`System Administration France'


Next: , Previous: (dir), Up: (dir)

Sysadmin France

This document is for system administrators, webmasters and users of GNU and FSF machines in France.

--- The Detailed Node Listing ---

Hosting facilities

Machine Accounts

Security

Firewall

Monitoring

Mrtg


Next: , Previous: Top, Up: Top

1 Introduction

No information on the philosophical and political goals of the FSF Europe in general and the FSFE France in particular can be found in this document.

The machines donated to the FSF Europe and hosted in France are part of the set of machines available to the GNU project. As such they follow the same rules and the same policy.

Reference documents describing the GNU environment are http://savannah.gnu.org/projects/sysadmin for system administration information and the Savannah admin guide for usage of the project hosting facility.

The essential URLs related to this document are:


Next: , Previous: Introduction, Up: Top

2 Hardware List

This list accurately describes the purpose of each piece of harware dedicated to the GNU project in France. It must not describe the interconnection between them. If something is running on these machines that do not match the intented purpose described here, it can be uninstalled without notice.


Next: , Previous: Hardware List, Up: Top

3 Hardware Setup

Each hardware is mentionned by its name in the See Hardware List. Each location is mentionned by its name in the See Hosting facilities. The sole purpose of this chapter is to describe the precise location of the corresponding hardware and its physical connections with other hardware.


Next: , Previous: Hardware Setup, Up: Top

4 Hosting facilities

Each section in this chapter describe a location where GNU machines are hosted in France.

If the people and contacts listed here are for some reason unable to fix an urgent problem, one can look into the sysadmin.texi document (entry Nevrax, Free.fr) in the private project http://savannah.gnu.org/projects/sysadmin/. This document list additional information that cannot be published to preserve the privacy of the people.


Next: , Previous: Hosting facilities, Up: Hosting facilities

4.1 Free

Free is one of the largest Internet provider in France. There is little chance that we are able to spot a connectivity problem which they overlook.

The range of IP addresses that is granted to us is:

213.228.62.2 - 213.228.62.14

The reverse is managed by Free and Antoine Levavasseur is the one to ask for a reverse change. The current setup is

     213.228.62.2 snail.gnu.org
     213.228.62.3 snail-ssh.gnu.org
     213.228.62.4 frog.gnu.org
     213.228.62.7 yoda.gnu.org(yoda.ipsyn.net)
     Linx
     124 bd de Verdun
     92400 Courbevoie
     +33 8 04 55 44 11


Previous: Free, Up: Hosting facilities

4.2 Nevrax

     Nevrax
     104 rue du Fg St Antoine
     75011 Paris
     +33 1 44 74 83 85

The leased line that connects Nevrax to the Internet is provided by

     COLT Telecommunication
     60 rue de Wattignies - Bat. B
     75012 PARIS
     Email : opi@fr.colt.net and support@fr.colt.net
     Phone : +33 1 44 29 58 99
     Fax   : +33 1 44 29 57 97

Here is a complete list of the mail threads related to solving problems when something goes wrong with the Internet connection.

Here is a list of people who know some about the machine and its connectivity and who actually did something in the past to improve or fix it.


Next: , Previous: Hosting facilities, Up: Top

5 Machine Accounts


Next: , Previous: Machines Accounts, Up: Machines Accounts

5.1 System Passwords

If you need the password of system users such as root or www on any GNU machines located in France you should ask to the following people:


Next: , Previous: System Passwords, Up: Machines Accounts

5.2 Account Create

The user accounts on fr.fsf.org and snail.gnu.org are managed with Savannah. If someone need a shell account on fr.fsf.org or snail.gnu.org she has to get an account on Savannah first. Then she should send a mail to one of the project administrators of the fsffr project. The project administrator adds her as a member of the fsffr project. Within 24 hours a cron job on fr.fsf.org and snail.gnu.org will fetch the new user from Savannah and create the corresponding account.


Next: , Previous: Account Create, Up: Machines Accounts

5.3 Account Access

Once the account is created, access to the machines is available using ssh and a public key. The Savannah password will not work on fr.fsf.org or snail.gnu.org. When logged on Savannah it is possible to register one or more public key at Edit SSH Keys.


Next: , Previous: Account Access, Up: Machines Accounts

5.4 Account Update

Once a day the ssh public keys of every account on fr.fsf.org or snail.gnu.org are updated from the information fetched on Savannah. If the authorized_keys file of a user is manually updated, it will be overwritten.


Next: , Previous: Account Update, Up: Machines Accounts

5.5 Account Delete

When a user is not listed anymore in the fsffr, its account is disabled on fr.fsf.org and snail.gnu.org. The home directory is not deleted and if the user is added again at a later time, she will retrieve his former home directory.


Next: , Previous: Account Delete, Up: Machines Accounts

5.6 Account www on fr.fsf.org

Every account created automatically as described above is also granted an access to the www user on fr.fsf..org (and not on snail.gnu.org). www owns the directory in which all the document roots of the apache server are : /home/www.

