Additional configuration on QRIScloud servers
Introduction
SMTP Configuration
smtp relay host configuration
sudo yum install postfix mailx Edit the /etc/postfix/main.cf and add/change the myhostname and relayhost details. vi /etc/postfix/main.cf myhostname = vm-130-XXX-XXX-XXX.qld.nectar.org.au relayhost = [smtp.uq.edu.au]:25 service postfix restart (or reload) Test email: echo "Test mail from postfix" | mail -s "Test Postfix" youremail@griffith.edu.au >>>>>>>>>>>> For VMs on intersect: Direct email transport to the Internet is blocked per NeCTAR guidelines to prevent spamming in case a VM is compromised. There is an easy workaround, however, that makes use of a dedicated SMTP relay, nectar-smtp-relay.intersect.org.au - This is actually two systems and will be accessed in a round-robin manner to share the load. For Postfix perform these configuration tasks to add a line to the configuration and reload the configuration into postfix: # vi /etc/postfix/main.cf relayhost = [nectar-smtp-relay.intersect.org.au] # postfix reload >>>>>>>>>>>>>>
X forwarding after su sudo
Ref: http://renesimoons.blogspot.com.au/2011/02/x-forwarding-after-su-sudo-etc.html
ssh -Y username@ip Temporarily transfer the authorization to the other account. xauth list xauth list aspc2o1/unix:10 MIT-MAGIC-COOKIE-1 bc334c66cfec3c5c3d5b0efc4ee9d3ad su - root xauth add aspc2o1/unix:10 MIT-MAGIC-COOKIE-1 bc334c66cfec3c5c3d5b0efc4ee9d3ad Now, you should be able to start any X Windows application, assuming that your DISPLAY variable is set to go through the ssh tunnel
freenx-server setup on centos 6.x servers
To obtain a graphical desktop on the QRIScloud server, install freenx-server
Centos 6.x
sudo yum groupinstall "X Window System" "Desktop" sudo yum groupinstall "General Purpose Desktop" yum install gnome-panel >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Adding the following repository is not needed but is provided in case: vi /etc/yum.repos.d/CentOS-Atrpms.repo [atrpms] name=RHEL $releasever - $basearch - ATrpms ##name=Fedora Core $releasever - $basearch - ATrpms baseurl=http://dl.atrpms.net/el6.5-x86_64/atrpms/stable gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms gpgcheck=1 [atrpms_bleeding] name=RHEL $releasever - $basearch - (Bleeding) ATrpms #name=Fedora Core $releasever - $basearch - (Bleeding) ATrpms baseurl=http://dl.atrpms.net/el6.5-x86_64/atrpms/bleeding gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms gpgcheck=1 rpm --import http://packages.atrpms.net/RPM-GPG-KEY.atrpms && yum update >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> yum install nx freenx freenx-server yum install nxagent #/usr/libexec/nx/nxsetup --install --setup-nomachine-key /usr/bin/nxsetup --install --setup-nomachine-key
Ubuntu
>>>>> apt-get install xinit sudo apt-get install build-essential sudo apt-get install ubuntu-desktop apt-get install ubuntu-desktop #apt-get install ubuntu/kubuntu/xubuntu-desktop sudo apt-get install --reinstall gdm sudo apt-get purge gdm && sudo apt-get install gdm >>>> #install FreeNX sudo add-apt-repository ppa:freenx-team #if ubuntu 14 #sudo add-apt-repository ppa:freenx-team/trusty sudo apt-get update && sudo apt-get install freenx #if ubuntu 14 #sudo apt-get install freenx-vnc #sudo apt-get install freenx-server wget https://bugs.launchpad.net/freenx-server/+bug/576359/+attachment/1378450/+files/nxsetup.tar.gz && tar xvf nxsetup.tar.gz && sudo cp nxsetup /usr/lib/nx sudo /usr/lib/nx/nxsetup --install --setup-nomachine-key #configure clients to use gnome session: echo -e "\n#Use gnome-fallback for client sessions\nCOMMAND_START_GNOME='gnome-session --session=gnome-fallback'"|sudo tee -a /etc/nxserver/node.conf nxloadconfig --check on the client: sudo apt-get update && sudo apt-get install qtnx
