DER's LLC - User contributions [en]

SpectroCloud/VertexInstall

2024-11-26T15:41:30Z

Admin: /* Vertex UI */

=Vertex Installation Instructions=
==Vertex Installation==
===Pre Requisites===
====1. Needed Downloads====
* Binaries: airgap-base-ova (ex. spectro-airgap-podman-v3.1.4.ova)
* Binaries: airgap-fips (ex. airgap-vertex-v4.5.11.bin)
* Binaries: airgap-fips-scar-zip (ex. scar-airgap-vertex-v4.5.11.zip)
* Capi OS Image: k8s_fips (ex. u-2004-0-k-1305-fips.ova)
* Airgap Binaries: kubernetes-<version> (ex. airgap-vertex-pack-kubernetes-1.30.5.bin)
* Airgap Binaries: kubernetes-<version> (ex. airgap-vertex-pack-kubernetes-1.29.9.bin)

====2. vCenter Prep ====
* Tag the DataCenter with k8s-region
* Tag the Cluster with k8s-zone
* Create a VM Folder called spectro-templates
* Create a VM Folder called spectro-vms
* Import the k8s_fips OVA (ex. u-2004-0-k-1305-fips.ova)
** Rename Image to "r_u-2004-0-k-<version>-fips" (ex. r_u-2004-0-k-1305-fips)
** Convert VM to Template.

====3. Harbor Prep====
* Create a new Public Project (spectro-images)

====4. OVA Setup====
DOCS REFERENCE: https://docs.spectrocloud.com/vertex/install-palette-vertex/install-on-vmware/airgap-install/environment-setup/vmware-vsphere-airgap-instructions/
* Deploy the OVA to vCenter (airgap-base-ova).
1. Machine name: sc-deploy
2. Folder: spectro-vms
3. Acknowledge the certificate.
4. Storage: DERS-HDD
5. Network: DERS-87
6. Set SSH Public Key: <opsman-key>
7. Default User Password: <ders>
* Copy the vertex bin to the sc-deploy vm.
export SC_DEPLOY_IP="172.16.87.51"
scp -i ~/.ssh/opsman /nfs/Download/airgap-vertex-v4.5.11.bin ubuntu@$SC_DEPLOY_IP:/tmp/
scp -i ~/.ssh/opsman /nfs/Download/airgap-vertex-pack-kubernetes-1.30.5.bin ubuntu@$SC_DEPLOY_IP:/tmp/
scp -i ~/.ssh/opsman /nfs/Download/airgap-vertex-pack-kubernetes-1.29.9.bin ubuntu@$SC_DEPLOY_IP:/tmp/
* SSH to the sc-deploy VM.
ssh -i ~/.ssh/opsman ubuntu@$SC_DEPLOY_IP
sudo --login
* Run the BIN Files
#################
# SET VARIABLES #
#################
export OCI_IMAGE_REGISTRY=harbor.dersllc.com
export OCI_PACK_BASE=spectro-images
export OCI_PACK_REGISTRY=harbor.dersllc.com
export OCI_IMAGE_BASE=spectro-images
export SC_VERSION='v4.5.11'

####################
# Trust DERS Certs #
####################
sudo curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /usr/local/share/ca-certificates/ders-star-ca.crt
sudo curl --insecure https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/DERS-CA-CERT/ders-ca.cer > /usr/local/share/ca-certificates/ders-ssca.crt
sudo update-ca-certificates

###################
# Log-in via ORAS #
###################
oras login harbor.dersllc.com --username 'admin' --password '<Password>'

##################################
# Setup NFS Mount (NOT REQUIRED) #
##################################
apt-get -y install snapd unzip nfs-common ca-certificates
echo "172.16.85.15:/Download /nfs/Download nfs vers=4.0 0 0" >> /etc/fstab
mkdir -p /nfs/Download
mount -a

#################################
# Import Containers into Harbor #
#################################
chmod +x /tmp/airgap-vertex-*
/tmp/airgap-vertex-$SC_VERSION.bin --nodiskspace --target /nfs/Download/airgap-vertex-$SC_VERSION/
# If Setting up CLI is not present in the output run the following:
source /nfs/Download/airgap-vertex-$SC_VERSION/bin/functions.sh; cli_copy
/tmp/airgap-vertex-pack-kubernetes-*

####################################################################
# UNZIP Manifest in /var/www/html/manifests/<Version> on ders-plex #
####################################################################
# ssh to ders-plex
export SC_VERSION='v4.5.11'
mkdir -p /var/www/html/manifests/${SC_VERSION}
mv /nfs/Download/scar-airgap-vertex-${SC_VERSION}.zip /var/www/html/manifests/${SC_VERSION}
cd /var/www/html/manifests/${SC_VERSION}
unzip scar-airgap-vertex-${SC_VERSION}.zip
systemctl restart httpd

curl http://172.16.84.22:8710/manifests/${SC_VERSION}/roar/nickfury/versions.yaml
===Vertex Install Steps===
# SSH to sc-deploy and run:
palette ec install

# No palette CLI config file detected. One will be created.
# Management Plane Type:
 Palette VerteX 
# Operating System:
 ubuntu 
# Enable Ubuntu Pro (required for production)? [y/N]: Yes 
# Ubuntu Pro token: C12HPMun5ibCKAqtW%cqBpaL66RNjd 
# enabling experimental podman provider
# No kind clusters found.
# Cloud Type:
 VMware vSphere 
##########################################################
# Spectro Cloud Artifact Repository (SCAR) Configuration #
##########################################################
# SCAR location:
 http://172.16.84.22:8710/manifests/v4.5.11/ 
# SCAR username:
 admin 
# SCAR password:
 ******** 
# Allow Insecure Connection (Bypass x509 Verification)? [Y/n]:
 Yes 
###################################
# Enter Environment Configuration #
###################################
# HTTPS Proxy (optional, hit enter to skip):
# HTTP Proxy (optional, hit enter to skip):
# Pod CIDR: 192.168.0.0/16
# Service IP Range: 10.96.0.0/12
# Retrieved version metadata. Using Spectro Cloud Version: 4.5.11
#######################
# Collecting Metadata #
#######################
# Kind Cluster Name:
 spectro-mgmt-cluster 
#############################################
# Enter Pack & Image Registry Configuration #
#############################################
# Registry Type:
 OCI 
# Registry Name:
harbor.dersllc.com 
# Registry Endpoint:
https://harbor.dersllc.com 
# Registry Base Content Path (optional, hit enter to skip):
spectro-images
# Allow Insecure Connection (Bypass x509 Verification)? [Y/n]:
Yes
# Registry Username (optional, hit enter to skip):
admin
# Registry Password (optional, hit enter to skip):
*********
# Enter 'Y' to pull images from public registries or 'N' to specify an OCI image registry
# Pull images from public registries? [Y/n]:
No
# Use the same OCI Registry for packs & images? [Y/n]:
Yes
# Registry Base Content Path (optional, hit enter to skip):
spectro-images
#####################################
# Enter vSphere Account Information #
#####################################
# vSphere Endpoint:
vcenter.dersllc.com
# vSphere Username (with domain):
administrator@ders.lab
# vSphere Password:
*********
# Allow Insecure Connection (Bypass x509 Verification)? [Y/n]:
Yes
##################################################
# Enter vSphere Enterprise Cluster configuration #
##################################################
# Datacenter:
DERSLLC
# VM Folder:
spectro-vms
# Image Template Folder:
spectro-templates
# Cluster for Fault Domain:
Lab
# Network:
DERS-87
# Resource Pool:
Default (root resource pool for cluster: Lab)
# Select specific Datastore or use a VM Storage Policy:
Datastore
# Datastore:
DERS-HDD
# Unable to add another Fault Domain as no Clusters remain in Datacenter DERSLLC
# NTP servers (comma-separated domain names or IP addresses, optional) (optional, hit enter to skip):
172.16.84.21
# Configure SSH public key(s)
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDngCrc1Na1xES5nnSBHxw1MMcwEwFL4TpwbSTq4BlcKb4WUGE4AOXr4W4RenB6OTyLkHOeLNc2ptILF3PZQG44SZ+uZMBLhx82DYbMq75F6WDSd7wnHA0cL90ncXGoLnwk+UnNEg59zmhYbrMEVM5OS3k0Ll/EXUb9PUsE+SdEoKDG+84OiwCQnQ+DWr9R79NHwLKflOvIMtoZuFwjObQ7xbsTO27FhL8wbcUDqygVqq+6r6adyZ1yEuqhXRkzUgQWv/rIzATaLTZp5r3kCGRe+EkB6AlapwE1O139ZGuY4m/FlIeXO1Ty0mmF88dI0CsbFUJcKKnO07nzSBhQevRr
# Specify a static IP range for assigning static IPs to cluster node(s).
# The IP range must contain at least 5 IPs.
# Start IP:
172.16.85.200
# End IP:
172.16.85.220
# Network Prefix:
22
# Gateway IP Address:
172.16.84.1
# Name servers (comma-separated IP addresses):
172.16.84.10
# Name server search suffixes (Optional) (optional, hit enter to skip):
dersllc.com
###################################################################
# Enter vSphere Machine configuration for the Enterprise Cluster #
###################################################################
# Select combination:
S: 16 CPU, 32 GB memory, 60 GB storage, 20 GB database with 4 CPU limit and 8 GB memory limit
# Node Affinity: Enter 'y' to schedule all Palette pods on control plane nodes? [y/N]:
No
===Vertex UI===
https://vertex.dersllc.com/system

==Troubleshooting==
===spectro mgmt self link creation is still pending===
Error:
spectro mgmt self link creation is still pending
Fix:
Restart the spectrocluster Deployment
===Failed to apply cert renewal plan for first time push of certs===
Error:
Failed to apply cert renewal plan for first time push of certs
Fix:
Restart the Palette-Controller-Manager Deployment
===No Helm Charts Showing up in Profile creation===
Error:
Helm results empty
Fix:
Navigate to "Tenant Settings" -> Platform -> Platform Settings
Enable "Allow non-FIPS packs"
Enable "Allow non-FIPS features"

* ??Download Certs
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /opt/spectro/ssl/server.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /opt/spectro/ssl/server.key

SpectroCloud/VertexInstall

2024-11-26T15:41:13Z

Admin: /* Vertex Install Steps */

=Vertex Installation Instructions=
==Vertex Installation==
===Pre Requisites===
====1. Needed Downloads====
* Binaries: airgap-base-ova (ex. spectro-airgap-podman-v3.1.4.ova)
* Binaries: airgap-fips (ex. airgap-vertex-v4.5.11.bin)
* Binaries: airgap-fips-scar-zip (ex. scar-airgap-vertex-v4.5.11.zip)
* Capi OS Image: k8s_fips (ex. u-2004-0-k-1305-fips.ova)
* Airgap Binaries: kubernetes-<version> (ex. airgap-vertex-pack-kubernetes-1.30.5.bin)
* Airgap Binaries: kubernetes-<version> (ex. airgap-vertex-pack-kubernetes-1.29.9.bin)

====2. vCenter Prep ====
* Tag the DataCenter with k8s-region
* Tag the Cluster with k8s-zone
* Create a VM Folder called spectro-templates
* Create a VM Folder called spectro-vms
* Import the k8s_fips OVA (ex. u-2004-0-k-1305-fips.ova)
** Rename Image to "r_u-2004-0-k-<version>-fips" (ex. r_u-2004-0-k-1305-fips)
** Convert VM to Template.

====3. Harbor Prep====
* Create a new Public Project (spectro-images)

====4. OVA Setup====
DOCS REFERENCE: https://docs.spectrocloud.com/vertex/install-palette-vertex/install-on-vmware/airgap-install/environment-setup/vmware-vsphere-airgap-instructions/
* Deploy the OVA to vCenter (airgap-base-ova).
1. Machine name: sc-deploy
2. Folder: spectro-vms
3. Acknowledge the certificate.
4. Storage: DERS-HDD
5. Network: DERS-87
6. Set SSH Public Key: <opsman-key>
7. Default User Password: <ders>
* Copy the vertex bin to the sc-deploy vm.
export SC_DEPLOY_IP="172.16.87.51"
scp -i ~/.ssh/opsman /nfs/Download/airgap-vertex-v4.5.11.bin ubuntu@$SC_DEPLOY_IP:/tmp/
scp -i ~/.ssh/opsman /nfs/Download/airgap-vertex-pack-kubernetes-1.30.5.bin ubuntu@$SC_DEPLOY_IP:/tmp/
scp -i ~/.ssh/opsman /nfs/Download/airgap-vertex-pack-kubernetes-1.29.9.bin ubuntu@$SC_DEPLOY_IP:/tmp/
* SSH to the sc-deploy VM.
ssh -i ~/.ssh/opsman ubuntu@$SC_DEPLOY_IP
sudo --login
* Run the BIN Files
#################
# SET VARIABLES #
#################
export OCI_IMAGE_REGISTRY=harbor.dersllc.com
export OCI_PACK_BASE=spectro-images
export OCI_PACK_REGISTRY=harbor.dersllc.com
export OCI_IMAGE_BASE=spectro-images
export SC_VERSION='v4.5.11'

####################
# Trust DERS Certs #
####################
sudo curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /usr/local/share/ca-certificates/ders-star-ca.crt
sudo curl --insecure https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/DERS-CA-CERT/ders-ca.cer > /usr/local/share/ca-certificates/ders-ssca.crt
sudo update-ca-certificates

###################
# Log-in via ORAS #
###################
oras login harbor.dersllc.com --username 'admin' --password '<Password>'

##################################
# Setup NFS Mount (NOT REQUIRED) #
##################################
apt-get -y install snapd unzip nfs-common ca-certificates
echo "172.16.85.15:/Download /nfs/Download nfs vers=4.0 0 0" >> /etc/fstab
mkdir -p /nfs/Download
mount -a

#################################
# Import Containers into Harbor #
#################################
chmod +x /tmp/airgap-vertex-*
/tmp/airgap-vertex-$SC_VERSION.bin --nodiskspace --target /nfs/Download/airgap-vertex-$SC_VERSION/
# If Setting up CLI is not present in the output run the following:
source /nfs/Download/airgap-vertex-$SC_VERSION/bin/functions.sh; cli_copy
/tmp/airgap-vertex-pack-kubernetes-*

####################################################################
# UNZIP Manifest in /var/www/html/manifests/<Version> on ders-plex #
####################################################################
# ssh to ders-plex
export SC_VERSION='v4.5.11'
mkdir -p /var/www/html/manifests/${SC_VERSION}
mv /nfs/Download/scar-airgap-vertex-${SC_VERSION}.zip /var/www/html/manifests/${SC_VERSION}
cd /var/www/html/manifests/${SC_VERSION}
unzip scar-airgap-vertex-${SC_VERSION}.zip
systemctl restart httpd

curl http://172.16.84.22:8710/manifests/${SC_VERSION}/roar/nickfury/versions.yaml
===Vertex Install Steps===
# SSH to sc-deploy and run:
palette ec install

# No palette CLI config file detected. One will be created.
# Management Plane Type:
 Palette VerteX 
# Operating System:
 ubuntu 
# Enable Ubuntu Pro (required for production)? [y/N]: Yes 
# Ubuntu Pro token: C12HPMun5ibCKAqtW%cqBpaL66RNjd 
# enabling experimental podman provider
# No kind clusters found.
# Cloud Type:
 VMware vSphere 
##########################################################
# Spectro Cloud Artifact Repository (SCAR) Configuration #
##########################################################
# SCAR location:
 http://172.16.84.22:8710/manifests/v4.5.11/ 
# SCAR username:
 admin 
# SCAR password:
 ******** 
# Allow Insecure Connection (Bypass x509 Verification)? [Y/n]:
 Yes 
###################################
# Enter Environment Configuration #
###################################
# HTTPS Proxy (optional, hit enter to skip):
# HTTP Proxy (optional, hit enter to skip):
# Pod CIDR: 192.168.0.0/16
# Service IP Range: 10.96.0.0/12
# Retrieved version metadata. Using Spectro Cloud Version: 4.5.11
#######################
# Collecting Metadata #
#######################
# Kind Cluster Name:
 spectro-mgmt-cluster 
#############################################
# Enter Pack & Image Registry Configuration #
#############################################
# Registry Type:
 OCI 
# Registry Name:
harbor.dersllc.com 
# Registry Endpoint:
https://harbor.dersllc.com 
# Registry Base Content Path (optional, hit enter to skip):
spectro-images
# Allow Insecure Connection (Bypass x509 Verification)? [Y/n]:
Yes
# Registry Username (optional, hit enter to skip):
admin
# Registry Password (optional, hit enter to skip):
*********
# Enter 'Y' to pull images from public registries or 'N' to specify an OCI image registry
# Pull images from public registries? [Y/n]:
No
# Use the same OCI Registry for packs & images? [Y/n]:
Yes
# Registry Base Content Path (optional, hit enter to skip):
spectro-images
#####################################
# Enter vSphere Account Information #
#####################################
# vSphere Endpoint:
vcenter.dersllc.com
# vSphere Username (with domain):
administrator@ders.lab
# vSphere Password:
*********
# Allow Insecure Connection (Bypass x509 Verification)? [Y/n]:
Yes
##################################################
# Enter vSphere Enterprise Cluster configuration #
##################################################
# Datacenter:
DERSLLC
# VM Folder:
spectro-vms
# Image Template Folder:
spectro-templates
# Cluster for Fault Domain:
Lab
# Network:
DERS-87
# Resource Pool:
Default (root resource pool for cluster: Lab)
# Select specific Datastore or use a VM Storage Policy:
Datastore
# Datastore:
DERS-HDD
# Unable to add another Fault Domain as no Clusters remain in Datacenter DERSLLC
# NTP servers (comma-separated domain names or IP addresses, optional) (optional, hit enter to skip):
172.16.84.21
# Configure SSH public key(s)
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDngCrc1Na1xES5nnSBHxw1MMcwEwFL4TpwbSTq4BlcKb4WUGE4AOXr4W4RenB6OTyLkHOeLNc2ptILF3PZQG44SZ+uZMBLhx82DYbMq75F6WDSd7wnHA0cL90ncXGoLnwk+UnNEg59zmhYbrMEVM5OS3k0Ll/EXUb9PUsE+SdEoKDG+84OiwCQnQ+DWr9R79NHwLKflOvIMtoZuFwjObQ7xbsTO27FhL8wbcUDqygVqq+6r6adyZ1yEuqhXRkzUgQWv/rIzATaLTZp5r3kCGRe+EkB6AlapwE1O139ZGuY4m/FlIeXO1Ty0mmF88dI0CsbFUJcKKnO07nzSBhQevRr
# Specify a static IP range for assigning static IPs to cluster node(s).
# The IP range must contain at least 5 IPs.
# Start IP:
172.16.85.200
# End IP:
172.16.85.220
# Network Prefix:
22
# Gateway IP Address:
172.16.84.1
# Name servers (comma-separated IP addresses):
172.16.84.10
# Name server search suffixes (Optional) (optional, hit enter to skip):
dersllc.com
###################################################################
# Enter vSphere Machine configuration for the Enterprise Cluster #
###################################################################
# Select combination:
S: 16 CPU, 32 GB memory, 60 GB storage, 20 GB database with 4 CPU limit and 8 GB memory limit
# Node Affinity: Enter 'y' to schedule all Palette pods on control plane nodes? [y/N]:
No
===Vertex UI===
https://vertex.dersllc.com

==Troubleshooting==
===spectro mgmt self link creation is still pending===
Error:
spectro mgmt self link creation is still pending
Fix:
Restart the spectrocluster Deployment
===Failed to apply cert renewal plan for first time push of certs===
Error:
Failed to apply cert renewal plan for first time push of certs
Fix:
Restart the Palette-Controller-Manager Deployment
===No Helm Charts Showing up in Profile creation===
Error:
Helm results empty
Fix:
Navigate to "Tenant Settings" -> Platform -> Platform Settings
Enable "Allow non-FIPS packs"
Enable "Allow non-FIPS features"

* ??Download Certs
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /opt/spectro/ssl/server.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /opt/spectro/ssl/server.key

VMware/TKGm

2023-08-14T19:45:49Z

Admin: /* Add another workload cluster */

= Tanzu Kubernetes Grid (Multi-Cloud)=
== Prep TKGm Install ==
cd /data
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /data/ders-star-chain.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt >> /data/ders-star-chain.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/DERS-CA-CERT/ders-ca.cer > /data/ders-priv-ca.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /data/ders-ca.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /data/ders-star.key
cat ders-priv-ca.crt >> ders-star-chain.crt
cat /data/ders-priv-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt
cp /data/ders-star-chain.crt /data/ders-star-chain.pem
cat /data/ders-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt

docker login harbor.dersllc.com

#arcas --load_tanzu_image_to_harbor --repo_name tanzu_210 --tkg_binaries_path /opt/vmware/arcas/tools/tanzu21.tar

== Installing TKGm ==
curl https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/tkgm-on-vlan-87.json > /data/tkgm-on-vlan-87.json
arcas --env vsphere --file /data/tkgm-on-vlan-87.json --verbose --avi_configuration
arcas --env vsphere --file /data/tkgm-on-vlan-87.json --verbose --skip_precheck --tkg_mgmt_configuration --shared_service_configuration --workload_preconfig --workload_deploy --deploy_extensions

== Installing Tanzu Package Applications ==

tanzu package install cert-manager -n tanzu-package-repo-global -p cert-manager.tanzu.vmware.com -v 1.7.2+vmware.1-tkg.1
tanzu package install contour -n tanzu-package-repo-global -p contour.tanzu.vmware.com -v 1.20.2+vmware.1-tkg.1 -f /data/contour-default-values.yaml
tanzu package install prometheus -n tanzu-package-repo-global -p prometheus.tanzu.vmware.com -v 2.36.2+vmware.1-tkg.1
tanzu package install grafana -n tanzu-package-repo-global -p grafana.tanzu.vmware.com -v 7.5.16+vmware.1-tkg.1

== Setup Pinniped for Key Cloak Authentication ==
=== Setup KeyCloak ===
1. Apache Proxy Configured as SSO.DERSLLC.COM
<VirtualHost *:443>
ServerName sso.dersllc.com
RequestHeader set X-Forwarded-Proto "https"
RemoteIPHeader X-Forwarded-For
ProxyPass / http://172.16.87.22:8080/
ProxyPassReverse / http://172.16.87.22:8080/
</VirtualHost>
2. Run Container
docker stop keycloak
docker rm keycloak
docker run -d --name keycloak -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:20.0.2 start --proxy edge --hostname-strict=false
3. Update the Admin Password
4. Create a Client Connection
Open the Keycloak Admin Console
Click 'Clients'
Click 'Create client'
Fill in the form with the following values:
Client type: OpenID Connect
Client ID: tkgm
Name: TKGm
Click 'Next'
Check 'Client authentication'
Check 'Authorization'
Make sure 'Standard flow' is enabled
Click 'Save'

References:
https://www.keycloak.org/getting-started/getting-started-docker

== Default Pods that have CURL ==
=== kube-system ===
1. vsphere-csi-node - vsphere-csi-node
kubectl exec -it -n kube-system vsphere-csi-node-{{highlight|4bf25}} -c vsphere-csi-node -- bash
2. vsphere-csi-controller -c vsphere-csi-controller
kubectl exec -it -n kube-system vsphere-csi-controller-{{highlight|74f44b74c5-2t2zh}} -c vsphere-csi-controller -- bash

== Upgrade vSphere Cluster Hardware ==

Frank Escaros-Buechsel
easiest would be to enable EVC on the cluster now
then add the new hosts to said cluster and migrate over with vmotion
depending on rack space and network layout of course
this way you dont need to update any references and you still have a more or less seamless migration (edited)

== Change TKGm node Resources (CPU / Memory / Datastore) ==

References:
https://veducate.co.uk/tkg-kubectl-scale-vertically/
https://vmwire.com/2021/11/22/scaling-tkgm-control-plane-nodes-vertically/
==REFERENCES==
https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-mgmt-clusters-airgapped-environments.html
https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-mgmt-clusters-airgapped-environments.html

==Add Trusted CA to TKG Management Cluster==

kubectl config use-context tanzu-mgmt-admin@tanzu-mgmt
kubectl edit Kubeadmconfigtemplates -n tkg-system tanzu-mgmt-md-0-bootstrap-72bfm

spec:
template:
spec:
files:
- content: |
-----BEGIN CERTIFICATE-----
MIIFmjCCA4KgAwIBAgIJAKVK2W1HOS0NMA0GCSqGSIb3DQEBCwUAMGsxCzAJBgNV
......
l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
-----END CERTIFICATE-----
owner: root:root
path: /etc/ssl/certs/tkg-custom-ca.pem
permissions: "0644"

==Add another workload cluster==
cp .config/tanzu/tkg/clusterconfigs/work.yaml test.yaml

# Change the name of the cluster throughout the file.
vi test.yaml

tanzu cluster create work-1 -f test.yaml
tanzu cluster kubeconfig get --admin work-1

VMware/TKGm

2023-08-14T19:44:34Z

Admin: /* Add Trusted CA to TKG Management Cluster */

= Tanzu Kubernetes Grid (Multi-Cloud)=
== Prep TKGm Install ==
cd /data
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /data/ders-star-chain.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt >> /data/ders-star-chain.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/DERS-CA-CERT/ders-ca.cer > /data/ders-priv-ca.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /data/ders-ca.crt
curl --insecure https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /data/ders-star.key
cat ders-priv-ca.crt >> ders-star-chain.crt
cat /data/ders-priv-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt
cp /data/ders-star-chain.crt /data/ders-star-chain.pem
cat /data/ders-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt

docker login harbor.dersllc.com

#arcas --load_tanzu_image_to_harbor --repo_name tanzu_210 --tkg_binaries_path /opt/vmware/arcas/tools/tanzu21.tar

== Installing TKGm ==
curl https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/tkgm-on-vlan-87.json > /data/tkgm-on-vlan-87.json
arcas --env vsphere --file /data/tkgm-on-vlan-87.json --verbose --avi_configuration
arcas --env vsphere --file /data/tkgm-on-vlan-87.json --verbose --skip_precheck --tkg_mgmt_configuration --shared_service_configuration --workload_preconfig --workload_deploy --deploy_extensions

== Installing Tanzu Package Applications ==

tanzu package install cert-manager -n tanzu-package-repo-global -p cert-manager.tanzu.vmware.com -v 1.7.2+vmware.1-tkg.1
tanzu package install contour -n tanzu-package-repo-global -p contour.tanzu.vmware.com -v 1.20.2+vmware.1-tkg.1 -f /data/contour-default-values.yaml
tanzu package install prometheus -n tanzu-package-repo-global -p prometheus.tanzu.vmware.com -v 2.36.2+vmware.1-tkg.1
tanzu package install grafana -n tanzu-package-repo-global -p grafana.tanzu.vmware.com -v 7.5.16+vmware.1-tkg.1

== Setup Pinniped for Key Cloak Authentication ==
=== Setup KeyCloak ===
1. Apache Proxy Configured as SSO.DERSLLC.COM
<VirtualHost *:443>
ServerName sso.dersllc.com
RequestHeader set X-Forwarded-Proto "https"
RemoteIPHeader X-Forwarded-For
ProxyPass / http://172.16.87.22:8080/
ProxyPassReverse / http://172.16.87.22:8080/
</VirtualHost>
2. Run Container
docker stop keycloak
docker rm keycloak
docker run -d --name keycloak -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:20.0.2 start --proxy edge --hostname-strict=false
3. Update the Admin Password
4. Create a Client Connection
Open the Keycloak Admin Console
Click 'Clients'
Click 'Create client'
Fill in the form with the following values:
Client type: OpenID Connect
Client ID: tkgm
Name: TKGm
Click 'Next'
Check 'Client authentication'
Check 'Authorization'
Make sure 'Standard flow' is enabled
Click 'Save'

References:
https://www.keycloak.org/getting-started/getting-started-docker

== Default Pods that have CURL ==
=== kube-system ===
1. vsphere-csi-node - vsphere-csi-node
kubectl exec -it -n kube-system vsphere-csi-node-{{highlight|4bf25}} -c vsphere-csi-node -- bash
2. vsphere-csi-controller -c vsphere-csi-controller
kubectl exec -it -n kube-system vsphere-csi-controller-{{highlight|74f44b74c5-2t2zh}} -c vsphere-csi-controller -- bash

== Upgrade vSphere Cluster Hardware ==

Frank Escaros-Buechsel
easiest would be to enable EVC on the cluster now
then add the new hosts to said cluster and migrate over with vmotion
depending on rack space and network layout of course
this way you dont need to update any references and you still have a more or less seamless migration (edited)

== Change TKGm node Resources (CPU / Memory / Datastore) ==

References:
https://veducate.co.uk/tkg-kubectl-scale-vertically/
https://vmwire.com/2021/11/22/scaling-tkgm-control-plane-nodes-vertically/
==REFERENCES==
https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-mgmt-clusters-airgapped-environments.html
https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-mgmt-clusters-airgapped-environments.html

==Add Trusted CA to TKG Management Cluster==

kubectl config use-context tanzu-mgmt-admin@tanzu-mgmt
kubectl edit Kubeadmconfigtemplates -n tkg-system tanzu-mgmt-md-0-bootstrap-72bfm

spec:
template:
spec:
files:
- content: |
-----BEGIN CERTIFICATE-----
MIIFmjCCA4KgAwIBAgIJAKVK2W1HOS0NMA0GCSqGSIb3DQEBCwUAMGsxCzAJBgNV
......
l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
-----END CERTIFICATE-----
owner: root:root
path: /etc/ssl/certs/tkg-custom-ca.pem
permissions: "0644"

==Add another workload cluster==

cp .config/tanzu/tkg/clusterconfigs/work.yaml test.yaml
vi test.yaml
tanzu cluster create work-1 -f test.yaml
tanzu cluster kubeconfig get --admin work-1

VMware/TMConEKS

2023-07-21T19:40:30Z

Admin: /* Install TMC */

= TMC on EKS Setup =

== Create Harbor on AWS==
=== SSH to Harbor-AWS EC2 Instance ===
#On Plex
ssh -i ~/.ssh/aws-keypair.pem ec2-user@ec2-54-91-52-46.compute-1.amazonaws.com

=== Install Harbor-AWS ===
#THIS IS JUST PULLING IN MY STAR CERT and KEY FOR DERSLLC
mkdir /data
cd /data
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /data/ders-star-chain.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt >> /data/ders-star-chain.crt
cp /data/ders-star-chain.crt /data/ders-star-chain.pem
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /data/ders-ca.crt
cat /data/ders-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /data/ders-star.key

yum -y install docker
service docker start
systemctl enable docker

wget https://github.com/docker/compose/releases/download/v2.18.1/docker-compose-linux-x86_64 -O /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
wget https://github.com/goharbor/harbor/releases/download/v2.8.1/harbor-offline-installer-v2.8.1.tgz
tar -zxvf harbor-offline-installer-v2.8.1.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
vi harbor.yml
# add Hostname and certs and location
#### harbor-aws.dersllc.com
#### /data/ders-star-chain.crt
#### /data/ders-star.key
#### /data/harbor-data

./install.sh --with-trivy --with-notary

== Load Harbor with Images ==
# On a Jumpbox...
docker login harbor-aws.dersllc.com
#################################
# Set Install Variables #
#################################
export IMGPKG_REGISTRY_HOSTNAME_0="harbor-aws.dersllc.com"
export IMGPKG_REGISTRY_USERNAME_0="admin"
export IMGPKG_REGISTRY_PASSWORD_0=<PASSWORD>
export PRIVATE_IMAGE_REGISTRY_CA_PATH="/data/ders-ca.crt"
export PRIVATE_IMAGE_REGISTRY="harbor-aws.dersllc.com"
export TKG_IMAGE_REGISTRY="projects.registry.vmware.com/tkg"
export TKG_REPO_VERSION="v2.2.0_update.1"
export TMC_HARBOR_PROJECT="tmc-sm-1.0.0"
export TMC_BUNDLE="tmc-self-managed-1.0.0"
#########################
# Prep TMC Bits #
#########################
mkdir tmc
tar -xf $TMC_BUNDLE.tar -C tmc
chmod +x /usr/local/bin/tmc
tmc/tmc-sm push-images harbor --project $IMGPKG_REGISTRY_HOSTNAME_0/$TMC_HARBOR_PROJECT --username $IMGPKG_REGISTRY_USERNAME_0 --password $IMGPKG_REGISTRY_PASSWORD_0
############################################################
# Upload Tanzu Standard Packages for TMC into Reop #
############################################################
imgpkg copy --registry-ca-cert-path $PRIVATE_IMAGE_REGISTRY_CA_PATH \
-b $TKG_IMAGE_REGISTRY/packages/standard/repo:$TKG_REPO_VERSION \
--to-repo $PRIVATE_IMAGE_REGISTRY/$TMC_HARBOR_PROJECT/498533941640.dkr.ecr.us-west-2.amazonaws.com/packages/standard/repo

== Setup EKS Cluster ==
#########################
# AWS AUTH INFO #
#########################
export AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
export AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>
export AWS_SESSION_TOKEN=<AWS_SESSION_TOKEN>

##########################
# INSTALL AWSCLI #
##########################
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

##########################
# Install EKSCLI #
##########################
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl /usr/local/bin

export eks_region=us-east-2
export eks_cluster_name=ders-tmc-sm
export eks_nodegroup_size=m5.xlarge

eksctl create cluster --name $eks_cluster_name -r $eks_region -t $eks_nodegroup_size --nodes 3 --nodes-min 3 --nodes-max 11
#Wait for Status Complete.......

