697251 - new puppetized people server

Status: RESOLVED FIXED

(Infrastructure & Operations :: Infrastructure: Other, task)

Description

[Corey Shields [:cshields]]

We need to replicate people.m.c (dm-peep01) in puppet so that we can build out a new server for scl3 and ditch the old.

Not quite sure how to go about finding all of the "uses" of people, the installed rpm list might be a start (to catch stuff like irssi, screen, shells, etc) and apache with public_html is a must.  Probably good to consult with oremj and see if the webapp module should be worked in to this, or if a one-off httpd setup in puppet for home dirs would be easier.

Grab a VM to test with.  Closer to SCL3 we will get new hw to install this on and migrate.

Comment 1

[Guillaume Destuynder [:kang] [this account is no longer active]]

Just as a reminder from our discussion:
we should use the new umask (0027) on this system by default (via puppet), and have setgid on /home/*/public_html for the web server to be able to access files that are copied there by default.

Comment 2

[Joe Stevensen [:joe]]

Also to note, this system, like all systems in the future will run the OSSEC HIDS agent. The current people server does not have OSSEC, so I just wanted to point this out.

OSSEC will give us the ability to better monitor the server for attempted breakins.

Comment 3

[Brian Hourigan [:digi]]

I've included ossec in the shellserver module. Ready for testing once a vm is setup.

Comment 4

[Brian Hourigan [:digi]]

Still waiting for vm - once this is setup I can validate the people shell_server module

Comment 5

[Brian Hourigan [:digi]]

I've puppetized the new people server. Included OSSEC and the new umask. Waiting for input from Jabba on how to ensure permissions on globbed patterns (*/public_html)

people-test.dmz.sjc1.mozilla.com

Comment 6

[Corey Shields [:cshields]]

(In reply to Brian Hourigan [:digi] from comment #5)
> I've puppetized the new people server. Included OSSEC and the new umask.
> Waiting for input from Jabba on how to ensure permissions on globbed
> patterns (*/public_html)
> 
> people-test.dmz.sjc1.mozilla.com

Next step would be to email infra-all@ and ask for people to test the new 'people'.. Meaning we should get proper netflows to this VM so that it is directly accessible from the outside.

Such note (and probably MOTD) should dictate that any data saved on this VM will -not- be migrated to the new server.  This is just a testbed to make sure that we have recreated the same functionality as the old people, and then we will rebuild in SCL3.

Comment 7

[Brian Hourigan [:digi]]

The ldap_users stuff isn't done yet, I have a few open emails to Jabba about this. Once I can work with him to get this part completed it will truly be ready for testing

Meanwhile I did file a netops bug and I added some info to MOTD

Comment 8

[Brian Hourigan [:digi]]

I set this host up in Zeus as per Jabba, Zeus VIP added to DNS:

people-test.mozilla.com

Comment 9

[Brian Hourigan [:digi]]

I worked with Jabba and there is now a ldap users module attached, however, it's not loading because of execution timeout on the puppet master. Will need to wait for new puppetmaster until testing can proceed

Comment 10

[Brian Hourigan [:digi]]

Certificate updated from wildcard mozilla.org to allizom.org

Comment 11

[Brian Hourigan [:digi]]

I reinstalled this system as I tore it up building rpms for another bug. I have a quick script to commit and testing may commence

Comment 12

[Brian Hourigan [:digi]]

Instead of branching Jabba's ldap users module I wrote a script to manage permissions, will complete testing and commit this today

Comment 13

[Rob Tucker [:rtucker]]

The people-test.dmz.vmx vm is set to move, however it seems like it can be left behind. Can you confirm?

Comment 14

[Brian Hourigan [:digi]]

people-test can be left behind

Comment 15

[Corey Shields [:cshields]]

new people server cutover will be on 5/12/12

Comment 16

[Shyam Mani [:fox2mike]]

Cutover complete, there are some minor issues, but this doesn't block scl3 anymore.

Comment 17

[Brian Hourigan [:digi]]

Cutover complete.