This is simply done by appending the public keys of all the users to the authorized_keys file of the www user.


Previous: Account www on fr.fsf.org, Up: Machines Accounts

5.7 Cron Job

The /usr/local/bin/savannahusers script does the user account updates. It is run from the /etc/cron.d/savannahusers cron file and spits log information in /var/log/savannahusers.log. The log file is rotated according to the /etc/logrotate.d/savannahusers specification. This holds for both fr.fsf.org and snail.gnu.org.

Savannah does not provide account information to non identified machines. The fr.fsf.org and snail.gnu.org machines are explicitly allowed to retrieve the relevant information. For more information check the Account Management chapter of the Savannah documentation.

The savannahusers script sources can be found in the www project source tree. It was checked out in /usr/local/src/www directory (on fr.fsf.org and snail.gnu.org), together with other GNU specific maintainance scripts.


Next: , Previous: Machines Accounts, Up: Top

6 Security


Next: , Previous: Security, Up: Security

6.1 Security alert

When there is a suspicion that a machine was compromised a mail should be sent to FSF France private mailing list and the following people can be contacted.

The intrusion related mails are kept in a private mail archive for future reference and are listed here.


Previous: Security alert, Up: Security

6.2 Firewall


Next: , Up: Firewall

Firewall

6.2.1 Firewall (fr.fsf.org)

A shell script applies filtering rules, it's located in fr.fsf.org:/etc/init.d/firewall. This script is compatible with kernel 2.2 and 2.4 and detects the kernel version using uname. ipchains is used with 2.2 and iptables with 2.4.

Warning : only the ipchains (2.2) section is well configured.

The policy applied is to close all TCP/UDP port by default and open only the ones we need.


Next: , Previous: Firewall (fr.fsf.org), Up: Firewall

6.2.2 Port control (snail.gnu.org and frog.gnu.org)

On snail.gnu.org and frog.gnu.org there is no firewall. Instead, only services needed to provide the services that match the intended purpose of the machine are launched. All other daemons are de-activated.


Previous: Port control (snail.gnu.org and frog.gnu.org), Up: Firewall

6.2.3 Port control (yoda.gnu.org)

On yoda.gnu.org there is a firewall. rules are in file yoda.gnu.org:/etc/iptables.rules which are read from script yoda.gnu.org:/etc/init.d/packetfilter. Tese rules are written for netfilter (iptables).


Next: , Previous: Security, Up: Top

7 Monitoring


Next: , Previous: Monitoring, Up: Monitoring

7.1 Netsaint

Netsaint was installed on http://snail.gnu.org/netsaint/. The configuration (/etc/netsaint/*) was created by hand. Neat was installed and can be used to fine tune the configuration.

This Netsaint instance is only supposed to watch over GNU machines.

Host groups were created for each hosting facilities so that different group of people can be sollicited if a problem occurs.

Contact : Cyril Bouthors


Previous: Netsaint, Up: Monitoring

7.2 Mrtg

mrtg and addons have been installed with apt-get, two packages :

Some more scripts are used, they are located in /usr/local/bin, they are coming from http://mrtg.xidus.net/


Next: , Previous: Mrtg, Up: Mrtg

7.2.1 Mrtg snail.gnu.org

The /var/www/mrtg/index.html file was generated with:

     make -C /etc/mrtg /var/www/mrtg/index.html

The /var/www/mrtg/storage/<host>.html files were generated with:

     make -C /etc/mrtg /var/www/mrtg/storage/<host>.html

Contact : Cyril Bouthors, Rodolphe Quiédeville


Previous: Mrtg snail.gnu.org, Up: Mrtg

7.2.2 Mrtg fr.fsf.org

Output dir is /var/www/fr.fsf.org/mrtg/

Contact : Rodolphe Quiédeville


Next: , Previous: Monitoring, Up: Top

8 Screen sessions

When logged in as root on frog.gnu.org or snail.gnu.org, one can connect to a shared screen(1) session via screen -x. These screen sessions contain terminals connected to the switch, the powerboot, the serial console. They are created at boot time by /etc/init.d/screen according to the content of ~root/.screenrc and use small shell scripts in /usr/local/bin to establish the connections. All sessions are logged permanently in /var/log/screen.

Although it is possible to talk to the switch or the powerboot without using the screen session, this is strongly discouraged because no log of the commands will be archived.

On all screen sessions, the escape character is C-\ instead of the default C-a so that editing stuff with emacs is not a nightmare.

A list of active windows is displayed permanently at the bottom of the screen session.

Most commonly used screen commands:


Next: , Previous: Screen sessions, Up: Top

9 Crash recovery

If snail.gnu.org crashes for some reason, do the following:


Next: , Previous: Crash recovery, Up: Top

Index of Concepts


Previous: Concept Index, Up: Top

Index of File Names

Short Contents

Table of Contents