August 2002 - admins-discuss@lists.redbrick.dcu.ie

[Admin-discuss] Enigma + Array = Frustration
by Cillian Sharkey 04 Sep '02

04 Sep '02

Last evening John Bolger and myself got the 6 disk (RAID5) array setup (using his spare disk) in CTYI. His disk was a couple of meg smaller than the others so we've lost a few meg in storage but hey, it's nothing to worry about. So we took his disk out and verified that the array still worked (in degraded mode). We then moved the controller into enigma and hooked up the array, but it refused to see the disks! So we took out all the other cards until we had just the RAID card and the video (PCI) card left. Again, no joy. It was getting late at this stage so we put everything back together. The controller is still in enigma so bootup is slower now while it times out looking for the array (currently powered down). Once ("if", hah!) we get the damn thing to work in enigma, we can parition and mount the array on the current enigma and work on it remotely to build the new install. We can do a make installworld onto the new array (set DESTDIR), chroot into it to install stuff safely (or even set it up as a jail if we wanted to run/test network stuff in it on the default ports). When it's ready to go online, we put in the system disk (everything we need should be copied off it by then), let the array rebuild and finish off the setup etc. On a more positive note: Enigma has it's front cover back! So things are (slowly) starting to shape up.. -- Cillian

3 3

[Admin-discuss] UPS
by Cillian Sharkey 27 Aug '02

27 Aug '02

Colm pointed out that we might be better off scrapping the UPS and buying a smaller one, e.g. an APC SmartUPS (like the one we had before). Why? 1. Cost is the main factor, the money saved on testing the UPS, room wiring, installing the UPS, etc. could easily buy us a smaller, easier to use and maintain UPS and cut down on costs for the room. As you may know, the plans for the redbrick room are to include a seperate circuit for the UPS. I'm not sure exactly how much this part of the wiring costs, but the total cost of wiring the room from the last quote I have seen was about ¤4500. In addition to this, we'd need to hire an electrician to wire up the whole thing (unless we've someone here who's able to do it..) 2. We don't know if the UPS works (as far as I know it was in working order for the previous owners) and it's not easy to test (needs to be wired up, seperate circuit/generator needed for testing, read: costs money). It's also been in the clubs & socs area for over a year now. According to the manual, the UPS is supposed to be plugged in every X months when the unit is not in use. I don't know if not doing this for more than a year has affected it or not. 3. The dead rodent is still in the back of the control unit :-) So I'm just looking for opinions on whether we should go with the UPS (i.e. work out how to test it first) or scrap it. Unfortunately, it may even cost money to scrap it (we're talking 40 car size batteries here..), unless we can sell them off? Thoughts & ideas welcome.. -- Cillian

5 6

[Admin-discuss] Ye Holy Grail of WebMail and other things mail
by Colm MacCárthaigh 27 Aug '02

