From 4891aacd5ff073c64e34b8750e5c0e3235ff9bba Mon Sep 17 00:00:00 2001 From: ebner Date: Wed, 23 Nov 2022 16:25:03 +0100 Subject: [PATCH 1/8] update overview picture --- .../overview_linux.drawio.svg | 1396 ++++++++++------- 1 file changed, 789 insertions(+), 607 deletions(-) diff --git a/infrastructure-guide/overview_linux.drawio.svg b/infrastructure-guide/overview_linux.drawio.svg index 4b5885a..80d9201 100644 --- a/infrastructure-guide/overview_linux.drawio.svg +++ b/infrastructure-guide/overview_linux.drawio.svg @@ -1,369 +1,55 @@ - + - - - - - - - + + + - -
-
-
- boot00.psi.ch -
-
-
- - - boot00.psi.... - - - - - - - - - - - - -
-
-
-

- - /afs/psi.ch/service/linux/ - -

-
-
-
- - - /afs/ps... - - - - - - - - - Virtual Machines - - - - - - - - - - - - - - - - - - - -
-
-
- vcenter.psi.ch -
-
-
- - - vcenter.psi.ch - - - - - - - - - Network - - - - - - - - - - - - - - - - - - - -
-
-
- qip.psi.ch/qip/ -
-
-
- - - qip.psi.ch/qi... - - - - - - - - - - - - -
-
-
- pxeserv01.psi.ch -
- - - 129.129.190.59 - - -
-
- -
- -
-
- - Services: - -
- - TFTP server -
-
-
- - - pxeserv01.p... - - - - - - - - - - -
-
-
-

- - /afs/psi.ch/service/linux/tftpboot/ - -
-

-

- - /afs/psi.ch/service/linux/tftpboot - - /pxelinux.cfg (pxe config) -
-

-
-
-
- - - /afs/ps... - - - - - - - - - - -
-
-
-

- /tftpboot -

-
-
-
- - - /tftpbo... - - - - - - - - -
-
-
+ +
+
+
tftp udp:69
- + tftp udp:69 - - + + - -
-
-
+ +
+
+
cron / rsync (every minute)
- + cron / rsy... - - - - - - + + + + + - -
-
-
- repo00.psi.ch -
- - - 129.129.160.212 - - -
-
- -
- -
-
- - Services: - -
- - http server -
-
-
- - - repo00.psi.... - - - - - - - - - - -
-
-
-

- /var/www/html -

-
-
-
- - - /var/ww... - - - - - - - - -
-
-
- iso sync -
-
-
- - - iso sync - - - - - - - - -
-
-
- repo sync -
- sources defined in -
- /opt/pli/etc/yum.conf -
-
-
- - - repo sync... - - - - - - -
-
-
+ +
+
+
+ iso sync: https://id-sat-prd.ethz.ch/pub/isos/ @@ -371,19 +57,19 @@
- - https://id-sat-prd.ethz.ch/pub/is... + + iso sync: https://id-sat-prd.ethz.ch/pub/... - - + + - -
-
-
+ +
+
+
http tcp:80
https tcp:443 @@ -391,23 +77,734 @@
- + http tcp:8... - - - - - - + + + + - -
-
-
+ +
+
+
+ http tcp:80 +
+ https tcp:443 +
+
+
+ + + http tcp:8... + + + + + + + + +
+
+
+ tcp:5666 +
+
+
+ + + tcp:5666 + + + + + + + + +
+
+
+ http tcp:80 +
+ (redirect to https) +
+ https tcp:443 +
+
+
+ + + http tcp:8... + + + + + + + + + + + + + + + + +
+
+
+ network infra structure servers +
+ (network team) +
+
+
+ + + network infra structure servers... + + + + + + + + + + + +
+
+
+ special systems (e.g. ppc) +
+
+
+ + + special systems (e.g. ppc) + + + + + + + + + +
+
+
+ subscribed via subscription manager +
+
+
+ + + subscribed via subscription... + + + + + + + +
+
+
+ boot00.psi.ch +
+
+
+
+
+ + + boot00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+ + sysdb + + +
+ +
+
+ + - serves grub config + +
+ - generates kickstart files +
+
+
+ + + Services:... + + + + + + + +
+
+
+ located at and operatoed by ETH +
+
+
+ + + located at and operatoe... + + + + + + + + +
+
+
+ id-sat-prd.ethz.ch +
+
+
+ + + id-sat-prd.ethz.ch + + + + + + + +
+
+
+ internet repositories +
+
+
+ + + internet repositories + + + + + + + +
+
+
+ + repo sync + +
+ + sources defined in + +
+ + /opt/pli/etc/yum.conf + +
+
+
+ + + repo sync... + + + + + + + + +
+
+
+ + repo sync + + + sources defined in + + + /etc/yum.repos.d/rhel.repo + +
+
+
+ + + repo sync  sources defined in /etc/yum.repos.d/r... + + + + + + + + +
+
+
+
+ + Services: + +
+ + TFTP server + + +
+ +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+ + pxeserv01.psi.ch + +
+ + + 129.129.190.59 + + +
+
+
+ + + pxeserv01.psi.ch... + + + + + + + +
+
+
+ + /tftpboot + +
+
+
+ + + /tftpboot + + + + + + + +
+
+
+

