This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
userspace:centos_6.3 [2013/02/06 17:52] SisterOfMercy |
userspace:centos_6.3 [2021/08/23 08:37] (current) |
||
---|---|---|---|
Line 6: | Line 6: | ||
So this is about a minimal install, without any additional packages. | So this is about a minimal install, without any additional packages. | ||
- | ===== preparation | + | ===== Preparation |
In the DHCP server on the network we use the mac address of the OPSI server to set a static lease. | In the DHCP server on the network we use the mac address of the OPSI server to set a static lease. | ||
Line 12: | Line 12: | ||
// | // | ||
With a different DHCP server you will have to look for the correct commands.\\ | With a different DHCP server you will have to look for the correct commands.\\ | ||
- | (insert | + | The static lease looks a bit like this (with DD-WRT): |
+ | {{http:// | ||
I use [[http:// | I use [[http:// | ||
Line 20: | Line 22: | ||
Now the CentOS server gets the IP address which was set in the DHCP server. This saves a lot of trouble, no messing with resolv.conf and //hostname -f// returns the correct hostname. | Now the CentOS server gets the IP address which was set in the DHCP server. This saves a lot of trouble, no messing with resolv.conf and //hostname -f// returns the correct hostname. | ||
- | ===== first part of installation ===== | + | ===== First part of installation ===== |
We first install xinetd and samba, then we start their services and make sure they start again when rebooting the server:\\ | We first install xinetd and samba, then we start their services and make sure they start again when rebooting the server:\\ | ||
- | //yum install xinetd samba\\ | + | <code winst> |
- | / | + | yum install xinetd samba |
- | / | + | / |
- | / | + | / |
- | chkconfig smb on\\ | + | / |
- | chkconfig nmb on\\ | + | chkconfig smb on |
- | chkconfig xinetd on//\\ | + | chkconfig nmb on |
+ | chkconfig xinetd on | ||
+ | </code> | ||
As you can see, mysql is not installed, but I do not have a license for the mysql-module, | As you can see, mysql is not installed, but I do not have a license for the mysql-module, | ||
Now we install the OPSI packages:\\ | Now we install the OPSI packages:\\ | ||
- | //yum install p7zip p7zip-plugins cabextract//\\ | + | <code winst> |
- | //yum install opsi-depotserver opsi-configed/ | + | yum install p7zip p7zip-plugins cabextract |
+ | yum install opsi-depotserver opsi-configed | ||
+ | </code> | ||
This is shamelessly copied from the [[http:// | This is shamelessly copied from the [[http:// | ||
- | /// | + | <code winst> |
- | / | + | / |
- | opsi-setup --auto-configure-samba\\ | + | / |
- | chkconfig opsiconfd on\\ | + | opsi-setup --auto-configure-samba |
- | chkconfig opsipxeconfd on\\ | + | chkconfig opsiconfd on |
- | / | + | chkconfig opsipxeconfd on |
- | / | + | / |
+ | / | ||
+ | </code> | ||
+ | ===== Iptables configuration ===== | ||
- | ===== iptables | + | To make OPSI work correctly we have to open some ports on the firewall. I can never remember the iptables |
- | To make OPSI work correctly we have to open some ports on the firewall. I can never remember | + | //(In my case, after clean installation of Centos 6.3 the path of the file is not the same. On my machine the file is located at: /etc/sysconf/iptables)//\\ |
<code winst> | <code winst> | ||
# Firewall configuration written by system-config-firewall | # Firewall configuration written by system-config-firewall | ||
Line 72: | Line 81: | ||
</ | </ | ||
We then restart iptables: /// | We then restart iptables: /// | ||
+ | |||
