Sown-Auth Migration - Revision history

DavidNewman: All problems fixed :)

2015-05-25T12:04:52Z

All problems fixed :)

DavidNewman at 10:22, 22 May 2015

2015-05-22T10:22:50Z

← Older revision		Revision as of 10:22, 22 May 2015
Line 21:		Line 21:
	#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.		#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.
	#* /etc/freeradius/proxy.conf needs updating for shared secrets. However, these will only work via sown-auth's ECS IP. It is probably worth switching this over to auth2 and having this as auth2 primary ECS interface and auth2's current IP on a virtual interface on the same physical interface.		#* /etc/freeradius/proxy.conf needs updating for shared secrets. However, these will only work via sown-auth's ECS IP. It is probably worth switching this over to auth2 and having this as auth2 primary ECS interface and auth2's current IP on a virtual interface on the same physical interface.
			#* One problem was that auth and auth2 have different radius shared secret, so when auth's config was copied over this needed to be changed.
			#* auth2's /etc/network/interfaces set a gateway of eth0:1 (auth2's rather than auth's IP) which caused traffic to be routed out through the wrong interface/IP.
			#* Still some issues with the checks for ECS/SOTON servers. Suspect this is a shared secret issue.
	#* Reorganised the interfaces on auth2 but simply updating proxy.conf to what was running on auth does not work.		#* Reorganised the interfaces on auth2 but simply updating proxy.conf to what was running on auth does not work.
	#* Could Morse look at proxy.conf (and proxy.conf.old and proxy.conf.new) on auth2 in /etc/freeradius/.		#* Could Morse look at proxy.conf (and proxy.conf.old and proxy.conf.new) on auth2 in /etc/freeradius/.

DavidNewman at 17:33, 21 May 2015

2015-05-21T17:33:49Z

← Older revision		Revision as of 17:33, 21 May 2015
Line 1:		Line 1:
	''Priority Key: 1 = Fix ASAP, 2 = Not a big problem if takes a week or two to fix, 3 = Would like to fix but can be left to last.''		''Priority Key: 1 = Fix ASAP, 2 = Not a big problem if takes a week or two to fix, 3 = Would like to fix but can be left to last.''
	# Move NWMONITOR/NAGIOS check to gw as that is a box that is know to be monitored by NWMONITOR. (Priority 3)		# <strike>Move NWMONITOR/NAGIOS check to gw as that is a box that is know to be monitored by NWMONITOR.</strike> (Priority 3)
	#* This requires some iptables and syslog configuration.		#* This requires some iptables and syslog configuration.
	#* It would be useful if this could be documented, in case we want to move/add to another server in future.		#* It would be useful if this could be documented, in case we want to move/add to another server in future.
			#* Ported syslog-ng config. Need some manipulation as auth2 only running syslog-ng 2 (not 3).
			#* Added iptables rule to /etc/rc.local (nasty).
	#* Morse is best placed to do this.		#* Morse is best placed to do this.
	# <strike>Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth.</strike> (Priority 2)		# <strike>Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth.</strike> (Priority 2)

DavidNewman: Fixed SVN/Git checks for SOWN-Bot from the repo end

2015-05-20T21:39:44Z

Fixed SVN/Git checks for SOWN-Bot from the repo end

← Older revision		Revision as of 21:39, 20 May 2015
Line 4:		Line 4:
	#* It would be useful if this could be documented, in case we want to move/add to another server in future.		#* It would be useful if this could be documented, in case we want to move/add to another server in future.
	#* Morse is best placed to do this.		#* Morse is best placed to do this.
	# Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth. (Priority 2)		# <strike>Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth.</strike> (Priority 2)
	#* daveruss will look into fixing this.		#* daveruss will look into fixing this.
	#* This are now fixed from SOWN-Bot's end.		#* This are now fixed from SOWN-Bot's end.
			#* This has been fixed on auth2 and monitor SVN/GIT repo end. SVN repos on dev have also been added with a new cron jobn on dev.
	#* These will need fixing SVN/Git repo end with db credential; updates and new users / granted privileges in the database.		#* These will need fixing SVN/Git repo end with db credential; updates and new users / granted privileges in the database.
	# <strike>Move passive Debsums cron job checks to auth2 and make sure all supporting files are also copied accross.</strike> (Priority 2)		# <strike>Move passive Debsums cron job checks to auth2 and make sure all supporting files are also copied accross.</strike> (Priority 2)