+ + /afs/psi.ch/service/linux/tftpboot/ + +
+

+

+ + /afs/psi.ch/service/linux/tftpboot + + /pxelinux.cfg +

+
+
+
+ + + /afs/psi.c... + + + + + + + +
+
+
+

+ + + /afs/psi.ch/service/linux/ + + +
+

+
+
+
+ + + /afs/psi.c... + + + + + + + +
+
+
+
+ + repo01.psi.ch + +
+
+
+
+ + + repo01.psi.ch + + + + + + +
+
+
+
+ + Services: + +
+
+ + http server + +
+
+ + - RHEL8 repos + +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+ + /var/www/html + +
+
+
+ + + /var/www/h... + + + + + + + +
+
+
+
+ + repo00.psi.ch + +
+
+ + 129.129.160.212 + +
+
+
+
+ + + repo00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+
+ + http server + +
+
+ + - RHEL8 repos + +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+ + /var/www/html + +
+
+
+ + + /var/www/h... + + + + + + + + +
+
+
+ http tcp:80 +
+ https tcp:443 +
+
+
+ + + http tcp:8... + + + + + + + +
+
+
+
+ metric00.psi.ch +
+
+ metric.psi.ch +
+
+ 129.129.190.226 +
+
+
+
+ + + metric00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+
+ + http server + +
+
+ + - grafana + +
+
+
+
+
+
+
+ + + Services:... + + + + + + + + + +
+
+
+
+ influx00.psi.ch +
+
+ 129.129.190.225 +
+
+
+
+ + + influx00.psi.ch... + + + + + + +
+
+
+
+ + Services: + +
+
+ influxd +
+
+
+
+
+
+
+ + + Services:... + + + + + + + +
+
+
+

+ Local storage for data +

+

+ /var/lib/influxdb +

+
+
+
+ + + Local storage for dat... + + + + + + + +
+
+

/dist "/afs/psi.ch/project/linux/www/dist"

@@ -448,277 +845,62 @@
- - /dist "... + + /dist "/afs/psi.ch/project/linux/www/dist"... - - - - - - - - - - - - - - - - - - - - + - -
-
-
-
+ +
+
+
+
lxweb00.psi.ch
-
- - - 129.129.190.46 - - - -
- +
+ linux.web.psi.ch
-
- - -
- - +
+ 129.129.190.46
-
- - http://linux.web.psi.ch - -
-
- -
- -
-
+
+
+
+ + + lxweb00.psi.ch... + + + + + + +
+
+
+
Services:
- -
- - - http server - -
- -
-
-
- - - lxweb00.psi.... - - - - - - - - -
-
-
- http tcp:80 -
- https tcp:443 -
-
-
- - - http tcp:8... - - - - - - - - - - - - -
-
-
-
+
- influx00.psi.ch - -
- -
- - - 129.129.190.225 - - -
- -
-
-
-
- - Services: - -
-
- - - influxd + http server
- - influx00.ps... + + Services:... - - - - - -
-
-
- tcp:5666 -
-
-
- - - tcp:5666 - - - - - - - - - - -
-
-
-