TCP port 22 is used by SSH. UDP port 69 is used by the TFTP server.\\ | TCP port 22 is used by SSH. UDP port 69 is used by the TFTP server.\\ | ||
UDP ports 137, 137 and TCP ports 139 and 445 are used by Samba.\\ | UDP ports 137, 137 and TCP ports 139 and 445 are used by Samba.\\ | ||
TCP ports 4441 and 4447 are of course used by OPSI.\\ | TCP ports 4441 and 4447 are of course used by OPSI.\\ | ||
- | ===== opsi configuration ===== | + | ===== OPSI configuration ===== |
Now we are going to edit the opsi configuration files:\\ | Now we are going to edit the opsi configuration files:\\ | ||
This is / | This is / | ||
Line 135: | Line 145: | ||
</ | </ | ||
- | ===== second | + | ===== Second |
Now we fire off the next part of commands:\\ | Now we fire off the next part of commands:\\ | ||
- | //opsi-setup --init-current-config// | + | <code winst> |
- | // | + | opsi-setup --init-current-config |
- | /// | + | opsi-setup --set-rights |
- | /// | + | /etc/init.d/ |
+ | / | ||
+ | </ | ||
+ | |||
+ | To set the password of the pcpatch user, we use this command:\\ | ||
+ | <code winst> | ||
+ | opsi-admin -d task setPcpatchPassword | ||
+ | </code> | ||
+ | Then we create the adminuser, set the linux password and the samba password: | ||
+ | <code winst> | ||
+ | useradd -m -s /bin/bash adminuser | ||
+ | passwd adminuser | ||
+ | smbpasswd -a adminuser | ||
+ | </ | ||
+ | We also add the adminuser to the opsiadmin and pcpatch group - at least if I am not mistaken: | ||
+ | <code winst> | ||
+ | usermod -aG opsiadmin adminuser | ||
+ | usermod -aG pcpatch adminuser | ||
+ | </ | ||
+ | You can check your work with these commands: | ||
+ | <code winst> | ||
+ | cat / | ||
+ | cat / | ||
+ | </ | ||
+ | |||
+ | Ok, now we are finally getting to the good stuff, letting OPSI install the rest of the packages: | ||
+ | <code winst> | ||
+ | opsi-product-updater -i -vv | ||
+ | </ | ||
+ | This is going to take some time if you do not have a fast internet connection. In the meantime you could check out the [[http:// | ||
+ | |||
+ | ===== Troubleshooting Samba and TFTP ===== | ||
+ | |||
+ | I opened https:// | ||
+ | My Samba share was not working, so I tried this: | ||
+ | <code winst> | ||
+ | opsi-setup --auto-configure-samba | ||
+ | opsi-setup --set-rights | ||
+ | /etc/init.d/ | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | </ | ||
+ | That did not help, and to make a long story short: SELinux was blocking access.\\ | ||
+ | <code winst> | ||
+ | yum install setroubleshoot-server | ||
+ | </code> | ||
+ | At least now SELinux alerts show up in /var/ | ||
+ | To enable exporting of samba shares we use this command: | ||
+ | <code winst> | ||
+ | setsebool -P samba_export_all_rw on | ||
+ | </ | ||
+ | Now we can use the samba shares! Doesn' | ||
+ | Well, this also happened a lot with the TFTP server, when serving netboot products. :-(\\ | ||
+ | After a SELinux alert I used these commands: | ||
+ | <code winst> | ||
+ | cd /root | ||
+ | cat / | ||
+ | checkmodule -M -m -o opsi-tftp.mod opsi-tftp.te | ||
+ | semodule_package -o opsi-tftp.pp -m opsi-tftp.mod | ||
+ | semodule -v -i opsi-tftp.pp | ||
+ | </ | ||
+ | Well, each time you recieve a SELinux alert you have to use these commands. And of course, to make it easier, you overwrite your last opsi-tftp.te, | ||
+ | <code winst> | ||
+ | module opsi-tftp 1.0; | ||
+ | |||
+ | require { | ||
+ | type smbd_t; | ||
+ | type var_lib_t; | ||
+ | class file getattr; | ||
+ | type tftpd_t; | ||
+ | type usr_t; | ||
+ | type tftpdir_t; | ||
+ | class fifo_file { read getattr open }; | ||
+ | class file { read getattr open }; | ||
+ | class lnk_file { read getattr }; | ||
