diff --git a/index.md b/index.md index f00c433..b3d37c4 100644 --- a/index.md +++ b/index.md @@ -48,20 +48,37 @@ This email list is administered by Outlook in the following way (if you have man ![outlook_04.png](outlook_04.png) -## Meetings +## Linux Meetings ### Weekly Sync Meeting -Tuesdays 15:00-15:30 +__Time:__ Tuesdays 14:30-15:00 +__Chair:__ Konrad +__Location:__ Zoom +__Purpose:__ Discuss general Linux topics +__Participants__: Usually the people on the linux@psi.ch mailing list -- 5 Minutes News/Announcements -- Discussions -Chair: xxx +### Merge Meeting +__Time:__ Tuesdays 15:00-15:30 - directly following the Sync Meeting +__Chair:__ Konrad +__Location:__ Zoom +__Purpose:__ Review new changes in the Puppet code +__Participants__: Usually some of the people on the linux@psi.ch mailing list -### Merge Meeting -Chair: xxx +### Linux Core Group "Meeting" / Standup Meeting +__Time:__ Monday to Thursday 08:45 - 09:00 +__Chair:__ Simon +__Location:__ Zoom +__Purpose:__ Coordination work within the Linux core group +__Participants:__ Member of Linux Core group + + +### Supporter Meeting(s) +__Time:__ Tuesday, Friday +__Chair:__ Silvio +__Location:__ Zoom +__Purpose:__ Coordination within the PC Supporters (more details contact Silvio) +__Participants:__ PC Supporters -### Standup Meeting -Chair: xxx diff --git a/infrastructure-guide/overview_linux.drawio.svg b/infrastructure-guide/overview_linux.drawio.svg index 4b5885a..acb8d0a 100644 --- a/infrastructure-guide/overview_linux.drawio.svg +++ b/infrastructure-guide/overview_linux.drawio.svg @@ -1,369 +1,55 @@ - + - - - - - - - + + + - -
-
-
- boot00.psi.ch -
-
-
- - - boot00.psi.... - - - - - - - - - - - - -
-
-
-

- - /afs/psi.ch/service/linux/ - -

-
-
-
- - - /afs/ps... - - - - - - - - - Virtual Machines - - - - - - - - - - - - - - - - - - - -
-
-
- vcenter.psi.ch -
-
-
- - - vcenter.psi.ch - - - - - - - - - Network - - - - - - - - - - - - - - - - - - - -
-
-
- qip.psi.ch/qip/ -
-
-
- - - qip.psi.ch/qi... - - - - - - - - - - - - -
-
-
- pxeserv01.psi.ch -
- - - 129.129.190.59 - - -
-
- -
- -
-
- - Services: - -
- - TFTP server -
-
-
- - - pxeserv01.p... - - - - - - - - - - -
-
-
-

- - /afs/psi.ch/service/linux/tftpboot/ - -
-

-

- - /afs/psi.ch/service/linux/tftpboot - - /pxelinux.cfg (pxe config) -
-

-
-
-
- - - /afs/ps... - - - - - - - - - - -
-
-
-

- /tftpboot -

-
-
-
- - - /tftpbo... - - - - - - - - -
-
-
+ +
+
+
tftp udp:69
- + tftp udp:69 - - + + - -
-
-
+ +
+
+
cron / rsync (every minute)
- + cron / rsy... - - - - - - + + + + + - -
-
-
- repo00.psi.ch -
- - - 129.129.160.212 - - -
-
- -
- -
-
- - Services: - -
- - http server -
-
-
- - - repo00.psi.... - - - - - - - - - - -
-
-
-

