Difference between revisions of "BXadmin:BX Migration stuff"

From CCGB
Jump to: navigation, search
Line 1: Line 1:
 +
 
This is to serve as a list of services and responsibilites to be either migrated to ITS or ECoS IT, or decom'd.
 
This is to serve as a list of services and responsibilites to be either migrated to ITS or ECoS IT, or decom'd.
  
Line 11: Line 12:
 
*** ~100TB total vice partition space dedicated to AFS, most in Solaris+ZFS with at least LZJB compression
 
*** ~100TB total vice partition space dedicated to AFS, most in Solaris+ZFS with at least LZJB compression
 
*** ~30TB disk space used, after compression
 
*** ~30TB disk space used, after compression
 +
*** PTS users and groups sync'd from LDAP (bxAccount and bxAFSGroup objectClasses, bxAFSGroupId and bxAFSPTSName attr's)
 
** Stored in afs:
 
** Stored in afs:
 
*** Websites (31 vhosts, 8 physical servers), config files, log files, SSL certs, webalizer and associated scripts (not currently enabled, needs to go into cfengine)
 
*** Websites (31 vhosts, 8 physical servers), config files, log files, SSL certs, webalizer and associated scripts (not currently enabled, needs to go into cfengine)
Line 33: Line 35:
 
** Outgoing via password auth sendmail (smtp.bx.psu.edu)
 
** Outgoing via password auth sendmail (smtp.bx.psu.edu)
 
** MX and smtp.bx are filtered via milter over IPv6 to amavisd running on wash and zoe
 
** MX and smtp.bx are filtered via milter over IPv6 to amavisd running on wash and zoe
 +
** Handles bx.psu.edu directly, and contains bio.cse.psu.edu virtual users and corresponding aliases
 +
* Mailing lists
 
** Mailman (lists.psu.edu). Some of it is in AFS, so it gets k5start'd
 
** Mailman (lists.psu.edu). Some of it is in AFS, so it gets k5start'd
 +
** lists.bx.psu.edu accepts mail from the MXes
 +
* LDAP
 +
** OpenLDAP
 +
** dc=bx,dc=psu,dc=edu - syncrepl replicated between 3 machines, single-master. HDB backend
 +
*** Contains mail, users, groups, Apple OD stuff (cn=apple), RADIUS, DHCP, automount maps, sudoers
 +
*** SASL/GSSAPI binds, specifically to allow user-managed groups and mail forwarding edits (mailRoutingAddress) by regular users
 +
*** Users RFC2307bis groups
 +
** dc=dce,dc=psu,dc=edu - syncrepl, HDB backend. Contains stub entries for cosign+mod_authnz_ldap functionality with dce users
 +
** dc=psu,dc=edu - fake directory, Perl backend. Returns fake entries for FOPS users
 +
* DNS
 +
** Nothing special. BIND 9 on Solaris SPARC. Many many special entries, SRV records, AAAA records, etc.
 +
* cfengine
 +
** git repo lives in AFS
 +
** cfservd is k5start'd
 +
** Controls almost EVERYTHING
 +
** Needs to be split into separate prod and master branches for proper testing
 +
** Configured to manage Solaris (OpenCSW), OSX (macports), Linux (Centos5, SL6, Debian Squeeze)
 +
* Munki
 +
** Installs pkg's, dmg's, etc on OS X. Currently set up to run on 10.5, 10.6, 10.7
 +
** pkginfo files (xml) edited directly in AFS. Should be moved to git with separate master and prod branches for testing
 +
* WPKG
 +
** Installs all the Windows packages. Targeted at 64-bit Win7 as setup right now.
 +
** Runs via BAT script at startup, configured via AD (BX-WPKG-prod and BX-WPKG-master GPO's)
 +
* IPP
 +
** CUPS running on a (rather old) Fedora VM. All printers are on RFC1918 network. Firewall ACLs allow access to 631/tcp from psu wireless subnet.
 +
** No authentication or page counting, but SPNEGO auth could, in theory, be used
 +
* RT
 +
** Version 3.8.8. Protected behind our cosign
 +
** installed using shipwright, with some minor modifications
 +
*

Revision as of 00:04, 6 December 2011

This is to serve as a list of services and responsibilites to be either migrated to ITS or ECoS IT, or decom'd.

This is going to be rather long, and many services listed here will have a long list of requirements.