#Get Kubeconfig for EKS if needed
#aws eks update-kubeconfig --region $eks_region --name $eks_cluster_name

#Add another Node group if needed
#export eks_nodegroup_name=ders-tmc-nodes
#eksctl create nodegroup -c $eks_cluster_name -r $eks_region -n $eks_nodegroup_name -t $eks_nodegroup_size --nodes 3 --nodes-min 3 --nodes-max 11

== Prepare EKS for TMC Deploy ==
# Prep the EBS CSI
eksctl utils associate-iam-oidc-provider \
--region=$eks_region \
--cluster=$eks_cluster_name \
--approve

eksctl create iamserviceaccount \
--name ebs-csi-controller-sa \
--namespace kube-system \
--cluster $eks_cluster_name \
--attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
--approve \
--role-only \
--region=$eks_region \
--role-name AmazonEKS_EBS_CSI_DriverRole

eksctl create addon --name aws-ebs-csi-driver \
--cluster $eks_cluster_name \
--service-account-role-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/AmazonEKS_EBS_CSI_DriverRole \
--region=$eks_region \
--force

== Create CA Cert for Cert-Manager ==
################################################
# Create Config for CA SSL Certificate #
################################################
mkdir -p /tmp/ssl
cd /tmp/ssl
cat <<EOF > ca.cnf
[ req ]
default_bits = 2048
default_md = sha256
prompt = no
encrypt_key = no
distinguished_name = dn
[ dn ]
countryName = US
stateOrProvinceName = Ohio
localityName = Beavercreek
organizationName = DER's LLC
organizationalUnitName = IT
commonName = ca.dersllc.com
[ext]
keyUsage=critical,keyCertSign,cRLSign
basicConstraints=critical,CA:true,pathlen:1
subjectAltName=DNS:ca.dersllc.com
EOF

###############################################################
# Create a Self-Signed CA Cert Using the Config Above #
###############################################################
openssl req -x509 -nodes -newkey rsa:4096 -sha256 -days 3650 -nodes -keyout ders-ca.key -out ders-ca.cer -extensions ext -config ca.cnf

########################################################################################
# Get Base64 encoded PEM and KEY for the K8S Issuer YAML Used in the Next Step #
########################################################################################
cat ders-ca.cer | base64 -w0
cat ders-ca.key | base64 -w0

== Install TMC ==
################################################
# Setup TMC Namespace and Cert-Manager #
################################################
kubectl create ns tmc-local
# Deploy Cert-Manager into EKS Cluster
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
sleep 60
# Add ders-ca issuer (this is referenced in the tmc-eks-values.yaml)
kubectl apply -f https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/TMC%20on%20TKGm/tmc-issuer.yaml

################################################################
# Setup Harbor Credentials For The tmc-local Namespace #
################################################################
kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json --type=kubernetes.io/dockerconfigjson -n tmc-local
kubectl patch serviceaccount default -p "{\"imagePullSecrets\": [{\"name\": \"regcred\"}]}" -n tmc-local

##################################
# Create TMC Values File #
##################################
#tmc/tmc-sm generate-values-schema --output-file tmc-eks-values.yaml #(Depending on the version or TMC you will use this or the next command.)
#tmc/tmc-sm show-values-schema --output-filet tmc-eks-values.yaml

#############################################
# Pull TMC Values File and Validate #
#############################################
curl https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/TMC/tmc-eks-values.yaml > tmc-eks-values.yaml
tmc/tmc-sm validate-values tmc-values.yaml

############################################
# Finally Install TMC Self-Managed #
############################################
tmc/tmc-sm deploy --image-prefix $PRIVATE_IMAGE_REGISTRY/$TMC_HARBOR_PROJECT --kubeconfig ~/.kube/config --values=tmc-eks-values.yaml

###############################################################
# During Install get the LB IP/Name and add it to DNS #
###############################################################
kubectl get service -n tmc-local contour-envoy -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

== Uninstall TMC ==
tmc/tmc-local uninstall --kubeconfig ~/.kube/config

== Setup Inspection Images ==
Run the below command to create the download script.
cat > ./inspection-images.sh << "EOF"
#!/bin/bash

# https://github.com/vmware-tanzu/sonobuoy/releases
VERSION=${1:-"v0.56.16"}
LATEST_RELEASE=${2:-"sonobuoy_0.56.16_linux_amd64.tar.gz"}
CUSTOM_REGISTRY=${3:-"harbor-aws.dersllc.com/tmc-1.0.0-beta.2-rc.3"}
DOCKER_PROXY=${4:-"harbor.tanzu.io:8443/dockerhub-proxy-cache"} # optional argument
CUSTOM_TMC_REPO="${CUSTOM_REGISTRY}/498533941640.dkr.ecr.us-west-2.amazonaws.com"

# https://kubernetes.io/releases/patch-releases/
k8s_versions=(v1.23.8 v1.24.10)

wget "https://github.com/vmware-tanzu/sonobuoy/releases/download/${VERSION}/${LATEST_RELEASE}"
tar -xvf ${LATEST_RELEASE}

for i in "${k8s_versions[@]}"
do
echo "================CHECKING K8S: $i======================="
./sonobuoy images list --kubernetes-version $i > images_$i.txt

while read image
do
echo "================CHECKING IMAGE: $image=================="
base=$(basename "$image")
output=${image#*/*}

if [[ $image == *"docker"* && -n $DOCKER_PROXY ]];
then
docker pull $DOCKER_PROXY/$output
docker tag $DOCKER_PROXY/$output ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
else
docker pull $image
docker tag $image ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
fi

docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
echo "===================PUSHING: ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base ==========="
done < images_$i.txt
done

# not part of sonobuoy image list, install manually, update these as images are found
docker pull k8s.gcr.io/e2e-test-images/agnhost:2.31
docker pull k8s.gcr.io/pause:3.9
docker tag k8s.gcr.io/e2e-test-images/agnhost:2.31 ${CUSTOM_TMC_REPO}/extensions/inspection-images/agnhost:2.31
docker tag k8s.gcr.io/pause:3.9 ${CUSTOM_TMC_REPO}/extensions/inspection-images/pause:3.9
docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/agnhost:2.31
docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/pause:3.9

# clean up text files and sonobuoy tar
rm images_*
rm sonobuoy_*
EOF
Edit the file and set the Variables at the top. (VERSION, LATEST_RELEASE, CUSTOM_REGISTRY, and k8s_versions)
vi inspection-images.sh
Save the file and change the permissions
chmod +x inspection-images.sh
Run the Script
./inspection-images.sh

VMware/TMConEKS

2023-07-21T18:47:25Z

Admin: /* Setup EKS Cluster */

= TMC on EKS Setup =

== Create Harbor on AWS==
=== SSH to Harbor-AWS EC2 Instance ===
#On Plex
ssh -i ~/.ssh/aws-keypair.pem ec2-user@ec2-54-91-52-46.compute-1.amazonaws.com

=== Install Harbor-AWS ===
#THIS IS JUST PULLING IN MY STAR CERT and KEY FOR DERSLLC
mkdir /data
cd /data
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /data/ders-star-chain.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt >> /data/ders-star-chain.crt
cp /data/ders-star-chain.crt /data/ders-star-chain.pem
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /data/ders-ca.crt
cat /data/ders-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /data/ders-star.key

yum -y install docker
service docker start
systemctl enable docker

wget https://github.com/docker/compose/releases/download/v2.18.1/docker-compose-linux-x86_64 -O /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
wget https://github.com/goharbor/harbor/releases/download/v2.8.1/harbor-offline-installer-v2.8.1.tgz
tar -zxvf harbor-offline-installer-v2.8.1.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
vi harbor.yml
# add Hostname and certs and location
#### harbor-aws.dersllc.com
#### /data/ders-star-chain.crt
#### /data/ders-star.key
#### /data/harbor-data

./install.sh --with-trivy --with-notary

== Load Harbor with Images ==
# On a Jumpbox...
docker login harbor-aws.dersllc.com
#################################
# Set Install Variables #
#################################
export IMGPKG_REGISTRY_HOSTNAME_0="harbor-aws.dersllc.com"
export IMGPKG_REGISTRY_USERNAME_0="admin"
export IMGPKG_REGISTRY_PASSWORD_0=<PASSWORD>
export PRIVATE_IMAGE_REGISTRY_CA_PATH="/data/ders-ca.crt"
export PRIVATE_IMAGE_REGISTRY="harbor-aws.dersllc.com"
export TKG_IMAGE_REGISTRY="projects.registry.vmware.com/tkg"
export TKG_REPO_VERSION="v2.2.0_update.1"
export TMC_HARBOR_PROJECT="tmc-sm-1.0.0"
export TMC_BUNDLE="tmc-self-managed-1.0.0"
#########################
# Prep TMC Bits #
#########################
mkdir tmc
tar -xf $TMC_BUNDLE.tar -C tmc
chmod +x /usr/local/bin/tmc
tmc/tmc-sm push-images harbor --project $IMGPKG_REGISTRY_HOSTNAME_0/$TMC_HARBOR_PROJECT --username $IMGPKG_REGISTRY_USERNAME_0 --password $IMGPKG_REGISTRY_PASSWORD_0
############################################################
# Upload Tanzu Standard Packages for TMC into Reop #
############################################################
imgpkg copy --registry-ca-cert-path $PRIVATE_IMAGE_REGISTRY_CA_PATH \
-b $TKG_IMAGE_REGISTRY/packages/standard/repo:$TKG_REPO_VERSION \
--to-repo $PRIVATE_IMAGE_REGISTRY/$TMC_HARBOR_PROJECT/498533941640.dkr.ecr.us-west-2.amazonaws.com/packages/standard/repo

== Setup EKS Cluster ==
#########################
# AWS AUTH INFO #
#########################
export AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
export AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>
export AWS_SESSION_TOKEN=<AWS_SESSION_TOKEN>

##########################
# INSTALL AWSCLI #
##########################
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

##########################
# Install EKSCLI #
##########################
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl /usr/local/bin

export eks_region=us-east-2
export eks_cluster_name=ders-tmc-sm
export eks_nodegroup_size=m5.xlarge

eksctl create cluster --name $eks_cluster_name -r $eks_region -t $eks_nodegroup_size --nodes 3 --nodes-min 3 --nodes-max 11
#Wait for Status Complete.......

#Get Kubeconfig for EKS if needed
#aws eks update-kubeconfig --region $eks_region --name $eks_cluster_name

#Add another Node group if needed
#export eks_nodegroup_name=ders-tmc-nodes
#eksctl create nodegroup -c $eks_cluster_name -r $eks_region -n $eks_nodegroup_name -t $eks_nodegroup_size --nodes 3 --nodes-min 3 --nodes-max 11

== Prepare EKS for TMC Deploy ==
# Prep the EBS CSI
eksctl utils associate-iam-oidc-provider \
--region=$eks_region \
--cluster=$eks_cluster_name \
--approve

eksctl create iamserviceaccount \
--name ebs-csi-controller-sa \
--namespace kube-system \
--cluster $eks_cluster_name \
--attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
--approve \
--role-only \
--region=$eks_region \
--role-name AmazonEKS_EBS_CSI_DriverRole

eksctl create addon --name aws-ebs-csi-driver \
--cluster $eks_cluster_name \
--service-account-role-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/AmazonEKS_EBS_CSI_DriverRole \
--region=$eks_region \
--force

== Create CA Cert for Cert-Manager ==
################################################
# Create Config for CA SSL Certificate #
################################################
mkdir -p /tmp/ssl
cd /tmp/ssl
cat <<EOF > ca.cnf
[ req ]
default_bits = 2048
default_md = sha256
prompt = no
encrypt_key = no
distinguished_name = dn
[ dn ]
countryName = US
stateOrProvinceName = Ohio
localityName = Beavercreek
organizationName = DER's LLC
organizationalUnitName = IT
commonName = ca.dersllc.com
[ext]
keyUsage=critical,keyCertSign,cRLSign
basicConstraints=critical,CA:true,pathlen:1
subjectAltName=DNS:ca.dersllc.com
EOF

###############################################################
# Create a Self-Signed CA Cert Using the Config Above #
###############################################################
openssl req -x509 -nodes -newkey rsa:4096 -sha256 -days 3650 -nodes -keyout ders-ca.key -out ders-ca.cer -extensions ext -config ca.cnf

########################################################################################
# Get Base64 encoded PEM and KEY for the K8S Issuer YAML Used in the Next Step #
########################################################################################
cat ders-ca.cer | base64 -w0
cat ders-ca.key | base64 -w0

== Install TMC ==
################################################
# Setup TMC Namespace and Cert-Manager #
################################################
kubectl create ns tmc-local
# Deploy Cert-Manager into EKS Cluster
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
sleep 60
# Add ders-ca issuer (this is referenced in the tmc-eks-values.yaml)
kubectl apply -f https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/TMC%20on%20TKGm/tmc-issuer.yaml

################################################################
# Setup Harbor Credentials For The tmc-local Namespace #
################################################################
kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json --type=kubernetes.io/dockerconfigjson -n tmc-local
kubectl patch serviceaccount default -p "{\"imagePullSecrets\": [{\"name\": \"regcred\"}]}" -n tmc-local

##################################
# Create TMC Values File #
##################################
#tmc/tmc-local generate-values-schema --output-file tmc-eks-values.yaml #(Depending on the version or TMC you will use this or the next command.)
#tmc/tmc-local show-values-schema --output-filet tmc-eks-values.yaml

#############################################
# Pull TMC Values File and Validate #
#############################################
curl https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/TMC/tmc-eks-values.yaml > tmc-eks-values.yaml
tmc/tmc-local validate-values tmc-values.yaml

############################################
# Finally Install TMC Self-Managed #
############################################
tmc/tmc-local deploy --image-prefix $PRIVATE_IMAGE_REGISTRY/$TMC_HARBOR_PROJECT --kubeconfig ~/.kube/config --values=tmc-eks-values.yaml

###############################################################
# During Install get the LB IP/Name and add it to DNS #
###############################################################
kubectl get service -n tmc-local contour-envoy -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

== Uninstall TMC ==
tmc/tmc-local uninstall --kubeconfig ~/.kube/config

== Setup Inspection Images ==
Run the below command to create the download script.
cat > ./inspection-images.sh << "EOF"
#!/bin/bash

# https://github.com/vmware-tanzu/sonobuoy/releases
VERSION=${1:-"v0.56.16"}
LATEST_RELEASE=${2:-"sonobuoy_0.56.16_linux_amd64.tar.gz"}
CUSTOM_REGISTRY=${3:-"harbor-aws.dersllc.com/tmc-1.0.0-beta.2-rc.3"}
DOCKER_PROXY=${4:-"harbor.tanzu.io:8443/dockerhub-proxy-cache"} # optional argument
CUSTOM_TMC_REPO="${CUSTOM_REGISTRY}/498533941640.dkr.ecr.us-west-2.amazonaws.com"

# https://kubernetes.io/releases/patch-releases/
k8s_versions=(v1.23.8 v1.24.10)

wget "https://github.com/vmware-tanzu/sonobuoy/releases/download/${VERSION}/${LATEST_RELEASE}"
tar -xvf ${LATEST_RELEASE}

for i in "${k8s_versions[@]}"
do
echo "================CHECKING K8S: $i======================="
./sonobuoy images list --kubernetes-version $i > images_$i.txt

while read image
do
echo "================CHECKING IMAGE: $image=================="
base=$(basename "$image")
output=${image#*/*}

if [[ $image == *"docker"* && -n $DOCKER_PROXY ]];
then
docker pull $DOCKER_PROXY/$output
docker tag $DOCKER_PROXY/$output ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
else
docker pull $image
docker tag $image ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
fi

docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
echo "===================PUSHING: ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base ==========="
done < images_$i.txt
done

# not part of sonobuoy image list, install manually, update these as images are found
docker pull k8s.gcr.io/e2e-test-images/agnhost:2.31
docker pull k8s.gcr.io/pause:3.9
docker tag k8s.gcr.io/e2e-test-images/agnhost:2.31 ${CUSTOM_TMC_REPO}/extensions/inspection-images/agnhost:2.31
docker tag k8s.gcr.io/pause:3.9 ${CUSTOM_TMC_REPO}/extensions/inspection-images/pause:3.9
docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/agnhost:2.31
docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/pause:3.9

# clean up text files and sonobuoy tar
rm images_*
rm sonobuoy_*
EOF
Edit the file and set the Variables at the top. (VERSION, LATEST_RELEASE, CUSTOM_REGISTRY, and k8s_versions)
vi inspection-images.sh
Save the file and change the permissions
chmod +x inspection-images.sh
Run the Script
./inspection-images.sh

VMware/TMConEKS

2023-07-21T18:14:04Z

Admin: /* Load Harbor with Images */

= TMC on EKS Setup =

== Create Harbor on AWS==
=== SSH to Harbor-AWS EC2 Instance ===
#On Plex
ssh -i ~/.ssh/aws-keypair.pem ec2-user@ec2-54-91-52-46.compute-1.amazonaws.com

=== Install Harbor-AWS ===
#THIS IS JUST PULLING IN MY STAR CERT and KEY FOR DERSLLC
mkdir /data
cd /data
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /data/ders-star-chain.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt >> /data/ders-star-chain.crt
cp /data/ders-star-chain.crt /data/ders-star-chain.pem
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /data/ders-ca.crt
cat /data/ders-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /data/ders-star.key

yum -y install docker
service docker start
systemctl enable docker

wget https://github.com/docker/compose/releases/download/v2.18.1/docker-compose-linux-x86_64 -O /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
wget https://github.com/goharbor/harbor/releases/download/v2.8.1/harbor-offline-installer-v2.8.1.tgz
tar -zxvf harbor-offline-installer-v2.8.1.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
vi harbor.yml
# add Hostname and certs and location
#### harbor-aws.dersllc.com
#### /data/ders-star-chain.crt
#### /data/ders-star.key
#### /data/harbor-data

./install.sh --with-trivy --with-notary

== Load Harbor with Images ==
# On a Jumpbox...
docker login harbor-aws.dersllc.com
#################################
# Set Install Variables #
#################################
export IMGPKG_REGISTRY_HOSTNAME_0="harbor-aws.dersllc.com"
export IMGPKG_REGISTRY_USERNAME_0="admin"
export IMGPKG_REGISTRY_PASSWORD_0=<PASSWORD>
export PRIVATE_IMAGE_REGISTRY_CA_PATH="/data/ders-ca.crt"
export PRIVATE_IMAGE_REGISTRY="harbor-aws.dersllc.com"
export TKG_IMAGE_REGISTRY="projects.registry.vmware.com/tkg"
export TKG_REPO_VERSION="v2.2.0_update.1"
export TMC_HARBOR_PROJECT="tmc-sm-1.0.0"
export TMC_BUNDLE="tmc-self-managed-1.0.0"
#########################
# Prep TMC Bits #
#########################
mkdir tmc
tar -xf $TMC_BUNDLE.tar -C tmc
chmod +x /usr/local/bin/tmc
tmc/tmc-sm push-images harbor --project $IMGPKG_REGISTRY_HOSTNAME_0/$TMC_HARBOR_PROJECT --username $IMGPKG_REGISTRY_USERNAME_0 --password $IMGPKG_REGISTRY_PASSWORD_0
############################################################
# Upload Tanzu Standard Packages for TMC into Reop #
############################################################
imgpkg copy --registry-ca-cert-path $PRIVATE_IMAGE_REGISTRY_CA_PATH \
-b $TKG_IMAGE_REGISTRY/packages/standard/repo:$TKG_REPO_VERSION \
--to-repo $PRIVATE_IMAGE_REGISTRY/$TMC_HARBOR_PROJECT/498533941640.dkr.ecr.us-west-2.amazonaws.com/packages/standard/repo

== Setup EKS Cluster ==
#########################
# AWS AUTH INFO #
#########################
export AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
export AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>
export AWS_SESSION_TOKEN=<AWS_SESSION_TOKEN>

##########################
# INSTALL AWSCLI #
##########################
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

##########################
# Install EKSCLI #
##########################
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl /usr/local/bin

export eks_region=us-east-2
export eks_cluster_name=ders-tmc
export eks_nodegroup_size=m5.xlarge

eksctl create cluster --name $eks_cluster_name -r $eks_region -t $eks_nodegroup_size --nodes 3 --nodes-min 3 --nodes-max 11
#Wait for Status Complete.......

#Get Kubeconfig for EKS if needed
#aws eks update-kubeconfig --region $eks_region --name $eks_cluster_name

#Add another Node group if needed
#export eks_nodegroup_name=ders-tmc-nodes
#eksctl create nodegroup -c $eks_cluster_name -r $eks_region -n $eks_nodegroup_name -t $eks_nodegroup_size --nodes 3 --nodes-min 3 --nodes-max 11

== Prepare EKS for TMC Deploy ==
# Prep the EBS CSI
eksctl utils associate-iam-oidc-provider \
--region=$eks_region \
--cluster=$eks_cluster_name \
--approve

eksctl create iamserviceaccount \
--name ebs-csi-controller-sa \
--namespace kube-system \
--cluster $eks_cluster_name \
--attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
--approve \
--role-only \
--region=$eks_region \
--role-name AmazonEKS_EBS_CSI_DriverRole

eksctl create addon --name aws-ebs-csi-driver \
--cluster $eks_cluster_name \
--service-account-role-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/AmazonEKS_EBS_CSI_DriverRole \
--region=$eks_region \
--force

== Create CA Cert for Cert-Manager ==
################################################
# Create Config for CA SSL Certificate #
################################################
mkdir -p /tmp/ssl
cd /tmp/ssl
cat <<EOF > ca.cnf
[ req ]
default_bits = 2048
default_md = sha256
prompt = no
encrypt_key = no
distinguished_name = dn
[ dn ]
countryName = US
stateOrProvinceName = Ohio
localityName = Beavercreek
organizationName = DER's LLC
organizationalUnitName = IT
commonName = ca.dersllc.com
[ext]
keyUsage=critical,keyCertSign,cRLSign
basicConstraints=critical,CA:true,pathlen:1
subjectAltName=DNS:ca.dersllc.com
EOF

###############################################################
# Create a Self-Signed CA Cert Using the Config Above #
###############################################################
openssl req -x509 -nodes -newkey rsa:4096 -sha256 -days 3650 -nodes -keyout ders-ca.key -out ders-ca.cer -extensions ext -config ca.cnf

########################################################################################
# Get Base64 encoded PEM and KEY for the K8S Issuer YAML Used in the Next Step #
########################################################################################
cat ders-ca.cer | base64 -w0
cat ders-ca.key | base64 -w0

== Install TMC ==
################################################
# Setup TMC Namespace and Cert-Manager #
################################################
kubectl create ns tmc-local
# Deploy Cert-Manager into EKS Cluster
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
sleep 60
# Add ders-ca issuer (this is referenced in the tmc-eks-values.yaml)
kubectl apply -f https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/TMC%20on%20TKGm/tmc-issuer.yaml

################################################################
# Setup Harbor Credentials For The tmc-local Namespace #
################################################################
kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json --type=kubernetes.io/dockerconfigjson -n tmc-local
kubectl patch serviceaccount default -p "{\"imagePullSecrets\": [{\"name\": \"regcred\"}]}" -n tmc-local

##################################
# Create TMC Values File #
##################################
#tmc/tmc-local generate-values-schema --output-file tmc-eks-values.yaml #(Depending on the version or TMC you will use this or the next command.)
#tmc/tmc-local show-values-schema --output-filet tmc-eks-values.yaml

#############################################
# Pull TMC Values File and Validate #
#############################################
curl https://ders-gitlab.dersllc.com/ders/vmware-se/-/raw/main/HomeLab/TMC/tmc-eks-values.yaml > tmc-eks-values.yaml
tmc/tmc-local validate-values tmc-values.yaml

############################################
# Finally Install TMC Self-Managed #
############################################
tmc/tmc-local deploy --image-prefix $PRIVATE_IMAGE_REGISTRY/$TMC_HARBOR_PROJECT --kubeconfig ~/.kube/config --values=tmc-eks-values.yaml

###############################################################
# During Install get the LB IP/Name and add it to DNS #
###############################################################
kubectl get service -n tmc-local contour-envoy -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

== Uninstall TMC ==
tmc/tmc-local uninstall --kubeconfig ~/.kube/config

== Setup Inspection Images ==
Run the below command to create the download script.
cat > ./inspection-images.sh << "EOF"
#!/bin/bash

# https://github.com/vmware-tanzu/sonobuoy/releases
VERSION=${1:-"v0.56.16"}
LATEST_RELEASE=${2:-"sonobuoy_0.56.16_linux_amd64.tar.gz"}
CUSTOM_REGISTRY=${3:-"harbor-aws.dersllc.com/tmc-1.0.0-beta.2-rc.3"}
DOCKER_PROXY=${4:-"harbor.tanzu.io:8443/dockerhub-proxy-cache"} # optional argument
CUSTOM_TMC_REPO="${CUSTOM_REGISTRY}/498533941640.dkr.ecr.us-west-2.amazonaws.com"

# https://kubernetes.io/releases/patch-releases/
k8s_versions=(v1.23.8 v1.24.10)

wget "https://github.com/vmware-tanzu/sonobuoy/releases/download/${VERSION}/${LATEST_RELEASE}"
tar -xvf ${LATEST_RELEASE}

for i in "${k8s_versions[@]}"
do
echo "================CHECKING K8S: $i======================="
./sonobuoy images list --kubernetes-version $i > images_$i.txt

while read image
do
echo "================CHECKING IMAGE: $image=================="
base=$(basename "$image")
output=${image#*/*}

if [[ $image == *"docker"* && -n $DOCKER_PROXY ]];
then
docker pull $DOCKER_PROXY/$output
docker tag $DOCKER_PROXY/$output ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
else
docker pull $image
docker tag $image ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
fi

docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base
echo "===================PUSHING: ${CUSTOM_TMC_REPO}/extensions/inspection-images/$base ==========="
done < images_$i.txt
done

# not part of sonobuoy image list, install manually, update these as images are found
docker pull k8s.gcr.io/e2e-test-images/agnhost:2.31
docker pull k8s.gcr.io/pause:3.9
docker tag k8s.gcr.io/e2e-test-images/agnhost:2.31 ${CUSTOM_TMC_REPO}/extensions/inspection-images/agnhost:2.31
docker tag k8s.gcr.io/pause:3.9 ${CUSTOM_TMC_REPO}/extensions/inspection-images/pause:3.9
docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/agnhost:2.31
docker push ${CUSTOM_TMC_REPO}/extensions/inspection-images/pause:3.9

# clean up text files and sonobuoy tar
rm images_*
rm sonobuoy_*
EOF
Edit the file and set the Variables at the top. (VERSION, LATEST_RELEASE, CUSTOM_REGISTRY, and k8s_versions)
vi inspection-images.sh
Save the file and change the permissions
chmod +x inspection-images.sh
Run the Script
./inspection-images.sh

TDKC

2023-06-02T19:47:37Z

Admin: Created page with "= System Administrator Documentation = ==Mediawiki Installation Procedures== * Build a Centos 7 Server * Set Selinux to Permissive and allow port 80 through the firewall: sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config setenforce 0 firewall-cmd --add-port 80/tcp firewall-cmd --add-port 80/tcp --permanent * Install EPEL Repository: yum install -y epel-release * Install Required Packages: yum install -y mediawiki mariadb-server php-mysql * Enable..."

