/
Additional configuration on QRIScloud servers

Additional configuration on QRIScloud servers

Introduction

SMTP Configuration

smtp relay host configuration

sudo yum install postfix mailx
Edit the /etc/postfix/main.cf and add/change the myhostname and relayhost details.

 vi /etc/postfix/main.cf

myhostname = vm-130-XXX-XXX-XXX.qld.nectar.org.au
relayhost = [smtp.uq.edu.au]:25

service postfix restart  (or reload)

Test email:

echo "Test mail from postfix" | mail -s "Test Postfix" youremail@griffith.edu.au

>>>>>>>>>>>>
For VMs on intersect:
Direct email transport to the Internet is blocked per NeCTAR guidelines to prevent spamming in case a VM is compromised.

There is an easy workaround, however, that makes use of a dedicated SMTP relay, nectar-smtp-relay.intersect.org.au - This is actually two systems and will be accessed in a round-robin manner to share the load.

For Postfix perform these configuration tasks to add a line to the configuration and reload the configuration into postfix:
# vi /etc/postfix/main.cf
relayhost = [nectar-smtp-relay.intersect.org.au]

# postfix reload


>>>>>>>>>>>>>>

X forwarding after su sudo

Ref: http://renesimoons.blogspot.com.au/2011/02/x-forwarding-after-su-sudo-etc.html

ssh -Y username@ip
Temporarily transfer the authorization to the other account.
xauth list

xauth list
aspc2o1/unix:10 MIT-MAGIC-COOKIE-1 bc334c66cfec3c5c3d5b0efc4ee9d3ad

su - root
xauth add aspc2o1/unix:10 MIT-MAGIC-COOKIE-1 bc334c66cfec3c5c3d5b0efc4ee9d3ad

Now, you should be able to start any X Windows application, assuming that your DISPLAY variable is set to go through the ssh tunnel

freenx-server setup on centos 6.x servers

To obtain a graphical desktop on the QRIScloud server, install freenx-server

Centos 6.x

sudo yum groupinstall "X Window System" "Desktop"
sudo yum groupinstall "General Purpose Desktop"
yum install gnome-panel

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Adding the following repository is not needed but is provided in case:
vi /etc/yum.repos.d/CentOS-Atrpms.repo
[atrpms]
name=RHEL $releasever - $basearch - ATrpms
##name=Fedora Core $releasever - $basearch - ATrpms
baseurl=http://dl.atrpms.net/el6.5-x86_64/atrpms/stable
gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms
gpgcheck=1

[atrpms_bleeding]
name=RHEL $releasever - $basearch - (Bleeding) ATrpms
#name=Fedora Core $releasever - $basearch - (Bleeding) ATrpms
baseurl=http://dl.atrpms.net/el6.5-x86_64/atrpms/bleeding
gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms
gpgcheck=1

rpm --import http://packages.atrpms.net/RPM-GPG-KEY.atrpms && yum update
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

yum install nx freenx freenx-server 
yum install nxagent
#/usr/libexec/nx/nxsetup  --install --setup-nomachine-key
/usr/bin/nxsetup  --install --setup-nomachine-key

Ubuntu

>>>>>
apt-get install xinit
sudo apt-get install build-essential
sudo apt-get install ubuntu-desktop
apt-get install ubuntu-desktop
#apt-get install ubuntu/kubuntu/xubuntu-desktop
sudo apt-get install --reinstall gdm
sudo apt-get purge gdm && sudo apt-get install gdm
>>>>

#install FreeNX
sudo add-apt-repository ppa:freenx-team
#if ubuntu 14
#sudo add-apt-repository ppa:freenx-team/trusty
sudo apt-get update && sudo apt-get install freenx
#if ubuntu 14
#sudo apt-get install freenx-vnc
#sudo apt-get install freenx-server
wget https://bugs.launchpad.net/freenx-server/+bug/576359/+attachment/1378450/+files/nxsetup.tar.gz && tar xvf nxsetup.tar.gz && sudo cp nxsetup /usr/lib/nx
sudo /usr/lib/nx/nxsetup --install --setup-nomachine-key
#configure clients to use gnome session:
echo -e "\n#Use gnome-fallback for client sessions\nCOMMAND_START_GNOME='gnome-session --session=gnome-fallback'"|sudo tee -a /etc/nxserver/node.conf

nxloadconfig --check

on the client:
sudo apt-get update && sudo apt-get install qtnx

opennx client setup

Download and install client package from http://opennx.net/download.html OR nxclient 3x from:

http://www2.vrdc.cornell.edu/news/ecco/step-4-using-ecco/nx-client-3-5/

Zone Specific Changes

If you create a server using one of the images, most likely one will need to change some of the settings (e.g Time Zone, time etc). Here are some of the sysadmin commands to make the changes:

