Compare <code> and <code text> blocks:
<code>
*filter
# This will allow all loopback (lo0) traffic and drop all traffic to 127/8
# that does not use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
# This accepts all already established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# This allows all outbound traffic
-A OUTPUT -j ACCEPT
</code>
<code text>
*filter
# This will allow all loopback (lo0) traffic and drop all traffic to 127/8
# that does not use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
# This accepts all already established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# This allows all outbound traffic
-A OUTPUT -j ACCEPT
</code>
In dokuwiki text formatting option adds single spaces in the blank lines. Not helpful in the case of iptables rules files, where these spaces break the parser…
Way to change primary interface – edit /etc/hosts to change ip address returned when cman does lookup of system hostname.
e.g.
127.0.0.1 localhost.localdomain localhost
192.168.40.6 Hildasay.physics.gla.ac.uk Hildasay pvelocalhost
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
With this config cman will return 192.168.40.6 as the address totem should bind to for its multicast stuff.
There may be certificate problems doing this. Probably best in future to install Proxmox with the initial interface on the SAN (or other appropriate private network).
Proxy
In addition to the web interface setting (for the cluster), need to configure aptitude as well. Add to somewhere appropriate (e.g. /etc/apt/apt.conf.d/70debconf)
Acquire::http::Proxy "http://wwwcache.gla.ac.uk:8080";
Acquire::ftp::Proxy "http://wwwcache.gla.ac.uk:8080";
Time
Have to set up NTP on each system as before. Edit /etc/ntp.conf to add:
server login.physics.gla.ac.uk iburst
and restart the service
Check with ntpq -p , output will look something like:
remote refid st t when poll reach delay offset jitter
==============================================================================
*puck.physics.gl 130.159.196.117 3 u 41 64 17 0.244 0.154 0.115
s02.be.it2go.eu .STEP. 16 u - 64 0 0.000 0.000 0.000
utl-ntp.evo.hlm .STEP. 16 u - 64 0 0.000 0.000 0.000
218-32-169-193. .STEP. 16 u - 64 0 0.000 0.000 0.000
wan1.dgeb.info .STEP. 16 u - 64 0 0.000 0.000 0.000
Time needs to be reasonably accurate before attempting cluster join!
Read more...
N.B. Gave up on this – taking too much time and effort for something that would require some command line admin anyway – such as the mailer configuration. Will go back to purely standard setup on Debian like existing servers.
Minimum setup
Network
To get network going edit ifcfg-eth0 in /etc/sysconfig/network-scripts/
Need to use vi for this – minimal install doesn’t have anything else.
DEVICE="eth0"
NM_CONTROLLED=no
ONBOOT=yes
HWADDR=6E:89:F7:F2:8B:47
TYPE=Ethernet
BOOTPROTO=none
IPADDR=130.209.45.49
NETMASK=255.255.255.0
GATEWAY=130.209.45.1
DNS1=130.209.4.16
DNS2=130.209.4.18
DNS3=130.209.16.6
DOMAIN=physics.gla.ac.uk
IPV6INIT=no
NAME="System eth0"
UUID=5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03
The UUID here was put in by the GUI network setup, as was some of the other stuff. The minimum required is IPADDR, BOOTPROTO (maybe?), NETMASK, GATEWAY, DNS1(2,3,etc).
Read more...
LDAP server package is slapd. LDAP command-line stuff gets installed along with it.
First database is set up automatically – only requirement is admin password. Root DN is taken from host IP domain name – so get dc=physics,dc=gla,dc=ac,dc=uk if not careful. And with OpenLDAP there’s no easy way to delete databases.
Browsers
Web-based
phpLDAPadmin works reasonably well as a server-based browser. Needs Apache. This template gives you users with the RDN set to uid rather than cn, and email entry.
Read more...