= System Administrator Documentation =
==Mediawiki Installation Procedures==
* Build a Centos 7 Server
* Set Selinux to Permissive and allow port 80 through the firewall:
sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
setenforce 0
firewall-cmd --add-port 80/tcp
firewall-cmd --add-port 80/tcp --permanent
* Install EPEL Repository:
yum install -y epel-release
* Install Required Packages:
yum install -y mediawiki mariadb-server php-mysql
* Enable and Turn on Services:
systemctl enable httpd
systemctl enable mariadb
systemctl start httpd
systemctl start mariadb
* Configure Mariadb:
mysql
create database wiki;
GRANT ALL PRIVILEGES ON wiki.* to 'wiki'@'localhost' IDENTIFIED BY '<password>';
exit
* Edit the /etc/httpd/conf.d/mediawiki123.conf to look like:
Alias /mw-config /var/www/mediawiki123/mw-config

Alias /index.php /var/www/mediawiki123/index.php
Alias /api.php /var/www/mediawiki123/api.php
Alias /load.php /var/www/mediawiki123/load.php
Alias /opensearch_desc.php /var/www/mediawiki123/opensearch_desc.php
Alias /skins /var/www/mediawiki123/skins
Alias /images /var/www/mediawiki123/images
Alias / /var/www/mediawiki123/index.php

<Directory /var/www/mediawiki123>
Options FollowSymLinks
</Directory>
* Restart the httpd service and go http://wiki.tdkc.com/mw-config to configure the Site.
** Click Continue.
** Click Continue.
** Select the MySQL radio button.
** Set the Database Name to wiki.
** Set the Database Username to wiki.
** Set the Database Password.
** Click Continue.
** Click Continue.
** Set the Wiki Name to TDKC Wiki.
** Set the Administrator Username to admin.
** Set the Administrator Password and Confirm it.
** Set the Administrator E-mail to cpowell@tdkc.com.
** Select the Ask me more questions radio button.
** Click Continue.
** Select the Authorized Editors Only radio button.
** Check all of the Extensions.
** Check Enable File Uploads .
** Check Enable Instant Commons 
** Click Continue.
* Download the LocalSettings.php and place it at /var/www/mediawiki123/LocalSettings.php on the wiki server.
* After the install comment the mw-config line in the /etc/httpd/conf.d/mediawiki123.conf:
#Alias /mw-config /var/www/mediawiki123/mw-config
* Restart httpd and go to http://wiki.tdkc.com

= Disable Account Creation for everyon but admins=
* Edit the LocalSettings.php file and add the following to the bottom.
$wgGroupPermissions['*']['createaccount'] = false;
= LDAP Integration =
* Install required Software
yum -y install php-ldap
systemctl restart httpd
* Allow httpd to make network calls
setsebool -P httpd_can_network_connect on
* Get Latest Plugin for your Version of MediaWiki
https://www.mediawiki.org/wiki/Extension:LDAP_Authentication
* Download Snapshot and copy tar file to the wiki server
tar -zxvf <tar> -C /var/www/mediawiki123/extensions/
* Add the following to the /var/www/mediawiki123/LocalSettings.php file
#LDAP Settings
require_once "extensions/LdapAuthentication/LdapAuthentication.php";
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDomainNames = array("TDKC");
$wgLDAPServerNames = array("TDKC" => "<IP>");
$wgLDAPEncryptionType = array("TDKC" => "clear");
$wgLDAPUseLocal = true;
$wgMinimalPasswordLength = 1;
$wgLDAPBaseDNs = array("TDKC" => "dc=tdkc,dc=com");
$wgLDAPSearchAttributes = array("TDKC" => "sAMAccountName");
$wgLDAPRetrievePrefs = array("TDKC" => true);
$wgLDAPPreferences = array("TDKC" => array("email" => "mail", "realname" => "displayname"));
$wgLDAPProxyAgent = array("TDKC" => "wiki@tdkc.com");
$wgLDAPProxyAgentPassword = array("TDKC" => "<PASS>");

= Restricting Wiki Pages =
* Get Latest Plugin for your Version of MediaWiki
https://www.mediawiki.org/wiki/Extension:AccessControl
* Download Snapshot and copy tar file to the wiki server
tar -zxvf <tar> -C /var/www/mediawiki123/extensions/
* Add the following to the /var/www/mediawiki123/LocalSettings.php file
require_once "$IP/extensions/AccessControl/AccessControl.php";
$wgAdminCanReadAll = true;
$wgAccessControlRedirect = false;
* Add the below tag to the top of each page you want restricted:
<nowiki><accesscontrol>Administrators</accesscontrol></nowiki>
* Add / Remove users to the Administrators Group
** Go to Special Pages
** User Right Management
** Enter the username you wish to add/remove
** Check or Uncheck the administrator box
** Click Save user groups
'''Note:''' You may need to do this as the admin user.

= Customizing the Logo =
* Copy the logo to the wiki server and replace the /var/www/mediawiki123/skins/common/images/wiki.png file:
mv /var/www/mediawiki123/skins/common/images/wiki.png /var/www/mediawiki123/skins/common/images/wiki.png.old
mv /tmp/logo.png /var/www/mediawiki123/skins/common/images/wiki.png
* Refresh the Webpage

 
==Spacewalk Installation Procedures==
=Spacewalk Installation Procedures=
* Build a Centos 7 Server
* Set Selinux to Permissive and allow port 80 through the firewall:
sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
setenforce 0
firewall-cmd --add-port 80/tcp
firewall-cmd --add-port 80/tcp --permanent
firewall-cmd --add-port 443/tcp
firewall-cmd --add-port 443/tcp --permanent

* Install the Required Server Repositories:
# Spacewalk Server Repository
rpm -Uvh http://yum.spacewalkproject.org/2.3/RHEL/7/x86_64/spacewalk-repo-2.3-4.el7.noarch.rpm

# JPackage Repository
cat <<EOF> /etc/yum.repos.d/jpackage-generic.repo
[jpackage-generic]
name=JPackage generic
mirrorlist=http://www.jpackage.org/mirrorlist.php?dist=generic&type=free&release=5.0
enabled=1
gpgcheck=1
gpgkey=http://www.jpackage.org/jpackage.asc
EOF

* Install The Spacewalk Database:
yum -y install spacewalk-setup-postgresql

* Install Spacewalk:
yum -y install spacewalk-postgresql
# EPEL Repository
yum -y install epel-release

=Spacewalk Configuration=
== Basic Configuration ==
* Start the installation wizard:
spacewalk-setup --disconnected
* Answer the questions:
Admin Email Address? cpowell@tdkc.com

Should setup configure apache's default ssl server for you (saves original ssl.conf) [Y]? Y

CA certificate password? <pass>
Re-enter CA certificate password? <pass>
Organization? TDKC
Organization Unit? IT
Email Address [cpowell@tdkc.com]? cpowell@tdkc.com
City? Fairborn
State? OH
Country code (Examples: "US", "JP", "IN", or type "?" to see a list)? US

Cobbler requires tftp and xinetd services be turned on for PXE provisioning functionality. Enable these services [Y]? Y

* On complete, start the Spacewalk service if not started automatically.
/usr/sbin/spacewalk-service start

* Go to https://spacewalk.tdkc.com and create an admin account
[[File:Spacewalk1.png]]

== Changing the Spacewalk Logo ==
* Resize the TDKC logo to 44px wide
* Change spacewalk logo to TDKC:
mv /var/www/html/img/logo_vendor.png /var/www/html/img/logo_vendor.png.old
mv /tmp/logo.png /var/www/html/img/logo_vendor.png

== Creating Software Channels ==
=== Base Channels ===
* Go to the Channels Tab.
* Click the Manage Software Channels Tab on the Left Menu.
* Click the Create Channel Button.
* Fill out the form.
Channel Name: CentOS 7
Channel Label: centos-7
Parent Channel: None
Architecture: x86_64
Yum Repository Checksum Type: sha512
Channel Summary: CentOS Base Channel
Channel Description: CentOS Base Channel
* Click Create Channel.
* Repeat the above steps for each needed Base Channel
=== Sub Channels ===
* Go to the Channels Tab.
* Click the Manage Software Channels Tab on the Left Menu.
* Click the Create Channel Button.
* Fill out the form.
Channel Name: CentOS 7 Updates
Channel Label: centos-7-updates
Parent Channel: CentOS 7
Architecture: x86_64
Yum Repository Checksum Type: sha512
Channel Summary: CentOS 7 Updates Sub Channel
Channel Description: CentOS 7 Updates Sub Channel
* Click Create Channel.
* Repeat the above steps for each needed Sub Channel
=== Syncing Software Channels ===
* SSH to the spacewalk server
* Create a scripts directory
mkdir -p /usr/share/rhn/scripts
* Create a file called reposync.sh
vi /usr/share/rhn/scripts/reposync.sh

mkdir -p /var/log/scripts/
date > /var/log/scripts/spacewalk-repo-sync.log
echo ##################################################### >> /var/log/scripts/spacewalk-repo-sync.log
CENT7LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">7\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`

spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/os/x86_64/ -c centos-7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/extras/x86_64/ -c centos-7-extras >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/updates/x86_64/ -c centos-7-updates >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://dl.fedoraproject.org/pub/epel/7/x86_64/ -c centos-7-epel >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/7/x86_64/ -c centos-7-spacewalk-client >> /var/log/scripts/spacewalk-repo-sync.log

chmod -R 777 /var/satellite/redhat/1/
echo #################################################### >> /var/log/scripts/spacewalk-repo-sync.log
date >> /var/log/scripts/spacewalk-repo-sync.log

* Change permissions to the reposync.sh file
chmod 755 /usr/share/rhn/scripts/reposync.sh
* To run it manually simply use the following command:
/usr/share/rhn/scripts/reposync.sh
* To schedule the script use cron as root:
crontab -e
* Add the following line to the crontab: (This will run the script once a week on sunday morning at 00:01)
1 0 * * 0 /usr/share/rhn/scripts/reposync.sh
* This script is logged at /var/log/scripts/spacewalk-repo-sync.log

== Creating System Groups ==
* Go to the Systems Tab.
* Click the System Groups Tab on the Left Menu.
* Click the Create Group Button.
* Fill out the form.
Name: '''Centos 7 Servers'''
Description: '''Centos 7 Servers'''
* Repeat for all of the groups you wish to create.

== Creating Configuration Channels ==
These are groups of configuration files that are managed by spacewalk. These files can be pushed to the servers that are subscribed to the channel.
* Go to the Configuration Tab.
* Click the Configuration Channels Tab on the Left Menu.
* Click the Create Config Channel Button.
* Fill out the form.
Name: '''Centos 7 Servers'''
Label: '''centos-7-config'''
Description: '''Centos 7 Servers'''
* Click the Add Files Tab and add any configuration files you wish.
'''Note:''' These can be added at anytime. 
'''Note:''' These files can be pulled to each server that is subscribed, by running the command '''rhncfg-client get'''
* Repeat for all of the channels you wish to create.

== Creating Activation Keys ==
These are used during kickstarts to join the spacewalk server. They are also use to assign kickstarted machines to the appropriate System Groups, Software Channels, Configuration Channels and more.
* Go to the Systems Tab.
* Click the Activation Keys Tab on the Left Menu.
* Click the Create Key Button.
* Fill out the form.
Description: '''Centos 7 Servers'''
Key: '''centos-7-key'''
Base Channel: '''CentOS 7'''
Check Provisioning
* Under the '''Child Channels''' tab add all desired Software channels by pressing ctrl and clicking each channel you wish.
* Then click the '''Update Key''' button.
* Under the '''Packages''' Tab, add all of the software packages you wish to install at spacewalk registration time.
* Then click the '''Update Key''' button.
* Under the '''Configuration''' Tab and the Subscribe Channels Sub-Tab, add all of the configuration channels you wish the servers be added to.
* Then click the '''Update Key''' button.
* Under the '''Groups''' Tab and the '''Join''' sub-tab, check the groups you wish the activation key to add the server to.
* Then click the '''Join Selected Group''' button.
== Joining Existing Servers ==
=== Spacewalk Setup ===
* Create a Repository file on the spacewalk server
mkdir -p /var/www/html/pub/repo_files/
vi /var/www/html/pub/repo_files/centos7.repo

[local-centos-7]
name=local-centos-7
baseurl=http://spacewalk.tdkc.com/ks/dist/org/1/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-updates]
name=local-centos-7-updates
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-updates/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-extras]
name=local-centos-7-extras
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-extras/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-spacewalk-client]
name=local-centos-7-spacewalk-client
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-spacewalk-client/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-epel]
name=local-centos-7-epel
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-epel/centos-7-latest
enabled=1
gpgcheck=0

====Add python-gudev and python-hwdata to the CentOS 7 Spacewalk Client Repo====
* Go to the '''Channels''' Tab
* Go to the '''Manage Software Channels''' Tab on the Left hand side.
* Click the '''CentOS 7 Spacewalk Client''' Channel.
* Click the '''Packages''' Tab.
* Click the '''Add''' Sub Tab.
* Under channel Choose '''CentOS 7''' and Click '''View Packages'''
* Search for python-gudev and python-hwdata and Click '''Add Packages'''
* Then Click '''Confirm Addition''' Button.

=== Client Setup ===
==== CentOS 7 ====
Run the following as '''ROOT''':
mkdir -p /tmp/old_repos
for i in `ls /etc/yum.repos.d/*`; do mv -f $i /tmp/old_repos/; done
#for i in `ls /etc/yum.repos.d/Cent*`; do echo > $i; done
curl http://spacewalk/pub/repo_files/centos7.repo > /etc/yum.repos.d/local-centos-7.repo
yum -y install wget
rpm --import http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-EPEL-7 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-CentOS-7 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2008 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2010 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2012 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2014 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2015
cat /tmp/ssl-key-* > /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
perl -pe 's/RHNS-CA-CERT/RHN-ORG-TRUSTED-SSL-CERT/g' -i /etc/sysconfig/rhn/up2date
yum -y install pyOpenSSL rhnlib libxml2 libxml2-python
perl -npe 's|^(\s*(noSSLS\|s)erverURL\s*=\s*[^:]+://)[^/]*/|${1}spacewalk.tdkc.com/|' -i /etc/sysconfig/rhn/up2date
mkdir -p /etc/sysconfig/rhn/allowed-actions/script
touch /etc/sysconfig/rhn/allowed-actions/script/run
mkdir -p /etc/sysconfig/rhn/allowed-actions/configfiles
touch /etc/sysconfig/rhn/allowed-actions/configfiles/all
mkdir -p /usr/share/rhn/
wget http://spacewalk.tdkc.com/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
yum -y install rhncfg-client rhncfg rhncfg-actions osad osa-common jabberpy rhn-setup
rhnreg_ks --serverUrl=https://spacewalk.tdkc.com/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=1-centos-7-key
rhncfg-client get
systemctl enable osad
systemctl start osad
systemctl disable firewalld
systemctl stop firewalld

# The Below are only needed if you want to keep firewalld ON
#firewall-cmd --add-port 5222/tcp
#firewall-cmd --add-port 4545/tcp
#firewall-cmd --add-port 5222/tcp --permanent
#firewall-cmd --add-port 4545/tcp --permanent

==== CentOS 6 ====
Run the following as '''ROOT''':
mkdir -p /tmp/old_repos
for i in `ls /etc/yum.repos.d/*`; do mv -f $i /tmp/old_repos/; done
#for i in `ls /etc/yum.repos.d/Cent*`; do echo > $i; done
curl http://spacewalk/pub/repo_files/centos6.repo > /etc/yum.repos.d/local-centos-6.repo
yum -y install wget
rpm --import http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-pbis http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-EPEL-6 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-CentOS-6 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2008 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2010 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2012 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2014 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2015
cat /tmp/ssl-key-* > /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
perl -pe 's/RHNS-CA-CERT/RHN-ORG-TRUSTED-SSL-CERT/g' -i /etc/sysconfig/rhn/up2date
yum -y install pyOpenSSL rhnlib libxml2 libxml2-python
perl -npe 's|^(\s*(noSSLS\|s)erverURL\s*=\s*[^:]+://)[^/]*/|${1}spacewalk.tdkc.com/|' -i /etc/sysconfig/rhn/up2date
mkdir -p /etc/sysconfig/rhn/allowed-actions/script
touch /etc/sysconfig/rhn/allowed-actions/script/run
mkdir -p /etc/sysconfig/rhn/allowed-actions/configfiles
touch /etc/sysconfig/rhn/allowed-actions/configfiles/all
mkdir -p /usr/share/rhn/
wget http://spacewalk.tdkc.com/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
yum -y install rhncfg-client rhncfg rhncfg-actions osad osa-common jabberpy rhn-setup
rhnreg_ks --serverUrl=https://spacewalk.tdkc.com/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=1-centos-6-key --force
rhncfg-client get
chkconfig osad on
service osad start
chkconfig iptables off
service iptables stop
chkconfig ip6tables off
service ip6tables stop

# The Below are only needed if you want to keep iptables ON
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 4545 -j ACCEPT' /etc/sysconfig/iptables
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 5222 -j ACCEPT' /etc/sysconfig/iptables
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 4545 -j ACCEPT' /etc/sysconfig/ip6tables
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 5222 -j ACCEPT' /etc/sysconfig/ip6tables
#service iptables restart
#service ip6tables restart

==== CentOS 5 ====
Run the following as '''ROOT''':
mkdir -p /tmp/old_repos
for i in `ls /etc/yum.repos.d/*`; do mv -f $i /tmp/old_repos/; done
#for i in `ls /etc/yum.repos.d/Cent*`; do echo > $i; done
curl http://spacewalk/pub/repo_files/centos5.repo > /etc/yum.repos.d/local-centos-5.repo
yum -y install wget
rpm --import http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-pbis http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-EPEL-5 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-CentOS-5 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2008 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2010 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2012 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2014 http://spacewalk.tdkc.com/pub/repo_files/RPM-GPG-KEY-spacewalk-2015
cat /tmp/ssl-key-* > /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
perl -pe 's/RHNS-CA-CERT/RHN-ORG-TRUSTED-SSL-CERT/g' -i /etc/sysconfig/rhn/up2date
yum -y install pyOpenSSL rhnlib libxml2 libxml2-python
perl -npe 's|^(\s*(noSSLS\|s)erverURL\s*=\s*[^:]+://)[^/]*/|${1}spacewalk.tdkc.com/|' -i /etc/sysconfig/rhn/up2date
mkdir -p /etc/sysconfig/rhn/allowed-actions/script
touch /etc/sysconfig/rhn/allowed-actions/script/run
mkdir -p /etc/sysconfig/rhn/allowed-actions/configfiles
touch /etc/sysconfig/rhn/allowed-actions/configfiles/all
echo '#includedir /etc/sudoers.d' >> /etc/sudoers
chmod 755 /etc/sudoers.d/
mkdir -p /usr/share/rhn/
wget http://spacewalk.tdkc.com/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
yum -y install rhncfg-client rhncfg rhncfg-actions osad osa-common jabberpy rhn-setup
rhnreg_ks --serverUrl=https://spacewalk.tdkc.com/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=1-centos-5-key
rhncfg-client get
chkconfig osad on
service osad start
chkconfig iptables off
service iptables stop
chkconfig ip6tables off
service ip6tables stop

# The Below are only needed if you want to keep iptables ON
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 4545 -j ACCEPT' /etc/sysconfig/iptables
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 5222 -j ACCEPT' /etc/sysconfig/iptables
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 4545 -j ACCEPT' /etc/sysconfig/ip6tables
#sed -i '/--dport 22/a -A INPUT -m state --state NEW -m tcp -p tcp --dport 5222 -j ACCEPT' /etc/sysconfig/ip6tables
#service iptables restart
#service ip6tables restart

==== Ubuntu 12.04 ====
Run the following as '''ROOT''':
mkdir -p /tmp/spacewalk/
cd /tmp/spacewalk/
wget http://spacewalk.tdkc.com/pub/register/ubuntu-1204/apt-transport-spacewalk-1.0.6-2.5-1ubuntu1-precise1.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/libnl1_1.1-7_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/osad-5.9.21-2.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/pyjabber-0.5.0-1.4ubuntu3-precise1.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-dmidecode_3.10.11-1build2_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-ethtool_0.6-0ubuntu1_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-gudev_147.2-2_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-libxml2-2.7.8.dfsg-5.1ubuntu4.15.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-newt_0.52.11-2ubuntu10_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-rhn-2.5.52-1ubuntu1-precise1.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-support_1.0.14ubuntu2_all.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/rhncfg-5.10.14-1ubuntu1-precise2.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/rhn-client-tools_1.8.9-4~precise1_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/rhnsd-5.0.4-3.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/libgudev-1.0-0_175-0ubuntu9_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-gobject-2_2.28.6-10ubuntu1_amd64.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1204/python-gobject_3.2.2-1~precise_all.deb
dpkg -i *.deb
#add-apt-repository -y ppa:mj-casalogic/spacewalk-ubuntu
#apt-get update
mkdir -p /usr/share/rhn/
wget http://spacewalk.tdkc.com/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
apt-get -y install rhncfg rhn-client-tools apt-transport-spacewalk python-rhn rhnsd python-libxml2
sed -i 's/if not self.allow_none:/#if not self.allow_none:/' /usr/lib/python2.7/xmlrpclib.py
sed -i 's/raise TypeError, "cannot marshal None unless allow_none is enabled"/#raise TypeError, "cannot marshal None unless allow_none is enabled"/' /usr/lib/python2.7/xmlrpclib.py
mkdir /var/lock/subsys
rhnreg_ks --activationkey=1-ubuntu-1204 --serverUrl=http://spacewalk.tdkc.com/XMLRPC --force
rhn-actions-control --enable-run
echo 'deb spacewalk://spacewalk.tdkc.com/XMLRPC channels: main ubuntu-1204-custom ubuntu-1204-security ubuntu-1204-updates' > /etc/apt/sources.list.d/spacewalk.list
mv /etc/apt/sources.list /etc/apt/sources.list.bak
mkdir -p /var/spool/rhn
cd /tmp
rm -rf /tmp/spacewalk/
apt-get update
sleep 10
apt-get update

==== Ubuntu 14.04 ====
Run the following as '''ROOT''':
mkdir -p /tmp/spacewalk/
cd /tmp/spacewalk/
mkdir -p /usr/share/rhn/
wget http://spacewalk.tdkc.com/pub/register/ubuntu-1404/apt-transport-spacewalk-1.0.6-2.1.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/libgudev-1.0-0-1-204-5ubuntu20.22.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/libnl1-1.1-8ubuntu1.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-dbus-1.2.0-2build2.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-dbus-dev-1.2.0-2build2.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-dmidecode-3.10.13-3.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-ethtool-0.7-1.1.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-gi-3.12.0-1ubuntu1.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-gobject-2-2.28.6-12build1.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-gobject-3.12.0-1ubuntu1.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-gudev-147.2-3.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-libxml2-2.9.1+dfsg1-3ubuntu4.8.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-newt-0.52.15-2ubuntu5.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-rhn-2.5.52-1.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/python-support-1.0.15-X.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/rhncfg-5.10.14-1ubuntu1-saucy2.all-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/rhn-client-tools-1.8.26-4-ubuntu14.04.1-ppa1.amd64-deb.deb http://spacewalk.tdkc.com/pub/register/ubuntu-1404/rhnsd-4.9.15-1.amd64-deb.deb
dpkg -i *.deb
wget http://spacewalk.tdkc.com/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
apt-get -y install rhn-client-tools apt-transport-spacewalk python-rhn rhnsd python-libxml2
wget http://spacewalk.tdkc.com/pub/register/rhncfg-5.10.14-1ubuntu1-saucy2.all-deb.deb
dpkg -i rhncfg-5.10.14-1ubuntu1-saucy2.all-deb.deb
sed -i 's/if not self.allow_none:/#if not self.allow_none:/' /usr/lib/python2.7/xmlrpclib.py
sed -i 's/raise TypeError, "cannot marshal None unless allow_none is enabled"/#raise TypeError, "cannot marshal None unless allow_none is enabled"/' /usr/lib/python2.7/xmlrpclib.py
apt-get install python-libxml2
mkdir -p /var/lock/subsys
rhnreg_ks --activationkey=1-ubuntu-1404 --serverUrl=http://spacewalk.tdkc.com/XMLRPC --force
rhn-actions-control --enable-run
rhn_check
rhncfg-client get
echo 'deb spacewalk://spacewalk.tdkc.com/XMLRPC channels: main ubuntu-1404-custom ubuntu-1404-security ubuntu-1404-updates' > /etc/apt/sources.list.d/spacewalk.list
mv /etc/apt/sources.list /etc/apt/sources.list.bak
mkdir -p /var/spool/rhn
cd /tmp
rm -rf /tmp/spacewalk/
apt-get update
sleep 10
apt-get update

==== Ubuntu 15.10 ====
Run the following as '''ROOT''':
mkdir -p /tmp/spacewalk/
cd /tmp/spacewalk/
#wget http://spacewalk.tdkc.com/download/package/9a990879fd7d446a221fb1beecb9386b4193b9dd/1486533691738/2/74389/apt-transport-spacewalk-1.0.6-4.1.all-deb.deb http://spacewalk.tdkc.com/download/package/1fe2d5c78bb3a4bcffd210bc38a55809c7cb493f/1486533709647/2/74390/libgudev-1.0-0-1:230-2.amd64-deb.deb http://spacewalk.tdkc.com/download/package/0c38f9a52f4cdefd3ab2a29e574d215f99e3905e/1486533717989/2/74391/libnl-route-3-200-3.2.26-1.amd64-deb.deb http://spacewalk.tdkc.com/download/package/6230d4117a0a9c2ec92e348696efe3befad4355f/1486533730178/2/74393/python-cffi-1.1.2-1ubuntu2.all-deb.deb http://spacewalk.tdkc.com/download/package/4ca9d34787524960ef65707edda3f05353029408/1486533739004/2/74394/python-cffi-backend-1.1.2-1ubuntu2.amd64-deb.deb http://spacewalk.tdkc.com/download/package/d85db44c341d453689819112feb6150e9e14916d/1486533748338/2/74395/python-cryptography-1.0.1-1ubuntu1.amd64-deb.deb http://spacewalk.tdkc.com/download/package/2b6ee8eddeee8532995e732212aa590e6780cc6e/1486533757114/2/74396/python-dbus-1.2.0-2build3.amd64-deb.deb http://spacewalk.tdkc.com/download/package/73437d3050ecbc99ce5e0b52f9236963d327f1fd/1486533777174/2/74397/python-dbus-dev-1.2.0-2build3.all-deb.deb http://spacewalk.tdkc.com/download/package/ad71b97a51a6d2d41ef0169c9d2ab2e146f09a1e/1486533790037/2/74398/python-dmidecode-3.12.2-1.amd64-deb.deb http://spacewalk.tdkc.com/download/package/645ea178fa3d1d9109a630054e40650116118edf/1486533799975/2/74399/python-enum34-1.0.4-2.all-deb.deb http://spacewalk.tdkc.com/download/package/7fddb9738fe66b922e505e8258125cf2f3556734/1486533809243/2/74400/python-ethtool-0.11-3.amd64-deb.deb http://spacewalk.tdkc.com/download/package/9db7758c9f44c5600100046e022e7e78ee285d9c/1486533818862/2/74401/python-gi-3.16.2-1build1.amd64-deb.deb http://spacewalk.tdkc.com/download/package/45b505436891a30e5038f98f1125e5c8faf87255/1486533827584/2/73063/python-gobject-2-2.28.6-12build1.amd64-deb.deb http://spacewalk.tdkc.com/download/package/e3b34a2322fbc36ea1f14f5629402eed3a341345/1486533838570/2/74402/python-gobject-3.16.2-1build1.all-deb.deb http://spacewalk.tdkc.com/download/package/cac91472f41247a71e0cdfc09dc9ced6aa191808/1486533847044/2/73066/python-gudev-147.2-3.amd64-deb.deb http://spacewalk.tdkc.com/download/package/bc96ea69767e2929b0d42089e21306eed4a70c96/1486533855510/2/74403/python-idna-2.0-3.all-deb.deb http://spacewalk.tdkc.com/download/package/22a736afd87c57cc10b5d66077d68d96bbe2e303/1486533863520/2/74404/python-ipaddress-1.0.14-2.all-deb.deb http://spacewalk.tdkc.com/download/package/16d798f91c1736ea0b8cc85ae10ebc425ecfb20c/1486533872744/2/74405/python-libxml2-2.9.2+zdfsg1-4ubuntu0.4.amd64-deb.deb http://spacewalk.tdkc.com/download/package/2df719267a55d9e7f45eda9a9b5f2f54bf28efe8/1486533882046/2/74406/python-newt-0.52.18-1ubuntu1.amd64-deb.deb http://spacewalk.tdkc.com/download/package/24e041a6f29874de148225d3d3d42a035bc399a5/1486533891902/2/74408/python-openssl-0.15.1-2build1.all-deb.deb http://spacewalk.tdkc.com/download/package/2a18f3173b2af6c901f19631571170ee909482f5/1486533901275/2/74409/python-pkg-resources-18.4-1.all-deb.deb http://spacewalk.tdkc.com/download/package/83c2bfd93db39cc2976bfb242ba35ec15dd4ec19/1486533909664/2/74410/python-ply-3.7-1.all-deb.deb http://spacewalk.tdkc.com/download/package/ca446abc1e8472df4de42930170f6e3993a074c0/1486533925603/2/74411/python-pyasn1-0.1.8-2.all-deb.deb http://spacewalk.tdkc.com/download/package/2c37e07e157e58310e68b331bdcf74da4be2fdb7/1486533934180/2/74413/python-pycparser-2.14+dfsg-2build1.all-deb.deb http://spacewalk.tdkc.com/download/package/3200828f2c633a17a6776d8a8387c3144795c12c/1486533943711/2/74414/python-rhn-2.5.55-2.all-deb.deb http://spacewalk.tdkc.com/download/package/43e0245e31ec67a9c1bf508c8710f52a134af713/1486533958421/2/74415/python-six-1.9.0-5.all-deb.deb http://spacewalk.tdkc.com/download/package/683688494c9a41c085211fb8ecc7cf2fca3a82c1/1486533966846/2/74416/rhn-client-tools-1.8.26-4.amd64-deb.deb http://spacewalk.tdkc.com/download/package/1464b7a0f4d17718fe9eb2262df30a3e6c0bade3/1486533975390/2/74417/rhnsd-5.0.4-3.amd64-deb.deb http://spacewalk.tdkc.com/download/package/4100a3dcc3bde6c366888af2fc264e498167dddf/1486534916145/2/73403/rhncfg-5.10.14-1ubuntu1~saucy2.all-deb.deb
wget http://spacewalk.tdkc.com/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
apt-get -y install rhn-client-tools apt-transport-spacewalk python-rhn rhnsd python-libxml2
wget http://spacewalk.tdkc.com/pub/register/rhncfg-5.10.14-1ubuntu1-saucy2.all-deb.deb
dpkg -i rhncfg-5.10.14-1ubuntu1-saucy2.all-deb.deb
#dpkg -i *.deb
sed -i 's/if not self.allow_none:/#if not self.allow_none:/' /usr/lib/python2.7/xmlrpclib.py
sed -i 's/raise TypeError, "cannot marshal None unless allow_none is enabled"/#raise TypeError, "cannot marshal None unless allow_none is enabled"/' /usr/lib/python2.7/xmlrpclib.py
mkdir -p /var/lock/subsys
rhnreg_ks --activationkey=1-ubuntu-1510 --serverUrl=http://spacewalk.tdkc.com/XMLRPC --force
rhn-actions-control --enable-run
rhn_check
rhncfg-client get
echo 'deb spacewalk://spacewalk.tdkc.com/XMLRPC channels: main ubuntu-1510-custom ubuntu-1510-security ubuntu-1510-updates' > /etc/apt/sources.list.d/spacewalk.list
mv /etc/apt/sources.list /etc/apt/sources.list.bak
mkdir -p /var/spool/rhn
cd /tmp
rm -rf /tmp/spacewalk/
apt-get update
sleep 10
apt-get update

 
==Files Managed By Spacewalk==
= Files Managed By Spacewalk =
== /etc/sssd/sssd.conf ==
This File is here to ensure proper configuration of the SSSD clients.

By Default SSSD does not configure itself with all of the needed settings.

== /etc/sudoers.d/master-sudoers ==
This file is managed by spacewalk to ensure all machines are compliant with the concept of least privilege.

The % refers to groups

Adding '''TDKC\\''' in front of groups and users allow likewise joined servers (without the '''/opt/pbis/bin/config AssumeDefaultDomain true''' command run) to be compatible with the sudoers file.

For in-depth information on this file please refer to https://linux.die.net/man/5/sudoers.

== /etc/sysconfig/rhn/rhnsd ==
This file is managed by spacewalk to reduce the amount of time that the clients check in with spacewalk. The Default is 4 hours. Setting the INTERVAL to 60 (the lowest it allows) tells the clients to check in once an hour.

== /etc/profile.d/security_lockdowns.sh ==
This file is managed by spacewalk to provide the spacewalk clients with the proper profile lockdowns.

TMOUT refers to the amount of Idle time a session is allowed, in seconds. If a user is idle for this length of time they will be automatically logged off.

