Workshop:2019/06/01: Difference between revisions

Latest revision as of 09:57, 30 May 2019

<< Meeting 30 May 2019 18:00:00 | Current Event: 1 June 2019 11:00:00 | Meeting 6 June 2019 18:00:00 >>

[[|]] | Current Workshop:

[[|]]

Workshop (to be) held from 11:00-17:00 on 2019/06/01 in Zepler CLS Lecture Room

SOWN Workshop

Task list

Look at how the SOWN works and consider how it can be modularised
- Discuss how to implement SOWN login for SSH to SOWN servers.
- Possible Modules
  - User Authentication
    - Possible abstract with implementation for first RADIUS and maybe later others and
  - Single Sign On (uses User authentication)
  - VPN (OpenVPN sits underneath)
  - Node setup
  - Node admin
  - Node config
  - Node firmware build
  - Node package management
  - Monitoring (nodes and servers)
  - Firewall
  - Routing
  - Usage accounting
- May help with implementation of SSH login to individual servers for individual users described above.
Consider how we can expand SOWN coverage
- More SOWN nodes
- Make it easier to deploy eduroam on own hardware
Update keepalived on gateway servers
Renew CRLs for tunnelbroker
Investigate reboot issues with sown-auth2 where routes do not get setup as needed
Planning for what needs to be done before upgrading sown-auth2 OS
- Fix eapol_test.so on www so works with PHP 7.0
Update to SOWN firmware to fix known issue with dnsmasq amongst other bug fixes
Routing issues between sown-www and sown-monitor
- Remove routes to force traffic to ECS DMZ servers, via the gateways' DMZ interface as ECS firewall changes should have been made
- Switch SSH checks for sown-www and suws-marconi to be proxy checks using nrpe on sown-auth2
Upgrade sown-radius2 and sown-vpn2 to Ubuntu 18.04
- Maybe worth installing from scratch and using Ansible playbooks to reinstall stuff.

Todo list tasks

It is unlikely we would actually do any of these tasks but they are useful to be aware of during our discussions of points in the main task list.

@@ Line 11: / Line 11: @@
 * Look at how the SOWN works and consider how it can be modularised
 ** Discuss how to implement SOWN login for SSH to SOWN servers.
-** Possible first modules: RADIUS authentication and SSO to sit on top.
+** Possible Modules
-*** May help with implementation of SSH login to individual servers for individual users described above.
+*** User Authentication
+**** Possible abstract with implementation for first RADIUS and maybe later others and
+*** Single Sign On (uses User authentication)
+*** VPN (OpenVPN sits underneath)
+*** Node setup
+*** Node admin
+*** Node config
+*** Node firmware build
+*** Node package management
+*** Monitoring (nodes and servers)
+*** Firewall
+*** Routing
+*** Usage accounting
+** May help with implementation of SSH login to individual servers for individual users described above.
 * Consider how we can expand SOWN coverage
 ** More SOWN nodes
@@ Line 25: / Line 38: @@
 ** Remove routes to force traffic to ECS DMZ servers, via the gateways' DMZ interface as ECS firewall changes should have been made
 ** Switch SSH checks for sown-www and suws-marconi to be proxy checks using nrpe on sown-auth2
+* Upgrade sown-radius2 and sown-vpn2 to Ubuntu 18.04
+** Maybe worth installing from scratch and using Ansible playbooks to reinstall stuff.
 === Todo list tasks ===
-It is unlikely we would actually do any of these tasks but they are useful to bb aware of during our discussions of points in the main task list.
+It is unlikely we would actually do any of these tasks but they are useful to be aware of during our discussions of points in the main task list.
 * [[sown:todo:task/628|Munge check_eapol script to allow it to send RADIUS accounting start and stop messages to keep iSolutions happy]]
 * [[sown:todo:task/590|Consider how to setup openwrt git repo and branches so it can easily be pushed/pulled on buildroot and buildroot-dev]]