DavidNewman: Fixed debsums checks

2015-05-20T19:37:08Z

Fixed debsums checks

← Older revision		Revision as of 19:37, 20 May 2015
Line 8:		Line 8:
	#* This are now fixed from SOWN-Bot's end.		#* This are now fixed from SOWN-Bot's end.
	#* These will need fixing SVN/Git repo end with db credential; updates and new users / granted privileges in the database.		#* These will need fixing SVN/Git repo end with db credential; updates and new users / granted privileges in the database.
	# Move Debsums to auth2 and make sure ~~DEBSUMS checks run~~ are ~~run there~~. (Priority 2)		# <strike>Move passive Debsums cron job checks to auth2 and make sure all supporting files are also copied accross.</strike> (Priority 2)
	#* daveruss ~~will look into~~ this		#* daveruss has now done this and all the checks have gone OK.
	# <strike>Remove auth as a DNS server from all bind configuration.</strike> (Priority 2)		# <strike>Remove auth as a DNS server from all bind configuration.</strike> (Priority 2)
	#* daveruss has removed ns2 record associated with auth for ipv4 ipv6 and reverse records.		#* daveruss has removed ns2 record associated with auth for ipv4 ipv6 and reverse records.

DavidNewman: Fixed last website widget

2015-05-20T12:43:03Z

Fixed last website widget

← Older revision		Revision as of 12:43, 20 May 2015
Line 22:		Line 22:
	# <strike>Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.</strike> (Priority 2)		# <strike>Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.</strike> (Priority 2)
	#* daveruss has done this marking the commented out lines with "auth-based check".		#* daveruss has done this marking the commented out lines with "auth-based check".
	# Fix widgets on www.sown.org.uk homepage for host and service checks, etc. (Priority 1)		# <strike>Fix widgets on www.sown.org.uk homepage for host and service checks, etc. (Priority 1)</strike>
	#* daveruss will look into this.		#* daveruss will look into this.
	#* Moved to sown-monitor and renamed directory status-icinga and updated the file_get_contents URLs on the public website, which are now mainly working.		#* Moved to sown-monitor and renamed directory status-icinga and updated the file_get_contents URLs on the public website, which are now mainly working.
	#* Still having some problems with the generateNodeXML.php script which is probably the reason the map is currently broken.		#* Still having some problems with the generateNodeXML.php script which is probably the reason the map is currently broken.
			#** This was due to the code not dealing very well with exactly one node being deployed and up.

DavidNewman: Added priortities

2015-05-20T08:50:05Z

Added priortities

DavidNewman: Updated migration status

2015-05-20T08:41:58Z

Updated migration status

← Older revision		Revision as of 08:41, 20 May 2015
Line 5:		Line 5:
	# Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth.		# Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth.
	#* daveruss will look into fixing this.		#* daveruss will look into fixing this.
			#* This are now fixed from SOWN-Bot's end.
			#* These will need fixing SVN/Git repo end with db credential; updates and new users / granted privileges in the database.
	# Move Debsums to auth2 and make sure DEBSUMS checks run are run there.		# Move Debsums to auth2 and make sure DEBSUMS checks run are run there.
	#* daveruss will look into this		#* daveruss will look into this
	# Remove auth as a DNS server from all bind configuration.		# <strike>Remove auth as a DNS server from all bind configuration.</strike>
	#* daveruss has removed ns2 record associated with auth for ipv4 ipv6 and reverse records.		#* daveruss has removed ns2 record associated with auth for ipv4 ipv6 and reverse records.
	# Check all resolv.conf files for auth (10.13.0.252) still being used as a DNS server.		# <strike>Check all resolv.conf files for auth (10.13.0.252) still being used as a DNS server.</strike>
	#* daveruss has checked all the resolv.conf files and resolvconf.d files and removed all references to 10.13.0.252.		#* daveruss has checked all the resolv.conf files and resolvconf.d files and removed all references to 10.13.0.252.
	# Radius checks for Radmatrix need to be moved to auth2.		# Radius checks for Radmatrix need to be moved to auth2.
Line 15:		Line 17:
	#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.		#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.
	#* /etc/freeradius/proxy.conf needs updating for shared secrets. However, these will only work via sown-auth's ECS IP. It is probably worth switching this over to auth2 and having this as auth2 primary ECS interface and auth2's current IP on a virtual interface on the same physical interface.		#* /etc/freeradius/proxy.conf needs updating for shared secrets. However, these will only work via sown-auth's ECS IP. It is probably worth switching this over to auth2 and having this as auth2 primary ECS interface and auth2's current IP on a virtual interface on the same physical interface.
	# Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.		#* Reorganised the interfaces on auth2 but simply updating proxy.conf to what was running on auth does not work.
			#* Could Morse look at proxy.conf (and proxy.conf.old and proxy.conf.new) on auth2 in /etc/freeradius/.
			# <strike>Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.</strike>
	#* daveruss has done this marking the commented out lines with "auth-based check".		#* daveruss has done this marking the commented out lines with "auth-based check".
	# Fix widgets on www.sown.org.uk homepage for host and service checks, etc.		# Fix widgets on www.sown.org.uk homepage for host and service checks, etc.
	#* daveruss will look into this.		#* daveruss will look into this.
			#* Moved to sown-monitor and renamed directory status-icinga and updated the file_get_contents URLs on the public website, which are now mainly working.
			#* Still having some problems with the generateNodeXML.php script which is probably the reason the map is currently broken.