 
==General Linux Commands and Scripts==
= General Linux Commands and Scripts =
== Create Keytab file for adjoin user ==
Run the following code as '''ROOT''':

yum -y install krb5-workstation
ktutil
addent -password -p adjoin@TDKC.COM -k 1 -e RC4-HMAC
'''<enter password for username>'''
wkt adjoin.keytab
q

== Joining CentOS 7 Server to Active Directory (AD) ==
You must first join the Spacewalk server:
[[Admin/Spacewalk_Install#CentOS_7 | Join CentOS 7 to Spacewalk]]

Run the following code as '''ROOT''':

# Install Required Software
yum install -y realmd samba samba-common oddjob oddjob-mkhomedir sssd adcli sssd-tools samba-libs krb5-workstation

# Get Keytab for authentication
wget -q http://spacewalk.tdkc.com/pub/join/adjoin.keytab -O /root/adjoin.keytab

kinit -k -t /root/adjoin.keytab adjoin@TDKC.COM

# Leave all realms (this is only really needed if you are previously joined)
realm leave
sleep 5

# Join the Domain using an admin account and place the computer in the Servers OU
realm join --no-password --computer-ou="ou=VMs,OU=TDKCMachines,dc=tdkc,dc=com" "tdkc.com"
sleep 15

# Pull the Corrected configuration file from Spacewalk
systemctl stop sssd
rm -rf /var/lib/sss/db/*
rhncfg-client get
systemctl start sssd
sleep 10
systemctl restart sssd

# Remove Keytab File
rm -rf /root/adjoin.keytab

# Test to make sure it worked
id droessner

== Joining Ubuntu Server to Active Directory (AD) ==
You must first join the Spacewalk server:
[[Admin/Spacewalk_Install#Ubuntu_12.04 | Join Ubuntu Server to Spacewalk]]

Run the following code as '''ROOT''':

# Download PBIS Script
wget http://spacewalk.tdkc.com/pub/pbis/pbis-open-8.0.1.2029.linux.x86_64.deb.sh
bash pbis-open-8.0.1.2029.linux.x86_64.deb.sh

Answer the Script's Questions:
# Would you like to install package for legacy links? '''yes'''
# Would you like to install now? '''yes'''

# Cleanup after script
rm -rf pbis-open-8.0.1.2029.linux.x86_64.deb pbis-open-8.0.1.2029.linux.x86_64.deb.sh

#'''****ONLY RUN THIS ON 15.10****'''
cat <<EOF> /lib/systemd/system/lwsmd.service
[Unit]
Description=BeyondTrust PBIS Service Manager
After=network.target

[Service]
Type=forking
EnvironmentFile=/opt/pbis/libexec/init-base.sh
ExecStart=/opt/pbis/sbin/lwsmd --start-as-daemon
ExecReload=/opt/pbis/bin/lwsm refresh
ExecStop=/opt/pbis/bin/lwsm shutdown
# We want systemd to give lwsmd some time to finish gracefully, but still want
# it to kill lwsmd after TimeoutStopSec if something went wrong during the
# graceful stop. Normally, Systemd sends SIGTERM signal right after the
# ExecStop, which would kill lwsmd. We are sending useless SIGCONT here to give
# lwsmd time to finish.
KillSignal=SIGCONT
PrivateTmp=true

[Install]
WantedBy=multi-user.target nss-lookup.target
EOF
cd /etc/systemd/system
ln -s /lib/systemd/system/lwsmd.service
systemctl enable lwsmd.service
systemctl start lwsmd.service

# Join the Domain
domainjoin-cli join --ou "ou=VMs,OU=TDKCMachines,dc=tdkc,dc=com" TDKC.COM '''<DOMAIN_ADMIN>'''@tdkc.com

# Make PBIS Assume the Default Domain
/opt/pbis/bin/config AssumeDefaultDomain true

# Test to make sure it worked
id droessner@tdkc.com

# Reboot Server
reboot
'''Note:''' You need to login using full domain name.. i.e. droessner@tdkc.com

== Joining CentOS 5/6 Server to Active Directory (AD) ==
You must first join the Spacewalk server:
[[Admin/Spacewalk_Install#CentOS_6 | Join CentOS 6 Server to Spacewalk]]

Run the following code as '''ROOT''':

# Install Required Software
yum -y install pbis-open

# Join the Domain
domainjoin-cli join --ou "ou=VMs,OU=TDKCMachines,dc=tdkc,dc=com" TDKC.COM '''<DOMAIN_ADMIN>'''@tdkc.com

# Make PBIS Assume the Default Domain
/opt/pbis/bin/config AssumeDefaultDomain true

# Test to make sure it worked
id droessner@tdkc.com

# Reboot Server
reboot
'''Note:''' You need to login using full domain name.. i.e. droessner@tdkc.com

== Modify Local User Accounts ==
Run the following code as '''ROOT''':

usermod -l cpowell-local cpowell
usermod -l jwalrath-local jwalrath
mv /home/cpowell /home/cpowell-local
mv /home/jwalrath /home/jwalrath-local

== Restrict Users from Ubuntu Linux Login ==
The Following command will enable the access security on the Server:
grep -q pam_access.so /etc/pam.d/common-account && echo "Already There!" || sed -i '1s/^/account required pam_access.so\n/' /etc/pam.d/common-account
The Following commands will create a default access config file:
echo '+ : root : ALL' > /etc/security/access.conf
echo '+ : TDKC\domain^admins : ALL' >> /etc/security/access.conf
echo '+ : TDKC\subcontractors : ALL' >> /etc/security/access.conf
echo '- : TDKC\domain^users : ALL' >> /etc/security/access.conf
echo '- : ALL : ALL' >> /etc/security/access.conf

The file is read from Top to bottom so if the user is denied on line 1 but allowed on line 2, the user is Denied access. (The first match wins)

'''Legend:'''
* The First Column:
+ = Allow Access
- = Deny Access
* The Second Column:
user / group to be denied or allowed
* The Third Column:
The location the user is connecting from

For more information please refer to https://linux.die.net/man/5/access.conf

== Add Client to Elastic Stack ==
=== CentOS 7 ===
Copy the SSL certificate from elastic.tdkc.com to the client:
scp /etc/pki/tls/certs/logstash-forwarder.crt '''user'''@'''client''':/tmp

Copy the filebeat.yml file from a reference machine:
scp /etc/filebeat/filebeat.yml '''user'''@'''client''':/tmp

Run the following code as '''Root''':
mkdir -p /etc/pki/tls/certs
cp /tmp/logstash-forwarder.crt /etc/pki/tls/certs/
rpm --import http://packages.elastic.co/GPG-KEY-elasticsearch
vi /etc/yum.repos.d/elastic-beats.repo

Edit the open file to contain the following:
[elastic-5.x]
name=Elastic repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

Run the following code as '''Root''':
yum -y install filebeat
chown root:root /tmp/filebeat.yml
mv /tmp/filebeat.yml /etc/filebeat/filebeat.yml
systemctl start filebeat
systemctl enable filebeat
systemctl restart filebeat
systemctl status filebeat

Ensure that the "TLS" section of filebeat.yml is labled "SSL", it was changed in a recent version.

 
==Network layout information==
=== DHCP Reservation Preservation ===
Export all current reservations as a CSV file
Sort by IP address and create new a new CSV file per subnet/vlan
Create new DHCP scopes
Import the matching CSV file per subnet/vlan

=== VLAN Structure ===

One subnet to a vlan
10.179.0.0/24 = VLAN 500 - Virtual machine network
10.179.1.0/24 = VLAN 501 - Infrastructure - WAP's, switches, printers, physical servers, UPS
10.179.2.0/24 = VLAN 502 - Company Owned computers/have reservations - Wired
10.179.3.0/24 = VLAN 503 - Company Owned computers/have reservations - Wireless
10.179.4.0/24 = VLAN 504 - Company or user owned trusted devices but no reservations
10.179.5.0/24 = VLAN 505 - Growth, not currently in use
10.179.6.0/24 = VLAN 506 - Growth, not currently in use
10.179.7.0/24 = VLAN 507 - VPN pool - used by remote users - connectivity needs to be tested manually

DevNet

2023-06-02T19:43:56Z

Admin:

= Spacewalk Documentation =
== Lockdown Scripts ==
#raw
printf " Locking Down CentOS 7: "
/bin/bash /tmp/status.sh &

echo 'CCE-27053-8 - Set Password Hashing Algorithm in /etc/libuser.conf' >> /root/ks-lockdown.log
sed -i 's~crypt_style.*~crypt_style = sha512~' /etc/libuser.conf

yum -y remove vasclnt &> /dev/null
yum -y install clamav &> /dev/null

echo 'Installing oscap' >> /root/ks-lockdown.log
yum -y --nogpgcheck install spacewalk-oscap scap-security-guide &>> /root/ks-lockdown.log
sed -i '/<platform idref="cpe:\/o:redhat:enterprise_linux:7"\/>/a \ \ <platform idref="cpe:\/o:centos:centos:7" \/>' /usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml
#sed -i 's~idref="audit_rules_privileged_commands" selected=".*"~idref="audit_rules_privileged_commands" selected="false"~' /usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml
/usr/bin/oscap xccdf eval --profile stig-rhel7-server-upstream --remediate /usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml &>> /root/ks-lockdown.log
sed -i "s/MACs/\\nMACs/" /etc/ssh/sshd_config
/usr/bin/oscap xccdf eval --profile stig-rhel7-server-upstream --oval-results --results ssg-rhel7-xccdf.xml.result.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml &>> /root/ks-lockdown.log
/usr/bin/oscap xccdf generate report --oval-template ssg-rhel7-oval.xml.result.xml ssg-rhel7-xccdf.xml.result.xml > /root/stig-report-xccdf-oval.html

echo 'CVE-2004-1653' >> /root/ks-lockdown.log
cat /etc/ssh/sshd_config | grep -q "\#AllowTcpForwarding yes" && sed -i 's/\#AllowTcpForwarding yes/AllowTcpForwarding no/' /etc/ssh/sshd_config || sed -i '$a\CVE-2004-1653 (1 of 2) Already complete' /root/ks-lockdown.log
cat /etc/ssh/sshd_config | grep -q "AllowTcpForwarding yes" && sed -i 's/AllowTcpForwarding yes/AllowTcpForwarding no/' /etc/ssh/sshd_config || sed -i '$a\CVE-2004-1653 (2 of 2)Already complete' /root/ks-lockdown.log

echo 'CVE-2007-2243' >> /root/ks-lockdown.log
cat /etc/ssh/sshd_config | grep -q "\#ChallengeResponseAuthentication yes" && sed -i 's/\#ChallengeResponseAuthentication yes/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config || sed -i '$a\CVE-2007-2243 (1 of 2) Already complete' /root/ks-lockdown.log
cat /etc/ssh/sshd_config | grep -q "ChallengeResponseAuthentication yes" && sed -i 's/ChallengeResponseAuthentication yes/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config || sed -i '$a\CVE-2007-2243 (2 of 2) Already complete' /root/ks-lockdown.log

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

https://copr-be.cloud.fedoraproject.org/results/openscapmaint/openscap-latest/epel-7-x86_64/

= Spacewalk Installation Instructions =
== Installing Spacewalk ==

[https://fedorahosted.org/spacewalk/wiki/HowToInstall How-to]

== Joining a Client (Centos 6) to Spacewalk ==
'''On the Client as root, run:'''
mkdir reg-rpms
cd reg-rpms
wget http://spacewalk/pub/register/rhn-check-2.2.7-1.el6.noarch.rpm http://spacewalk/pub/register/rhn-client-tools-2.2.7-1.el6.noarch.rpm http://spacewalk/pub/register/rhn-setup-2.2.7-1.el6.noarch.rpm http://spacewalk/pub/register/rhncfg-5.10.73-1.el6.noarch.rpm http://spacewalk/pub/register/rhncfg-actions-5.10.73-1.el6.noarch.rpm http://spacewalk/pub/register/rhncfg-client-5.10.73-1.el6.noarch.rpm http://spacewalk/pub/register/rhnsd-5.0.14-1.el6.x86_64.rpm http://spacewalk/pub/register/yum-rhn-plugin-2.2.7-1.el6.noarch.rpm http://spacewalk/pub/register/m2crypto-0.20.2-9.el6.x86_64.rpm http://spacewalk/pub/register/python-dmidecode-3.10.13-3.el6_4.x86_64.rpm http://spacewalk/pub/register/python-gudev-147.1-4.el6_0.1.x86_64.rpm http://spacewalk/pub/register/python-hwdata-1.7.3-1.el6.noarch.rpm
yum -y localinstall rhn-setup-2.2.7-1.el6.noarch.rpm rhnsd-5.0.14-1.el6.x86_64.rpm rhn-check-2.2.7-1.el6.noarch.rpm rhn-client-tools-2.2.7-1.el6.noarch.rpm yum-rhn-plugin-2.2.7-1.el6.noarch.rpm m2crypto-0.20.2-9.el6.x86_64.rpm python-dmidecode-3.10.13-3.el6_4.x86_64.rpm python-hwdata-1.7.3-1.el6.noarch.rpm python-gudev-147.1-4.el6_0.1.x86_64.rpm
cd ..
rm -rf reg-rpms
mkdir keys
cd keys
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-EPEL-6 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-CentOS-6 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-EPEL-7 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-CentOS-7 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-redhat-release5 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-redhat-release6 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2014 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2012 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2010 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2008
rpm --import *
cd ..
rm -rf keys/
mkdir -p /etc/sysconfig/rhn/allowed-actions/script
touch /etc/sysconfig/rhn/allowed-actions/script/run
mkdir -p /etc/sysconfig/rhn/allowed-actions/configfiles
touch /etc/sysconfig/rhn/allowed-actions/configfiles/all
mkdir -p /usr/share/rhn/
wget http://spacewalk.devnet.prv/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
perl -npe 's/RHNS-CA-CERT/RHN-ORG-TRUSTED-SSL-CERT/g' -i /etc/sysconfig/rhn/*
rhnreg_ks --serverUrl=https://spacewalk.devnet.prv/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=1-97d994ea86b8f4ce665d6ef01546834b,1-centos6

== Joining a Client (Centos 7) to Spacewalk ==
'''On the Client as root, run:'''
mkdir reg-rpms
cd reg-rpms
wget http://spacewalk/pub/register/centos7/jabberpy-0.5-0.27.el7.noarch.rpm http://spacewalk/pub/register/centos7/osad-5.11.57-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/python-hwdata-1.7.3-4.el7.noarch.rpm http://spacewalk/pub/register/centos7/rhncfg-5.10.83-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/rhncfg-actions-5.10.83-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/rhncfg-client-5.10.83-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/rhn-check-2.3.16-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/rhn-client-tools-2.3.16-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/rhnsd-5.0.15-1.el7.x86_64.rpm http://spacewalk/pub/register/centos7/rhn-setup-2.3.16-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/yum-rhn-plugin-2.3.3-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/osa-common-5.11.57-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/rhnlib-2.5.75-1.el7.noarch.rpm http://spacewalk/pub/register/centos7/systemd-sysv-208-20.el7.x86_64.rpm http://spacewalk/pub/register/centos7/systemd-208-20.el7.x86_64.rpm http://spacewalk/pub/register/centos7/python-2.7.5-16.el7.x86_64.rpm http://spacewalk/pub/register/centos7/libnl-1.1.4-3.el7.x86_64.rpm http://spacewalk/pub/register/centos7/libxml2-python-2.9.1-5.el7_0.1.x86_64.rpm http://spacewalk/pub/register/centos7/m2crypto-0.21.1-15.el7.x86_64.rpm http://spacewalk/pub/register/centos7/pygobject2-2.28.6-11.el7.x86_64.rpm http://spacewalk/pub/register/centos7/pyOpenSSL-0.13.1-3.el7.x86_64.rpm http://spacewalk/pub/register/centos7/python-dmidecode-3.10.13-11.el7.x86_64.rpm http://spacewalk/pub/register/centos7/python-ethtool-0.8-5.el7.x86_64.rpm http://spacewalk/pub/register/centos7/usermode-1.111-5.el7.x86_64.rpm http://spacewalk/pub/register/centos7/python-gudev-147.2-7.el7.x86_64.rpm http://spacewalk/pub/register/centos7/libxml2-python-2.9.1-5.el7_1.2.x86_64.rpm
yum -y localinstall jabberpy-0.5-0.27.el7.noarch.rpm python-hwdata-1.7.3-4.el7.noarch.rpm rhncfg-actions-5.10.83-1.el7.noarch.rpm rhn-check-2.3.16-1.el7.noarch.rpm rhnsd-5.0.15-1.el7.x86_64.rpm yum-rhn-plugin-2.3.3-1.el7.noarch.rpm osad-5.11.57-1.el7.noarch.rpm rhncfg-5.10.83-1.el7.noarch.rpm rhncfg-client-5.10.83-1.el7.noarch.rpm rhn-client-tools-2.3.16-1.el7.noarch.rpm rhn-setup-2.3.16-1.el7.noarch.rpm systemd-sysv-208-20.el7.x86_64.rpm rhnlib-2.5.75-1.el7.noarch.rpm osa-common-5.11.57-1.el7.noarch.rpm libnl-1.1.4-3.el7.x86_64.rpm m2crypto-0.21.1-15.el7.x86_64.rpm pygobject2-2.28.6-11.el7.x86_64.rpm pyOpenSSL-0.13.1-3.el7.x86_64.rpm python-dmidecode-3.10.13-11.el7.x86_64.rpm python-ethtool-0.8-5.el7.x86_64.rpm usermode-1.111-5.el7.x86_64.rpm python-gudev-147.2-7.el7.x86_64.rpm libxml2-python-2.9.1-5.el7_1.2.x86_64.rpm
cd ..
rm -rf reg-rpms
mkdir keys
cd keys
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-EPEL-6 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-CentOS-6 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-EPEL-7 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-CentOS-7 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-redhat-release5 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-redhat-release6 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2014 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2012 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2010 http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-spacewalk-2008
rpm --import *
cd ..
rm -rf keys/
mkdir -p /etc/sysconfig/rhn/allowed-actions/script
touch /etc/sysconfig/rhn/allowed-actions/script/run
mkdir -p /etc/sysconfig/rhn/allowed-actions/configfiles
touch /etc/sysconfig/rhn/allowed-actions/configfiles/all
mkdir -p /usr/share/rhn/
wget http://spacewalk.devnet.prv/pub/RHN-ORG-TRUSTED-SSL-CERT -O /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
perl -npe 's/RHNS-CA-CERT/RHN-ORG-TRUSTED-SSL-CERT/g' -i /etc/sysconfig/rhn/*
rhnreg_ks --serverUrl=https://spacewalk.devnet.prv/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=1-centos7

== Building RPM's ==
https://fedoraproject.org/wiki/How_to_create_an_RPM_package#Preparing_your_system

== Finding GPG key ID and fingerprint ==
gpg --with-fingerprint RPM-GPG-KEY-redhat-release5

Output (First highlighted area is the ID and the Second is the fingerprint):
pub 1024D/37017186 2006-12-06 Red Hat, Inc. (release key) <security@redhat.com>
Key fingerprint = 47DB 2877 89B2 1722 B6D9 5DDE 5326 8101 3701 7186

== Import GPG key on Servers ==
=== Centos 6 ===
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-EPEL-6
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-CentOS-6
rpm --import RPM-GPG-KEY-EPEL-6 RPM-GPG-KEY-CentOS-6
rm -f RPM-GPG-KEY-EPEL-6 RPM-GPG-KEY-CentOS-6

=== Centos 7 ===
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-EPEL-7
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-CentOS-7
rpm --import RPM-GPG-KEY-EPEL-7 RPM-GPG-KEY-CentOS-7
rm -f RPM-GPG-KEY-EPEL-7 RPM-GPG-KEY-CentOS-7

=== RHEL 5 ===
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-redhat-release5
rpm --import RPM-GPG-KEY-redhat-release5
rm -f RPM-GPG-KEY-redhat-release5

=== RHEL 6 ===
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-redhat-release6
wget http://spacewalk.devnet.prv/pub/keys/RPM-GPG-KEY-EPEL-6
rpm --import RPM-GPG-KEY-redhat-release6 RPM-GPG-KEY-EPEL-6
rm -f RPM-GPG-KEY-redhat-release6 RPM-GPG-KEY-EPEL-6

== Configure PXE Booting ==
=== Change PXE Menu Names ===
vi /etc/cobbler/pxe/pxeprofile.template
#set $new_name = $profile_name.replace(':1:SpacewalkDefaultOrganization', ' ')
#set $new_menu_label = $menu_label.replace(':1:SpacewalkDefaultOrganization', ' ')
LABEL $new_name
MENU PASSWD
kernel $kernel_path
$new_menu_label
$append_line
ipappend 2
Update PXE files
cobbler sync
cat /var/lib/tftpboot/pxelinux.cfg/default

=== Add Password, Background, and WindowsDeployment to PXE Menu ===
vi /etc/cobbler/pxe/pxedefault.template
DEFAULT vesamenu.c32
PROMPT 0
MENU TITLE DevNet Image Central
MENU BACKGROUND /devnetSplash.png
MENU MARGIN 1
MENU ROWS 15
MENU COLOR BORDER 30;44 #ffffffff #00000000 std
MENU COLOR TITLE 1;36;44 #ffffffff #00000000 std
MENU COLOR UNSEL 37;44 #ffffffff #00000000 std
MENU COLOR TIMEOUT_MSG 37;40 #ffffffff #00000000 std
MENU MASTER PASSWD $1$YVi/j0hL$a6SdxIUHZCA7jFisNZh6O/
TIMEOUT 80
TOTALTIMEOUT 6000
ONTIMEOUT $pxe_timeout_profile
LABEL local
MENU LABEL (Boot Local System)
MENU DEFAULT
LOCALBOOT 0
$pxe_menu_items
LABEL WindowsDeployment
MENU LABEL Windows Deployment
MENU PASSWD
PXE tftp://10.81.49.27/pxelinux.0
MENU end
== Setup Pam Authentication w/ VAS ==
* Put the following in /etc/pam.d/rhn-satellite
#%PAM-1.0
auth required pam_env.so
auth sufficient pam_vas3.so
auth required pam_deny.so
account sufficient pam_vas3.so
account requisite pam_vas3.so echo_return
account required pam_unix.so broken_shadow
* Add the following line to /etc/rhn/rhn.conf
pam_auth_service = rhn-satellite
== Troubleshooting ==
=== Client Yum Errors ===
'''Error: Cannot retrieve repository metadata (repomd.xml) for repository: <channel> Please verify its path and try again.'''
* Client Side: Check /etc/sysconfig/rhn/up2date and make sure that the spacewalk URL is Fully Qualified.
* Spacewalk Side: Check /var/cache/rhn/repodata/<channel>/
** If noyumrepo.txt exists log into the Web GUI and manage channels. Make sure that the channel Checksum Type is not set to 'None'.
=== Kickstart Errors ===
'''Installing error populating transaction, retrying (1/10)'''
'''error populating transaction after 10 retries: failure: getPackage/<package name> from <repo name>: [Errno 256] No more mirrors to try.'''
* Spacewalk Side: Try running the following command:
chmod -R 777 /var/satellite/redhat/1/

= Spacewalk Scripts =
==cleanupPackages==
#!/bin/bash
# Script that uses RHN API to cleanup obsolete packages
# on Spacewalk server.
# Copyright (C) 2012 Nicolas PRADELLES
#
# Author: Nicolas PRADELLES (npradelles@eutelsat.fr)
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
#
# Version Information:
#
# 0.1 - 2012-04-17 - Nicolas PRADELLES

LOGIN='droessne'
PASS=''
SRV='localhost'
DIR='/tmp'

# extract spacewalk channels
CHANNELS=(`spacecmd -s $SRV -u $LOGIN -p $PASS -q softwarechannel_list`)
# string cleanup to remove "esc[?1034h" in line beginning
CHANNELS=${CHANNELS:8:${#CHANNELS}}

TOTALSIZE=0

# For each channel
for CHANNEL in ${CHANNELS[@]}; do

echo -e "################\n$CHANNEL\n################"

# extract all packages in channel
spacecmd -s $SRV -u $LOGIN -p $PASS -q softwarechannel_listallpackages $CHANNEL > $DIR/$CHANNEL.tmp
sed '1s/^.\{8\}//' $DIR/$CHANNEL.tmp > $DIR/$CHANNEL.all

sort $DIR/$CHANNEL.all -o $DIR/$CHANNEL.all

# extract latest packages in channel
spacecmd -s $SRV -u $LOGIN -p $PASS -q softwarechannel_listpackages $CHANNEL > $DIR/$CHANNEL.tmp
sed '1s/^.\{8\}//' $DIR/$CHANNEL.tmp > $DIR/$CHANNEL.latest
sort $DIR/$CHANNEL.latest -o $DIR/$CHANNEL.latest

# diff to find obsolete packages
comm -23 $DIR/$CHANNEL.all $DIR/$CHANNEL.latest > $DIR/$CHANNEL.old

DELETED=0

# if we have found obsolete packages
if [[ `wc -l < $DIR/$CHANNEL.old` -gt 0 ]]; then
# check if the old package is installed on a managed client
while read PACKAGE; do
echo $PACKAGE
SYSTEMS=(`spacecmd -s $SRV -u $LOGIN -p $PASS -q package_listinstalledsystems $PACKAGE`)
SYSTEMS=${SYSTEMS:8:${#SYSTEMS}}

# If this package is not installed on a managed client
if [[ ${#SYSTEMS[@]} -eq 2 ]]; then
# delete the package in the channel
spacecmd -s $SRV -u $LOGIN -p $PASS -q -y softwarechannel_removepackages $CHANNEL $PACKAGE > /dev/null
let DELETED=$DELETED+1

fi
done < $DIR/$CHANNEL.old
fi

echo "$CHANNEL: ALL=`wc -l < $DIR/$CHANNEL.all`, LATEST=`wc -l < $DIR/$CHANNEL.latest`, OLD=`wc -l < $DIR/$CHANNEL.old`, DELETED=$DELETED"
rm -f $DIR/$CHANNEL.*
done

# delete orphaned packages
spacecmd -s $SRV -u $LOGIN -p $PASS -q -y package_removeorphans > /dev/null

# delete orphaned packages on disk
spacewalk-data-fsck -r -S -C -O

==convertISOtoKickstartTree==
#!/bin/bash
ISO=$1
if [[ $ISO == '' ]]; then
echo "USAGE: convertISOtoKickstartableTree.sh <linux.iso>"
else
NAME=`echo $ISO | rev | cut -d '/' -f 1 | rev | sed 's/-dvd.iso//'`
mkdir -p /kickiso
mount -o loop $ISO /kickiso > 2&>/dev/null
mkdir -p /var/satellite/rhn/kickstart/$NAME
cp -Ruf /kickiso/* /var/satellite/rhn/kickstart/$NAME/
umount /kickiso
rm -rf /kickiso
cd /var/satellite/rhn/kickstart/$NAME
find -type f -name '*.rpm' -exec rm -f {} \;
chmod 777 .
fi

==createKickstartISO==
#yum -y install syslinux &> /dev/null
mkdir -p isolinux
rm -rf dren-ks.iso
rm -rf isolinux/*
cp -R /usr/share/syslinux/* isolinux/
cp -a ../centos7-latest/isolinux/* isolinux/
rm -rf isolinux/isolinux.cfg isolinux/splash.png
cp /var/lib/tftpboot/pxelinux.cfg/default isolinux/isolinux.cfg
cp /var/lib/tftpboot/splash.png isolinux/splash.png
sed -i '/vmlinuz/c\ kernel vmlinuz ' isolinux/isolinux.cfg
sed -i 's/$initrd$.*$initrd.img$/initrd=initrd.img/g' isolinux/isolinux.cfg
mkisofs -o dren-ks.iso -c isolinux/boot.cat -b isolinux/isolinux.bin -no-emul-boot -boot-load-size 4 -boot-info-table -J -l -r -T -v -V "DREN Kickstart CD" .

sudo su -
cd /var/satellite/rhn/kickstart/1/ISO
./createKickstartISO.sh
mv dren-ks.iso <destination directory>

==exportAllChannels==
DIRECTORY="/projects/SpacewalkExports"
CHANNELS=`rhn-satellite-exporter --list-channels | egrep -v '=' | egrep -v Channel | grep 'B\|C' | awk '{ print $2 }'`
mkdir -p $DIRECTORY/working
CMD=" rhn-satellite-exporter --start-date='`cat /usr/share/rhn/scripts/lastexportdate.txt`' --make-isos=dvd -d "$DIRECTORY"/working/"
for channel in $CHANNELS; do
CMD=$CMD" -c "$channel
done

eval $CMD

mv $DIRECTORY/working/satellite-isos/*.iso $DIRECTORY/
rsync -a --delete /empty/ $DIRECTORY/working/
#rm -rf $DIRECTORY/working
date +%Y%m%d > /usr/share/rhn/scripts/lastexportdate.txt

==findAndGetKickstartTree==
#!/bin/bash
echo '########################################################################' >> /var/log/scripts/findAndGetKickstartTree.log
date >> /var/log/scripts/findAndGetKickstartTree.log
cobbler sync 2&>/dev/null

CENT7LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">7\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`
CENT6LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">6\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`

/usr/share/rhn/scripts/mk-KickstartTree.py --release $CENT7LATEST --arch x86_64 --target /var/satellite/rhn/kickstart --mirror http://mirror.centos.org/centos/ -b centos7 -c 2&>> /var/log/scripts/findAndGetKickstartTree.log

/usr/share/rhn/scripts/mk-KickstartTree.py --release $CENT6LATEST --arch x86_64 --target /var/satellite/rhn/kickstart --mirror http://mirror.centos.org/centos/ -b centos6 -c 2&>> /var/log/scripts/findAndGetKickstartTree.log

cobbler sync 2&>/dev/null
date >> /var/log/scripts/findAndGetKickstartTree.log
echo '########################################################################' >> /var/log/scripts/findAndGetKickstartTree.log

==getCompletedActionId==
#!/usr/bin/python
import xmlrpclib
import time
from datetime import datetime
from space_cred import *
SPACEWALK_USER, SPACEWALK_PASSWORD = space_cred()

SPACEWALK_URL = "http://spacewalk.devnet.prv/rpc/api"

CLIENT = xmlrpclib.Server(SPACEWALK_URL, verbose=0)
KEY = CLIENT.auth.login(SPACEWALK_USER, SPACEWALK_PASSWORD)
ACTIONS = CLIENT.schedule.listCompletedActions(KEY)

print "-----------------------------------"
for A in ACTIONS:
print "Action Name: "+A['name']
print "Action ID: "+str(A['id'])
print "-----------------------------------"

CLIENT.auth.logout(KEY)

==getServerIds==
#!/usr/bin/python
import xmlrpclib
import time
from datetime import datetime
from space_cred import *
SPACEWALK_USER, SPACEWALK_PASSWORD = space_cred()

SPACEWALK_URL = "http://spacewalk.devnet.prv/rpc/api"

CLIENT = xmlrpclib.Server(SPACEWALK_URL, verbose=0)
KEY = CLIENT.auth.login(SPACEWALK_USER, SPACEWALK_PASSWORD)
LIST = CLIENT.system.listSystems(KEY)

print "-----------------------------------"
for L in LIST:
print "Server Name: "+L['name']
print "Server ID: "+str(L['id'])
print "-----------------------------------"

CLIENT.auth.logout(KEY)

==makeKickstartTree==
#!/usr/bin/env python
from optparse import OptionParser
import sys
import os
import shutil
import xmlrpclib
import getpass
import stat