- Local storage for data -

-

- /var/lib/influxdb -
-

-
-
-
- - - Local s... - - - - - - - - - - - - -
-
-
-
- - metric00.psi.ch - -
- -
- - 129.129.190.226 - -
-
- -
-
-
-
- metrics.psi.ch -
-
-
-
-
- - Services: - -
-
- - - graphana - -
-
-
-
- - - metric00.ps... - - - - - - - - -
-
-
- http tcp:80 -
- (redirect to https) -
- https tcp:443 -
-
-
- - - http tcp:8... - - - - - + From 7ecab4e1152e46448709c1ae7ffd1ee09345355f Mon Sep 17 00:00:00 2001 From: ebner Date: Wed, 23 Nov 2022 16:44:08 +0100 Subject: [PATCH 2/8] add puppet servers to overview --- .../overview_linux.drawio.svg | 365 +++++++++++------- 1 file changed, 224 insertions(+), 141 deletions(-) diff --git a/infrastructure-guide/overview_linux.drawio.svg b/infrastructure-guide/overview_linux.drawio.svg index 80d9201..f127e89 100644 --- a/infrastructure-guide/overview_linux.drawio.svg +++ b/infrastructure-guide/overview_linux.drawio.svg @@ -1,13 +1,13 @@ - + - - - + + + -
+
tftp udp:69 @@ -15,17 +15,17 @@
- + tftp udp:69 - - + + -
+
cron / rsync (every minute) @@ -33,20 +33,20 @@
- + cron / rsy... - - - - - + + + + + -
+
iso sync: @@ -57,17 +57,17 @@
- + iso sync: https://id-sat-prd.ethz.ch/pub/... - - + + -
+
http tcp:80 @@ -77,19 +77,19 @@
- + http tcp:8... - - - - + + + + -
+
http tcp:80 @@ -99,17 +99,17 @@
- + http tcp:8... - - + + -
+
tcp:5666 @@ -117,17 +117,17 @@
- + tcp:5666 - - + + -
+
http tcp:80 @@ -139,25 +139,25 @@
- + http tcp:8... - - - - - - - - - - + + + + + + + + + + -
+
network infra structure servers @@ -167,20 +167,20 @@
- + network infra structure servers... - - - - - + + + + + -
+
special systems (e.g. ppc) @@ -188,18 +188,18 @@
- + special systems (e.g. ppc) - - - + + + -
+
subscribed via subscription manager @@ -207,16 +207,16 @@
- + subscribed via subscription... - + -
+
boot00.psi.ch @@ -226,7 +226,7 @@
- + boot00.psi.ch... @@ -234,7 +234,7 @@ -
+
@@ -259,16 +259,16 @@
- + Services:... - + -
+
located at and operatoed by ETH @@ -276,17 +276,17 @@
- + located at and operatoe... - - + + -
+
id-sat-prd.ethz.ch @@ -294,16 +294,16 @@
- + id-sat-prd.ethz.ch - + -
+
internet repositories @@ -311,16 +311,16 @@
- + internet repositories - + -
+
@@ -338,17 +338,17 @@
- + repo sync... - - + + -
+
@@ -364,17 +364,17 @@
- + repo sync  sources defined in /etc/yum.repos.d/r... - - + + -
+
@@ -396,16 +396,16 @@
- + Services:... - + -
+
@@ -421,16 +421,16 @@
- + pxeserv01.psi.ch... - + -
+
@@ -440,16 +440,16 @@
- + /tftpboot - + -
+

