From c192f85949f9ed59308ab59bced3c59e815771c1 Mon Sep 17 00:00:00 2001 From: Konrad Bucheli Date: Fri, 26 May 2023 11:40:34 +0200 Subject: [PATCH 1/4] create an ISO with kickstart file only --- infrastructure-guide/initial_setup.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infrastructure-guide/initial_setup.md b/infrastructure-guide/initial_setup.md index 4cb17ba..b9a2585 100644 --- a/infrastructure-guide/initial_setup.md +++ b/infrastructure-guide/initial_setup.md @@ -22,6 +22,10 @@ The steps involved to bootstrap the boot server and the repository server are th ``` mkksiso lx-boot-dmz-01.psi.ch.ks rhel-8.7-x86_64-boot.iso lx-boot-dmz-01-rhel-8.7-x86_64-boot.iso ``` + Alternatively create a second iso file with just the kickstart file. Place the kickstart file as `ks.cfg` in an directory and run: + ``` + mkisofs -volid OEMDRV -output $TARGET_HOSTNAME-kickstart.iso $DIR_WITH_KICKSTART_FILE + ``` 1. Remote Login (via RDP) to vmsmgt.psi.ch and mount the ISO to the VM @@ -34,6 +38,8 @@ The steps involved to bootstrap the boot server and the repository server are th ![](initial_setup/mount_iso_menu.png) ![](initial_setup/mount_iso.png) + 1. If you have a separate kickstart iso file, you need two CD drives and connect both iso files. + 1. Start the VM to trigger the install ```{note} From d28921f0cb596b14921f288d2a6098d889bd79e5 Mon Sep 17 00:00:00 2001 From: Konrad Bucheli Date: Tue, 30 May 2023 16:58:10 +0200 Subject: [PATCH 2/4] show how to configure custom nameservers --- _toc.yml | 2 +- admin-guide/configuration.md | 4 ++++ admin-guide/configuration/custom_nameservers.md | 12 ++++++++++++ 3 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 admin-guide/configuration/custom_nameservers.md diff --git a/_toc.yml b/_toc.yml index e9b3a71..03f930c 100644 --- a/_toc.yml +++ b/_toc.yml @@ -33,7 +33,7 @@ chapters: - file: admin-guide/architecture/active-directory - file: admin-guide/configuration sections: - - file: admin-guide/configuration/hostname + - file: admin-guide/configuration/custom_nameservers - file: admin-guide/configuration/vgroot - file: admin-guide/configuration/citrix_vda - file: admin-guide/guidelines diff --git a/admin-guide/configuration.md b/admin-guide/configuration.md index 1a4b70d..a5100b4 100644 --- a/admin-guide/configuration.md +++ b/admin-guide/configuration.md @@ -2,5 +2,9 @@ Here starts a so far small collections of configuration guides for sysadmins of RHEL installations using Puppet and Hiera. +## Basic Setup - [Resize System Volumes (volume group `vg_root`)](configuration/vgroot) +- [Custom Nameservers](configuration/custom_nameservers) + +## Special Installations - [Install Citrix VDA](configuration/citrix_vda) diff --git a/admin-guide/configuration/custom_nameservers.md b/admin-guide/configuration/custom_nameservers.md new file mode 100644 index 0000000..ab509ad --- /dev/null +++ b/admin-guide/configuration/custom_nameservers.md @@ -0,0 +1,12 @@ +# Custom Nameservers + +The internal nameservers are configured according to the network zone by Puppet. + +If for some reason that is unsuitable, you might set your own in Hiera: + +``` +networking::nameservers_override: + - 192.33.120.5 + - 192.33.121.5 +``` + From 87f63fc909a17aa84ed0d0bafc7fd5047329d032 Mon Sep 17 00:00:00 2001 From: Konrad Bucheli Date: Tue, 30 May 2023 17:13:46 +0200 Subject: [PATCH 3/4] document ssh host trust --- admin-guide/configuration.md | 1 + admin-guide/configuration/ssh_host_hopping.md | 25 +++++++++++++++++++ 2 files changed, 26 insertions(+) create mode 100644 admin-guide/configuration/ssh_host_hopping.md diff --git a/admin-guide/configuration.md b/admin-guide/configuration.md index a5100b4..9f4546e 100644 --- a/admin-guide/configuration.md +++ b/admin-guide/configuration.md @@ -7,4 +7,5 @@ Here starts a so far small collections of configuration guides for sysadmins of - [Custom Nameservers](configuration/custom_nameservers) ## Special Installations +- [SSH Host Hopping as Root (e.g. between cluster members)](configuration/ssh_host_hopping) - [Install Citrix VDA](configuration/citrix_vda) diff --git a/admin-guide/configuration/ssh_host_hopping.md b/admin-guide/configuration/ssh_host_hopping.md new file mode 100644 index 0000000..79960cb --- /dev/null +++ b/admin-guide/configuration/ssh_host_hopping.md @@ -0,0 +1,25 @@ +# SSH Host Hopping as Root (e.g. between cluster members) + +This is to allow the user `root` on a given machine to log in as `root` onto another machine without using a password or a similar authentication. + + +The `ssh_server::root_host_trust` list in Hiera configures from which devices root is allowed to connect without special configuration: +``` +ssh_server::root_host_trust: + - 'lxdev04.psi.ch' + - 'lxdev05.psi.ch' +``` +From security perspective this nodes should have the same or stricter security rules/setup that the target host. + +To actually use host trust the client also needs to configure that while connecting, e.g. in Hiera: + +``` +ssh_client::try_host_trust: true +``` + +or spontaneously on the ssh command line with: +``` +ssh -o HostbasedAuthentication=yes ... +``` +or by setting `HostbasedAuthentication yes` in the appropriate place in the ssh configuration (e.g. `~/.ssh/config`). + From d1d46825f1d85314f685c298a074e816692c2425 Mon Sep 17 00:00:00 2001 From: Konrad Bucheli Date: Tue, 30 May 2023 17:15:38 +0200 Subject: [PATCH 4/4] document ssh host trust --- _toc.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/_toc.yml b/_toc.yml index 03f930c..d59f92b 100644 --- a/_toc.yml +++ b/_toc.yml @@ -35,6 +35,7 @@ chapters: sections: - file: admin-guide/configuration/custom_nameservers - file: admin-guide/configuration/vgroot + - file: admin-guide/configuration/ssh_host_hopping - file: admin-guide/configuration/citrix_vda - file: admin-guide/guidelines - file: admin-guide/deployment