ASL-Corp members, Bureaucrats, Check users, Structured Discussions bots, oversight, Suppressors, Administrators, Upload Wizard campaign editors
1,714
edits
Changes
Jump to navigation
Jump to search
mLine 1:
Line 1: − + + + + Line 34:
Line 37: − <code>apt-get install ntp python vim screen ipsec-tools strongswan fail2ban</code> + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − # The primary network interface+ − auto eth0+ − + − address 44.103.0.49+ − netmask 255.255.255.0+ − network 44.103.0.0+ − broadcast 44.103.0.255+ − gateway 44.103.0.1 + − dns-nameservers 44.103.0.4 1.1.1.1+ − dns-search allstarlink.org+ − up /etc/network/firewall.sh+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 59:
Line 126: + + + + + + + + + + + + Line 64:
Line 143: − + Line 72:
Line 151: − + + + + + + + + Line 233:
Line 319: + + + + + + + + + + + + + + Line 246:
Line 346: − + + + + + + +
no edit summary
This is intended to be a reference for setting up a VM or Server for AllStatLink.
[[Category: Infrastructure]]
[[Category: How to]]
{{Notice | This document reflects the current Infrastructure as of 2021-01-17}}
This is intended to be a reference for setting up a VM or Server for PTTLink.
= Server Overview =
= Server Overview =
All servers require this software
All servers require this software
apt-get install ntp ntpdate python vim screen ipsec-tools strongswan fail2ban snmp haveged libacl1-dev python3-dev libssl-dev gcc g++ fio pbzip2 ncdu
=== Mandatory Configs ===
=== Configuration ===
There are two types of configuration presented below:
*No Netplan config - removes netplan and swtiches back to ifupdown
*Netplan config - keeps netplan
As new versions of Ubuntu are released, it is very possible that netplan will become the only officially supported means to configure networking. Keeping that in mind, all efforts should be made to configure Ubuntu 20+ servers using netlpan with a fallback to the no netplan config as the last resort.
==== No Netplan Config ====
You can remove this and go back to ''ifupdown'' as follows.
First you need to disable the resolved service:
sudo systemctl disable systemd-resolved.service
sudo systemctl stop systemd-resolved
rm /etc/resolv.conf
sudo touch /etc/cloud/cloud-init.disabled
sudo apt-get purge cloud-init
echo "nameserver 1.1.1.1" > /etc/resolv.conf
apt-get install ifupdown
Reconfigure network services
systemctl unmask networking
systemctl enable networking
systemctl restart networking
systemctl stop systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
systemctl disable systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
systemctl mask systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
apt-get --assume-yes purge nplan netplan.io
Network Config
* The network should be configured to use /etc/network/interfaces, and add DNS and the firewall to it and search in the allstarlink.org domain
* The network should be configured to use /etc/network/interfaces, and add DNS and the firewall to it and search in the allstarlink.org domain
# The primary network interface
auto eth0
iface eth0 inet static
iface eth0 inet6 static
address 9805:0900:0340:1000::2600/64
autoconf 0
accept_ra 2
iface eth0 inet static
address 44.103.0.49
netmask 255.255.255.0
network 44.103.0.0
broadcast 44.103.0.255
gateway 44.103.0.1
dns-nameservers 44.103.0.4 1.1.1.1
dns-search allstarlink.org
up /etc/network/firewall.sh
==== Netplan config ====
Configure the network using /etc/netplan files. You should remove any existing files and create a new one called 01-netcfg.yaml with the following:
network:
version: 2
rendered: networkd
ethernets:
eth0:
addresses:
- 44.98.254.1/24
gateway4: 44.98.254.1
nameservers:
search: [allstarlink.org]
addresses: [1.1.1.1]
*Once done run the following and test to make sure the IP address is reachable. Follow the on-screen instructions:
netplan try
Refer to [https://netplan.io/examples/ Netplan configuration examples] for more examples on how to configure networking using netplan
==== Persistent Interface Names ====
To ensure that interface names are persistent (e.g., ethX) you can choose using either UDEV or Grub.
The Grub method tends to be easier and less prone to locking yourself out of a VM due to an interface naming conflict at reboot.