27 Aug '02

The following proposal is one which would see enigma become the mailhost, aswell as the home for mailman. It would have it's own webserver, serving mailman and webmail, over https. It's in outline only, though I do have exact sample configs for most of it. Since enigma would be doing a lot of MX lookups, having a local name resolver would be nice, so I suggest keeping it as the NS host for our domains and having a full blown nameserver. Outline of RedBrick MTA proposal ------------------------------------------- Objectives: to use disk space on enigma and to provide cool extra services. webmail as standard mutt/pine/othershitclients still working on prodigy common authentication system ability to read and send mail securely and easy from non-redbrick hosts. --------------------------------------------- Delivery: primary MX is enigma, running exim (preferably 4) 1. check /etc/aliases 2. check if mail is for mailman (generic ruleset to cover all lists) 3. check local user status 4. filter mail through spamassassin (using spamc/spamd) 5. check ~/.forward+suffix 6. check ~/.forward 7. check ~/.procmailrc (/etc/procmailrc will set MAILFOLDER to ~/Maildir) 8. deliver to ~/Maildir/ (maildir) all new users will have a .forward file which forwards their mail to their DCU address by default, aswell as wrapping it with a nice footer saying where it came from. A nice handy way of removing this file will be aliased (ssh enigma rm -f .forward). This is exiting policy for next year anyway. (at least, last I heard it is :) --------------------------------------------- Reading Mail: courier imapd imap configs on prodigy for pine,mutt et al (borrow from camac ;) /etc/Muttrc on enigma with : set mbox_type=maildir set folder=$HOME/Maildir set spoolfile=$HOME/Maildir in it for reading mail during any prodigy downtime, similar configs for other clients. courier popd squirell webmail primary clients should be mutt and pine using imap on prodigy. ---------------------------------------------- Authentication: all auth should use common passwords, preferably LDAP running on prodigy and enigma (distributed ldap using slurpd for redudancy during downtime). SMTP relay should ident from our subnets and use TLS/SSL authenticated aSMTP for external relays (the port is open), or use whoson to provide pop-before-smtp. SSL POP and SSL imap as standard. ----------------------------------------------- Disadvantages: enigma going down means no mail. Enigma is mostly new hardware and reliable, but no UPS. requires uid's for all the usernames on enigma. some extra admining (things like monitoring quotas on enigma). need come up with some way of keeping shell access to enigma (needed for editing .forwards, .procmailrc ) but discourage it's use for heying, reading news .. etc, since having a designated shell system is desirable. (suggestion: don't install much ;) needs a good backup/recovery system, and it's actual use ;) people might store their passwords in plaintext config files to handle IMAP auth between prodigy and enigma. Hopefully people who know how to edit config files would just use enigma in the first place, or know about permissions. From user feedback, it's highly likely the vast majority of users would fully migrate to webmail. webmail may mean less shell logins. Hard to say how much. Also hard to say if that's really that bad a thing, or big a deal. Bottom line, people want webmail either way. ----------------------------------------------- Rational: use of exim because at least some admins prefer it to postfix. It supports ident by default, with no patching, and it's more powerful .forward files offer an imporved feature set for end users. That said, staying with postfix is no big deal, but ident would be real nice. Use of courier because it works well and because squirrel is better than somethign like IMP (imo). spamassassin by default, because we can, and because it would be of benefit to users. LDAP because it can be distributed between the hosts easily, and becasue we can easily tie it in to other systems later. Yes it's more complicated than /etc/shadow, but since RedBrick managed to break even /etc/shadow (Ref: Feb 2001), there's really no argument for keeping thigns simple ;) ------------------------------------------------ Optional extras: set an MX record for prodigy aswell, and have it deliver to plain spools (aswell as queue), at least incoming mail can be read , even if they are duplicates pop-before-smtp using whoson. Authenticated SMTP probably better. add a rule to the /etc/procmailrc to filter spamassassin tagged mail into .spam/ (since MAILFOLDER is ~/Maildir that will end up being ~/maildir/.spam). POP users would never see this mail, but imap users would, just in a different folder. /etc/Muttc should add an "=spam" mailbox for local users. using the mailman-ldap extensions written by Donal Hunt, we can have mailman authenticate off of the LDAP directories. Authenticating redbrick users for their personal subscritions aswell as list admins for society/club lists etc. availing ,through CSD, of the free RBL service from HEAnet. mail virus scanning using amavis, or something. If webmail/external imap get used a lot, might be a good service to offer members. a mail2news gateway. Since enigma is a likely to remain the news host, we could offer a mailinglist -> news server gateway for popular mailing lists. Skynet do this very successfully, and it's a good way of encourageing interest in computing related things. (very optional extra) Use Debian as the base OS. Even though FreeBSD is a lot better (than linux), RedBrick admins are traditionally lazy (even to do a portsupgrade) , so something that people can do "apt-get dist-upgrade" on could make us sleep a bit easier. All of the above is doable with standard Debian apt-able packages. Also means things like LDAP are a pisstake. -- colmmacc(a)redbrick.dcu.ie PubKey: colmmacc+pgp(a)redbrick.dcu.ie Web: http://devnull.redbrick.dcu.ie/

6 13

[Admin-discuss] Enigma ports/packages
by Cillian Sharkey 25 Aug '02

25 Aug '02

For the new install, I think it would be a good idea to install ports into say /usr/pkg and not the default of /usr/local. Why? Locally compiled stuff ends up in /usr/local by default and it's better not to have ports and local mixed. This requires all packages to be installed from ports because binary packages would be compiled for /usr/local and I don't think they could be relocated. The alternative would be to make packages for all locally compiled software or use some other system for installing. Thoughts? -- Cillian

5 5

[Admin-discuss] Enigma array testing
by Cillian Sharkey 17 Aug '02

17 Aug '02

Mark and myself will be testing the array this Saturday using CTYI machine. I'd say we'll probably be there all day (in the c&s area). So if anyone else wishes to help out or hang about and be annoying, feel free to drop in. Note: this is only testing the array on its own, we won't be working on enigma. -- Cillian

1 1

[Admin-discuss] RedBrick Hardware Inventory
by Cillian Sharkey 05 Aug '02

05 Aug '02

The current description of our machines on the website doesn't do the machines justice I feel and we've always been in need of a decent inventory of our hardware.. so I've started such a thing here: http://www.redbrick.dcu.ie/~cns/rb_hw_inventory.html Now it's far from complete, so I'd welcome additions or corrections! Eventually, there'll be photos for all the main gear and it'll go up on the main site.. -- Cillian

3 2