#defining default mirrors
default_centos="http://mirror.centos.org/centos"
default_scientific="http://ftp.scientificlinux.org/linux/scientific"
default_fedora="http://mirrors.kernel.org/fedora"
default_folders=["images","isolinux","repodata"]

if __name__ == "__main__":
#define description, version and load parser
desc='''%prog is used to create kickstartable distribution trees of EL-like distros like CentOS, Fedora and ScientificLinux. Optionally you can also create kickstart distributions on Spacewalk, Red Hat Satellite and SUSE Manager. Login credentials are assigned using the following shell variables:
SATELLITE_LOGIN username
SATELLITE_PASSWORD password
It is also possible to create an authfile (permissions 0600) for usage with this script. The first line needs to contain the username, the second line should consist of the appropriate password.
If you're not defining variables or an authfile you will be prompted to enter your login information.
Checkout the GitHub page for updates: https://github.com/stdevel/mkelfs'''

parser = OptionParser(description=desc,version="%prog version 0.4")

#-r / --release
parser.add_option("-r", "--release", action="store", type="string", dest="release", help="define which release to use (e.g. 6.5)", metavar="RELEASE")

#-x / --arch
parser.add_option("-x", "--arch", action="store", type="string", dest="arch", help="define which architecture to use (e.g. x86_64)", metavar="ARCH")

#-t / --target
parser.add_option("-t", "--target", action="store", type="string", dest="target", default="/var/satellite/kickstart_tree", help="define where to store kickstart files. A subfolder will be created automatically. (default: /var/satellite/kickstart_tree)", metavar="DIR")

#-m / --mirror
parser.add_option("-m", "--mirror", dest="mirror", action="store", type="string", help="define a valid EL mirror to use - DON'T add the trailing slash! Have a loot at the EL mirror list (e.g. http://www.centos.org/download/mirrors) for alternatives", metavar="MIRROR")

#-o / --distribution
parser.add_option("-o", "--distro", dest="distro", default="centos", action="store", type="string", help="defines for which distro the files are downloaded (default: centos) - other possible values: fedora, scientific", metavar="DISTRO")

#-f / --force
parser.add_option("-f", "--force", dest="force", default=False, action="store_true", help="defines whether pre-existing kickstart files shall be overwritten")

#-i / --ignore-existing
parser.add_option("-i", "--ignore-existing", dest="ignoreExisting", default=False, action="store_true", help="don't throw errors if downloaded files are already existing (e.g. testing purposes)")

#-q / --quiet
parser.add_option("-q", "--quiet", action="store_false", dest="verbose", default=True, help="don't print status messages to stdout")

#-d / --debug
parser.add_option("-d", "--debug", dest="debug", default=False, action="store_true", help="enable debugging outputs")

#-c / --create-distribution
parser.add_option("-c", "--create-distribution", dest="createDistribution", default=False, action="store_true", help="creates a kickstart distribution on the Spacewalk / Red Hat Satellite or SUSE Manager server")

#-b / --base-channel
parser.add_option("-b", "--base-channel", dest="baseChannel", type="string", default="", help="defines the name of the distro base-channel", metavar="CHANNEL")

#-a / --authfile
parser.add_option("-a", "--authfile", dest="authfile", metavar="FILE", default="", help="defines an auth file to use instead of shell variables")

#-s / --server
parser.add_option("-s", "--server", dest="server", metavar="SERVER", default="localhost", help="defines the server to use")

#parse arguments
(options, args) = parser.parse_args()

#check whether all required options are given
if options.release is None and options.arch is None:
parser.error("missing values for release and arch!")
else:
#make options being lower-case in case you missed it
options.distro = str(options.distro).lower()
options.release = str(options.release).lower()
options.arch = str(options.arch).lower()

#setup default mirror URL (if no other defined) depending on selected distro
if options.mirror == None:
if str(options.distro).lower() == "scientific": options.mirror = default_scientific
if str(options.distro).lower() == "fedora": options.mirror = default_fedora
if str(options.distro).lower() == "centos": options.mirror = default_centos
if str(options.distro).lower() == "scientific": url = options.mirror+"/"+options.release+"/"+options.arch+"/os"
elif str(options.distro).lower() == "fedora": url = options.mirror+"/releases/"+options.release+"/Fedora/"+options.arch+"/os"
else: url = options.mirror+"/"+options.release+"/os/"+options.arch

#workaround for EL7
if options.release == "7" and options.distro.lower() in ["centos","scientific"]:
default_folders.append("LiveOS")
if options.verbose: print("INFO: EL7 detected, making sure to also download LiveOS")

#print debug output if required
if options.debug: print("release: " + options.release + "\narch: " + options.arch + "\ntarget: " + options.target + "\nmirror: " + options.mirror + "\nforce: " + `options.force` + "\nverbose: " + `options.verbose` + "\ndebug: " + `options.debug` + "\ndistro: " + options.distro + "\nURL: " + url)

#define URL and login information
SATELLITE_URL = "http://"+options.server+"/rpc/api"

#setup client and key depending on mode
client = xmlrpclib.Server(SATELLITE_URL, verbose=options.debug)
if options.authfile:
#use authfile
if options.debug: print "DEBUG: using authfile"
try:
#check filemode and read file
filemode = oct(stat.S_IMODE(os.lstat(options.authfile).st_mode))
if filemode == "0600":
if options.debug: print "DEBUG: file permission ("+filemode+") matches 0600"
fo = open(options.authfile, "r")
s_username=fo.readline().replace("\n", "")
s_password=fo.readline().replace("\n", "")
key = client.auth.login(s_username, s_password)
else:
if options.verbose: print "ERROR: file permission ("+filemode+") not matching 0600!"
exit(1)
except OSError:
print "ERROR: file non-existent or permissions not 0600!"
exit(1)
elif "SATELLITE_LOGIN" in os.environ and "SATELLITE_PASSWORD" in os.environ:
#shell variables
if options.debug: print "DEBUG: checking shell variables"
key = client.auth.login(os.environ["SATELLITE_LOGIN"], os.environ["SATELLITE_PASSWORD"])
else:
s_username = ""
s_password = ""
try:
from space_cred import *
s_username, s_password = space_cred()
except:
pass
if s_username == "":
if options.debug: print "DEBUG: prompting for login credentials"
s_username = raw_input("Username: ")
if s_password == "":
if options.debug: print "DEBUG: prompting for login credentials"
s_password = getpass.getpass("Password: ")
key = client.auth.login(s_username, s_password)

#check whether the API version matches the minimum required
api_level = client.api.getVersion()
if not api_level in supportedAPI:
print "ERROR: your API version ("+api_level+") does not support the required calls. You'll need API version 1.8 (11.1) or higher!"
exit(1)
else:
if options.debug: print "INFO: supported API version ("+api_level+") found."

#search for base-channel or check base-channel
listChannels = client.channel.listAllChannels(key)
if options.debug: print "INFO: all channels" + str(listChannels)
if options.baseChannel != "":
#check base-channel
if options.baseChannel not in str(listChannels):
print "ERROR: base-channel '" + options.baseChannel + "' does not exist!"
exit(1)
else:
for dict in listChannels:
if dict["label"] == options.baseChannel:
if options.arch == "i386":
if dict["arch_name"] != "IA-32":
print "ERROR: base-channel '" + options.baseChannel + "' has a different architecture!"
exit(1)
else:
if dict["arch_name"] != options.arch:
print "ERROR: base-channel '" + options.baseChannel + "' has a different architecture!"
exit(1)
else:
#search base-channel
for dict in listChannels:
#print dict
if dict["label"] == options.distro+options.release+"-"+options.arch:
if options.verbose: print "INFO: found matching base channel '" + dict["label"] + "'"
options.baseChannel = dict["label"]

#last check if we configured a base-channel
if options.baseChannel == "":
print "ERROR: unable to find a valid base-channel, please check your channels!"
exit(1)

#check whether target is writable
if os.access(options.target, os.W_OK):
if options.verbose: print "INFO: path exists and writable"

#switch to directory and create subfolder non-existent
os.chdir(options.target)

#check whether the directory already exists
if os.path.exists(options.distro+"-"+options.release+"-"+options.arch):

#delete content of directory if force given
if options.force == True:
shutil.rmtree(options.target+"/"+options.distro+"-"+options.release+"-"+options.arch)
if options.verbose: print "INFO: deleted directory ("+options.target+"/"+options.distro+"-"+options.release+"-"+options.arch+") because -f / --force given"
elif options.ignoreExisting == False:
#abort with error
print >> sys.stderr, "ERROR: kickstart tree directory ("+options.target+"/"+options.distro+"-"+options.release+"-"+options.arch+") already exists! Use -f / --force to overwrite!"
exit(1)

#create directory and change directory
if options.ignoreExisting == False: os.system("mkdir "+options.distro+"-"+options.release+"-"+options.arch)
os.chdir(options.target+"/"+options.distro+"-"+options.release+"-"+options.arch)

#download files
if options.ignoreExisting == False:
if options.verbose: print "INFO: about to download kickstart files for EL "+options.release+" "+options.arch+" from mirror "+options.mirror+"..."
for i in default_folders:
#setting offset based on mirror and distro
if options.distro == "fedora": dir_offset=6
elif "vault" in options.mirror: dir_offset=3
elif options.distro == "scientific": dir_offset=5
else: dir_offset=5
if options.debug: print "INFO: dir_offset: "+`dir_offset`
#run wget with or without quiet mode
cmd = "wget -e robots=off -q -r -nH --cut-dirs="+`dir_offset`+" --no-parent --reject 'index.html*' "+url+"/"+i+"/"
if options.verbose == False:
cmd = cmd+" --quiet"
retcode = os.system(cmd)
else:
retcode = os.system(cmd)

#print error if wget had a error
if retcode != 0:
print >> sys.stderr, "ERROR: some error occurred (see output above!) - hint: check URL ("+options.mirror+"/"+options.release+")"
exit(1)
else:
if options.verbose: print "INFO: successfully downloaded kickstart files for EL "+options.release+" "+options.arch+"!\nUse this file path for cobbler or the webui: "+options.target+"/"+options.distro+"-"+options.release+"-"+options.arch
if "7." in options.release:
#setting offset based on mirror and distro
if options.distro == "fedora": dir_offset=6
elif "vault" in options.mirror: dir_offset=3
elif options.distro == "scientific": dir_offset=5
else: dir_offset=5
if options.debug: print "INFO: dir_offset: "+`dir_offset`
#run wget with or without quiet mode
cmd = "wget -e robots=off -q -r -nH --cut-dirs="+`dir_offset`+" --no-parent --reject 'index.html*' "+url+"/LiveOS/"
if options.verbose == False:
cmd = cmd+" --quiet"
retcode = os.system(cmd)
else:
retcode = os.system(cmd)

#print error if wget had a error
if retcode != 0:
print >> sys.stderr, "ERROR: some error occurred (see output above!) - hint: check URL ("+options.mirror+"/"+options.release+")"
exit(1)
else:
if options.verbose: print "INFO: successfully downloaded kickstart files for EL "+options.release+" "+options.arch+"!\nUse this file path for cobbler or the webui: "+options.target+"/"+options.distro+"-"+options.release+"-"+options.arch
cmd = "chmod -R 0777 "+options.target+"/"+options.distro+"-"+options.release+"-"+options.arch
#print "CMD: "+cmd
retcode = os.system(cmd)

else:
print >> sys.stderr, "ERROR: path non-existent or non-writable!"

#create kickstart distribution
if options.createDistribution:
if options.verbose: print "INFO: Creating kickstart distribution..."
#set install type
if options.distro == "fedora": installType = "fedora"
else:
if "2.1" in options.release: installType = "rhel_2.1"
if "3." in options.release: installType = "rhel_3"
if "4." in options.release: installType = "rhel_4"
if "5." in options.release: installType = "rhel_5"
if "6." in options.release: installType = "rhel_6"
if "7." in options.release: installType = "rhel_7"
if options.debug: print "DEBUG: install type is '" + installType + "'"

#create distribution
result = client.kickstart.tree.create(key,"KD-"+options.distro+"-"+options.release+"-"+options.arch,options.target+"/"+options.distro+"-"+options.release+"-"+options.arch,options.baseChannel,installType)
if result == 1:
if options.verbose: print "Successfully created kickstart distribution 'KD-" + options.distro+"-"+options.release+"-"+options.arch + "'"

#logout and exit
client.auth.logout(key)

==pushConfigurationChannelFiles==
#!/usr/bin/python
import xmlrpclib
import time
from datetime import datetime
from space_cred import *
SPACEWALK_USER, SPACEWALK_PASSWORD = space_cred()
#################################################################
# VARIABLES #
#################################################################
SPACEWALK_URL = "http://spacewalk.devnet.prv/rpc/api"
MISSING_ENABLED = 0
ACTION_ID = [3064]

#################################################################
# CODE #
#################################################################
CLIENT = xmlrpclib.Server(SPACEWALK_URL, verbose=0)
KEY = CLIENT.auth.login(SPACEWALK_USER, SPACEWALK_PASSWORD)
LIST = CLIENT.system.listSystems(KEY)
TOTAL_ID_LIST = []
for L in LIST:
TOTAL_ID_LIST.append(L['id'])
ACTION_ID_LIST = []
MISSING_SERVER_LIST = []
MISSING_ID_LIST = []
ACTION_SYSTEMS = CLIENT.schedule.listCompletedSystems(KEY, ACTION_ID[0])
for A in ACTION_SYSTEMS:
ACTION_ID_LIST.append(A['server_id'])
for TID in TOTAL_ID_LIST:
if TID not in ACTION_ID_LIST:
for L in LIST:
if TID == L['id']:
MISSING_SERVER_LIST.append(L['name'])
MISSING_ID_LIST.append(L['id'])
print "Missing %d Systems from the current scheduled action." % (len(MISSING_SERVER_LIST))
print "Pushing Configuration files to %d Systems" % (len(ACTION_ID_LIST))
RESULTS = CLIENT.schedule.rescheduleActions(KEY, ACTION_ID, 0)
if RESULTS == 1:
print "Successfully re-scheduled the action for the %d systems." % (len(ACTION_ID_LIST))
else:
print "An Error occured while re-scheduling action ID %d." % (ACTION_ID[0])
if MISSING_ENABLED == 1:
print "Pushing Configuration files to %d missing systems" % (len(MISSING_ID_LIST))
TODAY = datetime.today()
EARLIEST_OCCURANCE = xmlrpclib.DateTime(TODAY)
RESULTS = CLIENT.system.config.deployAll(KEY, MISSING_ID_LIST, EARLIEST_OCCURANCE)
if RESULTS == 1:
print "Successfully scheduled a deploy action for all %d missinge systems." % (len(MISSING_ID_LIST))
else:
print "An Error occured while scheduling the deploy action."
CLIENT.auth.logout(KEY)

==reposync==
mkdir -p /var/log/scripts/
echo ##################################################### >> /var/log/scripts/spacewalk-repo-sync.log
CENT7LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">7\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`
CENT6LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">6\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`

spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest/RHEL/6/x86_64/ -c spacewalk-server6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest/RHEL/7/x86_64/ -c spacewalk-server7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/6/x86_64/ -c spacewalk-client >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/7/x86_64/ -c spacewalk-client-centos7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/6/x86_64/ -c spacewalk-client-rhel-6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.postgresql.org/9.4/redhat/rhel-7-x86_64/ -c 7-postgres94 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.postgresql.org/9.5/redhat/rhel-7-x86_64/ -c 7-postgres95 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://download.ceph.com/rpm/el7/x86_64/ -c ceph-centos7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/extras/x86_64/ -c centos-7-extras >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/updates/x86_64/ -c centos-7-updates >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://dl.fedoraproject.org/pub/epel/6/x86_64/ -c rhel-6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://rhel6.devnet.prv/rhel6/ -c rhel-6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://dl.fedoraproject.org/pub/epel/6/x86_64/ -c centos6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://dl.fedoraproject.org/pub/epel/7/x86_64/ -c epel-7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT6LATEST/os/x86_64/ -c centos6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT6LATEST/extras/x86_64/ -c centos6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT6LATEST/updates/x86_64/ -c centos6 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/os/x86_64/ -c centos7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://rhel5.devnet.prv/rhel5/ -c rhel-x86_64-server-5 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/5/x86_64/ -c spacewalk-client5 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/7/x86_64/ -c spacewalk-client-rhel-7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://rhel7.devnet.prv/rhel7/ -c rhel-7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://dl.fedoraproject.org/pub/epel/7/x86_64/ -c rhel-7-epel >> /var/log/scripts/spacewalk-repo-sync.log

chmod -R 777 /var/satellite/redhat/1/
echo #################################################### >> /var/log/scripts/spacewalk-repo-sync.log
date >> /var/log/scripts/spacewalk-repo-sync.log

==spacewalkCreds==
#!/usr/bin/python
def space_cred():
SPACEWALK_USER = "droessne"
SPACEWALK_PASSWORD = ""

return SPACEWALK_USER, SPACEWALK_PASSWORD

DevNet

2023-06-02T19:40:52Z

Admin: Created page with "= Spacewalk Documentation = == Lockdown Scripts == #raw printf " Locking Down CentOS 7: " /bin/bash /tmp/status.sh & echo 'CCE-27053-8 - Set Password Hashing Algorithm in /etc/libuser.conf' >> /root/ks-lockdown.log sed -i 's~crypt_style.*~crypt_style = sha512~' /etc/libuser.conf yum -y remove vasclnt &> /dev/null yum -y install clamav &> /dev/null echo 'Installing oscap' >> /root/ks-lockdown.log yum -y..."

DREN/Kickstart/snippets

2023-06-02T19:36:23Z

Admin: /* | StatusBarScript */

= AddADGroups =
#raw
printf " Adding AD Groups: "
/bin/bash /tmp/status.sh &

groupadd domain_users -g 1342600513

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddAcasUser =
#raw
printf " Creating ACAS Scan User: "
/bin/bash /tmp/status.sh &

useradd scan_account -g users
sudo -u scan_account ssh-keygen -b 2048 -t rsa -f /home/scan_account/.ssh/id_rsa -q -N ""
sudo -u scan_account rm -rf /home/scan_account/.ssh/id_rsa
sudo -u scan_account curl --cacert /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT https://rdhpwngmp-01/pub/kickstart/nga_acas.pub > /home/scan_account/.ssh/authorized_keys

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddMounts =
#raw
printf " Adding NFS Mounts: "
/bin/bash /tmp/status.sh &

mkdir -p /users
chown :domain_users /users
chmod 775 /users
mkdir -p /data
chown :domain_users /data
chmod 775 /data
echo 'users:/users /users nfs noauto,x-systemd.automount,x-systemd.device-timeout=10,timeo=14,relatime 0 0' >> /etc/fstab
echo 'data:/data /data nfs noauto,x-systemd.automount,x-systemd.device-timeout=10,timeo=14,relatime 0 0' >> /etc/fstab

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddScaleUser =
#raw
printf " Creating Scale User: "
/bin/bash /tmp/status.sh &

useradd scale -u 7498 -g 1342600513 -G users
sed -i 's~scale:!!:~scale:$6$hQ5XU8FI$BFssO833kwMzahuVXMnMO9qReK4VRAXtMKRL/csxtJoFtj7Wgc9twzp6E79jw8y.U/JfSqMhzMafhijnISiyh1:~' /etc/shadow

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddSpacewalkToHosts =
#raw
printf " Adding Spacewalk server to /etc/hosts: "
/bin/bash /tmp/status.sh &
curl http://140.32.192.51/pub/kickstart/hosts > /mnt/sysimage/etc/hosts
curl http://140.32.192.51/pub/kickstart/hosts > /etc/hosts
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= ForceTime =
printf " Forcing Time Synce with NTP Server: "
/bin/bash /tmp/status.sh &
ntpdate -s 140.32.191.249
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"

= InstallDCOSMaster =
#raw
printf " Installing DCOS Master: "
/bin/bash /tmp/status.sh &
#end raw
$SNIPPET('spacewalk/1/InstallDCOSPrereqs')
#raw
# This is needed for using the dcos command with jenkins
yum -y install expect &> /dev/null

# Creating installDCOS.sh script
echo "#CHECK=\`systemctl is-active docker\`" > /root/installDCOS.sh
echo "#while [[ \$CHECK != 'active' ]]; do sleep 5; CHECK=\`systemctl is-active docker\`;done" >> /root/installDCOS.sh
echo "/bin/bash /tmp/dcos/dcos_install.sh master" >> /root/installDCOS.sh
echo "mkdir -p /var/log/mesos/archive" >> /root/installDCOS.sh
echo "echo 'ENABLE_CHECK_TIME=false' >> /opt/mesosphere/environment" >> /root/installDCOS.sh
echo "#sleep 6000" >> /root/installDCOS.sh
echo "#rm -rf /root/installDCOS.sh" >> /root/installDCOS.sh
echo "sed -i 's/\/bin\/bash\ \/root\/installDCOS.sh//g' /etc/rc.d/rc.local" >> /root/installDCOS.sh
echo "sed -i 's~LD_LIBRARY_PATH=/opt/mesosphere/lib~LD_LIBRARY_PATH=/lib64~' /opt/mesosphere/environment.export" >> /root/installDCOS.sh
echo "curl -fLsS --retry 20 -Y 100000 -y 60 https://downloads.dcos.io/binaries/cli/linux/x86-64/dcos-1.8/dcos -o dcos" >> /root/installDCOS.sh
echo "mv dcos /usr/local/bin" >> /root/installDCOS.sh
echo "chmod +x /usr/local/bin/dcos" >> /root/installDCOS.sh
echo "dcos config set core.dcos_url http://172.16.99.200" >> /root/installDCOS.sh

chmod 777 /root/installDCOS.sh
echo "/bin/bash /root/installDCOS.sh" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= InstallDCOSPrereqs =
echo "proxy=http://192.168.1.73:3128" >> /etc/yum.conf
yum -y install ipset tar xz unzip curl docker docker-selinux &> /dev/null
yum -y upgrade &> /dev/null

grep -q Restart=on-failure /usr/lib/systemd/system/docker.service && printf 'Restart function is already set in systemd script' || sed -i '/MountFlags=slave/aRestart=on-failure' /usr/lib/systemd/system/docker.service
rhncfg-client get
systemctl daemon-reload
systemctl enable docker.service
systemctl start docker.service

# DCOS requires this firewall to be shut off.
## https://docs.mesosphere.com/1.7/administration/installing/custom/system-requirements/
systemctl disable firewalld
systemctl stop firewalld

mkdir -p /var/{lib,log}/mesos
chown nobody /var/{lib,log}/mesos
touch /var/marathon.ip
chown /var/marathon.ip

groupadd nogroup -g 9999
groupadd docker

yum -y remove dnsmasq &> /dev/null
PIDS=`ps -ef | grep dnsmasq | egrep -v grep | awk '{ print $2 }'`
kill $PIDS
mkdir -p /tmp/dcos && cd /tmp/dcos
#curl -s http://140.32.192.51/dcos/install/genconf/serve/dcos_install.sh > dcos_install.sh
curl -s http://192.168.1.73:81/dcos/genconf/serve/dcos_install.sh > dcos_install.sh

= InstallDCOSSlave =
#raw
printf " Installing DCOS Slave: "
/bin/bash /tmp/status.sh &
#end raw
$SNIPPET('spacewalk/1/InstallDCOSPrereqs')
#raw
echo "setenforce 0" > /root/installDCOS.sh
echo "#CHECK=\`systemctl is-active docker\`" >> /root/installDCOS.sh
echo "#while [[ \$CHECK != 'active' ]]; do sleep 5; CHECK=\`systemctl is-active docker\`;done" >> /root/installDCOS.sh
echo "/bin/bash /tmp/dcos/dcos_install.sh slave" >> /root/installDCOS.sh
echo "DCOS_CONFIG=\`grep -ir 'MESOS_HOSTNAME_LOOKUP=false' /opt/mesosphere/packages/dcos-config* | grep mesos-slave-common | cut -d ':' -f 1\`" >> /root/installDCOS.sh
echo "for i in \$DCOS_CONFIG; do sed -i 's~MESOS_HOSTNAME_LOOKUP=.*~MESOS_HOSTNAME_LOOKUP=true~' \$i; done" >> /root/installDCOS.sh
echo "rm -rf /var/lib/mesos/slave/meta/slaves/latest" >> /root/installDCOS.sh
echo "echo 'ENABLE_CHECK_TIME=false' >> /opt/mesosphere/environment" >> /root/installDCOS.sh
echo "#sleep 6000" >> /root/installDCOS.sh
echo "#rm -rf /root/installDCOS.sh" >> /root/installDCOS.sh
echo "sed -i 's/\/bin\/bash\ \/root\/installDCOS.sh//g' /etc/rc.d/rc.local" >> /root/installDCOS.sh
echo "sed -i 's~LD_LIBRARY_PATH=/opt/mesosphere/lib~LD_LIBRARY_PATH=/lib64~' /opt/mesosphere/environment.export" >> /root/installDCOS.sh

chmod 777 /root/installDCOS.sh
echo "/bin/bash /root/installDCOS.sh" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= InstallDesktopPackages =
#raw
printf " Installing GNOME Desktop Packages: "
/bin/bash /tmp/status.sh &
yum -y --nogpgcheck groupinstall "GNOME Desktop" &> /dev/null
sed -i 's/id:3:/id:5:/' /etc/inittab
systemctl set-default graphical.target
rm -f /etc/xdg/autostart/gnome-initial-setup-first-login.desktop &> /dev/null
rm -f /etc/xdg/autostart/gnome-initial-setup-copy-worker.desktop &> /dev/null
rm -f /etc/xdg/autostart/gnome-welcome-tour.desktop &> /dev/null
sed -i '/daemon/a InitialSetupEnable=False' /etc/gdm/custom.conf
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= InstallVMTools =
#raw
if [[ $(lspci|grep -i vmware) ]]; then
printf " Installing VMware Tools: "
/bin/bash /tmp/status.sh &
yum -y install open-vm-tools
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
fi
#end raw

= JoinAD =
#raw
printf " Creating /root/joinAD.sh: "
/bin/bash /tmp/status.sh &

yum install -y realmd samba samba-common oddjob oddjob-mkhomedir sssd adcli sssd-tools samba-libs krb5-workstation &> /dev/null
echo 'read -p "Enter Admin Username: " USERNAME' > /root/joinAD.sh
echo 'yum install -y realmd samba samba-common oddjob oddjob-mkhomedir sssd adcli sssd-tools samba-libs krb5-workstation &> /dev/null' >> /root/joinAD.sh
echo 'rhncfg-client get &> /dev/null' >> /root/joinAD.sh
echo 'realm leave' >> /root/joinAD.sh
echo 'sleep 5' >> /root/joinAD.sh
echo 'realm join --user=$USERNAME "711hpw.afrl-wrs.hpc.mil"' >> /root/joinAD.sh
echo 'sleep 15' >> /root/joinAD.sh
echo 'systemctl stop sssd' >> /root/joinAD.sh
echo 'rm -rf /var/lib/sss/db/*' >> /root/joinAD.sh
echo 'rhncfg-client get &> /dev/null' >> /root/joinAD.sh
echo 'systemctl start sssd' >> /root/joinAD.sh
echo 'sleep 10' >> /root/joinAD.sh
echo 'systemctl restart sssd' >> /root/joinAD.sh
chmod 777 /root/joinAD.sh

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= PostNoChroot-InstallNetworking =
$SNIPPET('spacewalk/1/StatusBarScript')
$SNIPPET('spacewalk/1/SwitchToTTY7')
#raw
# Set-Hostname-Network Snippet
printf " Setting up Networking: "
/bin/bash /tmp/status.sh &
PID=`ps -ef | grep status.sh | egrep -v grep | sed 's/\ \ \ \ /\ /g' | sed 's/\ \ \ /\ /g' | sed 's/\ \ /\ /g' | cut -d ' ' -f 2`
\cp -f /tmp/network /mnt/sysimage/etc/sysconfig/network
\cp -f /tmp/hostname /mnt/sysimage/tmp/hostname
\cp -f /tmp/newnic.txt /mnt/sysimage/tmp/newnic.txt
\cp -f /tmp/nics.txt /mnt/sysimage/tmp/nics.txt
NAME`grep HOSTNAME /tmp/hostname | cut -d "=" -f 2`
/mnt/sysimage/usr/bin/hostname ${NAME} &> /dev/null
/mnt/sysimage/usr/bin/hostnamectl set-hostname ${NAME} &> /dev/null
/bin/hostname ${NAME} &> /dev/null
/bin/hostnamectl set-hostname ${NAME} &> /dev/null
/mnt/sysimage/bin/hostname ${NAME} &> /dev/null
/mnt/sysimage/bin/hostnamectl set-hostname ${NAME} &> /dev/null
DEVICE1=`cat /tmp/newnic.txt`
\cp -f /tmp/ifcfg-${DEVICE1} /mnt/sysimage/etc/sysconfig/network-scripts/ifcfg-${DEVICE1}
\cp -f /tmp/ifcfg-${DEVICE1} /mnt/sysimage/tmp/ifcfg-${DEVICE1}
while read NIC
do
\cp -f /tmp/ifcfg-${NIC} /mnt/sysimage/etc/sysconfig/network-scripts/ifcfg-${NIC}
\cp -f /tmp/ifcfg-${NIC} /mnt/sysimage/tmp/ifcfg-${NIC}
done < /tmp/nics.txt
\cp -f /tmp/newnic.txt /mnt/sysimage/tmp/newnic.txt
\cp -f /tmp/nics.txt /mnt/sysimage/tmp/nics.txt
kill $PID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
printf " Setting up DNS: "
/bin/bash /tmp/status.sh &
\cp -f /tmp/resolv.conf /mnt/sysimage/etc/resolv.conf
PID=`ps -ef | grep status.sh | egrep -v grep | sed 's/\ \ \ \ /\ /g' | sed 's/\ \ \ /\ /g' | sed 's/\ \ /\ /g' | cut -d ' ' -f 2`
kill $PID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw
$SNIPPET('spacewalk/1/SwitchToTTY1')