@@ -468,16 +468,16 @@

- + /afs/psi.c... - + -
+

@@ -492,16 +492,18 @@

- + /afs/psi.c... - + + + -
+
@@ -513,7 +515,7 @@
- + repo01.psi.ch @@ -521,7 +523,7 @@ -
+
@@ -546,16 +548,16 @@
- + Services:... - + -
+
@@ -565,16 +567,16 @@
- + /var/www/h... - + -
+
@@ -591,7 +593,7 @@
- + repo00.psi.ch... @@ -599,7 +601,7 @@ -
+
@@ -624,16 +626,16 @@
- + Services:... - + -
+
@@ -643,17 +645,17 @@
- + /var/www/h... - - + + -
+
http tcp:80 @@ -663,16 +665,16 @@
- + http tcp:8... - + -
+
@@ -688,7 +690,7 @@
- + metric00.psi.ch... @@ -696,7 +698,7 @@ -
+
@@ -721,18 +723,18 @@
- + Services:... - - - + + + -
+
@@ -745,7 +747,7 @@
- + influx00.psi.ch... @@ -753,7 +755,7 @@ -
+
@@ -771,16 +773,16 @@
- + Services:... - + -
+

@@ -793,16 +795,16 @@

- + Local storage for dat... - + -
+

@@ -845,16 +847,16 @@

- + /dist "/afs/psi.ch/project/linux/www/dist"... - + -
+
@@ -870,7 +872,7 @@
- + lxweb00.psi.ch... @@ -878,7 +880,7 @@ -
+
@@ -895,12 +897,93 @@
- + Services:... - + + + + + +
+
+
+ boot00-test.psi.ch +
+
+
+
+ + + boot00-test.psi.ch + + + + + + + + + +
+
+
+ puppet01.psi.ch +
+
+
+ + + puppet01.psi.ch + + + + + + + +
+
+
+ puppet00-test.psi.ch +
+
+
+ + + puppet00-test.psi.ch + + + + + + +
+
+
+
+ + Services: + +
+
+ puppet +
+
+
+
+ + + Services:... + + + + + + + From bd9eca131aff0ea4281c5ce8660bdcc06ca480b9 Mon Sep 17 00:00:00 2001 From: ebner Date: Wed, 23 Nov 2022 16:47:10 +0100 Subject: [PATCH 3/8] update typo --- infrastructure-guide/overview_linux.drawio.svg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure-guide/overview_linux.drawio.svg b/infrastructure-guide/overview_linux.drawio.svg index f127e89..d67259a 100644 --- a/infrastructure-guide/overview_linux.drawio.svg +++ b/infrastructure-guide/overview_linux.drawio.svg @@ -1,4 +1,4 @@ - + @@ -616,7 +616,7 @@
- - RHEL8 repos + - RHEL7 repos
From fccc5cbac19e8bdb3480eaea54785fb3d8fc7fb1 Mon Sep 17 00:00:00 2001 From: ebner Date: Wed, 23 Nov 2022 16:49:23 +0100 Subject: [PATCH 4/8] added ports for puppet server --- .../overview_linux.drawio.svg | 48 +++++++++++++++++-- 1 file changed, 44 insertions(+), 4 deletions(-) diff --git a/infrastructure-guide/overview_linux.drawio.svg b/infrastructure-guide/overview_linux.drawio.svg index d67259a..4fa21bb 100644 --- a/infrastructure-guide/overview_linux.drawio.svg +++ b/infrastructure-guide/overview_linux.drawio.svg @@ -1,4 +1,4 @@ - + @@ -84,8 +84,8 @@ - - + + @@ -99,7 +99,7 @@ - + http tcp:8... @@ -984,6 +984,46 @@ + + + + + +
+
+
+ https/443 +
+ 8140 +
+
+
+ + + https/443... + + + + + + + + +
+
+
+ https/443 +
+ 8140 +
+
+
+ + + https/443... + + + From dbf6b65be726e5228c59624877689dab8f6c16cc Mon Sep 17 00:00:00 2001 From: ebner Date: Wed, 23 Nov 2022 17:13:02 +0100 Subject: [PATCH 5/8] cleanup --- .../overview_linux.drawio.svg | 31 +++++-------------- 1 file changed, 8 insertions(+), 23 deletions(-) diff --git a/infrastructure-guide/overview_linux.drawio.svg b/infrastructure-guide/overview_linux.drawio.svg index 4fa21bb..acb8d0a 100644 --- a/infrastructure-guide/overview_linux.drawio.svg +++ b/infrastructure-guide/overview_linux.drawio.svg @@ -1,7 +1,7 @@ - + - + @@ -264,41 +264,26 @@ - - - - -