opennx client setup
Download and install client package from http://opennx.net/download.html OR nxclient 3x from:
http://www2.vrdc.cornell.edu/news/ecco/step-4-using-ecco/nx-client-3-5/
Zone Specific Changes
If you create a server using one of the images, most likely one will need to change some of the settings (e.g Time Zone, time etc). Here are some of the sysadmin commands to make the changes:
Change Time Zone
ZONEINFO=Australia/Brisbane rm -f /etc/localtime ln -s /usr/share/zoneinfo/$ZONEINFO /etc/localtime
smtp relay host configuration
sudo yum install postfix mailx Edit the /etc/postfix/main.cf and add/change the myhostname and relayhost details. vi /etc/postfix/main.cf myhostname = vm-130-XXX-XXX-XXX.qld.nectar.org.au relayhost = [smtp.uq.edu.au]:25 service postfix restart (or reload) Test email: echo "Test mail from postfix" | mail -s "Test Postfix" youremail@griffith.edu.au
nfs mount
yum install nfs-utils nfs-utils-lib rpcbind showmount cd /etc/sysconfig/network-scripts cp ifcfg-eth0 ifcfg-eth1 vi ifcfg-eth1 Change the Device to eth1 ifdown eth1 ifup eth1 service networking restart 100.255.100.50:/collection/Q0008/Q0008 /mnt/QS0008 showmount -e 100.255.100.50 Manual Check: mount -t nfs -o vers=3 100.255.100.50:/collection/Q0046/Q0046 /mnt/Q0046 -v
Using Autofs: To mount 100.255.120.200:/tier2c1/Q0008/Q0008 on /data2, do the following: yum install autofs create a mount point if not done (e.g: mkdir /data2) vi /etc/auto.master insert the following: /- /etc/auto.misc --timeout=600 --ghost Create the /etc/auto.misc file vi /etc/auto.misc /data2 -rw,nfsvers=3,hard,intr,nosuid,nodev,timeo=15,retrans=5 100.255.120.200:/tier2c1/Q0008/Q0008
Ref:https://qriscloud.zendesk.com/hc/en-us/articles/200106199-NFS-mounting-collection-storage-in-Linux
nfs server
if you wish to nfs export a filesystem or folder to other clients, you cna do the following:
yum install nfs-utils nfs-utils-lib rpcbind showmount Create a security Group on NECTAR dashboard and give it a name (e.g. nfs) Add the following security Rules to this group: TCP/UDP 111 TCP/UDP 2049 TCP/32803 UDP/32769 PORT/892 PORT/875 PORT/662 PORT/2020
Apply this security group to the nfs server
Configure NFS services to use fixed ports. vi /etc/sysconfig/nfs Modify config directive as follows to set TCP/UDP unused ports: # TCP port rpc.lockd should listen on. LOCKD_TCPPORT=lockd-port-number # UDP port rpc.lockd should listen on. LOCKD_UDPPORT=lockd-port-number # Port rpc.mountd should listen on. MOUNTD_PORT=mountd-port-number # Port rquotad should listen on. RQUOTAD_PORT=rquotad-port-number # Port rpc.statd should listen on. STATD_PORT=statd-port-number # Outgoing port statd should used. The default is port is random STATD_OUTGOING_PORT=statd-outgoing-port-numbe Here is sample listing from one of my production NFS server: LOCKD_TCPPORT=32803 LOCKD_UDPPORT=32769 MOUNTD_PORT=892 RQUOTAD_PORT=875 STATD_PORT=662 STATD_OUTGOING_PORT=2020 # service nfs restart # service rpcsvcgssd restart
Check with: rpcinfo -p
Export the folder/filesystem
edit /etc/exports e.g: /mnt/home n002(rw) n003(rw)
Reference: http://www.cyberciti.biz/faq/centos-fedora-rhel-iptables-open-nfs-server-ports/
Disable network manager
There's a known issue with Network manager and Openstack