Change Time Zone

ZONEINFO=Australia/Brisbane
rm -f /etc/localtime
ln -s /usr/share/zoneinfo/$ZONEINFO /etc/localtime

smtp relay host configuration

sudo yum install postfix mailx
Edit the /etc/postfix/main.cf and add/change the myhostname and relayhost details.

 vi /etc/postfix/main.cf

myhostname = vm-130-XXX-XXX-XXX.qld.nectar.org.au
relayhost = [smtp.uq.edu.au]:25

service postfix restart  (or reload)

Test email:

echo "Test mail from postfix" | mail -s "Test Postfix" youremail@griffith.edu.au

nfs mount

yum install nfs-utils nfs-utils-lib rpcbind showmount
cd /etc/sysconfig/network-scripts
cp ifcfg-eth0 ifcfg-eth1
vi ifcfg-eth1
Change the Device to eth1

ifdown eth1
ifup eth1
service networking restart
100.255.100.50:/collection/Q0008/Q0008  /mnt/QS0008 

showmount -e  100.255.100.50

Manual Check:

mount  -t nfs -o vers=3  100.255.100.50:/collection/Q0046/Q0046 /mnt/Q0046 -v


Using Autofs:

To mount 100.255.120.200:/tier2c1/Q0008/Q0008  on /data2, do the following:

yum install autofs
create a mount point if not done (e.g: mkdir /data2)

vi /etc/auto.master
insert the following: 
/- /etc/auto.misc --timeout=600 --ghost

Create the /etc/auto.misc file
vi /etc/auto.misc
/data2 -rw,nfsvers=3,hard,intr,nosuid,nodev,timeo=15,retrans=5 100.255.120.200:/tier2c1/Q0008/Q0008

Ref:https://qriscloud.zendesk.com/hc/en-us/articles/200106199-NFS-mounting-collection-storage-in-Linux

nfs server

if you wish to nfs export a filesystem or folder to other clients, you cna do the following:

yum install nfs-utils nfs-utils-lib rpcbind showmount

Create a security Group on NECTAR dashboard and give it a name (e.g. nfs)

Add the following security Rules to this group:

TCP/UDP 111
TCP/UDP 2049
TCP/32803
UDP/32769
PORT/892
PORT/875
PORT/662
PORT/2020

Apply this security group to the nfs server

 
Configure NFS services to use fixed ports. vi /etc/sysconfig/nfs

Modify config directive as follows to set TCP/UDP unused ports:

# TCP port rpc.lockd should listen on.
LOCKD_TCPPORT=lockd-port-number
# UDP port rpc.lockd should listen on.
LOCKD_UDPPORT=lockd-port-number 
# Port rpc.mountd should listen on.
MOUNTD_PORT=mountd-port-number
# Port rquotad should listen on.
RQUOTAD_PORT=rquotad-port-number
# Port rpc.statd should listen on.
STATD_PORT=statd-port-number
# Outgoing port statd should used. The default is port is random
STATD_OUTGOING_PORT=statd-outgoing-port-numbe

Here is sample listing from one of my production NFS server:
LOCKD_TCPPORT=32803
LOCKD_UDPPORT=32769
MOUNTD_PORT=892
RQUOTAD_PORT=875
STATD_PORT=662
STATD_OUTGOING_PORT=2020

# service nfs restart
# service rpcsvcgssd restart

 
Check with:
rpcinfo -p

Export the folder/filesystem

edit /etc/exports
e.g:
/mnt/home        n002(rw) n003(rw)

Reference: http://www.cyberciti.biz/faq/centos-fedora-rhel-iptables-open-nfs-server-ports/

Disable network manager

There's a known issue with Network manager and Openstack

chkconfig --list NetworkManager
service NetworkManager stop
chkconfig NetworkManager off
echo "For each interface, ensure that the NM_CONTROLLED configuration key is set to no "
echo "NM_CONTROLLED=no"
echo "ONBOOT=yes"
vi  /etc/sysconfig/network-scripts/ifcfg-eth0
vi  /etc/sysconfig/network-scripts/ifcfg-eth1
read JUNK
chkconfig network on
read JUNK
service network start