-
-
- located at and operatoed by ETH -
-
-
- - - located at and operatoe... - - - - -
+
id-sat-prd.ethz.ch +
+ (located at and operated by ETHZ)
- - id-sat-prd.ethz.ch + + id-sat-prd.ethz.ch... + From 2b3e0a441813abed4651edd2795e0c11b9b25328 Mon Sep 17 00:00:00 2001 From: ebner Date: Wed, 23 Nov 2022 17:14:18 +0100 Subject: [PATCH 6/8] update meeting details --- index.md | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/index.md b/index.md index f00c433..8d9ecdd 100644 --- a/index.md +++ b/index.md @@ -48,20 +48,36 @@ This email list is administered by Outlook in the following way (if you have man ![outlook_04.png](outlook_04.png) -## Meetings +## Linux Meetings ### Weekly Sync Meeting -Tuesdays 15:00-15:30 +__Time:__ Tuesdays 14:30-15:00 +__Chair:__ Konrad +__Location:__ Zoom +__Purpose:__ Discuss general Linux topics +__Participants__: Usually the people on the linux@psi.ch mailing list -- 5 Minutes News/Announcements -- Discussions -Chair: xxx +### Merge Meeting +__Time:__ Tuesdays 15:00-15:30 - directly following the Sync Meeting +__Chair:__ Konrad +__Location:__ Zoom +__Purpose:__ Review new changes in the Puppet code +__Participants__: Usually some of the people on the linux@psi.ch mailing list -### Merge Meeting -Chair: xxx +### Linux Core Group "Meeting" / Standup Meeting +__Time:__ Monday to Thursday 08:45 - 09:00 +__Chair:__ Simon +__Location:__ Zoom +__Purpose:__ Coordination work within the Linux core group +__Participants:__ Member of Linux Core group -### Standup Meeting -Chair: xxx +### Supporter Meeting(s) +__Time:__ Tuesday, Friday +__Chair:__ Silvio +__Location:__ Zoom +__Purpose:__ Coordination within the PC Supporters +__Participants:__ PC Supporters + From 551a0c9f0f91646ecc66e9b3783f755f5c8cf29e Mon Sep 17 00:00:00 2001 From: ebner Date: Wed, 23 Nov 2022 17:15:58 +0100 Subject: [PATCH 7/8] cleanup --- index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/index.md b/index.md index 8d9ecdd..b3d37c4 100644 --- a/index.md +++ b/index.md @@ -78,6 +78,7 @@ __Participants:__ Member of Linux Core group __Time:__ Tuesday, Friday __Chair:__ Silvio __Location:__ Zoom -__Purpose:__ Coordination within the PC Supporters +__Purpose:__ Coordination within the PC Supporters (more details contact Silvio) __Participants:__ PC Supporters + From 3ac86e5e8b3095d6f29cc1873961d948a0a3f9cb Mon Sep 17 00:00:00 2001 From: ebner Date: Thu, 24 Nov 2022 11:50:45 +0100 Subject: [PATCH 8/8] cleanup overview? --- ...infrastructure_security_concept.drawio.svg | 536 ++++++++++-------- 1 file changed, 298 insertions(+), 238 deletions(-) diff --git a/proposals/draft_infrastructure_security_concept.drawio.svg b/proposals/draft_infrastructure_security_concept.drawio.svg index 4051f65..11b00ea 100644 --- a/proposals/draft_infrastructure_security_concept.drawio.svg +++ b/proposals/draft_infrastructure_security_concept.drawio.svg @@ -1,14 +1,16 @@ - + - + + + - - + + -