+ | class capability { dac_read_search dac_override }; | ||
+ | } | ||
+ | |||
+ | # | ||
+ | allow tftpd_t self: | ||
+ | allow tftpd_t tftpdir_t: | ||
+ | allow tftpd_t usr_t:file { read getattr open }; | ||
+ | </ | ||
+ | If you copy this to your OPSI server, you would only have to use the above commands from ' | ||
+ | |||
+ | The setsebool command to fix the samba shares was whining about userIds or something. So I changed the UID of the opsiconfd and pcpatch account. Most distributions have no problems with system accounts with an UID below 1000, but with CentOS this is still limited to 500. This is not really necessary, but I'm trying to fix any strange messages I recieve. This thing is supposed to go into production.\\ | ||
+ | <code winst> | ||
+ | usermod -u 450 opsiconfd | ||
+ | usermod -u 451 pcpatch | ||
+ | groupmod -g 450 pcpatch | ||
+ | groupmod -g 451 opsiadmin | ||
+ | </ | ||
+ | |||
+ | ===== Troubleshooting OPSI ===== | ||
+ | |||
+ | When OPSI is having problems you could read the logfiles, but before you do, use these commands: | ||
+ | <code winst> | ||
+ | opsi-setup --init-current-config | ||
+ | opsi-setup --auto-configure-samba | ||
+ | opsi-setup --set-rights | ||
+ | / | ||
+ | /etc/init.d/ | ||
+ | </ | ||
+ | Most problems can be fixed this way. If this fails, then read the logfiles and try to find the problem.\\ | ||
+ | When copying files from other systems, be sure to run //opsi-setup --set-rights// | ||
+ | |||
+ | ===== Conclusion ===== | ||
+ | |||
+ | If I have transcribed my notes correctly you now have a working OPSI server!\\ | ||
+ | If not, it isn't my fault! ;-)\\ | ||
+ | \\ | ||
+ | I was talking with the nice people at uib.de, and it seems the mysql backend can be used for hardware and software audit purposes, without a license. When I find the time I will expand this entry to include the mysql configuration. | ||
+ | |||
+ | ==== Change to mysql for inventory ==== | ||
+ | |||
+ | |||
+ | That's right and we recommend to use the mysql-Database for inventory-functions. To change from file-backend to mysql for the inventory data, you must at first install the mysql-server. If you don't have done before, you can use the following commands: | ||
+ | |||
+ | <code bash> | ||
+ | yum install mysql-server | ||
+ | / | ||
+ | mysql_secure_installation | ||
+ | chkconfig mysqld on | ||
+ | </code> | ||
+ | |||
+ | No you can run opsi-setup to configure your mysql-database (create a opsi database, create opsi user, set privileges and patch backend-configuration file from opsi.) For the next step you need the root password, that you have set with the command: mysql_secure_installation: | ||
+ | |||
+ | <code bash> | ||
+ | opsi-setup --configure-mysql | ||
+ | </code> | ||
+ | |||
+ | Now you must configure the opsi-Dispatcher to use mysql for Hard- and Software Inventory (You should set the licensemanagement to mysql-server too. If you don't use opsi-licensemanagement, | ||
+ | |||
+ | < | ||
+ | / | ||
+ | </ | ||
+ | |||
+ | The important entries are the following: | ||
+ | |||
+ | |||
+ | backend_.* | ||
+ | ...\\ | ||
+ | license.* | ||
+ | softwareLicense.* | ||
+ | audit.* | ||
+ | ...\\ | ||
+ | |||
+ | After a new init-current-config and a webservice-restart your Inventory-data should be written in mysql: | ||
+ | |||
+ | <code bash> | ||
+ | opsi-setup --init-current-config | ||
+ | / | ||
+ | / | ||
+ | </ | ||
- | We also have to install | + | **Finally your right, |
- | //yum install java-1.7.0-openjdk// | + | |
- | I did not have any problems | + | |
- | update-alternatives --config java | ||
- | aslk; | ||
- | work in progress |