DavidNewman: Added SOWN auth's migration page

2015-05-19T01:52:27Z

Added SOWN auth's migration page

New page

# Move NWMONITOR/NAGIOS check to gw as that is a box that is know to be monitored by NWMONITOR.
#* This requires some iptables and syslog configuration.
#* It would be useful if this could be documented, in case we want to move/add to another server in future.
#* Morse is best placed to do this.
# Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth.
#* daveruss will look into fixing this.
# Move Debsums to auth2 and make sure DEBSUMS checks run are run there.
#* daveruss will look into this
# Remove auth as a DNS server from all bind configuration.
#* daveruss has removed ns2 record associated with auth for ipv4 ipv6 and reverse records.
# Check all resolv.conf files for auth (10.13.0.252) still being used as a DNS server.
#* daveruss has checked all the resolv.conf files and resolvconf.d files and removed all references to 10.13.0.252.
# Radius checks for Radmatrix need to be moved to auth2.
#* These have been moved, as has check_eapol script.
#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.
#* /etc/freeradius/proxy.conf needs updating for shared secrets. However, these will only work via sown-auth's ECS IP. It is probably worth switching this over to auth2 and having this as auth2 primary ECS interface and auth2's current IP on a virtual interface on the same physical interface.
# Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.
#* daveruss has done this marking the commented out lines with "auth-based check".
# Fix widgets on www.sown.org.uk homepage for host and service checks, etc.
#* daveruss will look into this.

← Older revision		Revision as of 12:04, 25 May 2015
Line 17:		Line 17:
	# <strike>Check all resolv.conf files for auth (10.13.0.252) still being used as a DNS server.</strike> (Priority 1)		# <strike>Check all resolv.conf files for auth (10.13.0.252) still being used as a DNS server.</strike> (Priority 1)
	#* daveruss has checked all the resolv.conf files and resolvconf.d files and removed all references to 10.13.0.252.		#* daveruss has checked all the resolv.conf files and resolvconf.d files and removed all references to 10.13.0.252.
	# Radius checks for Radmatrix need to be moved to auth2. (Priority 1)		# <strike>Radius checks for Radmatrix need to be moved to auth2.</strike> (Priority 1)
	#* These have been moved, as has check_eapol script.		#* These have been moved, as has check_eapol script.
	#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.		#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.
Line 26:		Line 26:
	#* Reorganised the interfaces on auth2 but simply updating proxy.conf to what was running on auth does not work.		#* Reorganised the interfaces on auth2 but simply updating proxy.conf to what was running on auth does not work.
	#* Could Morse look at proxy.conf (and proxy.conf.old and proxy.conf.new) on auth2 in /etc/freeradius/.		#* Could Morse look at proxy.conf (and proxy.conf.old and proxy.conf.new) on auth2 in /etc/freeradius/.
			#* The localhost config in proxy.conf is used to find the shared secret for ECS ans SOTON servers. So the RADIUS secret for auth2 needs to be the same as was used for auth.
			#* After changing this restarted freeradius. Also restart some apache servers on various machines to make sure they can work with radius (shouldn't be necessary).
			#* Need to update freeradius secret for PHP eapol_test function in /etc/php5/conf.d/eapol_test.ini
	# <strike>Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.</strike> (Priority 2)		# <strike>Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.</strike> (Priority 2)
	#* daveruss has done this marking the commented out lines with "auth-based check".		#* daveruss has done this marking the commented out lines with "auth-based check".

