Server Administration Notes

From Freelock Knowledge Base

Jump to: navigation, search

This page has some specific notes/links to more advanced configuration instructions. We have a beginner server administration cheat-sheet for our clients over at Ubuntu VPS Administration.

Contents

[edit] Apache

There's plenty of stuff out there about Apache configuration.

We're currently learning the Debian way, with its tools a2enmod and a2ensite for enabling sites and modules.

For quite some time we've been using mod_authmysql for authentication, a simple module we've compiled for Apache 1 and 2. Now Debian/Apache comes with a similar but different mod_auth_mysql (note the extra underscore in the name).

Here's a helpful site explaining the (slightly different) directives: http://www.cgi101.com/class/password/mod_auth_mysql.html

[edit] Asterisk @ Home

Our latest venture: Asterisk


[edit] Certificate Authority

[edit] Backup removable drives

[edit] DNS

[edit] Email

[edit] Firewall


[edit] Shell/Screen

We make great use of the Screen command to keep track of a shell session, even after being disconnected. Here's a command to add to the .screenrc file, to allow the scrollbar to work when you're in a screen:

Q: My xterm scrollbar does not work with screen.

A: The problem is that xterm will not allow scrolling if the alternate text buffer is selected. The standard definitions of the termcap initialize capabilities ti and te switch to and from the alternate text buffer. (The scrollbar also does not work when you start e.g. 'vi'). You can tell screen not to use these initialisations by adding the line 

termcapinfo xterm ti@:te@

to your ~/.screenrc file.

[edit] Multi-user screen

  1. setuid root /usr/bin/screen
  2. chmod 755 /var/run/screen
  3. Start a screen
  4. Hit Ctrl-a, type ":multiuser on" and press enter.
  5. Hit Ctrl-a, type ":addacl <username>" and press enter.

Then the other user can connect with syntax like:

  • screen -r john/13544.pts-1.sahale

(the actual stuff to put after the slash can be found with screen -list)

[edit] Shared screen

This technique is useful for allowing temporary access to untrusted users. Instructions are Ubuntu-focused...

  1. sudo passwd # you need to have a root password, because we'll be using su instead of sudo
  2. sudo adduser tempuser # set password
  3. From another machine, ssh tempuser@host # need to be logged in as the same user to share screen
  4. screen
  5. (provide username/pw to user)
  6. (instruct user to type "screen -x" to join your screen

Now you're in a shared screen and can use su to grant temporary root access.

[edit] SSH Keygen

We manage servers using SSH keys, because we've seen people hack into machines protected only with a password. Here's how to create an SSH keypair:

Generally, you create it on the machine you're connecting from, and then copy the key to the machine(s) you want to connect to.

  1. Open a shell on your client machine (should work on a Mac...)
  2. Type: ssh-keygen -t rsa ... and press enter.
  3. It should tell you where it's going to save the private key, named id_rsa. Use the default for easiest operation...
  4. If the client machine is a laptop, use a passphrase to protect it. Otherwise anyone gaining access to the key file can log in as you. For home machines/secure machines/automatic processes (such as network backups) leave the passphrase blank.
  5. You'll end up with two files: ~/.ssh/id_rsa (your private key) and ~/.ssh/id_rsa.pub (your public key).

Put both keys on your client machines. Copy the contents of id_rsa.pub into your ~/.ssh/authorized_keys file (create it if it doesn't exist) on each server. Voila, secure, password-free logins!

You may be able to add it to your Mac keychain to really simplify logging in--type your passphrase once, and have access to the machines until you log out.

In Windows, the popular PuTTY program has a key generation function built in.

I often use USB thumbdrives to transfer keys, but you should be able to copy them over using Samba or any other way you can log in... Your id_rsa.pub file is public, and is not at all sensitive--but protect the id_rsa file, and only put it on machines you know you'll need to use for logging in!

[edit] LTSP

See LTSP notes.

[edit] Nagios

Getting started with Nagios

[edit] Samba

[edit] Auto-configure printers using RAW print spool

  1. edit smb.conf to make sure print$ share is there... change default print command to version for server-side drivers.
  2. add smbpasswd -a root so that you can use rpcclient and configure from Windows.
  3. copy generic postscript drivers to /var/lib/samba/printers/W32X86 : 
 PS5UI.DLL                           A   129024  Fri Mar 10 13:33:37 2006
 PSCRIPT.HLP                         A    26038  Fri Mar 10 13:33:37 2006
 PSCRIPT.NTF                         A   792644  Fri Mar 10 13:33:37 2006
 PSCRIPT5.DLL                        A   455168  Fri Mar 10 13:33:37 2006
  1. Run cupsaddsmb -a to add already configured ppd file for your printers. This doesn't finish successfully on Mandriva.
  2. Do not copy drivers into 3/ folder--the rpcclient command does that. Run this to check drivers: 
smbclient //foraker/print\$ -U root -c 'cd W32X86; pwd; dir; cd 3; pwd; dir'
  1. Run rpcclient adddriver as follows: 
 rpcclient localhost -U root -c 'adddriver "Windows NT x86" "HPPhotoSmart2600:PSCRIPT5.DLL:HPPhotoSmart2600.PPD:PS5UI.DLL:PSCRIPT.HLP:NULL:RAW:PSCRIPT.NTF" SAMBA-CUPS'
(that's drivername:PSCRIPT5.DLL:driver.PPD:PS5UI.DLL:PSCRIPT.HLP:Driver language:RAW:PSCRIPT.NTF for the long string)
  1. Associate printer with driver: 
rpcclient localhost -U root -c 'setdriver HPPhotoSmart2600 HPPhotoSmart2600'
  1. On Windows client, connect to print$ as root: 
net use \\servername\print$ /user:root
  1. Install driver by going to \\servername\printername.
  2. Edit the driver properties: change page rotation to landscape, apply, then go back. This finishes setting up the driver correctly, and sets the defaults for future installations.

Done!


[edit] Samba as domain controller

[edit] Add a machine account 

useradd -d /dev/null -s /dev/null machinename\$
smbpasswd –a –m machinename

[edit] Site Monitoring Script

The chkdomains script is a basic site monitoring script that we use on our sites. It is ran automatically every few minutes and will alert the system administrators of a server outage.

We run it with the command line PHP interpretor called from a cron job.

we store it at /var/www/conf/chkdomains.php

chkdomains.php basic site monitoring script 

 sends an email when status is different than previous running of the script

 installation instructions
create a /var/www/conf directory to store this
 /var/www/conf/satus contains the cache result
  this must be writable by the user running the job
  add a  URL to the $site array for each site to check
  set $mailto to appropriate email addresses, comma seporated
  schedual the cron job (php command line package required php_cli)
 
  The status file needs to be writiable by the script ( a user accont
  that runs the script)

 on your server that is to be checked,  create a textfile called "FILENAME" with your success string, this must match exactly, newlines and whitespace matter.

 Testing instructions
 delete the domain_uptime.txt
 run the script
 check the contents of the new domain_uptime.txt file
 check your email


 files, 
 on each server, uptime.txt
 on monitoring system
    /var/www/conf/chkdomains.php (this file)
   /var/www/conf/status/domain_uptime.txt  conists of 1's and 0's and newlines

[edit] Jabber Server

http://jabberd.jabberstudio.org/1.4/doc/adminguide (I finally found some documentation from a link in /usr/share/doc/jabberd/)

Retrieved from "http://freelock.com/kb/Server_Administration_Notes"
Personal tools