Ref: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/3/html/Installation_and_Configuration_Guide/Disabling_Network_Manager.html

Block SSH Server Attacks (Brute Force Attacks) Using DenyHosts

yum --enablerepo=epel install denyhosts
OR
yum install denyhosts

vi /etc/hosts.allow

Add:
ALL: 132.234.

 vi /etc/denyhosts.conf

Search for the ‘ADMIN_EMAIL‘ and add your email address here to receive email alerts about suspicious logins

ADMIN_EMAIL = youremail@griffithuni.edu.au
SMTP_FROM = DenyHosts <denyhost@qcloudservername>

chkconfig denyhosts on
service denyhosts start

Check to see it in action:
tail -f /var/log/secure

For Ubuntu:

$ wget http://mirror.pnl.gov/ubuntu//pool/universe/d/denyhosts/denyhosts_2.6-10_all.deb
$ sudo dpkg -i denyhosts_2.6-10_all.deb


Slow SSH login in CentOS 6

The following solution resolved the issue...

https://www.serverpronto.com/accounts/knowledgebase.php?action=displayarticle&id=16

If SSH login is very slow in CentOS 6 it’s because they have added another security feature, the SSH server will do a reverse DNS again for any incoming connection, this will delay connection up to 13 seconds, to avoid this:
1. Access the server
2. Edit the ssh config

Nano /etc/ssh/sshd_config

Look for use dns and change it to no
Ctrl +w, usedns, enter

Change it from

#useDNS yes

to

useDNS no

Save and close
Ctrl + X, Y, enter

Restart the sshd service
Service sshd restart

Creating or Renewing Certifcates

Here are some commands to create a new certificate:

1. Create the key

openssl genrsa -out somewebsite.griffith.edu.au_2015.key 2048 (needs to be 2048 bit key or else can't sign it)

2. Create Certificate Sign Request (CSR)

openssl req -new -key somewebsite.griffith.edu.au_2015.key -out somewebsite.griffith.edu.au.csr

3. Take the contents of the csr file and copy it into an email, or alternatively attach the csr to an email to j.braine@griffith.edu.au or security@griffith.edu.au.

4. You will receive a reply after a day or so with a certificate attached to the email, download the certificate and move it to the server.

5. Edit the webserver config (apache would be ssl.conf) and change the SSLCertificateFile to point to the certificate you received and the SSLCertificateKeyFile line to the key you created.

Register a domain and register it in Griffith dns servers

You will need to register your domain by purchasing a domain name from the likes of https://www.crazydomains.com.au/ etc. When registering, can you register dns1.griffith.edu.au anddns3.griffith.edu.au as the primary DNS name servers. Then we can log a service desk case at Griffith to point the name to  the correct IP address. Here is the procedure:

Let’s say you have registered a domain called treadd.org.au

Get the IP address of the server hosting this website. Let’s say it is:  103.131.227.107

Then go to the service desktop tool: https://griffith.service-now.com/

Log in. Go to "service request" ==> “Create new” ==> Fill in the following:

Requester : yourself
Affected end user: yourself
ITL Process: Request
Category:  Network (Plain network would do)
Summary: Point treadd.org.au to IP  103.131.227.107 in the dns servers
Description: (Give a description of the problem. see below for example):
We would like to use Griffith DNS servers as the primary dns servers for domain  treadd.org.au. Can you please point treadd.org.au to IP 203.101.227.155. Thanks


Save and Exit

That's it. 

Reference:

1. https://qriscloud.zendesk.com/hc/en-us/articles/200106199-NFS-mounting-collection-storage-in-Linux

Related content

QRISCloud Virtual Machine Configuration
QRISCloud Virtual Machine Configuration
More like this
QRIScloud-Queensland Server Additional Configuration
QRIScloud-Queensland Server Additional Configuration
More like this
Using VPN Client on QRIScloud to Access Institutional Resources
Using VPN Client on QRIScloud to Access Institutional Resources
More like this
Request a Server on QRIScloud
Request a Server on QRIScloud
More like this
Serving Web pages from QRISCloud Servers
Serving Web pages from QRISCloud Servers
More like this
multihop scp and ssh for QRIScloud servers
multihop scp and ssh for QRIScloud servers
More like this