= PreScript Get-Hostname-Network =
$SNIPPET('spacewalk/1/SwitchToTTY7')
#raw
# Get-Hostname-Network Snippet
uname -r | grep -q el7 && OS7=True || OS7=False
uname -r | grep -q el6 && OS6=True || OS6=False
SEP7="#########################################################################################"
LINE7="-----------------------------------------------------------------------------------------"
SEP6="#####################################################################"
LINE6="---------------------------------------------------------------------"
SPACE=" "
TITLE1="\e[4;32m"
TITLE2="\e[39;0m"
QUESTION1="\e[31;1m"
QUESTION2="\e[39;0m"

if [[ $OS7 = "True" ]]; then
setterm -powersave off -blank 0
DNS1=`nmcli device show | grep DNS | sed 's/\ //g' | cut -d ':' -f 2 | head -1`
DNS2=`nmcli device show | grep DNS | sed 's/\ //g' | cut -d ':' -f 2 | head -2 | tail -1`
DOMAIN1=`nmcli device show | grep DOMAIN | sed 's/\ //g' | cut -d ':' -f 2`
GW1=`nmcli device show | grep GATEWAY | sed 's/\ //g' | cut -d ':' -f 2 | head -1`
DEVICE=`nmcli device | grep ' connected ' | cut -d ' ' -f 1`
NM1=`ifconfig | grep netmask | sed 's/.*\ 255/255/' | head -1 | cut -d ' ' -f 1`
echo $SEP7
echo -e $SPACE $TITLE1 "DISCOVERED VARIABLES" $TITLE2
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
DNS1=`cat /etc/resolv.conf | grep nameserver | cut -d ' ' -f 2 | head -1`
DNS2=`cat /etc/resolv.conf | grep nameserver | cut -d ' ' -f 2 | head -2 | tail -1`
DOMAIN1=`cat /etc/resolv.conf | grep domain | cut -d ' ' -f 2 | head -1`
GW1=`ip route show | grep default | cut -d ' ' -f 3`
DEVICE=`ip addr show | grep inet | grep brd | cut -d ' ' -f 11`
NM1=`ifconfig | grep Mask | sed 's/.*\ 255\255/' | head -1 | cut -d ':' -f 4`
echo $SEP6
echo -e $SPACE $TITLE1 "DISCOVERED VARIABLES" $TITLE2
echo $LINE6
fi
NICNUM=`ip link show | grep ": " | egrep -v lo | wc -l`
ip link show | grep ": " | egrep -v lo | cut -d ':' -f 2 | cut -d ' ' -f 2 > /tmp/nics.txt
LINKNUM=0
COUNT=1
while read NIC
do
LINK1=`ethtool ${NIC} | grep "Link detected:" | cut -d ':' -f 2 | sed 's/\ //'`
if [[ $LINK1 = "yes" ]]; then
let LINKNUM=LINKNUM+1
LINKCHOICE=$COUNT
fi
let COUNT=COUNT+1
done < /tmp/nics.txt
echo -e ' DNS1 Server:\t\t\t'${DNS1}
echo -e ' DNS2 Server:\t\t\t'${DNS2}
echo -e ' Domain Name:\t\t\t'${DOMAIN1}
echo -e ' Current Network Device:\t'${DEVICE}
echo -e ' Number of Network Devices:\t'${NICNUM}
echo -e ' Gateway:\t\t\t'${GW1}
echo -e ' Netmask:\t\t\t'${NM1}
if [ $NICNUM -ne 1 ]; then
if [ $LINKNUM -ne 1 ]; then
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $QUESTION1 "WHAT NETWORK DEVICE DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo -e " Note: This kickstart will continue to use the \e[31m"${DEVICE}"\e[39m for the installation."
echo " Note: If you choose nothing it will default to option 1."
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $QUESTION1 "WHAT NETWORK DEVICE DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo -e " Note: This kickstart will continue to use the \e[31m"${DEVICE}"\e[39m for the installation."
echo " Note: If you choose nothing it will default to option 1."
echo $LINE6
fi
COUNT=1
while read NIC
do
LINK=`ethtool ${NIC} | grep "Link detected:" | cut -d ':' -f 2 | sed 's/\ //'`
echo -e " $COUNT: DEVICE:\t\t$NIC"
DRIVER=`ethtool -i ${NIC} | grep driver | cut -d ':' -f 2 | sed 's/\ //'`
echo -e " DRIVER:\t\t$DRIVER"
TENG=`ethtool -i ${NIC} | grep baseT | grep 10000 | wc -l`
if [ TENG -eq 0 ]; then
ONEG=`ethtool -i ${NIC} | grep baseT | grep 1000 | wc -l`
if [ ONEG -eq 0 ]; then
echo "NOT 1G Networking" > /dev/null
else
echo -e " SPEED:\t\t1G"
fi
else
echo -e " SPEED:\t\t10G"
fi
echo -e " LINK:\t\t$LINK"
if [[ $OS7 = "True" ]]; then
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $LINE6
fi
let COUNT=COUNT+1
done < /tmp/nics.txt
printf " "
read NICCHOICE
else
NICCHOICE=$LINKCHOICE
fi
if [ -z $NICCHOICE ]; then NICCHOICE=1; fi
fi
CMD='cat /tmp/nics.txt | head -'$NICCHOICE' | tail -1'
DEVICE1=`eval $CMD`
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $QUESTION1 "WHAT HOSTNAME DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo " Note: If this hostname is already in DNS you will NOT need to enter an IP address."
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $QUESTION1 "WHAT HOSTNAME DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo " Note: If this hostname is already in DNS you will NOT need to enter an IP address."
echo $LINE6
fi
printf " "
if [ -f "/tmp/pre_install_network_config" ]; then
NAME=`cat /tmp/pre_install_network_config | sed 's/.*--hostname=//' | cut -d '.' -f 1`
echo $NAME
else
read NAME
fi
echo ""
NAME1=`nslookup ${NAME} ${DNS1} | grep Name | head -1 | cut -f 2`
if [[ -z ${NAME1} ]]; then
NAME=`echo ${NAME}.${DOMAIN1}`
else
NAME=`echo ${NAME1}`
fi
/bin/hostnamectl set-hostname ${NAME}
ADDR=`cat /etc/hosts | grep -i ${NAME} | egrep -v KVM | awk '{ print $1 }'`
if [[ -z ${ADDR} ]]; then
ADDR=`nslookup ${NAME} ${DNS1} | tail -2 | head -1 | cut -d ' ' -f 2`
fi
if [[ "${ADDR}" == "server" ]]; then
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $QUESTION1 "WHAT IP ADDRESS DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $QUESTION1 "WHAT IP ADDRESS DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo $LINE6
fi
printf " "
read ADDR
echo ""
fi
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $SPACE $TITLE1 "USER DEFINED VARIABLES" $TITLE2
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $SPACE $TITLE1 "USER DEFINED VARIABLES" $TITLE2
echo $LINE6
fi
echo -e " Hostname:\t\t"${NAME}
echo -e " IP Address:\t\t"${ADDR}
echo -e " Network Device:\t"${DEVICE1}
if [[ $OS7 = "True" ]]; then
echo $SEP7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
fi

echo ${NAME} > /tmp/hostname
echo ${DEVICE1} > /tmp/newnic.txt
sed -i '/'$DEVICE1'/d' /tmp/nics.txt
echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/network
echo "NETWORKING=yes" >> /tmp/network
echo "HOSTNAME="${NAME} >> /tmp/network
echo "GATEWAY="${GW1} >> /tmp/network

echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/ifcfg-${DEVICE1}
echo "DEVICE="${DEVICE1} >> /tmp/ifcfg-${DEVICE1}
echo "BOOTPROTO=none" >> /tmp/ifcfg-${DEVICE1}
echo "IPV6INIT=no" >> /tmp/ifcfg-${DEVICE1}
echo "MTU=1500" >> /tmp/ifcfg-${DEVICE1}
echo "NM_CONTROLLED=no" >> /tmp/ifcfg-${DEVICE1}
echo "ONBOOT=yes" >> /tmp/ifcfg-${DEVICE1}
echo "TYPE=Ethernet" >> /tmp/ifcfg-${DEVICE1}
echo "IPADDR="${ADDR} >> /tmp/ifcfg-${DEVICE1}
echo "NETMASK="${NM1} >> /tmp/ifcfg-${DEVICE1}
echo "GATEWAY="${GW1} >> /tmp/ifcfg-${DEVICE1}
echo "DNS1="${DNS1} >> /tmp/ifcfg-${DEVICE1}
echo "DNS2="${DNS2} >> /tmp/ifcfg-${DEVICE1}
echo "DOMAIN="${DOMAIN1} >> /tmp/ifcfg-${DEVICE1}
while read NIC1
do
echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/ifcfg-${NIC1}
echo "DEVICE="${NIC1} >> /tmp/ifcfg-${NIC1}
echo "BOOTPROTO=none" >> /tmp/ifcfg-${NIC1}
echo "IPV6INIT=no" >> /tmp/ifcfg-${NIC1}
echo "MTU=1500" >> /tmp/ifcfg-${NIC1}
echo "NM_CONTROLLED=no" >> /tmp/ifcfg-${NIC1}
echo "ONBOOT=no" >> /tmp/ifcfg-${NIC1}
done < /tmp/nics.txt
echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/resolv.conf
echo "search "${DOMAIN1} >> /tmp/resolv.conf
echo "nameserver "${DNS1} >> /tmp/resolv.conf
echo "nameserver "${DNS2} >> /tmp/resolv.conf

if [[ $OS7 = "True" ]]; then
echo -e $SPACE $TITLE1 "BEGINNING INSTALLATION" $TITLE2
echo " Note: Press Ctrl+Alt+F1 to See Progress"
echo $SEP7
fi
if [[ $OS6 = "True" ]]; then
echo -e $SPACE $TITLE1 "BEGINNING INSTALLATION" $TITLE2
echo " Note: Press Ctrl+Alt+F1 to See Progress"
echo $SEP6
fi
#end raw
$SNIPPET('spacewalk/1/SwitchToTTY1')

= RemoveNetworkManager =
#raw
printf " Removing NetworkManager: "
/bin/bash /tmp/status.sh &

yum -y remove NetworkManager &> /dev/null
yes | cp -f /tmp/ifcfg-* /etc/sysconfig/network-scripts/ &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= SetHostname =
#raw
printf " Setting Hostname: "
/bin/bash /tmp/status.sh &

echo "NAME=`cat /tmp/hostname`" > /root/setHostname.sh
echo "hostname \$NAME" >> /root/setHostname.sh
echo "hostnamectl set-hostname \$NAME" >> /root/setHostname.sh
echo "rhn-profile-sync" >> /root/setHostname.sh
echo "chmod -x /etc/rc.d/rc.local" >> /root/setHostname.sh
#echo "rm -rf /tmp/hostname" >> /root/setHostname.sh
echo "rm -rf /root/setHostname.sh" >> /root/setHostname.sh
echo "sed -i 's/\/bin\/bash\ \/root\/setHostname.sh//g' /etc/rc.d/rc.local" >> /root/setHostname.sh
chmod 777 /root/setHostname.sh
echo "/bin/bash /root/setHostname.sh" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= SetupFiglet =
#raw
printf " Setting up Figlet: "
/bin/bash /tmp/status.sh &

yum -y install figlet &> /dev/null
mkdir -p /usr/share/figlet/
wget http://140.32.192.51/pub/kickstart/figlet.tar.gz &> /dev/null
tar xf figlet.tar.gz -C /usr/share/figlet/
rm -rf figlet.tar.gz
find /usr/share/figlet/ -name '*.flf' > /usr/share/figlet/figfonts.txt
rhncfg-client get &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= SetupNTP =
$SNIPPET('spacewalk/1/ForceTime')
#raw
printf " Setting up Chrony: "
/bin/bash /tmp/status.sh &

yum -y install chrony &> /dev/null
rhncfg-client get &> /dev/null
systemctl enable chrony &> /dev/null
systemctl start chrony &> /dev/null
ntpdate -s 140.32.191.249 &> /dev/null
hwclock --systohc &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw
= SetupPuppetAgent =
#raw
printf " Setting up Puppet Agent: "
/bin/bash /tmp/status.sh &

yum -y install puppet-agent &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= StatusBarScript =
#raw
echo 'until [ "1" -eq "0" ]; do' > /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" "* "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " *"' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" "* "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo 'done' >> /tmp/status.sh
chmod 777 /tmp/status.sh
#end raw

= SwitchToTTY1 =
#raw
exec </dev/tty1 > /dev/tty1
chvt 1
#end raw

= SwitchToTTY7 =
#raw
setterm -powersave off -blank 0
chvt 7
exec </dev/tty7 > /dev/tty7
#end raw

= UpdateAllRPMs =
#raw
printf " Installing the latest RPM's: "
/bin/bash /tmp/status.sh &

yum --nogpgcheck update -y &> /dev/null
systemctl enable osad

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

DREN/Kickstart/snippets

2023-06-02T19:36:15Z

Admin:

= AddADGroups =
#raw
printf " Adding AD Groups: "
/bin/bash /tmp/status.sh &

groupadd domain_users -g 1342600513

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddAcasUser =
#raw
printf " Creating ACAS Scan User: "
/bin/bash /tmp/status.sh &

useradd scan_account -g users
sudo -u scan_account ssh-keygen -b 2048 -t rsa -f /home/scan_account/.ssh/id_rsa -q -N ""
sudo -u scan_account rm -rf /home/scan_account/.ssh/id_rsa
sudo -u scan_account curl --cacert /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT https://rdhpwngmp-01/pub/kickstart/nga_acas.pub > /home/scan_account/.ssh/authorized_keys

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddMounts =
#raw
printf " Adding NFS Mounts: "
/bin/bash /tmp/status.sh &

mkdir -p /users
chown :domain_users /users
chmod 775 /users
mkdir -p /data
chown :domain_users /data
chmod 775 /data
echo 'users:/users /users nfs noauto,x-systemd.automount,x-systemd.device-timeout=10,timeo=14,relatime 0 0' >> /etc/fstab
echo 'data:/data /data nfs noauto,x-systemd.automount,x-systemd.device-timeout=10,timeo=14,relatime 0 0' >> /etc/fstab

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddScaleUser =
#raw
printf " Creating Scale User: "
/bin/bash /tmp/status.sh &

useradd scale -u 7498 -g 1342600513 -G users
sed -i 's~scale:!!:~scale:$6$hQ5XU8FI$BFssO833kwMzahuVXMnMO9qReK4VRAXtMKRL/csxtJoFtj7Wgc9twzp6E79jw8y.U/JfSqMhzMafhijnISiyh1:~' /etc/shadow

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= AddSpacewalkToHosts =
#raw
printf " Adding Spacewalk server to /etc/hosts: "
/bin/bash /tmp/status.sh &
curl http://140.32.192.51/pub/kickstart/hosts > /mnt/sysimage/etc/hosts
curl http://140.32.192.51/pub/kickstart/hosts > /etc/hosts
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= ForceTime =
printf " Forcing Time Synce with NTP Server: "
/bin/bash /tmp/status.sh &
ntpdate -s 140.32.191.249
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"

= InstallDCOSMaster =
#raw
printf " Installing DCOS Master: "
/bin/bash /tmp/status.sh &
#end raw
$SNIPPET('spacewalk/1/InstallDCOSPrereqs')
#raw
# This is needed for using the dcos command with jenkins
yum -y install expect &> /dev/null

# Creating installDCOS.sh script
echo "#CHECK=\`systemctl is-active docker\`" > /root/installDCOS.sh
echo "#while [[ \$CHECK != 'active' ]]; do sleep 5; CHECK=\`systemctl is-active docker\`;done" >> /root/installDCOS.sh
echo "/bin/bash /tmp/dcos/dcos_install.sh master" >> /root/installDCOS.sh
echo "mkdir -p /var/log/mesos/archive" >> /root/installDCOS.sh
echo "echo 'ENABLE_CHECK_TIME=false' >> /opt/mesosphere/environment" >> /root/installDCOS.sh
echo "#sleep 6000" >> /root/installDCOS.sh
echo "#rm -rf /root/installDCOS.sh" >> /root/installDCOS.sh
echo "sed -i 's/\/bin\/bash\ \/root\/installDCOS.sh//g' /etc/rc.d/rc.local" >> /root/installDCOS.sh
echo "sed -i 's~LD_LIBRARY_PATH=/opt/mesosphere/lib~LD_LIBRARY_PATH=/lib64~' /opt/mesosphere/environment.export" >> /root/installDCOS.sh
echo "curl -fLsS --retry 20 -Y 100000 -y 60 https://downloads.dcos.io/binaries/cli/linux/x86-64/dcos-1.8/dcos -o dcos" >> /root/installDCOS.sh
echo "mv dcos /usr/local/bin" >> /root/installDCOS.sh
echo "chmod +x /usr/local/bin/dcos" >> /root/installDCOS.sh
echo "dcos config set core.dcos_url http://172.16.99.200" >> /root/installDCOS.sh

chmod 777 /root/installDCOS.sh
echo "/bin/bash /root/installDCOS.sh" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= InstallDCOSPrereqs =
echo "proxy=http://192.168.1.73:3128" >> /etc/yum.conf
yum -y install ipset tar xz unzip curl docker docker-selinux &> /dev/null
yum -y upgrade &> /dev/null

grep -q Restart=on-failure /usr/lib/systemd/system/docker.service && printf 'Restart function is already set in systemd script' || sed -i '/MountFlags=slave/aRestart=on-failure' /usr/lib/systemd/system/docker.service
rhncfg-client get
systemctl daemon-reload
systemctl enable docker.service
systemctl start docker.service

# DCOS requires this firewall to be shut off.
## https://docs.mesosphere.com/1.7/administration/installing/custom/system-requirements/
systemctl disable firewalld
systemctl stop firewalld

mkdir -p /var/{lib,log}/mesos
chown nobody /var/{lib,log}/mesos
touch /var/marathon.ip
chown /var/marathon.ip

groupadd nogroup -g 9999
groupadd docker

yum -y remove dnsmasq &> /dev/null
PIDS=`ps -ef | grep dnsmasq | egrep -v grep | awk '{ print $2 }'`
kill $PIDS
mkdir -p /tmp/dcos && cd /tmp/dcos
#curl -s http://140.32.192.51/dcos/install/genconf/serve/dcos_install.sh > dcos_install.sh
curl -s http://192.168.1.73:81/dcos/genconf/serve/dcos_install.sh > dcos_install.sh

= InstallDCOSSlave =
#raw
printf " Installing DCOS Slave: "
/bin/bash /tmp/status.sh &
#end raw
$SNIPPET('spacewalk/1/InstallDCOSPrereqs')
#raw
echo "setenforce 0" > /root/installDCOS.sh
echo "#CHECK=\`systemctl is-active docker\`" >> /root/installDCOS.sh
echo "#while [[ \$CHECK != 'active' ]]; do sleep 5; CHECK=\`systemctl is-active docker\`;done" >> /root/installDCOS.sh
echo "/bin/bash /tmp/dcos/dcos_install.sh slave" >> /root/installDCOS.sh
echo "DCOS_CONFIG=\`grep -ir 'MESOS_HOSTNAME_LOOKUP=false' /opt/mesosphere/packages/dcos-config* | grep mesos-slave-common | cut -d ':' -f 1\`" >> /root/installDCOS.sh
echo "for i in \$DCOS_CONFIG; do sed -i 's~MESOS_HOSTNAME_LOOKUP=.*~MESOS_HOSTNAME_LOOKUP=true~' \$i; done" >> /root/installDCOS.sh
echo "rm -rf /var/lib/mesos/slave/meta/slaves/latest" >> /root/installDCOS.sh
echo "echo 'ENABLE_CHECK_TIME=false' >> /opt/mesosphere/environment" >> /root/installDCOS.sh
echo "#sleep 6000" >> /root/installDCOS.sh
echo "#rm -rf /root/installDCOS.sh" >> /root/installDCOS.sh
echo "sed -i 's/\/bin\/bash\ \/root\/installDCOS.sh//g' /etc/rc.d/rc.local" >> /root/installDCOS.sh
echo "sed -i 's~LD_LIBRARY_PATH=/opt/mesosphere/lib~LD_LIBRARY_PATH=/lib64~' /opt/mesosphere/environment.export" >> /root/installDCOS.sh

chmod 777 /root/installDCOS.sh
echo "/bin/bash /root/installDCOS.sh" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= InstallDesktopPackages =
#raw
printf " Installing GNOME Desktop Packages: "
/bin/bash /tmp/status.sh &
yum -y --nogpgcheck groupinstall "GNOME Desktop" &> /dev/null
sed -i 's/id:3:/id:5:/' /etc/inittab
systemctl set-default graphical.target
rm -f /etc/xdg/autostart/gnome-initial-setup-first-login.desktop &> /dev/null
rm -f /etc/xdg/autostart/gnome-initial-setup-copy-worker.desktop &> /dev/null
rm -f /etc/xdg/autostart/gnome-welcome-tour.desktop &> /dev/null
sed -i '/daemon/a InitialSetupEnable=False' /etc/gdm/custom.conf
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= InstallVMTools =
#raw
if [[ $(lspci|grep -i vmware) ]]; then
printf " Installing VMware Tools: "
/bin/bash /tmp/status.sh &
yum -y install open-vm-tools
STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
fi
#end raw

= JoinAD =
#raw
printf " Creating /root/joinAD.sh: "
/bin/bash /tmp/status.sh &

yum install -y realmd samba samba-common oddjob oddjob-mkhomedir sssd adcli sssd-tools samba-libs krb5-workstation &> /dev/null
echo 'read -p "Enter Admin Username: " USERNAME' > /root/joinAD.sh
echo 'yum install -y realmd samba samba-common oddjob oddjob-mkhomedir sssd adcli sssd-tools samba-libs krb5-workstation &> /dev/null' >> /root/joinAD.sh
echo 'rhncfg-client get &> /dev/null' >> /root/joinAD.sh
echo 'realm leave' >> /root/joinAD.sh
echo 'sleep 5' >> /root/joinAD.sh
echo 'realm join --user=$USERNAME "711hpw.afrl-wrs.hpc.mil"' >> /root/joinAD.sh
echo 'sleep 15' >> /root/joinAD.sh
echo 'systemctl stop sssd' >> /root/joinAD.sh
echo 'rm -rf /var/lib/sss/db/*' >> /root/joinAD.sh
echo 'rhncfg-client get &> /dev/null' >> /root/joinAD.sh
echo 'systemctl start sssd' >> /root/joinAD.sh
echo 'sleep 10' >> /root/joinAD.sh
echo 'systemctl restart sssd' >> /root/joinAD.sh
chmod 777 /root/joinAD.sh

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= PostNoChroot-InstallNetworking =
$SNIPPET('spacewalk/1/StatusBarScript')
$SNIPPET('spacewalk/1/SwitchToTTY7')
#raw
# Set-Hostname-Network Snippet
printf " Setting up Networking: "
/bin/bash /tmp/status.sh &
PID=`ps -ef | grep status.sh | egrep -v grep | sed 's/\ \ \ \ /\ /g' | sed 's/\ \ \ /\ /g' | sed 's/\ \ /\ /g' | cut -d ' ' -f 2`
\cp -f /tmp/network /mnt/sysimage/etc/sysconfig/network
\cp -f /tmp/hostname /mnt/sysimage/tmp/hostname
\cp -f /tmp/newnic.txt /mnt/sysimage/tmp/newnic.txt
\cp -f /tmp/nics.txt /mnt/sysimage/tmp/nics.txt
NAME`grep HOSTNAME /tmp/hostname | cut -d "=" -f 2`
/mnt/sysimage/usr/bin/hostname ${NAME} &> /dev/null
/mnt/sysimage/usr/bin/hostnamectl set-hostname ${NAME} &> /dev/null
/bin/hostname ${NAME} &> /dev/null
/bin/hostnamectl set-hostname ${NAME} &> /dev/null
/mnt/sysimage/bin/hostname ${NAME} &> /dev/null
/mnt/sysimage/bin/hostnamectl set-hostname ${NAME} &> /dev/null
DEVICE1=`cat /tmp/newnic.txt`
\cp -f /tmp/ifcfg-${DEVICE1} /mnt/sysimage/etc/sysconfig/network-scripts/ifcfg-${DEVICE1}
\cp -f /tmp/ifcfg-${DEVICE1} /mnt/sysimage/tmp/ifcfg-${DEVICE1}
while read NIC
do
\cp -f /tmp/ifcfg-${NIC} /mnt/sysimage/etc/sysconfig/network-scripts/ifcfg-${NIC}
\cp -f /tmp/ifcfg-${NIC} /mnt/sysimage/tmp/ifcfg-${NIC}
done < /tmp/nics.txt
\cp -f /tmp/newnic.txt /mnt/sysimage/tmp/newnic.txt
\cp -f /tmp/nics.txt /mnt/sysimage/tmp/nics.txt
kill $PID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
printf " Setting up DNS: "
/bin/bash /tmp/status.sh &
\cp -f /tmp/resolv.conf /mnt/sysimage/etc/resolv.conf
PID=`ps -ef | grep status.sh | egrep -v grep | sed 's/\ \ \ \ /\ /g' | sed 's/\ \ \ /\ /g' | sed 's/\ \ /\ /g' | cut -d ' ' -f 2`
kill $PID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw
$SNIPPET('spacewalk/1/SwitchToTTY1')

= PreScript Get-Hostname-Network =
$SNIPPET('spacewalk/1/SwitchToTTY7')
#raw
# Get-Hostname-Network Snippet
uname -r | grep -q el7 && OS7=True || OS7=False
uname -r | grep -q el6 && OS6=True || OS6=False
SEP7="#########################################################################################"
LINE7="-----------------------------------------------------------------------------------------"
SEP6="#####################################################################"
LINE6="---------------------------------------------------------------------"
SPACE=" "
TITLE1="\e[4;32m"
TITLE2="\e[39;0m"
QUESTION1="\e[31;1m"
QUESTION2="\e[39;0m"

if [[ $OS7 = "True" ]]; then
setterm -powersave off -blank 0
DNS1=`nmcli device show | grep DNS | sed 's/\ //g' | cut -d ':' -f 2 | head -1`
DNS2=`nmcli device show | grep DNS | sed 's/\ //g' | cut -d ':' -f 2 | head -2 | tail -1`
DOMAIN1=`nmcli device show | grep DOMAIN | sed 's/\ //g' | cut -d ':' -f 2`
GW1=`nmcli device show | grep GATEWAY | sed 's/\ //g' | cut -d ':' -f 2 | head -1`
DEVICE=`nmcli device | grep ' connected ' | cut -d ' ' -f 1`
NM1=`ifconfig | grep netmask | sed 's/.*\ 255/255/' | head -1 | cut -d ' ' -f 1`
echo $SEP7
echo -e $SPACE $TITLE1 "DISCOVERED VARIABLES" $TITLE2
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
DNS1=`cat /etc/resolv.conf | grep nameserver | cut -d ' ' -f 2 | head -1`
DNS2=`cat /etc/resolv.conf | grep nameserver | cut -d ' ' -f 2 | head -2 | tail -1`
DOMAIN1=`cat /etc/resolv.conf | grep domain | cut -d ' ' -f 2 | head -1`
GW1=`ip route show | grep default | cut -d ' ' -f 3`
DEVICE=`ip addr show | grep inet | grep brd | cut -d ' ' -f 11`
NM1=`ifconfig | grep Mask | sed 's/.*\ 255\255/' | head -1 | cut -d ':' -f 4`
echo $SEP6
echo -e $SPACE $TITLE1 "DISCOVERED VARIABLES" $TITLE2
echo $LINE6
fi
NICNUM=`ip link show | grep ": " | egrep -v lo | wc -l`
ip link show | grep ": " | egrep -v lo | cut -d ':' -f 2 | cut -d ' ' -f 2 > /tmp/nics.txt
LINKNUM=0
COUNT=1
while read NIC
do
LINK1=`ethtool ${NIC} | grep "Link detected:" | cut -d ':' -f 2 | sed 's/\ //'`
if [[ $LINK1 = "yes" ]]; then
let LINKNUM=LINKNUM+1
LINKCHOICE=$COUNT
fi
let COUNT=COUNT+1
done < /tmp/nics.txt
echo -e ' DNS1 Server:\t\t\t'${DNS1}
echo -e ' DNS2 Server:\t\t\t'${DNS2}
echo -e ' Domain Name:\t\t\t'${DOMAIN1}
echo -e ' Current Network Device:\t'${DEVICE}
echo -e ' Number of Network Devices:\t'${NICNUM}
echo -e ' Gateway:\t\t\t'${GW1}
echo -e ' Netmask:\t\t\t'${NM1}
if [ $NICNUM -ne 1 ]; then
if [ $LINKNUM -ne 1 ]; then
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $QUESTION1 "WHAT NETWORK DEVICE DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo -e " Note: This kickstart will continue to use the \e[31m"${DEVICE}"\e[39m for the installation."
echo " Note: If you choose nothing it will default to option 1."
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $QUESTION1 "WHAT NETWORK DEVICE DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo -e " Note: This kickstart will continue to use the \e[31m"${DEVICE}"\e[39m for the installation."
echo " Note: If you choose nothing it will default to option 1."
echo $LINE6
fi
COUNT=1
while read NIC
do
LINK=`ethtool ${NIC} | grep "Link detected:" | cut -d ':' -f 2 | sed 's/\ //'`
echo -e " $COUNT: DEVICE:\t\t$NIC"
DRIVER=`ethtool -i ${NIC} | grep driver | cut -d ':' -f 2 | sed 's/\ //'`
echo -e " DRIVER:\t\t$DRIVER"
TENG=`ethtool -i ${NIC} | grep baseT | grep 10000 | wc -l`
if [ TENG -eq 0 ]; then
ONEG=`ethtool -i ${NIC} | grep baseT | grep 1000 | wc -l`
if [ ONEG -eq 0 ]; then
echo "NOT 1G Networking" > /dev/null
else
echo -e " SPEED:\t\t1G"
fi
else
echo -e " SPEED:\t\t10G"
fi
echo -e " LINK:\t\t$LINK"
if [[ $OS7 = "True" ]]; then
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $LINE6
fi
let COUNT=COUNT+1
done < /tmp/nics.txt
printf " "
read NICCHOICE
else
NICCHOICE=$LINKCHOICE
fi
if [ -z $NICCHOICE ]; then NICCHOICE=1; fi
fi
CMD='cat /tmp/nics.txt | head -'$NICCHOICE' | tail -1'
DEVICE1=`eval $CMD`
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $QUESTION1 "WHAT HOSTNAME DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo " Note: If this hostname is already in DNS you will NOT need to enter an IP address."
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $QUESTION1 "WHAT HOSTNAME DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo " Note: If this hostname is already in DNS you will NOT need to enter an IP address."
echo $LINE6
fi
printf " "
if [ -f "/tmp/pre_install_network_config" ]; then
NAME=`cat /tmp/pre_install_network_config | sed 's/.*--hostname=//' | cut -d '.' -f 1`
echo $NAME
else
read NAME
fi
echo ""
NAME1=`nslookup ${NAME} ${DNS1} | grep Name | head -1 | cut -f 2`
if [[ -z ${NAME1} ]]; then
NAME=`echo ${NAME}.${DOMAIN1}`
else
NAME=`echo ${NAME1}`
fi
/bin/hostnamectl set-hostname ${NAME}
ADDR=`cat /etc/hosts | grep -i ${NAME} | egrep -v KVM | awk '{ print $1 }'`
if [[ -z ${ADDR} ]]; then
ADDR=`nslookup ${NAME} ${DNS1} | tail -2 | head -1 | cut -d ' ' -f 2`
fi
if [[ "${ADDR}" == "server" ]]; then
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $QUESTION1 "WHAT IP ADDRESS DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $QUESTION1 "WHAT IP ADDRESS DO YOU WANT THIS SERVER TO USE?" $QUESTION2
echo $LINE6
fi
printf " "
read ADDR
echo ""
fi
if [[ $OS7 = "True" ]]; then
echo $SEP7
echo -e $SPACE $TITLE1 "USER DEFINED VARIABLES" $TITLE2
echo $LINE7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
echo -e $SPACE $TITLE1 "USER DEFINED VARIABLES" $TITLE2
echo $LINE6
fi
echo -e " Hostname:\t\t"${NAME}
echo -e " IP Address:\t\t"${ADDR}
echo -e " Network Device:\t"${DEVICE1}
if [[ $OS7 = "True" ]]; then
echo $SEP7
fi
if [[ $OS6 = "True" ]]; then
echo $SEP6
fi

echo ${NAME} > /tmp/hostname
echo ${DEVICE1} > /tmp/newnic.txt
sed -i '/'$DEVICE1'/d' /tmp/nics.txt
echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/network
echo "NETWORKING=yes" >> /tmp/network
echo "HOSTNAME="${NAME} >> /tmp/network
echo "GATEWAY="${GW1} >> /tmp/network

echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/ifcfg-${DEVICE1}
echo "DEVICE="${DEVICE1} >> /tmp/ifcfg-${DEVICE1}
echo "BOOTPROTO=none" >> /tmp/ifcfg-${DEVICE1}
echo "IPV6INIT=no" >> /tmp/ifcfg-${DEVICE1}
echo "MTU=1500" >> /tmp/ifcfg-${DEVICE1}
echo "NM_CONTROLLED=no" >> /tmp/ifcfg-${DEVICE1}
echo "ONBOOT=yes" >> /tmp/ifcfg-${DEVICE1}
echo "TYPE=Ethernet" >> /tmp/ifcfg-${DEVICE1}
echo "IPADDR="${ADDR} >> /tmp/ifcfg-${DEVICE1}
echo "NETMASK="${NM1} >> /tmp/ifcfg-${DEVICE1}
echo "GATEWAY="${GW1} >> /tmp/ifcfg-${DEVICE1}
echo "DNS1="${DNS1} >> /tmp/ifcfg-${DEVICE1}
echo "DNS2="${DNS2} >> /tmp/ifcfg-${DEVICE1}
echo "DOMAIN="${DOMAIN1} >> /tmp/ifcfg-${DEVICE1}
while read NIC1
do
echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/ifcfg-${NIC1}
echo "DEVICE="${NIC1} >> /tmp/ifcfg-${NIC1}
echo "BOOTPROTO=none" >> /tmp/ifcfg-${NIC1}
echo "IPV6INIT=no" >> /tmp/ifcfg-${NIC1}
echo "MTU=1500" >> /tmp/ifcfg-${NIC1}
echo "NM_CONTROLLED=no" >> /tmp/ifcfg-${NIC1}
echo "ONBOOT=no" >> /tmp/ifcfg-${NIC1}
done < /tmp/nics.txt
echo "# GENERATED BY GET-HOSTNAME-NETWORK SNIPPET" > /tmp/resolv.conf
echo "search "${DOMAIN1} >> /tmp/resolv.conf
echo "nameserver "${DNS1} >> /tmp/resolv.conf
echo "nameserver "${DNS2} >> /tmp/resolv.conf

if [[ $OS7 = "True" ]]; then
echo -e $SPACE $TITLE1 "BEGINNING INSTALLATION" $TITLE2
echo " Note: Press Ctrl+Alt+F1 to See Progress"
echo $SEP7
fi
if [[ $OS6 = "True" ]]; then
echo -e $SPACE $TITLE1 "BEGINNING INSTALLATION" $TITLE2
echo " Note: Press Ctrl+Alt+F1 to See Progress"
echo $SEP6
fi
#end raw
$SNIPPET('spacewalk/1/SwitchToTTY1')