+
https/443 @@ -18,7 +20,7 @@
- + https/443... @@ -80,12 +82,12 @@ - - + + -
+
https/443 @@ -93,7 +95,7 @@
- + https/443 @@ -117,12 +119,12 @@ - - + + -
+
tftp @@ -134,7 +136,7 @@
- + tftp... @@ -144,7 +146,7 @@ -
+
443 @@ -177,7 +179,7 @@ - + @@ -199,7 +201,7 @@ - + @@ -220,7 +222,7 @@ - + @@ -259,12 +261,12 @@ - + -
+
5665 @@ -272,7 +274,7 @@
- + 5665 @@ -294,12 +296,12 @@ - - + + -
+
???? @@ -307,7 +309,7 @@
- + ???? @@ -329,12 +331,12 @@ - - + + -
+
@@ -356,30 +358,11 @@
- + nrpe... - - - - -
-
-
- agent(s) -
-
-
- - - agent(s) - - - - - @@ -421,7 +404,7 @@ -
+
https @@ -429,7 +412,7 @@
- + https @@ -486,132 +469,42 @@ - + -
-
+
+
- any supported system in +
+ + + All Networks + + +
- ANY + [Security Level 3] - zone !!!!
- - any supported system in... + + All Networks[Security L... - + - + + + -
-
-
- security level -
-
-
- - - security l... - - - - - - - - - -
-
-
- https/443 -
- 8140 -
-
-
- - - https/443... - - - - - - - - -
-
-
- 5665 -
-
-
- - - 5665 - - - - - - - - - - -
-
-
- https/443 -
-
-
- - - https/443 - - - - - - - - - -
-
-
- (specific) managed Linux machines -
-
-
- - - (specific) managed Linux machines - - - - - - - - - -
+
Icinga Satellite @@ -621,43 +514,20 @@
- + Icinga Satellite... - + -
-
-
- - DMZ - -
- - DMZ responsible ? -
- - Periodic reviews -
-
-
- - - DMZ... - - - - - - - -
+
- - Systems are installed in the DMZ + - Systems are installed in the DMZ?
@@ -673,23 +543,26 @@
+ - DMZ responsible? +
+ - Periodic reviews?
- - - Systems are installed in the DMZ... + + - Systems are installed in the DMZ?... - + -
+
5665 @@ -697,16 +570,16 @@
- + 5665 - + -
+
Icinga Satellites @@ -714,51 +587,16 @@
- + Icinga Satellites - - + -
-
-
- 5665 -
-
-
- - - 5665 - - - - - - - -
-
-
- agent(s)/beat(s) -
-
-
- - - agent(s)/b... - - - - - - - -
+
logstash @@ -766,17 +604,17 @@
- + logstash - + -
+
???? @@ -784,17 +622,17 @@
- + ???? - - + + -
+
@@ -816,11 +654,233 @@
- + nrpe... + + + + + +
+
+
+ + nrpe + +
+ + ns-client++ + +
+ + snmp + +
+ + other ports + +
+
+
+ + + nrpe... + + + + + + + + +
+
+
+ + DataCenter Network +
+ [Security level 3] + +
+
+
+ + SSH access only through dedicated SSH gateways. + +
+
+
+
+ + + DataCenter Network... + + + + + + + +
+
+
+
+ + + All Networks + + +
+ + [Security Level 4-5] + +
+
+
+ + + All Networks[Security L... + + + + + + + + + + + + + +
+
+
+ agents +
+
+
+ + + agents + + + + + + + +
+
+
+ beats +
+
+
+ + + beats + + + + + + + +
+
+
+ beats +
+
+
+ + + beats + + + + + + + + +
+
+
+ ???? +
+
+
+ + + ???? + + + + + + + + +
+
+
+ 5665 +
+
+
+ + + 5665 + + + + + + + +
+
+
+
+ + DMZ + +
+ + [Security Level 2] + +
+
+
+ + + DMZ[Security Level 2] + + + + + + + + +
+
+
+ 5665 +
+
+
+ + + 5665 + + +