chkconfig --list NetworkManager service NetworkManager stop chkconfig NetworkManager off echo "For each interface, ensure that the NM_CONTROLLED configuration key is set to no " echo "NM_CONTROLLED=no" echo "ONBOOT=yes" vi /etc/sysconfig/network-scripts/ifcfg-eth0 vi /etc/sysconfig/network-scripts/ifcfg-eth1 read JUNK chkconfig network on read JUNK service network start
Block SSH Server Attacks (Brute Force Attacks) Using DenyHosts
yum --enablerepo=epel install denyhosts OR yum install denyhosts vi /etc/hosts.allow Add: ALL: 132.234. vi /etc/denyhosts.conf Search for the ‘ADMIN_EMAIL‘ and add your email address here to receive email alerts about suspicious logins ADMIN_EMAIL = youremail@griffithuni.edu.au SMTP_FROM = DenyHosts <denyhost@qcloudservername> chkconfig denyhosts on service denyhosts start Check to see it in action: tail -f /var/log/secure For Ubuntu: $ wget http://mirror.pnl.gov/ubuntu//pool/universe/d/denyhosts/denyhosts_2.6-10_all.deb $ sudo dpkg -i denyhosts_2.6-10_all.deb
Slow SSH login in CentOS 6
The following solution resolved the issue... https://www.serverpronto.com/accounts/knowledgebase.php?action=displayarticle&id=16 If SSH login is very slow in CentOS 6 it’s because they have added another security feature, the SSH server will do a reverse DNS again for any incoming connection, this will delay connection up to 13 seconds, to avoid this: 1. Access the server 2. Edit the ssh config Nano /etc/ssh/sshd_config Look for use dns and change it to no Ctrl +w, usedns, enter Change it from #useDNS yes to useDNS no Save and close Ctrl + X, Y, enter Restart the sshd service Service sshd restart
Creating or Renewing Certifcates
Here are some commands to create a new certificate: 1. Create the key openssl genrsa -out somewebsite.griffith.edu.au_2015.key 2048 (needs to be 2048 bit key or else can't sign it) 2. Create Certificate Sign Request (CSR) openssl req -new -key somewebsite.griffith.edu.au_2015.key -out somewebsite.griffith.edu.au.csr 3. Take the contents of the csr file and copy it into an email, or alternatively attach the csr to an email to j.braine@griffith.edu.au or security@griffith.edu.au. 4. You will receive a reply after a day or so with a certificate attached to the email, download the certificate and move it to the server. 5. Edit the webserver config (apache would be ssl.conf) and change the SSLCertificateFile to point to the certificate you received and the SSLCertificateKeyFile line to the key you created.
Register a domain and register it in Griffith dns servers
You will need to register your domain by purchasing a domain name from the likes of https://www.crazydomains.com.au/ etc. When registering, can you register dns1.griffith.edu.au anddns3.griffith.edu.au as the primary DNS name servers. Then we can log a service desk case at Griffith to point the name to the correct IP address. Here is the procedure: Let’s say you have registered a domain called treadd.org.au Get the IP address of the server hosting this website. Let’s say it is: 103.131.227.107 Then go to the service desktop tool: https://griffith.service-now.com/ Log in. Go to "service request" ==> “Create new” ==> Fill in the following: Requester : yourself Affected end user: yourself ITL Process: Request Category: Network (Plain network would do) Summary: Point treadd.org.au to IP 103.131.227.107 in the dns servers Description: (Give a description of the problem. see below for example): We would like to use Griffith DNS servers as the primary dns servers for domain treadd.org.au. Can you please point treadd.org.au to IP 203.101.227.155. Thanks Save and Exit That's it.
Reference:
1. https://qriscloud.zendesk.com/hc/en-us/articles/200106199-NFS-mounting-collection-storage-in-Linux