Merge branch 'master' of git.psi.ch:linux-infra/documentation

_toc.yml

@@ -33,8 +33,9 @@ chapters:
           - file: admin-guide/architecture/active-directory
       - file: admin-guide/configuration
         sections:
-          - file: admin-guide/configuration/hostname
+          - file: admin-guide/configuration/custom_nameservers
           - file: admin-guide/configuration/vgroot
+          - file: admin-guide/configuration/ssh_host_hopping
           - file: admin-guide/configuration/citrix_vda
       - file: admin-guide/guidelines
       - file: admin-guide/deployment

admin-guide/configuration.md

@@ -2,5 +2,10 @@
 
 Here starts a so far small collections of configuration guides for sysadmins of RHEL installations using Puppet and Hiera.
 
+## Basic Setup
 - [Resize System Volumes (volume group `vg_root`)](configuration/vgroot)
+- [Custom Nameservers](configuration/custom_nameservers)
+
+## Special Installations
+- [SSH Host Hopping as Root (e.g. between cluster members)](configuration/ssh_host_hopping)
 - [Install Citrix VDA](configuration/citrix_vda)

admin-guide/configuration/custom_nameservers.md

@@ -0,0 +1,12 @@
+# Custom Nameservers
+
+The internal nameservers are configured according to the network zone by Puppet.
+
+If for some reason that is unsuitable, you might set your own in Hiera:
+
+```
+networking::nameservers_override:
+  - 192.33.120.5
+  - 192.33.121.5
+```
+

admin-guide/configuration/ssh_host_hopping.md

@@ -0,0 +1,25 @@
+# SSH Host Hopping as Root (e.g. between cluster members)
+
+This is to allow the user `root` on a given machine to log in as `root` onto another machine without using a password or a similar authentication.
+
+
+The `ssh_server::root_host_trust` list in Hiera configures from which devices root is allowed to connect without special configuration:
+```
+ssh_server::root_host_trust:
+  - 'lxdev04.psi.ch'
+  - 'lxdev05.psi.ch'
+```
+From security perspective this nodes should have the same or stricter security rules/setup that the target host.
+
+To actually use host trust the client also needs to configure that while connecting, e.g. in Hiera:
+
+```
+ssh_client::try_host_trust: true
+```
+
+or spontaneously on the ssh command line with:
+```
+ssh -o HostbasedAuthentication=yes ...
+```
+or by setting `HostbasedAuthentication yes` in the appropriate place in the ssh configuration (e.g. `~/.ssh/config`).
+

infrastructure-guide/initial_setup.md

@@ -22,6 +22,10 @@ The steps involved to bootstrap the boot server and the repository server are th
     ```
     mkksiso lx-boot-dmz-01.psi.ch.ks rhel-8.7-x86_64-boot.iso  lx-boot-dmz-01-rhel-8.7-x86_64-boot.iso
     ```
+    Alternatively create a second iso file with just the kickstart file. Place the kickstart file as `ks.cfg` in an directory and run:
+    ```
+    mkisofs -volid OEMDRV -output $TARGET_HOSTNAME-kickstart.iso $DIR_WITH_KICKSTART_FILE
+    ```
 
 1. Remote Login (via RDP) to vmsmgt.psi.ch and mount the ISO to the VM
 
@@ -34,6 +38,8 @@ The steps involved to bootstrap the boot server and the repository server are th
         ![](initial_setup/mount_iso_menu.png)
         ![](initial_setup/mount_iso.png)
 
+    1. If you have a separate kickstart iso file, you need two CD drives and connect both iso files.
+
     1. Start the VM to trigger the install
 
 ```{note}