====== UDEV method ======
* There is typically only one network interface, and it will be named dynamically. We must setup this using udev to be persistent
* There is typically only one network interface, and it will be named dynamically. We must setup this using udev to be persistent
Now take this HWaddr and put it in the config file
Now take this HWaddr and put it in the config file
echo 'SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:73:86:06", ATTR{dev_id}=="0x0", ATTR{type}=="1", NAME="eth0"' >/etc/udev/rules.d/70-persistent-net.rules
echo 'SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:73:86:06", ATTR{dev_id}=="0x0", ATTR{type}=="1", NAME="eth0"' >/etc/udev/rules.d/70-persistent-net.rules
====== Grub method ======
* Edit the '''''/etc/default/grub''''' file:
vim /etc/default/grub
* Look for "GRUB_CMDLINE_LINUX" and add the following "net.ifnames=0 biosdevname=0"
GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"
* Generate new grub config file
sudo grub-mkconfig -o /boot/grub/grub.cfg
==== Other config items ====
* configure screen to use the scroll back buffer
* configure screen to use the scroll back buffer
uncomment "termcapinfo xterm|xterms|xs|rxvt ti@:te@"
uncomment "termcapinfo xterm|xterms|xs|rxvt ti@:te@"
* configure bash compilation for interactive shells
* configure bash completion for interactive shells
vim /etc/bash.bashrc
vim /etc/bash.bashrc
uncomment the stuff below
uncomment the stuff below
echo "domain.allstarlink.org" >/etc/hostname
echo "domain.allstarlink.org" >/etc/hostname
* setup a firewall as /etc/network/firewall.sh and chmod +x it. You'll need to edit this based on the machine. Note the stuff in tampa uses a firewall on the HV too.
* set the default editor
update-alternatives --config editor
Then select #3 vim.basic
* setup a firewall and chmod +x it. You'll need to edit this based on the machine.
**For netplan place this file in '''''/etc/networkd-dispatcher/routable.d/50-ifup-hooks'''''
**For ifupdown place this file in '''''/etc/network/firewall.sh'''''
#!/bin/bash
#!/bin/bash
two-to-one{13209}: 44.1.1.1/32 === 44.2.2.2/32
two-to-one{13209}: 44.1.1.1/32 === 44.2.2.2/32
If they are not up, check /var/log/syslog and restart ipsec on both servers. Some times a server can get in a bad status if there is a mis-config. Also it's worth noting that IPSEC is processed by iptables once it's decrypted, the <code>iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT --src "$IPSECsrc" </code> line in the firewall allows all IPsec packets once decrypted to bypass the firewall. This is able to prevent traffic between unencrypted services on the servers (e.g. mysql will not connect if the ipsec is down).
If they are not up, check /var/log/syslog and restart ipsec on both servers. Some times a server can get in a bad status if there is a mis-config. Also it's worth noting that IPSEC is processed by iptables once it's decrypted, the <code>iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT --src "$IPSECsrc" </code> line in the firewall allows all IPsec packets once decrypted to bypass the firewall. This is able to prevent traffic between unencrypted services on the servers (e.g. mysql will not connect if the ipsec is down).
=== Configure Postfix ===
Postfix is installed to forward mail for root to a smtp host.
<code>apt-get install postfix mailutils</code>
This will run an installer with a curses interface and you must select '''Satallite System'''. Check the '''System mail''' name is the hostname of the server, and the '''SMTP relay host''' is ''morty.keekles.org''. '''Root and postmaster mail''' should be ''rootmail@allstarlink.org''.
Should you need to reconfigure this use:
<code> dpkg-reconfigure postfix </code>
other aliases are setup in /etc/aliases. You must run ''newaliases'' after this is updated for them to take effect.
= Verification =
= Verification =
* IPSEC is active <code>ipsec status</code>?
* IPSEC is active <code>ipsec status</code>?
* Does Screen work in an xterm with scroll back?
* Does Screen work in an xterm with scroll back?
* Is the time set via ntp <code>ntpdate</code> and is the timezone set to UTC?
* Is the time set via ntp <code>ntptime</code> and is the timezone set to UTC?
* Is fail2ban working? Make a couple test connections and see if the IP is null routed <code>ip route show</code>
* Is fail2ban working? Make a couple test connections and see if the IP is null routed <code>ip route show</code>
You may need to check your other services on this server now.
You may need to check your other services on this server now.
= Network Monitoring =
It's time to hand off the server to the NMS team. Please ensure SNMP is configured and an IPSEC tunnel is built to nms.allstarlink.org
Logging will be sucked up by graylog.
Please ensure it's being watched in librenms by asking on the admin list or in the slack.