= RemoveNetworkManager =
#raw
printf " Removing NetworkManager: "
/bin/bash /tmp/status.sh &

yum -y remove NetworkManager &> /dev/null
yes | cp -f /tmp/ifcfg-* /etc/sysconfig/network-scripts/ &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= SetHostname =
#raw
printf " Setting Hostname: "
/bin/bash /tmp/status.sh &

echo "NAME=`cat /tmp/hostname`" > /root/setHostname.sh
echo "hostname \$NAME" >> /root/setHostname.sh
echo "hostnamectl set-hostname \$NAME" >> /root/setHostname.sh
echo "rhn-profile-sync" >> /root/setHostname.sh
echo "chmod -x /etc/rc.d/rc.local" >> /root/setHostname.sh
#echo "rm -rf /tmp/hostname" >> /root/setHostname.sh
echo "rm -rf /root/setHostname.sh" >> /root/setHostname.sh
echo "sed -i 's/\/bin\/bash\ \/root\/setHostname.sh//g' /etc/rc.d/rc.local" >> /root/setHostname.sh
chmod 777 /root/setHostname.sh
echo "/bin/bash /root/setHostname.sh" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= SetupFiglet =
#raw
printf " Setting up Figlet: "
/bin/bash /tmp/status.sh &

yum -y install figlet &> /dev/null
mkdir -p /usr/share/figlet/
wget http://140.32.192.51/pub/kickstart/figlet.tar.gz &> /dev/null
tar xf figlet.tar.gz -C /usr/share/figlet/
rm -rf figlet.tar.gz
find /usr/share/figlet/ -name '*.flf' > /usr/share/figlet/figfonts.txt
rhncfg-client get &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= SetupNTP =
$SNIPPET('spacewalk/1/ForceTime')
#raw
printf " Setting up Chrony: "
/bin/bash /tmp/status.sh &

yum -y install chrony &> /dev/null
rhncfg-client get &> /dev/null
systemctl enable chrony &> /dev/null
systemctl start chrony &> /dev/null
ntpdate -s 140.32.191.249 &> /dev/null
hwclock --systohc &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw
= SetupPuppetAgent =
#raw
printf " Setting up Puppet Agent: "
/bin/bash /tmp/status.sh &

yum -y install puppet-agent &> /dev/null

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

= | StatusBarScript =
#raw
echo 'until [ "1" -eq "0" ]; do' > /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" "* "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " *"' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" " * "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo ' printf "[\e[1;32m%-6s\e[0;39m]" "* "' >> /tmp/status.sh
echo ' sleep .25' >> /tmp/status.sh
echo ' printf "\b\b\b\b\b\b\b\b"' >> /tmp/status.sh
echo 'done' >> /tmp/status.sh
chmod 777 /tmp/status.sh
#end raw

= SwitchToTTY1 =
#raw
exec </dev/tty1 > /dev/tty1
chvt 1
#end raw

= SwitchToTTY7 =
#raw
setterm -powersave off -blank 0
chvt 7
exec </dev/tty7 > /dev/tty7
#end raw

= UpdateAllRPMs =
#raw
printf " Installing the latest RPM's: "
/bin/bash /tmp/status.sh &

yum --nogpgcheck update -y &> /dev/null
systemctl enable osad

STATUSPID=`ps -ef | grep status| egrep -v grep | head -1 | awk '{print $2}'`
kill $STATUSPID
printf "\b\b\b\b\b\b\b\b"
echo -e "[ \e[1;32mOK\e[0;39m ]"
#end raw

DREN/Kickstart/snippets

2023-06-02T19:30:56Z

Admin:

DREN/Kickstart/snippets

2023-06-02T19:28:19Z

Admin: Created page with "= AddADGroups = = AddAcasUser = = AddMounts = = AddScaleUser = = AddSpacewalkToHosts = = ForceTime = = InstallDCOSMaster = = InstallDCOSPrereqs = = InstallDCOSSlave = = InstallDesktopPackages = = InstallVMTools = = JoinAD = = PostNoChroot-InstallNetworking = = PreScript Get-Hostname-Network = = RemoveNetworkManager = = SetHostname = = SetupFiglet = = SetupNTP = = | SetupPuppetAgent = = | StatusBarScript = = | SwitchToTTY1 = = | SwitchToTTY7 = = | UpdateAllRPMs ="

= AddADGroups =
= AddAcasUser =
= AddMounts =
= AddScaleUser =
= AddSpacewalkToHosts =
= ForceTime =
= InstallDCOSMaster =
= InstallDCOSPrereqs =
= InstallDCOSSlave =
= InstallDesktopPackages =
= InstallVMTools =
= JoinAD =
= PostNoChroot-InstallNetworking =
= PreScript Get-Hostname-Network =
= RemoveNetworkManager =
= SetHostname =
= SetupFiglet =
= SetupNTP =
= | SetupPuppetAgent =
= | StatusBarScript =
= | SwitchToTTY1 =
= | SwitchToTTY7 =
= | UpdateAllRPMs =

DREN/Kickstart/pxe

2023-06-02T19:24:16Z

Admin: Created page with "=cobbler= = /etc/cobbler/pxe/pxedefault.template = DEFAULT vesamenu.c32 PROMPT 0 menu clear menu background splash.png MENU TITLE Choose from the following kickstart Profiles: menu vshift 8 menu hshift 15 menu width 60 MENU MARGIN 1 MENU ROWS 15 MENU MASTER PASSWD $6$/GULqBhPJsrxxiC3$iJiWYlMyZNfwwOKsKeyLiNNcfwd7yUjYErzh4WtGMozDcmRubesMeQGeKE956qhhlmGia/1jsdth7vVaMOOP60 TIMEOUT 80 TOTALTIMEOUT 6000 ONTIMEOUT $pxe_timeout_profile LABEL local MEN..."

=cobbler=
= /etc/cobbler/pxe/pxedefault.template =

DEFAULT vesamenu.c32
PROMPT 0
menu clear
menu background splash.png
MENU TITLE Choose from the following kickstart Profiles:
menu vshift 8
menu hshift 15
menu width 60
MENU MARGIN 1
MENU ROWS 15
MENU MASTER PASSWD $6$/GULqBhPJsrxxiC3$iJiWYlMyZNfwwOKsKeyLiNNcfwd7yUjYErzh4WtGMozDcmRubesMeQGeKE956qhhlmGia/1jsdth7vVaMOOP60
TIMEOUT 80
TOTALTIMEOUT 6000
ONTIMEOUT $pxe_timeout_profile

LABEL local
MENU LABEL (Boot to Local OS)
MENU DEFAULT
LOCALBOOT 0

$pxe_menu_items

MENU end

= /etc/cobbler/pxe/pxeprofile.template =
#set $new_name = $profile_name.replace(':1:NGAResearchLabEnvironmentRLE', ' ')
#set $new_menu_label = $menu_label.replace(':1:NGAResearchLabEnvironmentRLE', ' ')
LABEL $new_name
MENU PASSWD
kernel $kernel_path
$new_menu_label
$append_line
ipappend 2

DREN/Kickstart/scripts

2023-06-02T19:23:27Z

Admin: Created page with "==initiateKickstart== #!/usr/bin/python import xmlrpclib import subprocess import sys SATELLITE_URL = "http://localhost/rpc/api" SATELLITE_LOGIN = "daniel.roessner.adm" SATELLITE_PASSWORD = SYSTEM = "rdhpwngmp-09.711hpw.afrl-wrs.hpc.mil" PROFILE_NAME = "DCOS-Slave" def kickstart(key, SYSTEM, PROFILE_NAME): list = client.system.listSystems(key) for sys in list: if sys['name'] == SYSTEM: system_id = sys['id'] #print client.kickstart.lis..."

==initiateKickstart==
#!/usr/bin/python
import xmlrpclib
import subprocess
import sys

SATELLITE_URL = "http://localhost/rpc/api"
SATELLITE_LOGIN = "daniel.roessner.adm"
SATELLITE_PASSWORD =
SYSTEM = "rdhpwngmp-09.711hpw.afrl-wrs.hpc.mil"
PROFILE_NAME = "DCOS-Slave"

def kickstart(key, SYSTEM, PROFILE_NAME):
list = client.system.listSystems(key)
for sys in list:
if sys['name'] == SYSTEM:
system_id = sys['id']
#print client.kickstart.listKickstarts(key)
print client.system.provisionSystem(key, system_id, PROFILE_NAME)

def rhn_check(SYSTEM):
COMMAND="rhn_check"
SYSTEM = SYSTEM.split('.')[0]

ssh = subprocess.Popen(["ssh", "-oStrictHostKeyChecking=no", "%s" % SYSTEM, COMMAND],
shell=False,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
result = ssh.stdout.readlines()
if result == []:
error = ssh.stderr.readlines()
print >>sys.stderr, "ERROR: %s" % error
else:
print result

def login(SATELLITE_URL, SATELLITE_LOGIN, SATELLITE_PASSWORD):
client = xmlrpclib.Server(SATELLITE_URL, verbose=0)
key = client.auth.login(SATELLITE_LOGIN, SATELLITE_PASSWORD)
return key, client

def logout(key):
client.auth.logout(key)

######################################################################

key, client = login(SATELLITE_URL, SATELLITE_LOGIN, SATELLITE_PASSWORD)

#kickstart(key, SYSTEM, PROFILE_NAME)
rhn_check(SYSTEM)

logout(key)

==reposync==
mkdir -p /var/log/scripts/
date > /var/log/scripts/spacewalk-repo-sync.log
echo ##################################################### >> /var/log/scripts/spacewalk-repo-sync.log
CENT7LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">7\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`
#CENT6LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">6\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`

spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/os/x86_64/ -c centos7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/extras/x86_64/ -c centos7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/updates/x86_64/ -c centos7 >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://dl.fedoraproject.org/pub/epel/7/x86_64/ -c centos7-latest-epel >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u https://yum.dockerproject.org/repo/main/centos/7/ -c centos7-latest-docker >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u https://yum.puppetlabs.com/el/7/PC1/x86_64/ -c centos7-latest-puppet >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://download.zfsonlinux.org/epel/7/x86_64/ -c centos-latest-zfs >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://download.zfsonlinux.org/epel/7/kmod/x86_64/ -c centos-latest-zfs >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest/RHEL/7/x86_64/ -c centos7-latest-spacewalk-server >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/7/x86_64/ -c centos7-latest-spacewalk-server >> /var/log/scripts/spacewalk-repo-sync.log

#spacewalk-repo-sync -u http://yum.postgresql.org/9.4/redhat/rhel-7-x86_64/ -c 7-postgres94 >> /var/log/scripts/spacewalk-repo-sync.log
#spacewalk-repo-sync -u http://yum.postgresql.org/9.5/redhat/rhel-7-x86_64/ -c 7-postgres95 >> /var/log/scripts/spacewalk-repo-sync.log
#spacewalk-repo-sync -u http://download.ceph.com/rpm/el7/x86_64/ -c ceph-centos7 >> /var/log/scripts/spacewalk-repo-sync.log

chmod -R 777 /var/satellite/redhat/1/
echo #################################################### >> /var/log/scripts/spacewalk-repo-sync.log
date >> /var/log/scripts/spacewalk-repo-sync.log

Main Page

2023-06-02T19:21:34Z

Admin:

[[VMware|VMware Documentation]] 
 
<HR>
 
[[DERs|DER's Documentation]] 
 
<HR>
 
[[DCOS/Install|DCOS LAB Installation Documentation]]

DCOS/Install

2023-06-02T19:20:52Z

Admin:

= DCOS Installation Instructions =

== LAB Setup ==
* Virtual Machine (2 CPU, 4G Memory, 50G HDD)
* CentOS 7 Minimal
* IP Address Assigned
* Hostname Assigned
* DNS Assigned

Master-01:
hostnamectl set-hostname Master-01.dersllc.com
sed -i 's/172.16.99.150/172.16.99.160/' /etc/sysconfig/network-scripts/ifcfg-ens192
yum -y install open-vm-tools
yum update -y

Slave-01:
hostnamectl set-hostname Slave-01.dersllc.com
sed -i 's/172.16.99.150/172.16.99.161/' /etc/sysconfig/network-scripts/ifcfg-ens192
yum -y install open-vm-tools
yum update -y

Web-01:
hostnamectl set-hostname Web-01.dersllc.com
sed -i 's/172.16.99.150/172.16.99.170/' /etc/sysconfig/network-scripts/ifcfg-ens192
yum update -y
yum install -y httpd open-vm-tools
systemctl enable httpd
systemctl start httpd

== Configuration Creation ==
* SSH to Web-01
Install and configure Docker:
yum install -y docker wget
mkdir -p /etc/systemd/system/docker.service.d
cat > /etc/systemd/system/docker.service.d/http-proxy.conf << "EOF"
[Service]
Environment="HTTPS_PROXY=https://192.168.1.73:3128/"
Environment="HTTP_PROXY=http://192.168.1.73:3128/"
Environment="FTP_PROXY=ftp://192.168.1.73:3128/"
Environment="NO_PROXY=localhost,127.0.0.0/8,dersllc.com"
EOF

cat <<EOF | sudo tee -a /etc/sysconfig/docker
http_proxy="http://192.168.1.73:3128/"
https_proxy="https://192.168.1.73:3128/"
ftp_proxy="ftp://192.168.1.73:3128/"
no_proxy="localhost,127.0.0.0/8,dersllc.com"
EOF

sudo sed -i '/\[Service\]/a EnvironmentFile=/etc/sysconfig/docker' /usr/lib/systemd/system/docker.service
systemctl daemon-reload
systemctl restart docker

Create GENCONF directory in Apache Directory:
cd /var/www/html
mkdir -p genconf

Download dcos_generate_config.sh file from DCOS.io:
wget https://downloads.dcos.io/dcos/stable/dcos_generate_config.sh

Create admin password hash:
./dcos_generate_config.sh --hash-password <PASSWORD>

Create Configuration File and copy in superuser password:
cat > genconf/config.yaml << "EOF"
bootstrap_url: http://web-01.dersllc.com/genconf/serve
cluster_name: LAB
superuser_username: admin
superuser_password_hash: $6$rounds=656000$dOTsAHKtm/yBuOCF$iC9m16rE38eZ/iaDLoIgeFSPS9cb1NoBJGmEkHxghAvVkreyq9/Tl.CvYwUQDzot8iO6v6fVIWx7Nx0.yZjOA.
exhibitor_storage_backend: static
master_discovery: static
ip_detect_public_filename: genconf/ip-detect
master_list:
- 172.16.99.160
resolvers:
- 172.16.87.5
- 172.16.87.1
security: 'disabled'
use_proxy: 'true'
http_proxy: http://192.168.1.73:3128
https_proxy: https://192.168.1.73:3128
no_proxy:
- 'dersllc.com'
enable_ipv6: 'false'
EOF

Create IP detection script:
cat > genconf/ip-detect << "EOF"
#!/usr/bin/env bash
set -o nounset -o errexit
export PATH=/usr/sbin:/usr/bin:$PATH
echo $(ip addr show ens192 | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
EOF

Run Configuration Generator:
./dcos_generate_config.sh
systemctl restart httpd

== Master / Slave Prerequisites ==
echo "proxy=http://192.168.1.73:3128" >> /etc/yum.conf # ONLY REQUIRED FOR DERSLLC ENVIRONMENT
yum -y install ipset tar xz unzip curl docker docker-selinux chrony&> /dev/null
yum -y upgrade &> /dev/null
systemctl start chronyd
systemctl enable chronyd
cat > /etc/chrony.conf << "EOF"
server 192.168.1.73
server 0.vmware.pool.ntp.org
server 1.vmware.pool.ntp.org
server 2.vmware.pool.ntp.org
server 3.vmware.pool.ntp.org
allow 192.168.1.0/24
EOF

systemctl restart chronyd
mkdir -p /etc/systemd/system/docker.service.d
cat > /etc/systemd/system/docker.service.d/http-proxy.conf << "EOF"
[Service]
Environment="HTTPS_PROXY=https://192.168.1.73:3128/"
Environment="HTTP_PROXY=http://192.168.1.73:3128/"
Environment="FTP_PROXY=ftp://192.168.1.73:3128/"
Environment="NO_PROXY=localhost,127.0.0.0/8,dersllc.com"
EOF

cat <<EOF | sudo tee -a /etc/sysconfig/docker
http_proxy="http://192.168.1.73:3128/"
https_proxy="https://192.168.1.73:3128/"
ftp_proxy="ftp://192.168.1.73:3128/"
no_proxy="localhost,127.0.0.0/8,dersllc.com"
EOF

sudo sed -i '/\[Service\]/a EnvironmentFile=/etc/sysconfig/docker' /usr/lib/systemd/system/docker.service
systemctl daemon-reload
systemctl restart docker
grep -q Restart=on-failure /usr/lib/systemd/system/docker.service && printf 'Restart function is already set in systemd script' || sed -i '/MountFlags=slave/aRestart=on-failure' /usr/lib/systemd/system/docker.service
systemctl daemon-reload
systemctl enable docker.service
systemctl start docker.service
systemctl disable firewalld # DCOS requires this firewall to be shut off. https://docs.mesosphere.com/1.7/administration/installing/custom/system-requirements/
systemctl stop firewalld
mkdir -p /var/{lib,log}/mesos
chown nobody /var/{lib,log}/mesos
touch /var/marathon.ip
chown /var/marathon.ip
groupadd nogroup -g 9999
groupadd docker

mkdir -p /tmp/dcos && cd /tmp/dcos
curl -s http://web-01.dersllc.com/genconf/serve/dcos_install.sh > dcos_install.sh # Change this to the Web Server hosting the Configuration

== Master Installation ==
* SSH to Master-01
# Creating installDCOS.sh script
echo "setenforce 0" > /root/installDCOS.sh
echo "sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/sysconfig/selinux" >> /root/installDCOS.sh
echo "/bin/bash /tmp/dcos/dcos_install.sh master" >> /root/installDCOS.sh
echo "mkdir -p /var/log/mesos/archive" >> /root/installDCOS.sh
echo "echo 'ENABLE_CHECK_TIME=false' >> /opt/mesosphere/environment" >> /root/installDCOS.sh
echo "curl -fLsS --retry 20 -Y 100000 -y 60 https://downloads.dcos.io/binaries/cli/linux/x86-64/dcos-1.12/dcos -o dcos" >> /root/installDCOS.sh
echo "mv dcos /usr/local/bin" >> /root/installDCOS.sh
echo "chmod +x /usr/local/bin/dcos" >> /root/installDCOS.sh
echo "dcos config set core.dcos_url http://Master-01.dersllc.com" >> /root/installDCOS.sh # Replace the IP with the IP or DNS name of your Master host 
echo "sed -i 's/"clock_sync"\:/"clock_sync1"\:/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
echo "sed -i '/"clock_sync"/d' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
echo "sed -i 's/"journald_dir_permissions",/"journald_dir_permissions"/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
echo "sed -i 's/"clock_sync1"\:/"clock_sync"\:/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
chmod 777 /root/installDCOS.sh

# Running the DCOS Installation Script (AS ROOT)
/root/installDCOS.sh

== Slave Installation ==
* SSH to Slave-01
# Creating the Install Script
echo "setenforce 0" > /root/installDCOS.sh
echo "sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/sysconfig/selinux" >> /root/installDCOS.sh
echo "/bin/bash /tmp/dcos/dcos_install.sh slave" >> /root/installDCOS.sh
echo "DCOS_CONFIG=\`grep -ir 'MESOS_HOSTNAME_LOOKUP=false' /opt/mesosphere/packages/dcos-config* | grep mesos-slave-common | cut -d ':' -f 1\`" >> /root/installDCOS.sh
echo "for i in \$DCOS_CONFIG; do sed -i 's~MESOS_HOSTNAME_LOOKUP=.*~MESOS_HOSTNAME_LOOKUP=true~' \$i; done" >> /root/installDCOS.sh
echo "rm -rf /var/lib/mesos/slave/meta/slaves/latest" >> /root/installDCOS.sh
echo "echo 'ENABLE_CHECK_TIME=false' >> /opt/mesosphere/environment" >> /root/installDCOS.sh
echo "sed -i 's/"clock_sync"\:/"clock_sync1"\:/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
echo "sed -i '/"clock_sync"/d' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
echo "sed -i 's/"journald_dir_permissions",/"journald_dir_permissions"/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
echo "sed -i 's/"clock_sync1"\:/"clock_sync"\:/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json" >> /root/installDCOS.sh
chmod 777 /root/installDCOS.sh

# Running the DCOS Installation Script (AS ROOT)
/root/installDCOS.sh

DERs

2023-06-02T19:20:17Z

Admin: Created page with "==DER's Documentation== DER's HomeLab Documentation DER's Docker Repository Setup DER's MongoDB Documentation DER's MySQL DB Documentation DER's PhotonOS Documentation DER's Docker Documentation DER's DCOS Documentation DER's 3D Printer Documentation DER's MAC Documentation DERs/Horizon|DER's..."

==DER's Documentation==
[[DERs/HomeLab|DER's HomeLab Documentation]] 

[[DERs/Harbor|DER's Docker Repository Setup]] 
[[DERs/DERS-DB|DER's MongoDB Documentation]] 
[[DERs/DERS-DB1|DER's MySQL DB Documentation]] 
[[DERs/PhotonOS|DER's PhotonOS Documentation]] 
[[DERs/Docker|DER's Docker Documentation]] 
[[DERs/DCOS|DER's DCOS Documentation]] 
[[DERs/3D|DER's 3D Printer Documentation]] 
[[DERs/MAC|DER's MAC Documentation]] 
[[DERs/Horizon|DER's Horizon Documentation]] 
[[DERs/Templates|DER's Template Documentation]] 
[[DERs/vRA|DER's vRA 8 Documentation]] 
[[DERs/K8s|DER's Kubernetes Documentation]] 

<HR>

==DREN Documentation ==
[[DREN|DREN Documentation]] 
<HR>
==DevNet Documentation ==
[[DevNet| DevNet Documentation]] 
<HR>

==TDKC Documentation ==
[[TDKC|TDKC Documentation]] 
<HR>
==VMware Documentation==
[[VMware|VMware Documentation]]

DREN/Kickstart/configFiles

2023-06-02T19:18:50Z

Admin:

==Docker.conf==
/etc/systemd/system/docker.service.d/docker.conf

[Service]
ExecStart=
ExecStart=/usr/bin/dockerd --storage-driver=overlay

==Figlet.sh==
/etc/profile.d/figlet.sh

#!/bin/bash

fontlist=( `cat /usr/share/figlet/figfonts.txt` )

num=$((($RANDOM%${#fontlist[@]})))
red='\e[0;31m'
reset='\e[0m'

if [ $EUID -ne 0 ]; then
echo 'now connected to...'
figlet -t -c -f ${fontlist[$num]} `hostname|cut -d '.' -f 1`
echo " "
else
echo -e "you are now...$red"
figlet -t -c -f ${fontlist[$num]} root
echo -e " $reset"
fi

==Sudoers.d.conf==
/etc/sudoers.d/nga-sudoers

Cmnd_Alias DOMAIN_USERS_CMD = /usr/bin/docker,\
/usr/local/bin/dcos
%domain_users ALL=(ALL) NOPASSWD: DOMAIN_USERS_CMD
james.ricker ALL=(ALL) NOPASSWD: ALL
james.ricker.adm ALL=(ALL) NOPASSWD: ALL
daniel.roessner ALL=(ALL) NOPASSWD: ALL
daniel.roessner.adm ALL=(ALL) NOPASSWD: ALL
scan_account ALL=(ALL) NOPASSWD: ALL

==Resolv.conf==
/etc/resolv.conf

####################################################
# This File is managed by SpaceWalk (RDHPWNGMP-01)
# Please Contact the following Administrators:
# Daniel Roessner
# Email: daniel.roessner.ctr@us.af.mil
# Phone: 937-522-6094
# VOIP: 570-2483
# James Ricker
# Email: james.ricker.2.ctr@us.af.mil
# Phone: 937-522-6092
# VOIP: 570-2682
####################################################
search 711hpw.afrl-wrs.hpc.mil
nameserver 140.32.191.249
nameserver 140.32.191.248
nameserver 140.32.191.247
nameserver 140.32.187.129

==SSSD.conf==
/etc/sssd/sssd.conf

[sssd]
domains = 711HPW.afrl-wrs.hpc.mil
config_file_version = 2
services = nss, pam

[domain/711HPW.afrl-wrs.hpc.mil]
enumerate = true
ad_domain = 711HPW.afrl-wrs.hpc.mil
krb5_realm = 711HPW.AFRL-WRS.HPC.MIL
realmd_tags = manages-system joined-with-samba
cache_credentials = False
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
ldap_schema = ad
use_fully_qualified_names = False
fallback_homedir = /users/%u
id_provider = ad
access_provider = ad

DREN/Kickstart/configFiles

2023-06-02T19:17:35Z

Admin:

==Docker.conf==
/etc/systemd/system/docker.service.d/docker.conf

[Service]
ExecStart=
ExecStart=/usr/bin/dockerd --storage-driver=overlay

==Figlet.sh==
==Sudoers.d.conf==
==Resolv.conf==
==SSSD.conf==

DREN/Kickstart/configFiles

2023-06-02T19:16:17Z

Admin: Created page with " Docker.conf Figlet.sh Sudoers.d.conf Resolv.conf SSSD.conf "

[[DREN/Kickstart/configFiles/docker.conf | Docker.conf]] 
[[DREN/Kickstart/configFiles/figlet.sh | Figlet.sh]] 
[[DREN/Kickstart/configFiles/nga-sudoers.conf | Sudoers.d.conf]] 
[[DREN/Kickstart/configFiles/resolv.conf | Resolv.conf]] 
[[DREN/Kickstart/configFiles/sssd.conf | SSSD.conf]]

DREN

2023-06-02T19:15:58Z

Admin: Created page with " Spacewalk Kickstart Configuration Files Spacewalk Kickstart SNIPPET Scripts Spacewalk Scripts Spacewalk PXE Scripts "

[[DREN/Kickstart/configFiles| Spacewalk Kickstart Configuration Files]] 
[[DREN/Kickstart/snippets| Spacewalk Kickstart SNIPPET Scripts]] 
[[DREN/Kickstart/scripts| Spacewalk Scripts]] 
[[DREN/Kickstart/pxe| Spacewalk PXE Scripts]]

DERs/K8s

2023-06-02T19:15:31Z

Admin: Created page with "= Kubernetes Documentation = == Force Delete Persistent Volume Claim == kubectl get pvc kubectl patch pvc <PVC_NAME> -p '{"metadata":{"finalizers": []}}' --type=merge kubectl delete pvc <PVC_NAME> == Force StorageClass to Default == kubectl patch storageclass <vk8s-storage> -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}' === Force StorageClass in vSphere 7 === https://www.pramodrane.com/vsphere-7-with-kubernetes-part-4-clo..."

= Kubernetes Documentation =
== Force Delete Persistent Volume Claim ==
kubectl get pvc
kubectl patch pvc <PVC_NAME> -p '{"metadata":{"finalizers": []}}' --type=merge
kubectl delete pvc <PVC_NAME>

== Force StorageClass to Default ==
kubectl patch storageclass <vk8s-storage> -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
=== Force StorageClass in vSphere 7 ===
https://www.pramodrane.com/vsphere-7-with-kubernetes-part-4-cloud-native-storage-with-vsphere-csi-for-persistent-volumes/

#ssh to the vCenter

#RUN THIS SCRIPT TO GET THE IP AND PWD
/usr/lib/vmware-wcp/decryptK8Pwd.py

ssh <IP from CMD above>

kubectl patch storageclass <vk8s-storage> -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

DERs/vRA

2023-06-02T19:15:12Z

Admin: Created page with "===vRA 8=== https://garyflynn.com/technology/vmware/vrealize-automation-8x-troubleshooting/"

===vRA 8===
https://garyflynn.com/technology/vmware/vrealize-automation-8x-troubleshooting/

DERs/Templates

2023-06-02T19:14:52Z

Admin: Created page with "===Centos Template w/ Cloud-Init=== yum -y update yum -y install perl cloud-init cat > /etc/cloud/cloud.cfg.d/99-custom-networking.cfg << "EOF" network: {config: disabled} EOF systemctl disable firewalld cloud-init clean init 0"

===Centos Template w/ Cloud-Init===
yum -y update
yum -y install perl cloud-init
cat > /etc/cloud/cloud.cfg.d/99-custom-networking.cfg << "EOF"
network: {config: disabled}
EOF
systemctl disable firewalld
cloud-init clean
init 0

DERs/Horizon

2023-06-02T19:14:27Z

Admin: Created page with "= DER's Horizon Documentation = === Adding a new STAR Cert to Connection Server === FROM MAC or LINUX openssl pkcs12 -export -out /Users/droessner/ownCloud/DER\'s\ Drive/DERs/SSL/31Jul2021/star.dersllc.com.pfx -inkey /Users/droessner/ownCloud/DER\'s\ Drive/DERs/SSL/31Jul2021/dersllc-new.key -in /Users/droessner/ownCloud/DER\'s\ Drive/DERs/SSL/31Jul2021/star.dersllc.com.crt Open MMC on Connection Server -> Add Certiicates Snap-In (Local Machine) -> Personal -> Import..."

