Archive Trac jetstream

Jetstream

Legacy Trac archive page imported from jetstream. Source: https://genapp.rocks/wiki/wiki/jetstream. Review age, links, and examples before treating as current.

Jetstream

• migration instances setup under 2017 xsede allocation

• notes for multi-project runs

• namd production notes

• sharing image notes

• manage vms

• openstack dashboard - use TACC creds

• network notes

• openstack management notes

• created a ubuntu 14.04.3 LTS "genapp test" image m1.small (2 cpus 20 GB disk) at 149.165.172.193 (ip changes after suspend)

• open web shell

• cat >> .ssh/authorized_keys

  • put in your key, then you can access
  • with their web shell, esc key seems funky

• install steps ubuntu14.04

sudo apt-get -y install subversion && sudo mkdir /src && sudo chmod a+rwx /src && cd /src && svn co svn://gw105.iu.xsede.org/svn/base/genapp genapp && genapp/sbin/install

• install steps centos6.7 & redhat 6.7, 6.8

sudo yum install -y subversion && sudo mkdir /src && sudo chmod a+rwx /src && cd /src && svn co svn://gw105.iu.xsede.org/svn/base/genapp genapp && genapp/sbin/install

• install steps centos6.7 & redhat 6.7, 6.8 with svn+ssh checkout

sudo yum install -y subversion && sudo mkdir /src && sudo chmod a+rwx /src && cd /src && svn co svn+ssh://<redacted-email>/svn/base/genapp genapp

• extra's for me ubuntu, centos

sudo apt-get -y install emacs24-nox
sudo apt-get -y install emacs-nox
sudo yum -y install emacs-nox
mkdir ~/bin
cat <<__EOF > ~/bin/e
env TERM=vt100 emacs -nw \$*
__EOF
cat <<__EOF > ~/bin/s
ls -sxF \$*
__EOF
cat <<__EOF > ~/bin/lth
ls -lt \$* | head -40
__EOF
chmod +x ~/bin/*
cat <<__EOF > ~/p
export EDITOR=vi
. /etc/profile
__EOF

ffmpeg ubuntu 14.04

sudo add-apt-repository -y ppa:mc3man/trusty-media
sudo apt-get -y update
sudo apt-get -y dist-upgrade
sudo apt-get -y install ffmpeg

todo

• setup of postfix for mail?

• dis5mod pcntl if already installed (php -m to check)

• finish & test install.pl for ubuntu 14.04

  • [done] jobs running
  • [done] multiplex ws messaging
  • nice startup for the web socket server
  • add pid files?
    • create/test on slackgenapp
    • write msg_udp.pid & msg_ws.pid ?
    • make rc. like file for start/stop/restart
  • startup messaging (rc.genapp ?)
  • add https support ? (create certs etc)
  • sshd.config to restrict users (check with jetstream management for those they need)
  • {{{AllowGroups root users}}}

• then ubuntu 16, centos 6 & 7

CentOS/RedHat

• httpd2.4 and other repository

  • {{{yum install centos-release-scl}}}
  • {{{yum --disablerepo="*" --enablerepo=centos-sclo-rh list available}}}
  • {{{yum --disablerepo="*" --enablerepo=centos-sclo-sclo list available}}}
  • {{{yum-config-manager --enable rhel-server-rhscl-6-rpms}}}
  • {{{yum --disablerepo="*" --enablerepo=rhel-server-rhscl-6-rpms list available}}}

• centos 6.7 seems to work

• getapp.pl

  • add setup of default appconfig, directives info into etc (during install.pl or maybe a sysconfig setup?)
  • read this sysconfig file when installing a new instance
  • merge with htmlsetuppaths?

• test installing & setup

• aws ?

  • pretty much all rhel instances available

• rhel 6.7 (aws) & 6.8 tested (virtbox'd)

• apache http is 2.2.15, proxying ws is an issue

  • upgrade to 2.4.6 redhat developers blog about 2.4 on rh
  • looks like they also have a php 5.5 repo
  • does it work for centos?
  • selinux
  • CentOS SELinux howto
    • important commands
    • chcon
    • ls -Z
    • setenforce/getenforce
    • /etc/selinux/config
    • sealert -a /var/log/audit/audit.log
    • yum install "setroubleshoot" log info
    • semodule add/list/remove modules
    • make permissive only httpd {{{semanage permissive -a httpd_t}}}
  • testing workarounds suggested by sealert
  1. setsebool -P httpd_can_network_connect 1
  2. audit2allow some info on this
  • audit2allow -a
  • audit2allow -a -M genapp_httpd_write
  • makes the file genapp_httpd_write.te

module genapp_httpd_write 1.0;

require {
        type anon_inodefs_t;
        type httpd_t;
        class file write;
}

#============= httpd_t ==============
allow httpd_t anon_inodefs_t:file write;

- then compile {{{ checkmodule -M -m -o genapp_httpd_write.mod genapp_httpd_write.te && semodule_package -o genapp_httpd_write.pp -m genapp_httpd_write.mod }}}
- install in kernel {{{ semodule -i genapp_httpd_write.pp }}}

• also

module genapp_httpd_getattr 1.0;

require {
        type httpd_t;
        type default_t;
        class file getattr;
}

#============= httpd_t ==============
allow httpd_t default_t:file getattr;

module genapp_httpd_read_execute 1.0;

require {
        type httpd_t;
        type default_t;
        class file { getattr write read execute };
}

#============= httpd_t ==============
allow httpd_t default_t:file { read execute };