Difference between revisions of "Jalapeno"
From Nuclear Physics Group Documentation Pages
Jump to navigationJump to search| Line 45: | Line 45: | ||
# Allow only administrators | # Allow only administrators | ||
- : ALL EXCEPT domain_admins : ALL | - : ALL EXCEPT domain_admins : ALL | ||
| + | </pre> | ||
| + | == Backup Configuration == | ||
| + | === /etc/rsync-backup.conf === | ||
| + | <pre># Backups are 'pull' only. Too bad there isn't a better way to enforce this. | ||
| + | read only = yes | ||
| + | |||
| + | # Oh for the ability to retain CAP_DAC_READ_SEARCH, and no other. | ||
| + | #uid = root | ||
| + | # XXX There seems to be an obscure bug with pam_ldap and rsync whereby | ||
| + | # getpwnam(3) segfaults when (and only when) archiving /etc. Using a numeric | ||
| + | # uid avoids this bug. Only verified on Fedora Core 2. | ||
| + | uid = 0 | ||
| + | |||
| + | # There's not much point in putting the superuser in a chroot jail | ||
| + | # use chroot = yes | ||
| + | |||
| + | # This isn't really an effective "lock" per se, since the value is per-module, | ||
| + | # but there really ought never be more than one, and it would at least | ||
| + | # ensure serialized backups. | ||
| + | max connections = 1 | ||
| + | |||
| + | [usr_local] | ||
| + | path = /usr/local | ||
| + | comment = unpackaged software | ||
| + | |||
| + | [opt] | ||
| + | path = /opt | ||
| + | comment = unpackaged software | ||
| + | |||
| + | [etc] | ||
| + | path = /etc | ||
| + | comment = conf files | ||
| + | |||
| + | [var] | ||
| + | path = /var | ||
| + | comment = user and system storage | ||
</pre> | </pre> | ||
Revision as of 15:35, 18 July 2007
General Information
Jalapeno does something. Currently has a 3ware raid controller, although 3dm monitoring software is not present.
Hostnames: jalapeno.unh.edu, jalapeno.farm.physics.unh.edu
Jalapeno is our Splunk server.
Network Configuration
Currently has ethernet cable to switch, accessing outside world via the VLAN functions of the switch.
/etc/sysconfig/network-scripts/ifcfg-eth0.2
VLAN=yes DEVICE=eth0.2 BOOTPROTO=static HWADDR=00:04:23:A7:55:3C IPADDR=132.177.88.37 NETMASK=255.255.252.0 REORDER_HDR=no ONBOOT=yes TYPE=Ethernet
/etc/sysconfig/network-scripts/ifcfg-farm
DEVICE=eth0 BOOTPROTO=none HWADDR=00:04:23:a7:55:3c IPADDR=10.0.0.253 NETMASK=255.255.252.0 ONBOOT=yes TYPE=Ethernet
/etc/sysconfig/network-scripts/ifcfg-lo
DEVICE=lo IPADDR=127.0.0.1 NETMASK=255.0.0.0 NETWORK=127.0.0.0 # If you're having problems with gated making 127.0.0.0/8 a martian, # you can change this to something else (255.255.255.255, for example) BROADCAST=127.255.255.255 ONBOOT=yes NAME=loopback
Access Configuration
/etc/security/access.conf
# NPG Config: # Allow direct root logins only from console and einstein + : root : LOCAL einstein.unh.edu einstein.farm.physics.unh.edu lentil.unh.edu lentil.farm.physics.unh.edu # Allow only administrators - : ALL EXCEPT domain_admins : ALL
Backup Configuration
/etc/rsync-backup.conf
# Backups are 'pull' only. Too bad there isn't a better way to enforce this.
read only = yes
# Oh for the ability to retain CAP_DAC_READ_SEARCH, and no other.
#uid = root
# XXX There seems to be an obscure bug with pam_ldap and rsync whereby
# getpwnam(3) segfaults when (and only when) archiving /etc. Using a numeric
# uid avoids this bug. Only verified on Fedora Core 2.
uid = 0
# There's not much point in putting the superuser in a chroot jail
# use chroot = yes
# This isn't really an effective "lock" per se, since the value is per-module,
# but there really ought never be more than one, and it would at least
# ensure serialized backups.
max connections = 1
[usr_local]
path = /usr/local
comment = unpackaged software
[opt]
path = /opt
comment = unpackaged software
[etc]
path = /etc
comment = conf files
[var]
path = /var
comment = user and system storage