  • AFS
    • Statistics:
      • 306 user entries in prdb
      • 98 groups in prdb
      • 669 volumes across 17 fileservers and 42 vice partitions
      • ~100TB total vice partition space dedicated to AFS, most in Solaris+ZFS with at least LZJB compression
      • ~30TB disk space used, after compression
      • PTS users and groups sync'd from LDAP (bxAccount and bxAFSGroup objectClasses, bxAFSGroupId and bxAFSPTSName attr's)
    • Stored in afs:
      • Websites (31 vhosts, 8 physical servers), config files, log files, SSL certs, webalizer and associated scripts (not currently enabled, needs to go into cfengine)
      • rancid, cacti, ganglia-web
      • afs-pkg (/afs/bx/pkg and /afs/bx/software)
      • WPKG and Munki xml repos and software packages/installers
      • local YUM repositories, miscellaneous mirrors (ftp.bx.psu.edu/(software|mirrors)
      • Sun Grid Engine with AFS token integration (/afs/bx/service/sge/prod)
      • DNS zone files (config files are in cfengine)
      • cfengine master repo
      • cosign - html files, cgi's, mod_cosign.so
      • Private and public FTP via k5start'd vsftpd
      • Mailman archive files and list config files
      • Rt 3.8.8, built for 64-bit linux and Solaris 10 SPARC (via @sys symlinks)
      • Several 10's of TB of research data (/afs/bx/depot/data/)
      • 214 user home directories, 5.6TB total, average 26GB in size, biggest is 414GB
  • Mail
    • imap.bx.psu.edu: dovecot IMAP, with GSSAPI auth. Works with BX.PSU.EDU and dce.psu.edu
    • Squirrelmail and Horde/IMP for web based access
    • Mail routing, aliases, mailer config, and per-user mail forwarding stored in LDAP
    • Sendmail on Solaris 10 SPARC for incoming MX's, delivery via procmail+Maildir, sendmail process is run under k5start
    • Outgoing via password auth sendmail (smtp.bx.psu.edu)
    • MX and smtp.bx are filtered via milter over IPv6 to amavisd running on wash and zoe
    • Handles bx.psu.edu directly, and contains bio.cse.psu.edu virtual users and corresponding aliases
  • Mailing lists
    • Mailman (lists.psu.edu). Some of it is in AFS, so it gets k5start'd
    • lists.bx.psu.edu accepts mail from the MXes
  • LDAP
    • OpenLDAP
    • dc=bx,dc=psu,dc=edu - syncrepl replicated between 3 machines, single-master. HDB backend
      • Contains mail, users, groups, Apple OD stuff (cn=apple), RADIUS, DHCP, automount maps, sudoers
      • SASL/GSSAPI binds, specifically to allow user-managed groups and mail forwarding edits (mailRoutingAddress) by regular users
      • Users RFC2307bis groups
    • dc=dce,dc=psu,dc=edu - syncrepl, HDB backend. Contains stub entries for cosign+mod_authnz_ldap functionality with dce users
    • dc=psu,dc=edu - fake directory, Perl backend. Returns fake entries for FOPS users
  • DNS
    • Nothing special. BIND 9 on Solaris SPARC. Many many special entries, SRV records, AAAA records, etc.
  • cfengine
    • git repo lives in AFS
    • cfservd is k5start'd
    • Controls almost EVERYTHING
    • Needs to be split into separate prod and master branches for proper testing
    • Configured to manage Solaris (OpenCSW), OSX (macports), Linux (Centos5, SL6, Debian Squeeze)
  • Munki
    • Installs pkg's, dmg's, etc on OS X. Currently set up to run on 10.5, 10.6, 10.7
    • pkginfo files (xml) edited directly in AFS. Should be moved to git with separate master and prod branches for testing
  • WPKG
    • Installs all the Windows packages. Targeted at 64-bit Win7 as setup right now.
    • Runs via BAT script at startup, configured via AD (BX-WPKG-prod and BX-WPKG-master GPO's)
  • IPP
    • CUPS running on a (rather old) Fedora VM. All printers are on RFC1918 network. Firewall ACLs allow access to 631/tcp from psu wireless subnet.
    • No authentication or page counting, but SPNEGO auth could, in theory, be used
  • RT
    • Version 3.8.8. Protected behind our cosign
    • installed using shipwright, with some minor modifications
Retrieved from "https://wiki.bx.psu.edu/index.php?title=BXadmin:BX_Migration_stuff&oldid=1822"