Overview

Description

• Status: online

• xen domU [PV] on ofc
• 2 CPUs, 2048 MB RAM
• eth1 - 134.96.186.68 (HWaddr 00:16:3e:5c:ed:2e)
• eth1:1 - 134.96.186.71
• ssh host key fingerprint:

  Host key fingerprint is a6:bf:63:85:84:1c:c1:69:67:ff:9e:24:61:bd:db:d8
  +--[ RSA 2048]----+
  |     ..o         |
  |      = o        |
  |     o = . .     |
  |      o . + .    |
  |       .So o .   |
  |       o. o +    |
  |      .  . + *   |
  |       .o   = E  |
  |       .oo       |
  +-----------------+

• ...

Services

• inetd
• atd
• cron

• NetWorker (nsrexecd)

• Munin
• Bind (named)
• LDAP (slapd)
• sshd
• MySQL
• PostgreSQL
• SASL (depends on LDAP)
• Cyrus IMAP (depends on SASL)
• Exim (depends on LDAP)

• SpamAssassin (spamd)

• nscd
• Apache2 (depends on LDAP)
  • phpMyAdmin
  • phpLDAPadmin

  • SquirrelMail

  • phpBB
  • bugzilla
  • webalizer
• GOsa (depends on Apache, LDAP)
• mailman (depends on Exim, Apache)
• CUPS
• netatalk (atalkd, afpd; depends on LDAP, CUPS)
• Samba (nmbd, smbd; depends on LDAP, CUPS)
• rkhunter (launched by cron)
• logcheck (launched by cron)
• svn
• git
• etckeeper (depends on git)
• cron-apt (launched by cron)

Links

Webalizer statistics https://www.ps.uni-saarland.de/Internal/statistics/

Authentication System

James authenticates users against the LDAP database running on hyperion. The authentication is done through the PAM library (see /etc/pam_ldap.conf). The other PAM configurations are set up to allow authentication using LDAP (for normal users) and local users (i.e root). In order to reduce latencies all LDAP query results are cached by the nscd (name service caching daemon). It is strongly recommended to disable nscd while working on the PAM system as the caching makes proper testing impossible.

Upgrade auf Debian 7 (wheezy)

Crucial Services and Upgrade guides.

• GoSA 2.7: https://oss.gonicus.de/labs/gosa/blog/gosa274 No upgrade guide available! I have seen problems with shema updates

• MySQL 5.5: http://dev.mysql.com/doc/refman/5.5/en/upgrading-from-previous-series.html Backup erstellen, mysql_update nach dem upgrade der Pakete nicht vergessen

• Cyrus 2.4.16: http://cyrusimap.web.cmu.edu/docs/cyrus-imapd/2.4.16/install-upgrade.php Change to storage format requires complete rebuild of all messages

ToDo

• Package avelsieve is broken (missing) in wheezy / installed jessie version -> properly set up testing/backports in sources list/apt_preferences

• N O T E: Is anything here still valid?
• [IMPORTANT] check and delete duplicated group entries in ldap via phpldapadmin

• [IMPORTANT] backup postgresql databases (see [http://www.postgresql.org/docs/8.3/interactive/backup.html here])

• check why gosa doesn't set file quota when creating new user
• remove unneeded packages
• purge previously removed packages
• check orphaned files in /opt and /srv (see /root/find_orphaned_files)
• backup and remove /home/boutter

• rewrite /root/bin/delete-account (fix bugs, automate the whole remove process, adjust hints in ["UserManagement"])

HOWTOs

How to change ldap passwd

• change password in https://www.ps.uni-saarland.de/phpldapadmin/ (type the password in cleartext in the password field and choose the algorithm)

• enter the password in the following skripts and configs:

  • /etc/gosa/gosa.conf - enables GoSA to modify account data

  • /root/scripts/connect.php - used e.g. by the policy script

  • /etc/ldappass - used by the ldap backup script

  • /etc/ldap.secret - used by ldap_pam. Note that this is probably superfluous, but I try to avoid touching PAM unless absolutely necessary

• change the samba password for ldap

  # /usr/bin/smbpasswd -W