- /var/www/html -

-
-
-
- - - /var/ww... - - - - - - - - -
-
-
- iso sync -
-
-
- - - iso sync - - - - - - - - -
-
-
- repo sync -
- sources defined in -
- /opt/pli/etc/yum.conf -
-
-
- - - repo sync... - - - - - - -
-
-
+ +
+
+
+ iso sync: https://id-sat-prd.ethz.ch/pub/isos/ @@ -371,19 +57,19 @@
- - https://id-sat-prd.ethz.ch/pub/is... + + iso sync: https://id-sat-prd.ethz.ch/pub/... - - + + - -
-
-
+ +
+
+
http tcp:80
https tcp:443 @@ -391,23 +77,721 @@
- + http tcp:8... - - - - - - + + + + - -
-
-
+ +
+
+
+ http tcp:80 +
+ https tcp:443 +
+
+
+ + + http tcp:8... + + + + + + + + +
+
+
+ tcp:5666 +
+
+
+ + + tcp:5666 + + + + + + + + +
+
+
+ http tcp:80 +
+ (redirect to https) +
+ https tcp:443 +
+
+
+ + + http tcp:8... + + + + + + + + + + + + + + + + +
+
+
+ network infra structure servers +
+ (network team) +
+
+
+ + + network infra structure servers... + + + + + + + + + + + +
+
+
+ special systems (e.g. ppc) +
+
+
+ + + special systems (e.g. ppc) + + + + + + + + + +
+
+
+ subscribed via subscription manager +
+
+
+ + + subscribed via subscription... + + + + + + + +
+
+
+ boot00.psi.ch +
+
+
+
+
+ + + boot00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+ + sysdb + + +
+ +
+
+ + - serves grub config + +
+ - generates kickstart files +
+
+
+ + + Services:... + + + + + + + +
+
+
+ id-sat-prd.ethz.ch +
+ (located at and operated by ETHZ) +
+
+
+ + + id-sat-prd.ethz.ch... + + + + + + + + +
+
+
+ internet repositories +
+
+
+ + + internet repositories + + + + + + + +
+
+
+ + repo sync + +
+ + sources defined in + +
+ + /opt/pli/etc/yum.conf + +
+
+
+ + + repo sync... + + + + + + + + +
+
+
+ + repo sync + + + sources defined in + + + /etc/yum.repos.d/rhel.repo + +
+
+
+ + + repo sync  sources defined in /etc/yum.repos.d/r... + + + + + + + + +
+
+
+
+ + Services: + +
+ + TFTP server + + +
+ +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+ + pxeserv01.psi.ch + +
+ + + 129.129.190.59 + + +
+
+
+ + + pxeserv01.psi.ch... + + + + + + + +
+
+
+ + /tftpboot + +
+
+
+ + + /tftpboot + + + + + + + +
+
+
+

+ + /afs/psi.ch/service/linux/tftpboot/ + +
+

+

+ + /afs/psi.ch/service/linux/tftpboot + + /pxelinux.cfg +

+
+
+
+ + + /afs/psi.c... + + + + + + + +
+
+
+

+ + + /afs/psi.ch/service/linux/ + + +
+

+
+
+
+ + + /afs/psi.c... + + + + + + + + + +
+
+
+
+ + repo01.psi.ch + +
+
+
+
+ + + repo01.psi.ch + + + + + + +
+
+
+
+ + Services: + +
+
+ + http server + +
+
+ + - RHEL8 repos + +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+ + /var/www/html + +
+
+
+ + + /var/www/h... + + + + + + + +
+
+
+
+ + repo00.psi.ch + +
+
+ + 129.129.160.212 + +
+
+
+
+ + + repo00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+
+ + http server + +
+
+ + - RHEL7 repos + +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+ + /var/www/html + +
+
+
+ + + /var/www/h... + + + + + + + + +
+
+
+ http tcp:80 +
+ https tcp:443 +
+
+
+ + + http tcp:8... + + + + + + + +
+
+
+
+ metric00.psi.ch +
+
+ metric.psi.ch +
+
+ 129.129.190.226 +
+
+
+
+ + + metric00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+
+ + http server + +
+
+ + - grafana + +
+
+
+
+
+
+
+ + + Services:... + + + + + + + + + +
+
+
+
+ influx00.psi.ch +
+
+ 129.129.190.225 +
+
+
+
+ + + influx00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+
+ influxd +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+

+ Local storage for data +

+

+ /var/lib/influxdb +

+
+
+
+ + + Local storage for dat... + + + + + + + +
+
+

/dist "/afs/psi.ch/project/linux/www/dist"

@@ -448,277 +832,183 @@
- - /dist "... + + /dist "/afs/psi.ch/project/linux/www/dist"... - - - - - - - - - - - - - - - - - - - - + - -
-
-
-
+ +
+
+
+
lxweb00.psi.ch
-
- - - 129.129.190.46 - - - -
- +
+ linux.web.psi.ch
-
- - -
- - +
+ 129.129.190.46
-
- - http://linux.web.psi.ch - -
-
- -
- -
-
+
+
+
+ + + lxweb00.psi.ch... + + + + + + +
+
+
+
Services:
- -
- - - http server - -
- -
-
-
- - - lxweb00.psi.... - - - - - - - - -
-
-
- http tcp:80 -
- https tcp:443 -
-
-
- - - http tcp:8... - - - - - - - - - - - - -
-
-
-
+
- influx00.psi.ch + http server
- -
- - - 129.129.190.225 - - -
- -
-
-
-
+
+
+
+ + + Services:... + + + + + + + + +
+
+
+ boot00-test.psi.ch +
+
+
+
+ + + boot00-test.psi.ch + + + + + + + + + +
+
+
+ puppet01.psi.ch +
+
+
+ + + puppet01.psi.ch + + + + + + + +
+
+
+ puppet00-test.psi.ch +
+
+
+ + + puppet00-test.psi.ch + + + + + + +
+
+
+
Services:
-
- - - influxd - +
+ puppet
- - influx00.ps... + + Services:... - - + + + + + + - -
-
-
- tcp:5666 -
-
-
- - - tcp:5666 - - - - - - - - - - -
-
-
-

