of http port 80 to get the initial https certificate, renewal can continue to use the https port 443)

(Note: as of 2019-01-?? certbot requires use of port 80 for renewals)

  • check that port 80 is not used by anything:
  • netstat -an | grep LISTEN | grep ^tcp | grep 80
  • lsof -P | grep -i tcp | grep LISTEN | grep 80
  • if lsof reports that apache2 is listening on port 80, follow the apache2 instructions above (remove "listen 80" from apache2.conf
  • install certbot (if necessary open tcp port 80 in the firewall, see documentation for ufw):
apt install certbot python3-certbot-apache
certbot certonly --standalone --installer apache
  • then answer questions:
  • "activate HTTPS for daq14.triumf.ca" - say ok
  • "enter email address" - enter your own email address
  • "please read terms..." - read the terms and say "agree"
  • it will take a few moments...
  • "congratulations..." - say ok.
certbot install --apache --cert-name daq14.triumf.ca
  • then answer questions:
  • "choose redirect..." - say "1" (no redirect)
  • look inside /etc/apache2/sites-enabled/ssl-daq14.conf to see that SSLCertificateFile & co point to certbot certificates in

/etc/letsencrypt/live/daq14.triumf.ca/

  • to check current renewal and to update the certbot config file in /etc/letsencrypt/renewal, run this:
certbot renew --standalone --installer apache --force-renewal

NOTE: this certificate will expire in 3 months, automatic renewal should work with current version of certbot

Third, activate password protection:

  • as shown in the config file above, create password file and initial user: (replace "midas" with specific username)
touch /etc/apache2/htpasswd
htpasswd /etc/apache2/htpasswd midas
  • restart apache2
systemctl restart apache2
systemctl status apache2

From here:

  • enable proxy for MIDAS mhttpd - uncomment redirect in the config file above
  • enable proxy for ELOG - ditto
a2enmod proxy
a2enmod proxy_http
apache2ctl configtest
systemctl restart apache2

From here:

  • enable proxy for MIDAS mhttpd - uncomment redirect in the config file above
  • enable proxy for ELOG - ditto
a2enmod proxy
a2enmod proxy_http
apache2ctl configtest
systemctl restart apache2
SSL                  = 0

NOTE: if certbot fails with errors about 'module' object has no attribute 'pyopenssl', try this: pip install requests==2.6.0

Update packages

  • apt-get update # update package list
  • apt-get dist-upgrade # install updated packages and update "kept back" packages
  • apt-get autoremove # remove packages that apt thinks should be removed

Finish installation

  • reboot
shutdown -r now

Install ZFS

!!! after installing all the packages, after updating the system, after updating the linux kernel, after rebooting into latest kernel !!!

apt-get install zfsutils-linux

Follow generic ZFS instructions: ZFS

Update to new version of Ubuntu

vi /etc/update-manager/release-upgrades # set "Prompt=normal"
do-release-upgrade

Ubuntu package manager

  • apt-get install xxx # install package xxx
  • apt-get update
  • apt-get upgrade
  • apt-get dist-upgrade
  • apt-get autoremove # remove automatically installed packages required by a removed package
  • apt-get remove xxx # remove package xxx
  • apt-cache search . # list all available packages
  • apt-cache show "." | grep ^Package # list al available packages
  • apt-cache madison root-system # show all available versions of package root-system
  • apt list # list all installed packages
  • dpkg --listfiles libpng16-16 # list all files from this package
  • apt list --installed # list all installed packages

Ubuntu grub boot loader

  • edit /etc/default/grub
  • grub-mkconfig -o /boot/grub/grub.cfg
  • update-initramfs -v -u
  • grub-install /dev/sda

Setup ubuntu as gateway to private network

See also:

Steps to do

  • assign network numbers to the private network, i.e. 192.168.1.x, 192.168.2.x, etc
  • (on the gateway machine, each private network interface has to have a different network number)
  • (each network interface can have multiple networks attached, via VLANs or via eth0:0, eth0:1 constructs)
  • assign IP addresses on the private network, save them in /etc/hosts i.e. "hvps 192.168.1.10"
  • (for simplicity, assign 192.168.1.1 to the gateway machine itself)
  • (IP addresses 192.168.1.0 and 192.168.1.255 are "special", do not use them)
  • setup DNS server (dnsmasq) to serve contents of /etc/hosts via DNS (otherwise, many programs will see inconsistent name to IP address mapping)
  • setup DHCP server (ISC dhcpd or dnsmasq) to give out the IP addresses
  • setup tftp, pxelinux and NFS for diskless booting
  • setup time server (chronyd) to provide common time to all devices
  • setup NAT so machines on private network can access the internet (to get OS updates, etc)
  • setup NIS and NFS so machines on the private network can use common home directories
  • setup rsync backup of machines on the private network