← Older revision		Revision as of 08:50, 20 May 2015
Line 1:		Line 1:
	# Move NWMONITOR/NAGIOS check to gw as that is a box that is know to be monitored by NWMONITOR.		''Priority Key: 1 = Fix ASAP, 2 = Not a big problem if takes a week or two to fix, 3 = Would like to fix but can be left to last.''
			# Move NWMONITOR/NAGIOS check to gw as that is a box that is know to be monitored by NWMONITOR. (Priority 3)
	#* This requires some iptables and syslog configuration.		#* This requires some iptables and syslog configuration.
	#* It would be useful if this could be documented, in case we want to move/add to another server in future.		#* It would be useful if this could be documented, in case we want to move/add to another server in future.
	#* Morse is best placed to do this.		#* Morse is best placed to do this.
	# Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth.		# Fix SOWN-Bot's SVN/Git reminders so they don't depend or check SVNs on auth. (Priority 2)
	#* daveruss will look into fixing this.		#* daveruss will look into fixing this.
	#* This are now fixed from SOWN-Bot's end.		#* This are now fixed from SOWN-Bot's end.
	#* These will need fixing SVN/Git repo end with db credential; updates and new users / granted privileges in the database.		#* These will need fixing SVN/Git repo end with db credential; updates and new users / granted privileges in the database.
	# Move Debsums to auth2 and make sure DEBSUMS checks run are run there.		# Move Debsums to auth2 and make sure DEBSUMS checks run are run there. (Priority 2)
	#* daveruss will look into this		#* daveruss will look into this
	# <strike>Remove auth as a DNS server from all bind configuration.</strike>		# <strike>Remove auth as a DNS server from all bind configuration.</strike> (Priority 2)
	#* daveruss has removed ns2 record associated with auth for ipv4 ipv6 and reverse records.		#* daveruss has removed ns2 record associated with auth for ipv4 ipv6 and reverse records.
	# <strike>Check all resolv.conf files for auth (10.13.0.252) still being used as a DNS server.</strike>		# <strike>Check all resolv.conf files for auth (10.13.0.252) still being used as a DNS server.</strike> (Priority 1)
	#* daveruss has checked all the resolv.conf files and resolvconf.d files and removed all references to 10.13.0.252.		#* daveruss has checked all the resolv.conf files and resolvconf.d files and removed all references to 10.13.0.252.
	# Radius checks for Radmatrix need to be moved to auth2.		# Radius checks for Radmatrix need to be moved to auth2. (Priority 1)
	#* These have been moved, as has check_eapol script.		#* These have been moved, as has check_eapol script.
	#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.		#* eapol_test has been recompiled on auth2 and placed in the appropriate directory.
	#* /etc/freeradius/proxy.conf needs updating for shared secrets. However, these will only work via sown-auth's ECS IP. It is probably worth switching this over to auth2 and having this as auth2 primary ECS interface and auth2's current IP on a virtual interface on the same physical interface.		#* /etc/freeradius/proxy.conf needs updating for shared secrets. However, these will only work via sown-auth's ECS IP. It is probably worth switching this over to auth2 and having this as auth2 primary ECS interface and auth2's current IP on a virtual interface on the same physical interface.
	#* Reorganised the interfaces on auth2 but simply updating proxy.conf to what was running on auth does not work.		#* Reorganised the interfaces on auth2 but simply updating proxy.conf to what was running on auth does not work.
	#* Could Morse look at proxy.conf (and proxy.conf.old and proxy.conf.new) on auth2 in /etc/freeradius/.		#* Could Morse look at proxy.conf (and proxy.conf.old and proxy.conf.new) on auth2 in /etc/freeradius/.
	# <strike>Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.</strike>		# <strike>Remove Icinga config (MySQL query to auth sown_data DB, service checks, service dependencies etc.) that are dependent on auth.</strike> (Priority 2)
	#* daveruss has done this marking the commented out lines with "auth-based check".		#* daveruss has done this marking the commented out lines with "auth-based check".
	# Fix widgets on www.sown.org.uk homepage for host and service checks, etc.		# Fix widgets on www.sown.org.uk homepage for host and service checks, etc. (Priority 1)
	#* daveruss will look into this.		#* daveruss will look into this.
	#* Moved to sown-monitor and renamed directory status-icinga and updated the file_get_contents URLs on the public website, which are now mainly working.		#* Moved to sown-monitor and renamed directory status-icinga and updated the file_get_contents URLs on the public website, which are now mainly working.
	#* Still having some problems with the generateNodeXML.php script which is probably the reason the map is currently broken.		#* Still having some problems with the generateNodeXML.php script which is probably the reason the map is currently broken.