- Local storage for data -

-

- /var/lib/influxdb -
-

-
-
-
- - - Local s... - - - - - - - - - - - - -
-
-
-
- - metric00.psi.ch - -
- -
- - 129.129.190.226 - -
-
- -
-
-
-
- metrics.psi.ch -
-
-
-
-
- - Services: - -
-
- - - graphana - -
-
-
-
- - - metric00.ps... - - - - - - - - -
-
-
- http tcp:80 + +
+
+
+ https/443
- (redirect to https) -
- https tcp:443 + 8140
- - http tcp:8... + + https/443... + + + + + + + + +
+
+
+ https/443 +
+ 8140 +
+
+
+ + + https/443... - - diff --git a/proposals/draft_infrastructure_security_concept.drawio.svg b/proposals/draft_infrastructure_security_concept.drawio.svg index 4051f65..11b00ea 100644 --- a/proposals/draft_infrastructure_security_concept.drawio.svg +++ b/proposals/draft_infrastructure_security_concept.drawio.svg @@ -1,14 +1,16 @@ - + - + + + - - + + -
+
https/443 @@ -18,7 +20,7 @@
- + https/443... @@ -80,12 +82,12 @@ - - + + -
+
https/443 @@ -93,7 +95,7 @@
- + https/443 @@ -117,12 +119,12 @@ - - + + -
+
tftp @@ -134,7 +136,7 @@
- + tftp... @@ -144,7 +146,7 @@ -
+
443 @@ -177,7 +179,7 @@ - + @@ -199,7 +201,7 @@ - + @@ -220,7 +222,7 @@ - + @@ -259,12 +261,12 @@ - + -
+
5665 @@ -272,7 +274,7 @@
- + 5665 @@ -294,12 +296,12 @@ - - + + -
+
???? @@ -307,7 +309,7 @@
- + ???? @@ -329,12 +331,12 @@ - - + + -
+
@@ -356,30 +358,11 @@
- + nrpe... - - - - -
-
-
- agent(s) -
-
-
- - - agent(s) - - - - - @@ -421,7 +404,7 @@ -
+
https @@ -429,7 +412,7 @@
- + https @@ -486,132 +469,42 @@ - + -
-
+
+
- any supported system in +
+ + + All Networks + + +
- ANY + [Security Level 3] - zone !!!!
- - any supported system in... + + All Networks[Security L... - + - + + + -
-
-
- security level -
-
-
- - - security l... - - - - - - - - - -
-
-
- https/443 -
- 8140 -
-
-
- - - https/443... - - - - - - - - -
-
-
- 5665 -
-
-
- - - 5665 - - - - - - - - - - -
-
-
- https/443 -
-
-
- - - https/443 - - - - - - - - - -
-
-
- (specific) managed Linux machines -
-
-
- - - (specific) managed Linux machines - - - - - - - - - -
+
Icinga Satellite @@ -621,43 +514,20 @@
- + Icinga Satellite... - + -
-
-
- - DMZ - -
- - DMZ responsible ? -
- - Periodic reviews -
-
-
- - - DMZ... - - - - - - - -
+
- - Systems are installed in the DMZ + - Systems are installed in the DMZ?
@@ -673,23 +543,26 @@
+ - DMZ responsible? +
+ - Periodic reviews?
- - - Systems are installed in the DMZ... + + - Systems are installed in the DMZ?... - + -
+
5665 @@ -697,16 +570,16 @@
- + 5665 - + -
+
Icinga Satellites @@ -714,51 +587,16 @@
- + Icinga Satellites - - + -
-
-
- 5665 -
-
-
- - - 5665 - - - - - - - -
-
-
- agent(s)/beat(s) -
-
-
- - - agent(s)/b... - - - - - - - -
+
logstash @@ -766,17 +604,17 @@
- + logstash - + -
+
???? @@ -784,17 +622,17 @@
- + ???? - - + + -
+
@@ -816,11 +654,233 @@
- + nrpe... + + + + + +
+
+
+ + nrpe + +
+ + ns-client++ + +
+ + snmp + +
+ + other ports + +
+
+
+ + + nrpe... + + + + + + + + +
+
+
+ + DataCenter Network +
+ [Security level 3] + +
+
+
+ + SSH access only through dedicated SSH gateways. + +
+
+
+
+ + + DataCenter Network... + + + + + + + +
+
+
+
+ + + All Networks + + +
+ + [Security Level 4-5] + +
+
+
+ + + All Networks[Security L... + + + + + + + + + + + + + +
+
+
+ agents +
+
+
+ + + agents + + + + + + + +
+
+
+ beats +
+
+
+ + + beats + + + + + + + +
+
+
+ beats +
+
+
+ + + beats + + + + + + + + +
+
+
+ ???? +
+
+
+ + + ???? + + + + + + + + +
+
+
+ 5665 +
+
+
+ + + 5665 + + + + + + + +
+
+
+
+ + DMZ + +
+ + [Security Level 2] + +
+
+
+ + + DMZ[Security Level 2] + + + + + + + + +
+
+
+ 5665 +
+
+
+ + + 5665 + + +