setup hosts

  • edit /etc/hosts
192.168.1.101 dsfe01
... and so forth

setup dns and dhcp

  • apt-get install dnsmasq
  • edit /etc/dnsmasq.conf
# /etc/dnsmasq.conf
# DNS settings
#port=0 # disable DNS function
port=53
domain-needed
bogus-priv
no-resolv
server=142.90.100.19
# DHCP settings
interface=enp1s0f0 # DHCP interface
#dhcp-range=192.168.1.50,192.168.1.150,infinite
dhcp-range=192.168.1.0,static
dhcp-boot=pxelinux.0
#dhcp-host=ac:1f:6b:9e:7f:4a,192.168.1.100,10m
dhcp-host=ac:1f:6b:9e:7f:4a,dsfe01,infinite
# TFTP settings
enable-tftp
tftp-root=/zssd/tftpboot
  • mkdir /zssd/tftpboot ### per tftp-root
  • systemctl enable dnsmasq
  • systemctl restart dnsmasq

setup chronyd

  • enable ntp server:
  • configure and enable chronyd per instructions above
  • emacs -nw /etc/chrony/chrony.conf
    • add "allow 192.168.1.0/24" at the end
  • systemctl restart chronyd
  • chronyc tracking ### wait until time is synchronized (a few seconds)

setup diskless network booting

setup pxelinux

cd ~
wget https://www.kernel.org/pub/linux/utils/boot/syslinux/4.xx/syslinux-4.03.tar.bz2
tar xjvf syslinux-4.03.tar.bz2
cd syslinux-4.03
cp -pv ./core/pxelinux.0 ./com32/hdt/hdt.c32 ./memdisk/memdisk ./com32/menu/menu.c32 /zssd/tftpboot/
  • cd /zssd/tftpboot
wget http://ladd00.triumf.ca/tftpboot/memtest86+-4.20.iso.zip
wget http://ladd00.triumf.ca/tftpboot/memtest86+-5.01.iso.gz
wget http://ladd00.triumf.ca/tftpboot/modules.alias
wget http://ladd00.triumf.ca/tftpboot/modules.pcimap
wget http://ladd00.triumf.ca/tftpboot/pci.ids
  • mkdir pxelinux.cfg
  • emacs -nw pxelinux.cfg/default
default menu.c32
prompt 0

menu title Welcome to the DSVSLICE PXE boot menu

timeout 50

label hdt
  kernel hdt.c32

label memtest86+-5.01 
  kernel memdisk iso initrd=memtest86+-5.01.iso.gz 

label memtest86+-4.20
  kernel memdisk iso initrd=memtest86+-4.20.iso.zip

label vmlinuz-5.3.0-26-generic
  menu default
  kernel vmlinuz-5.3.0-26-generic
  append initrd=initrd.img-5.3.0-26-generic boot=nfs root=/dev/nfs netboot=nfs nfsroot=192.168.1.1:/zssd/nfsroot/dsfe01 toram ip=dhcp panic=60 BOOTIF=enp1s0f0

#end

setup linux kernel

  • copy the kernel files
cd /boot
rsync -av config* initrd* System.map* vmlinuz* /zssd/tftpboot/
  • cd /zssd/tftpboot
  • chmod a+r *

setup nfs

  • apt-get install nfs-kernel-server
  • emacs -nw /etc/exports
/zssd/nfsroot/dsfe01 dsfe01(rw,no_root_squash,async,no_subtree_check)
  • enable services
systemctl enable nfs-server
systemctl enable nfs-mountd
systemctl enable nfs-idmapd

setup userland

  • zfs create zssd/nfsroot
  • zfs set dedup=verify zssd/nfsroot ### enable deduplication to save disk space because most linux images have mostly identical files
  • clone ubuntu
mkdir /zssd/nfsroot/dsfe01
cd /
rsync -avx . /zssd/nfsroot/dsfe01
  • edit config files:
  • cd /zssd/nfsroot/dsfe01
  • emacs -nw etc/hostname ### change to dsfe01
  • emacs -nw etc/fstab ### add this
192.168.1.1:/zssd/nfsroot/dsfe01 / nfs defaults,nolock 0 0
  • emacs -nw etc/chrony/chrony.conf
    • comment-out all "pool" and "server" entries
    • add entry "server 192.168.1.1 iburst"

After dsfe01 is booted:

  • disable services:
systemctl disable apache2
systemctl disable dnsmasq
systemctl disable zfs-import-cache

To setup additional machines, clone dsfe01 instead of cloning the gateway machine

setup shared home directory

on the gateway machine

  • define netgroups
  • emacs -nw /etc/netgroup
dsfe (dsfe01,,) (dsfe02,,)
  • emacs -nw /etc/nsswitch.conf ### edit the netgroup line to read:
netgroup: files
  • export the home directories:
  • emacs -nw /etc/exports ### add this:
/zssd/home1 @dsfe(rw,no_root_squash,async,no_subtree_check)
  • exportfs -rc

on the frontend machine

  • mkdir /home
  • emacs -nw /etc/fstab ### add this:
192.168.1.1:/zssd/home1 /home nfs defaults 0 0
  • mount -a

setup NAT

NAT allows machines on the private network to connect to the internet: https://en.wikipedia.org/wiki/Network_address_translation

  • emacs -nw /etc/rc.local ### add this:
# /etc/rc.local

/sbin/iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE
iptables -L -v

#/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
#/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
#iptables -L -v

iptables -L -v
sysctl -w net.ipv4.ip_forward=1
#sysctl -a | grep forward

/etc/firewall-rfc1918.sh

# end