BXadmin:BX Migration stuff

This is to serve as a list of services and responsibilites to be either migrated to ITS or ECoS IT, or decom'd.

This is going to be rather long, and many services listed here will have a long list of requirements.

• AFS
  • Statistics:
    • 306 user entries in prdb
    • 98 groups in prdb
    • 669 volumes across 17 fileservers and 42 vice partitions
    • ~100TB total vice partition space dedicated to AFS, most in Solaris+ZFS with at least LZJB compression
    • ~30TB disk space used, after compression
    • PTS users and groups sync'd from LDAP (bxAccount and bxAFSGroup objectClasses, bxAFSGroupId and bxAFSPTSName attr's)
  • Stored in afs:
    • Websites (31 vhosts, 8 physical servers), config files, log files, SSL certs, webalizer and associated scripts (not currently enabled, needs to go into cfengine)
    • rancid, cacti, ganglia-web
    • afs-pkg (/afs/bx/pkg and /afs/bx/software)
    • WPKG and Munki xml repos and software packages/installers
    • local YUM repositories, miscellaneous mirrors (ftp.bx.psu.edu/(software|mirrors)
    • Sun Grid Engine with AFS token integration (/afs/bx/service/sge/prod)
    • DNS zone files (config files are in cfengine)
    • cfengine master repo
    • cosign - html files, cgi's, mod_cosign.so
    • Private and public FTP via k5start'd vsftpd
    • Mailman archive files and list config files
    • Rt 3.8.8, built for 64-bit linux and Solaris 10 SPARC (via @sys symlinks)
    • Several 10's of TB of research data (/afs/bx/depot/data/)
    • 214 user home directories, 5.6TB total, average 26GB in size, biggest is 414GB
• Mail
  • imap.bx.psu.edu: dovecot IMAP, with GSSAPI auth. Works with BX.PSU.EDU and dce.psu.edu
  • Squirrelmail and Horde/IMP for web based access
  • Mail routing, aliases, mailer config, and per-user mail forwarding stored in LDAP
  • Sendmail on Solaris 10 SPARC for incoming MX's, delivery via procmail+Maildir, sendmail process is run under k5start
  • Outgoing via password auth sendmail (smtp.bx.psu.edu)
  • MX and smtp.bx are filtered via milter over IPv6 to amavisd running on wash and zoe
  • Handles bx.psu.edu directly, and contains bio.cse.psu.edu virtual users and corresponding aliases
• Mailing lists
  • Mailman (lists.psu.edu). Some of it is in AFS, so it gets k5start'd
  • lists.bx.psu.edu accepts mail from the MXes
• LDAP
  • OpenLDAP
  • dc=bx,dc=psu,dc=edu - syncrepl replicated between 3 machines, single-master. HDB backend
    • Contains mail, users, groups, Apple OD stuff (cn=apple), RADIUS, DHCP, automount maps, sudoers
    • SASL/GSSAPI binds, specifically to allow user-managed groups and mail forwarding edits (mailRoutingAddress) by regular users
    • Users RFC2307bis groups
  • dc=dce,dc=psu,dc=edu - syncrepl, HDB backend. Contains stub entries for cosign+mod_authnz_ldap functionality with dce users
  • dc=psu,dc=edu - fake directory, Perl backend. Returns fake entries for FOPS users
• DNS
  • Nothing special. BIND 9 on Solaris SPARC. Many many special entries, SRV records, AAAA records, etc.
• cfengine
  • git repo lives in AFS
  • cfservd is k5start'd
  • Controls almost EVERYTHING
  • Needs to be split into separate prod and master branches for proper testing
  • Configured to manage Solaris (OpenCSW), OSX (macports), Linux (Centos5, SL6, Debian Squeeze)
• Munki
  • Installs pkg's, dmg's, etc on OS X. Currently set up to run on 10.5, 10.6, 10.7
  • pkginfo files (xml) edited directly in AFS. Should be moved to git with separate master and prod branches for testing
• WPKG
  • Installs all the Windows packages. Targeted at 64-bit Win7 as setup right now.
  • Runs via BAT script at startup, configured via AD (BX-WPKG-prod and BX-WPKG-master GPO's)
• IPP
  • CUPS running on a (rather old) Fedora VM. All printers are on RFC1918 network. Firewall ACLs allow access to 631/tcp from psu wireless subnet.
  • No authentication or page counting, but SPNEGO auth could, in theory, be used
• RT
  • Version 3.8.8. Protected behind our cosign
  • installed using shipwright, with some minor modifications
• SGE
  • Scheduling for most of the clusters
  • Lives in AFS, with AFS token integration (set_token.sh and get_token.sh)
• Kerberos
  • Heimdal 1.3.3. iprop over ipv6.
  • One-way trust between BX.PSU.EDU and dce.psu.edu
  • 589 principals
• Cosign
  • weblogin.bx.psu.edu
  • Supported login realms:
    • fops.psu.edu(R_U = abc123@fops.psu.edu, R_R=fops.psu.edu)
    • dce.psu.edu (R_U = abc123, R_R=dce.psu.edu)
    • BX.PSU.EDU (R_U = abc123, R_R = BX.PSU.EDU)
  • Supports SPNEGO via background AJAX mojo that redirects to /negotiate if SPNEGO is deemed to be working. /negotiate is then protected with mod_auth_kerb (see cosign.bx.psu.edu-ssl vhost file)
  • Several local patches to disable kdc verification, and change some variables around so we compare certain fields in cosign.conf before RE substitution