= DER's Horizon Documentation =

=== Adding a new STAR Cert to Connection Server ===
FROM MAC or LINUX
openssl pkcs12 -export -out /Users/droessner/ownCloud/DER\'s\ Drive/DERs/SSL/31Jul2021/star.dersllc.com.pfx -inkey /Users/droessner/ownCloud/DER\'s\ Drive/DERs/SSL/31Jul2021/dersllc-new.key -in /Users/droessner/ownCloud/DER\'s\ Drive/DERs/SSL/31Jul2021/star.dersllc.com.crt

Open MMC on Connection Server -> Add Certiicates Snap-In (Local Machine) -> Personal -> Import the PFX file.
After Imported change the cert friendly name to "vdm" and modify the old vdm cert.

'''MAKE SURE YOU UPDATE THE THUMBPRINT IN THE UAG!!!'''

Note: This PFX file works for the UAG as well.

DERs/MAC

2023-06-02T19:14:05Z

Admin: Created page with "=MAC Documentation= ===Enter Restore Menu === During boot press: Command + R ===Get to Terminal from Restore Menu=== *Click the Utilities Tab *Terminal ===Manually set ip address from Terminal=== ipconfig set en5 DHCP ifconfig ===Keep Recovery mode from sleeping === pmset -a sleep 0 pmset -a disksleep 0 pmset -a displaysleep 0 ===Mount NFS from MacOS === mount -t nfs -o resvport 192.168.3.1:/mp3 /private/nfs === Allow Untrusted Applications === #Disable Ap..."

=MAC Documentation=

===Enter Restore Menu ===
During boot press:
Command + R

===Get to Terminal from Restore Menu===
*Click the Utilities Tab
*Terminal

===Manually set ip address from Terminal===
ipconfig set en5 DHCP
ifconfig

===Keep Recovery mode from sleeping ===
pmset -a sleep 0
pmset -a disksleep 0
pmset -a displaysleep 0

===Mount NFS from MacOS ===
mount -t nfs -o resvport 192.168.3.1:/mp3 /private/nfs

=== Allow Untrusted Applications ===
#Disable Application Checking:
#:sudo spctl --master-disable
#Install Application as usual!
#Enable Application Checking
#:sudo spctl --master-enable

DERs/3D

2023-06-02T19:13:44Z

Admin: Created page with "= DER's 3D Printer Documentation = == Current Printer Version == * ORIGINAL PRUSA I3 "MK2.5" w/ RAMBo13a ** https://www.prusa3d.com/drivers/"

= DER's 3D Printer Documentation =
== Current Printer Version ==
* ORIGINAL PRUSA I3 "MK2.5" w/ RAMBo13a
** https://www.prusa3d.com/drivers/

DERs/DCOS

2023-06-02T19:13:21Z

Admin: Created page with "= DCOS Documentation = === Disable clock-sync check on dcos-checks-poststart.service === sed -i 's/"clock_sync"\:/"clock_sync1"\:/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json sed -i '/"clock_sync"/d' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json sed -i 's/"journald_dir_permissions",/"journald_dir_permissions"/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json sed -i 's/"clock_sync1"\:/"clock_sync"\:/' /opt/mesosphere/etc/dcos-diagnostic..."

= DCOS Documentation =

=== Disable clock-sync check on dcos-checks-poststart.service ===
sed -i 's/"clock_sync"\:/"clock_sync1"\:/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json
sed -i '/"clock_sync"/d' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json
sed -i 's/"journald_dir_permissions",/"journald_dir_permissions"/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json
sed -i 's/"clock_sync1"\:/"clock_sync"\:/' /opt/mesosphere/etc/dcos-diagnostics-runner-config.json

=== Enable Chrony NTP service ===
yum install -y chrony
systemctl start chronyd
systemctl enable chronyd
cat > /etc/chrony.conf << "EOF"
server 192.168.1.73 iburst
EOF

systemctl restart chronyd
chronyc tracking
chronyc sources
chronyc sourcestats

=== Setup Proxy Server for Docker ===
mkdir -p /etc/systemd/system/docker.service.d
cat > /etc/systemd/system/docker.service.d/http-proxy.conf << "EOF"
[Service]
Environment="HTTPS_PROXY=https://192.168.1.73:3128/"
Environment="HTTP_PROXY=http://192.168.1.73:3128/"
Environment="FTP_PROXY=ftp://192.168.1.73:3128/"
Environment="NO_PROXY=localhost,127.0.0.0/8,dersllc.com"
EOF

systemctl daemon-reload
systemctl restart docker

=== Setup Proxy Server for Docker Containers ===
cat <<EOF | sudo tee -a /etc/sysconfig/docker
http_proxy="http://192.168.1.73:3128/"
https_proxy="https://192.168.1.73:3128/"
ftp_proxy="ftp://192.168.1.73:3128/"
no_proxy=<REGISTRY_IP>
EOF

sudo sed -i '/\[Service\]/a EnvironmentFile=/etc/sysconfig/docker' /usr/lib/systemd/system/docker.service
sudo systemctl daemon-reload
sudo service docker restart

DERs/Docker

2023-06-02T19:12:56Z

Admin: Created page with "== Configure Proxy Server in Docker == mkdir -p /etc/systemd/system/docker.service.d cat > /etc/systemd/system/docker.service.d/http-proxy.conf << "EOF" [Service] Environment="HTTPS_PROXY=https://192.168.1.73:3128/" Environment="HTTP_PROXY=http://192.168.1.73:3128/" Environment="FTP_PROXY=ftp://192.168.1.73:3128/" Environment="NO_PROXY=localhost,127.0.0.0/8,dersllc.com" EOF sudo systemctl daemon-reload #sudo systemctl show --property Environment docker sudo..."

== Configure Proxy Server in Docker ==
mkdir -p /etc/systemd/system/docker.service.d
cat > /etc/systemd/system/docker.service.d/http-proxy.conf << "EOF"
[Service]
Environment="HTTPS_PROXY=https://192.168.1.73:3128/"
Environment="HTTP_PROXY=http://192.168.1.73:3128/"
Environment="FTP_PROXY=ftp://192.168.1.73:3128/"
Environment="NO_PROXY=localhost,127.0.0.0/8,dersllc.com"
EOF

sudo systemctl daemon-reload
#sudo systemctl show --property Environment docker
sudo systemctl restart docker

== cloud.dersllc.com (NextCloud) ==
[[ DERs/Docker/OwnCloud_Changes | Change Log ]]
docker stop DERS-NextCloud
docker rm DERS-NextCloud

echo "Starting DERS-NextCloud Container!"
docker run -d \
--restart always \
--name DERS-NextCloud \
-v /nfs/Apps/NextCloud/html:/var/www/html \
-v /nfs/Apps/NextCloud/custom_apps:/var/www/html/custom_apps \
-v /nfs/Apps/NextCloud/config:/var/www/html/config \
-v /nfs/Apps/NextCloud/data:/var/www/html/data \
-v /nfs/Apps/NextCloud/ders_theme:/var/www/html/themes/ders_theme \
-p "10115:80" \
--privileged \
nextcloud:latest

docker exec -u www-data DERS-NextCloud php occ upgrade

Exit Maintenance Mode
go to your nextcloud folder and then open config/config.php.
search for 'maintenance' => true,
change true to false.
save your changes.
reload your web page.

== jenkins.dersllc.com (Jenkins) ==
[[ DERs/Docker/Jenkins_Changes | Change Log ]]
docker run -d \
--restart always \
--name DERS-Jenkins \
-p 8080:8080 \
-p 50000:50000 \
-v /data/DERS-Jenkins:/var/jenkins_home \
jenkins/jenkins

== gitlab.dersllc.com (Gitlab) ==
[[ DERs/Docker/Gitlab_Changes | Change Log ]]
docker run -d \
--restart always \
--name DERS-Gitlab \
-v "/data3/DERS-GitLab/config:/etc/gitlab" \
-v "/data3/DERS-GitLab/logs:/var/log/gitlab" \
-v "/data3/DERS-GitLab/data:/var/opt/gitlab" \
-p "8880:80" \
-p "8443:443" \
-p "8822:22" \
gitlab/gitlab-ce:latest

== rig.dersllc.com (ETN Miners) ==
[[ DERs/Docker/Rig_Changes | Change Log ]]
docker run -d \
--name DERS-RIG \
--restart always \
-p 85:80 \
harbor.dersllc.com/ders/ders-rig

DERs/PhotonOS

2023-06-02T19:12:35Z

Admin: Created page with "= PhotonOS = == DEFAULT PASSWORD == changeme == MANUALLY SET IP ADDRESS == cat > /etc/systemd/network/10-eth-static.network << "EOF" [Match] Name=eth0 [Network] Address=172.16.87.40/24 Gateway=172.16.87.1 DNS1=172.16.87.5 DNS2=172.16.87.1 Domains=dersllc.com EOF == RESTART NETWORK SERVICE == systemctl restart systemd-networkd == ADD MANUAL ROUTE == cat >> /etc/systemd/network/10-eth-static.network << "EOF" [Route] Gateway=172.16.87.2 Destination=19..."

= PhotonOS =
== DEFAULT PASSWORD ==
changeme

== MANUALLY SET IP ADDRESS ==
cat > /etc/systemd/network/10-eth-static.network << "EOF"
[Match]
Name=eth0

[Network]
Address=172.16.87.40/24
Gateway=172.16.87.1
DNS1=172.16.87.5
DNS2=172.16.87.1
Domains=dersllc.com
EOF

== RESTART NETWORK SERVICE ==
systemctl restart systemd-networkd

== ADD MANUAL ROUTE ==
cat >> /etc/systemd/network/10-eth-static.network << "EOF"

[Route]
Gateway=172.16.87.2
Destination=192.168.1.0/24
EOF

== MANUALLY SET DNS SERVERS ==
cat > /etc/resolv.conf << "EOF"
# Begin /etc/resolv.conf

domain dersllc.com
nameserver 172.16.87.5
nameserver 172.16.87.1

# End /etc/resolv.conf
EOF

== ALLOW DOCKER REMOTELY ==
sed -i '/ExecStart/c\ExecStart=/usr/bin/dockerd -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375' /lib/systemd/system/docker.service
systemctl enable docker
systemctl restart docker

== JOIN TO ACTIVE DIRECTORY ==
tdnf install likewise-open --refresh #(NEEDS TO BE version 6.2.11.4-4.ph2 or highier)
tdnf install openldap --refresh #(NEEDS TO BE version 2.4.44-4.ph2 or highier)

vi /etc/hosts
127.0.0.1 photon.dersllc.com photon

/opt/likewise/bin/lwregshell
cd HKEY_THIS_MACHINE\Services\lwio\Parameters\Drivers\rdr\
set_value Smb2Enabled 1
quit

/opt/likewise/bin/lwsm restart lwio
/opt/likewise/bin/domainjoin-cli join dersllc.com daniel.roessner

/opt/likewise/bin/domainjoin-cli query
/opt/likewise/bin/lw-find-user-by-name daniel.roessner@dersllc.com

/opt/likewise/bin/domainjoin-cli configure nsswitch
/opt/likewise/bin/domainjoin-cli configure pam

tdnf install sudo
vi /etc/sudoers
%DERSLLC\\vra_admins ALL=(ALL) ALL

== ALLOW PINGS ==
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT

DERs/DERS-DB1

2023-06-02T19:12:17Z

Admin: Created page with "== USERS TABLE == CREATE TABLE IF NOT EXISTS `users` ( `ID` int(11) NOT NULL AUTO_INCREMENT, `user` varchar(30), `level` varchar(2), PRIMARY KEY (`ID`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=12 ; INSERT INTO users (user, level) VALUES('admin', 'CL'); INSERT INTO users (user, level) VALUES('pbuser', 'CL');"

== USERS TABLE ==
CREATE TABLE IF NOT EXISTS `users` (
`ID` int(11) NOT NULL AUTO_INCREMENT,
`user` varchar(30),
`level` varchar(2),
PRIMARY KEY (`ID`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=12 ;
INSERT INTO users (user, level) VALUES('admin', 'CL');
INSERT INTO users (user, level) VALUES('pbuser', 'CL');

DERs/DERS-DB

2023-06-02T19:11:53Z

Admin: Created page with "== Database Setup == cat <<EOF> /etc/yum.repos.d/mongodb.repo [mongodb] name=MongoDB Repository baseurl=http://downloads-distro.mongodb.org/repo/redhat/os/x86_64/ gpgcheck=0 enabled=1 EOF yum -y install mongodb-org mongodb-org-server firewall-cmd --add-port 27017/tcp firewall-cmd --add-port 27017/tcp --permanent sed -i 's~bind_ip=127.0.0.1~#bind_ip=127.0.0.1~' /etc/mongod.conf systemctl enable mongod systemctl start mongod systemctl restart mongod == Creat..."

== Database Setup ==
cat <<EOF> /etc/yum.repos.d/mongodb.repo
[mongodb]
name=MongoDB Repository
baseurl=http://downloads-distro.mongodb.org/repo/redhat/os/x86_64/
gpgcheck=0
enabled=1
EOF
yum -y install mongodb-org mongodb-org-server
firewall-cmd --add-port 27017/tcp
firewall-cmd --add-port 27017/tcp --permanent
sed -i 's~bind_ip=127.0.0.1~#bind_ip=127.0.0.1~' /etc/mongod.conf
systemctl enable mongod
systemctl start mongod
systemctl restart mongod

== Create Multiple new PB Users ==
sed -i 's~auth=true~#auth=true~' /etc/mongod.conf
systemctl restart mongod
mongo
db.createUser( { "user": "admin", "pwd": "****", "roles": [ "readWrite", "dbAdmin" ] } )
use dersworkout
db.createUser( { "user": "p1user", "pwd": "****", "customData": { "level": "P1" }, "roles": [ "read" ] } )
db.createUser( { "user": "p2user", "pwd": "****", "customData": { "level": "P2" }, "roles": [ "read" ] } )
db.createUser( { "user": "p3user", "pwd": "****", "customData": { "level": "P3" }, "roles": [ "read" ] } )
db.createUser( { "user": "p4user", "pwd": "****", "customData": { "level": "P4" }, "roles": [ "read" ] } )
db.createUser( { "user": "admin", "pwd": "****", "roles": [ "readWrite" ] } )
var users = [ {user: "p1user", level: "P1"},{user: "p2user", level: "P2"},{user: "p3user", level: "P3"},{user: "p4user", level: "P4"},{user: "admin", level: "P4"}];
db.users.insert(users)
quit()
sed -i 's~#auth=true~auth=true~' /etc/mongod.conf
systemctl restart mongod

== Create new PB Users ==
sed -i 's~auth=true~#auth=true~' /etc/mongod.conf
systemctl restart mongod
mongo
use dersworkout
db.createUser( { "user": "pbuser", "pwd": "****", "customData": { "level": "CL" }, "roles": [ "read" ] } )
db.users.insert({user: "pbuser", level: "CL"})
quit()
sed -i 's~#auth=true~auth=true~' /etc/mongod.conf
systemctl restart mongod

== Show list of Collections ==
mongo
use dersworkout
db.auth('admin', '*****')
show collections
quit()

== Display a Collection ==
mongo
use dersworkout
db.auth('admin', '*****')
db.users.find()
db.PB2017Q3.find()
quit()

== Change Users Passwords ==
mongo
use dersworkout
db.auth('admin', '*****')
db.changeUserPassword("p1user", "*****")
quit()

== Drop a Collection ==
sed -i 's~auth=true~#auth=true~' /etc/mongod.conf
systemctl restart mongod
mongo
use dersworkout
db.PB2015Q2.drop()
quit()
sed -i 's~#auth=true~auth=true~' /etc/mongod.conf
systemctl restart mongod

DERs/Harbor

2023-06-02T19:11:26Z

Admin: Created page with "= VIC.DERSLLC.COM = == Setup Repo Certs == # Download ca.crt from https://vic.dersllc.com:8282/#/administration/configuration # Post it to cloud.dersllc.com and share it publicly yum -y install ca-certificates update-ca-trust force-enable wget http://cloud.dersllc.com/index.php/s/YrqISnQvIHqZCwz/download -O /etc/pki/ca-trust/source/anchors/vic-ca.crt update-ca-trust extract update-ca-trust mkdir -p /root/.docker wget http://cloud.dersllc.com/index.php/s/lepRsqY..."

= VIC.DERSLLC.COM =
== Setup Repo Certs ==
# Download ca.crt from https://vic.dersllc.com:8282/#/administration/configuration
# Post it to cloud.dersllc.com and share it publicly

yum -y install ca-certificates
update-ca-trust force-enable
wget http://cloud.dersllc.com/index.php/s/YrqISnQvIHqZCwz/download -O /etc/pki/ca-trust/source/anchors/vic-ca.crt
update-ca-trust extract
update-ca-trust

mkdir -p /root/.docker
wget http://cloud.dersllc.com/index.php/s/lepRsqYTS86yTIc/download -O /root/.docker/config.json
systemctl restart docker

docker login vic.dersllc.com
#
#Username: administrator@vsphere.local
#Password: <vsphere password>

= DER's Harbor Install =
cd ~
wget https://storage.googleapis.com/harbor-releases/harbor-online-installer-v1.3.0-rc4.tgz
tar -xzvf harbor-online-installer-v1.3.0-rc4.tgz

cd harbor
wget https://github.com/docker/compose/releases/download/1.18.0/docker-compose-Linux-x86_64
ln -s /harbor/docker-compose-Linux-x86_64 /bin/docker-compose
mkdir -p /data/cert
wget http://time.dersllc.com/ders-star.crt -O /data/cert/server.crt
wget http://time.dersllc.com/ders-star.key -O /data/cert/server.key

vi harbor.cfg

./install.sh

= DER's Docker Repo Setup =
wget --no-check-certificate https://time.dersllc.com/ca.crt -O /etc/pki/ca-trust/source/anchors/cacert.cer
update-ca-trust
systemctl restart docker
docker login https://vic.dersllc.com

echo 'DOCKER_OPTS="--insecure-registry vic.dersllc.com"' > /etc/default/docker
wget --no-check-certificate https://time.dersllc.com/ca.crt -O /etc/docker/certs.d/vic.dersllc.com/ca.crt
systemctl restart docker
docker login vic.dersllc.com

tdnf -y install wget
mkdir -p /etc/docker/certs.d/docker.dersllc.com/
wget --no-check-certificate https://time.dersllc.com/ders-ca.crt -O /etc/docker/certs.d/docker.dersllc.com/ders-ca.crt
systemctl restart docker
docker login docker.dersllc.com

mkdir -p /etc/docker/certs.d/harbor.dersllc.com/
wget --no-check-certificate https://time.dersllc.com/ders-ca.crt -O /etc/docker/certs.d/harbor.dersllc.com/ders-ca.crt
systemctl restart docker
docker login harbor.dersllc.com

= VCH Deploy =

==Get Thumbprint==
ssh vcsa.dersllc.com
openssl x509 -in /etc/vmware-vpx/ssl/rui.crt -fingerprint -sha1 -noout

./vic/vic-machine-linux create --no-tlsverify --target 192.168.87.85 --user administrator@vsphere.local --password ****** --name ders-vch1 --public-network /Beavercreek/network/Public --bridge-network /Beavercreek/network/Bridge --compute-resource /Beavercreek/host/HP/Resources --image-store DERS-FILE --insecure-registry 192.168.87.90:443 --thumbprint 8B:0C:4B:59:C6:E2:82:2E:1C:A5:7F:CE:E2:87:D8:A1:14:43:81:95 --volume-store 'DERS-FILE'/volumes:default --registry-ca="./ca.crt"

DERs/HomeLab

2023-06-02T19:11:02Z

Admin: Created page with "= DER's Home Lab Documentation = == harbor-aws.dersllc.com == === SSH to Harbor-AWS === #On Plex ssh -i ~/.ssh/aws-keypair.pem ec2-user@ec2-54-91-52-46.compute-1.amazonaws.com === Install Harbor-AWS === mkdir /data cd /data curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /data/ders-star-chain.crt curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt >> /data/ders-star-chain.crt cp /da..."

= DER's Home Lab Documentation =
== harbor-aws.dersllc.com ==
=== SSH to Harbor-AWS ===
#On Plex
ssh -i ~/.ssh/aws-keypair.pem ec2-user@ec2-54-91-52-46.compute-1.amazonaws.com

=== Install Harbor-AWS ===
mkdir /data
cd /data
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/STAR_dersllc_com.crt > /data/ders-star-chain.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt >> /data/ders-star-chain.crt
cp /data/ders-star-chain.crt /data/ders-star-chain.pem
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/AddTrustExternalCARoot.crt > /data/ders-ca.crt
cat /data/ders-ca.crt >> /etc/pki/tls/certs/ca-bundle.crt
curl https://ders-gitlab.dersllc.com/ders/ders-proxy/-/raw/master/dersllc-new.key > /data/ders-star.key

yum -y install docker
service docker start
systemctl enable docker

wget https://github.com/docker/compose/releases/download/v2.18.1/docker-compose-linux-x86_64 -O /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
wget https://github.com/goharbor/harbor/releases/download/v2.8.1/harbor-offline-installer-v2.8.1.tgz
tar -zxvf harbor-offline-installer-v2.8.1.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
vi harbor.yml
# add Hostname and certs and location
#### harbor-aws.dersllc.com
#### /data/ders-star-chain.crt
#### /data/ders-star.key
#### /data/harbor-data

./install.sh --with-trivy --with-notary

DCOS/Install

2023-06-02T19:10:39Z

VMware/VHA

2023-06-02T19:10:04Z

Admin: Created page with "= Health Analyzer = ===Vault Link=== https://vault.vmware.com/group/vault-main-library/healthanalyzer ===Registration Link=== https://pstoolhub.vmware.com/ === Registration Code for 5.4 === Registration Key: WG88IS9LJFA1KNYWUV Registration E-mail: droessner@vmware.com ===Support Information=== services-software-support@vmware.com = Issues and Fixes = ==Fails to collect Data from vCenter== ===Issue=== Unable to get progress information. See application logs for mor..."

= Health Analyzer =
===Vault Link===
https://vault.vmware.com/group/vault-main-library/healthanalyzer
===Registration Link===
https://pstoolhub.vmware.com/
=== Registration Code for 5.4 ===
Registration Key: WG88IS9LJFA1KNYWUV
Registration E-mail: droessner@vmware.com
===Support Information===
services-software-support@vmware.com

= Issues and Fixes =
==Fails to collect Data from vCenter==
===Issue===
Unable to get progress information. See application logs for more information. (Version 5.4)
===Fix===
In general vHA tool is very memory hungry when analyzing big projects. You will need to increase the amount of RAM for the tool (if this is possible)

Please follow this guide:

If you use java version -

For java app 64-bit JRE is recommended for large environments
To change the amount of memory using the Java application
1. Stop the VMware HealthAnalyzer Java application.
2. Go to the directory where the VMware HealthAnalyzer Java application was unzipped.
3. Open <vhalocation>/resources/applicationContext.xml using a Text Editor (Notepad++ like app)
4. App Server: Locate vha-start section and change the value of Xmx1024m to Xmx2048m, and XX:MaxPermSize=256M to XX:MaxPermSize=512M
<util:map id="vha-start" map-class="java.util.LinkedHashMap">
<entry key="java" value="" />
<entry key="-Xmx2048m" value="" />
<entry key="-XX:MaxPermSize=512M" value="" />

5. DB Server: Locate basex-start section and change the value of Xmx1280m to Xmx2048m. Notice there is a new line added as well.

<util:map id="basex-start" map-class="java.util.LinkedHashMap">
<entry key="java" value="" />
<entry key="-Xmx2048m" value="" />
<entry key="-XX:MaxPermSize=512M" value="" /> #new line

6. Start the VMware HealthAnalyzer Java application.

-----------------------------------------

To change the amount of Tomcat memory with a virtual appliance
1. Log in to the virtual appliance using the user root and password vmware.
2. Open the configuration file using vi or another text editor:
vi /usr/share/vha/tomcat/conf/vha-tomcat-memory
3. Locate the default value of 2048 and change it to your desired value. This is the amount of memory allocated to Tomcat in megabytes.
4. To change the amount of database memory with a virtual appliance You have to edit basexserver configuration file
/usr/share/vha/basex/bin/basexserver
# Options for virtual machine
VM=-Xmx2048m - change this to amount memory you have and want
5. Restart the appliance with the following command:
shutdown –r now
6. You can confirm that the memory value changed by issuing the following command and reviewing the argument –Xmx .
ps –ef | grep catalina and ps -ef | grep -i basex
Default virtual appliance memory size is 1.5GB so it must be increased as well.

If this did not work I have deployed one vHA instance in our vCenter with 8G for tomcat and 8G for database. You can access it on the following URL:

http://10.26.226.213/vha/HealthAnalyzer.html#!explore
(you must be in VMware VPN/network)
You can use it as long as needed. Please let me know when You finish. Thank You

Best regards,
Anton Sabev
Support Engineer, Field Tools
sabeva@vmware.com

VMware/Horizon

2023-06-02T19:09:47Z

Admin: Created page with "= Horizon = = Issues and Fixes = == Lotus Notes causes a Busy Cursor and not going away == ===Issue=== Lotus notes inside of the app stack or installed directly on the parent causes a busy cursor that does not go away. This may also only happen on the Blast client on high resolution clients. ===Fix=== Modify the pool and enable "3D Rendering" and set it to "Auto". Then set the Video RAM (ex. 128). In the blast client set the preference to "Low Resolution Mode"."

= Horizon =
= Issues and Fixes =

== Lotus Notes causes a Busy Cursor and not going away ==
===Issue===
Lotus notes inside of the app stack or installed directly on the parent causes a busy cursor that does not go away. This may also only happen on the Blast client on high resolution clients.
===Fix===
Modify the pool and enable "3D Rendering" and set it to "Auto". Then set the Video RAM (ex. 128). In the blast client set the preference to "Low Resolution Mode".

VMware/ESXi

2023-06-02T19:09:25Z

Admin: Created page with "= ESXi = = Issues and Fixes = ==HPE Proliant G7 Servers and vSphere 6.5 Purple Screen of Death== ===Issue=== PSOD: PF Exception 14 in world 67667:sfcb-smx IP 0x0 addr 0x0 ===Fix=== https://www.virtualmvp.com/hpe-proliant-g7-servers-and-vsphere-6-5-purple-screen-of-death/ == NSX-T Filling up Scratch space == ===Fix=== * SSH as root to ESXi Server and run the following commands: chmod +t /etc/rc.local echo "" >> /etc/rc.local echo "chmod +t /etc/vmware/nsx-ops..."

= ESXi =
= Issues and Fixes =
==HPE Proliant G7 Servers and vSphere 6.5 Purple Screen of Death==
===Issue===
PSOD: PF Exception 14 in world 67667:sfcb-smx IP 0x0 addr 0x0

===Fix===
https://www.virtualmvp.com/hpe-proliant-g7-servers-and-vsphere-6-5-purple-screen-of-death/

== NSX-T Filling up Scratch space ==
===Fix===
* SSH as root to ESXi Server and run the following commands:

chmod +t /etc/rc.local

echo "" >> /etc/rc.local

echo "chmod +t /etc/vmware/nsx-opsagent/nsx-opsAgent.xml" >> /etc/rc.local

echo "sed -i 's/<max_size>40 MiB<\/max_size>/<max_size>40 MiB<\/max_size>/' /etc/vmware/nsx-opsagent/nsx-opsAgent.xml" >> /etc/rc.local

echo "sed -i 's/<max_files>2<\/max_files>/<max_files>2<\/max_files>/' /etc/vmware/nsx-opsagent/nsx-opsAgent.xml" >> /etc/rc.local

echo "sed -i 's/<max_size>20 MiB<\/max_size>/<max_size>40 MiB<\/max_size>/' /etc/vmware/nsx-opsagent/nsx-opsAgent.xml" >> /etc/rc.local

echo "chmod -t /etc/vmware/nsx-opsagent/nsx-opsAgent.xml" >> /etc/rc.local

echo "/etc/init.d/nsx-opsagent restart" >> /etc/rc.local

chmod -t /etc/rc.local

/etc/rc.local

VMware/GITLAB

2023-06-02T19:09:03Z

Admin: Created page with "= Setting up GITLAB with SSO = 1. vi /etc/gitlab/gitlab.rb gitlab_rails['omniauth_enabled'] = true gitlab_rails['omniauth_allow_single_sign_on'] = ['saml'] gitlab_rails['omniauth_sync_email_from_provider'] = 'saml' gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml'] gitlab_rails['omniauth_sync_profile_attributes'] = ['email'] gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml' gitlab_rails['omniauth_block_auto_created_users'] = false #gitlab_r..."

= Setting up GITLAB with SSO =
1. vi /etc/gitlab/gitlab.rb
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
gitlab_rails['omniauth_block_auto_created_users'] = false
#gitlab_rails['omniauth_auto_link_ldap_user'] = true
gitlab_rails['omniauth_auto_link_saml_user'] = true
#gitlab_rails['omniauth_external_providers'] = ['twitter', 'google_oauth2']
#gitlab_rails['omniauth_allow_bypass_two_factor'] = ['google_oauth2']
gitlab_rails['omniauth_providers'] = [
{
"name" => "saml",
"args" => {
assertion_consumer_service_url: 'https://gitlab.dersllc.com/users/auth/saml/callback',
idp_cert: '-----BEGIN CERTIFICATE-----
MIIEDTCCAnWgAwIBAgIFX8pgs88wDQYJKoZIhvcNAQELBQAwPzEgMB4GA1UEAwwX
Vk13YXJlIElkZW50aXR5IE1hbmFnZXIxDjAMBgNVBAoMBUxPR0lOMQswCQYDVQQG
EwJVUzAeFw0yMDA3MDgwMDMzMDBaFw0zMDA3MDYwMDMzMDBaMD8xIDAeBgNVBAMM
F1ZNd2FyZSBJZGVudGl0eSBNYW5hZ2VyMQ4wDAYDVQQKDAVMT0dJTjELMAkGA1UE
BhMCVVMwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCu3PrucCHvTQhQ
+g/dd3t6rNwnCsq7EEZQLgj+kv3yVaBTUvlnmxALR0jR+oHKtg3/ZRvX2R82zUyW
LSe3rtxyg9iQx/0oFXjIaK65/f1KsQWrHW4knXfwf/81k1sx14DVFoF953w7jKOf
N9lcOMEnWD6Oi9tF1hQ/5imW1359uL0DzOVD+OOd94fkhU+yNmH6Ag+D+YTcKUt8
pdkiYLw0vMqVAU6Qh47SJrd5p2HogcibxLPm4SCJ5efui1lEWjZ3MhrKrikc5ghv
4AuCbt16QADHXIo+xWgpULM1LR6uDYPkELSJXqL9ME16B640u5V82U8co1JdBxe7
80pXCRky5gIP7iefefqaY5UpZUmr9AhCzMzZ0H17h1F52mIyOD83ZbonNqnCcSWB
fWL/cHt7siCMvuj9OVgzHDoDrHVOCoyMJrI6jBYvTmx4kMYaycRdNdFUlcle87L6
KCGqi4Nj/NOnkJ3hnSiJdbqZhGpbBRDUqsPexWoZtrUBTtybDe8CAwEAAaMQMA4w
DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAYEAdDeWzbXO7TAtOi42HAZK
MW02hzqH1DbIghb0rmRQPpQmAEb5lxVW/Ly9M+HJEjiSqW8NZKdBBEtQYb5Uzuy0
StNIrRTDZ5u1z0B8PbY4Jh7JVaxHWOLF3PU9r26NkRIV6ze4J+J1PuPbriZ+iWyM
fU68tLee8E2Nru0FJ58ArZ+9OsREJ6ym9ic2URDqFedNncJlXhDbteiAIcxZU+JO
C5zWOGsXUvIz76azxjC1rT1R+zkB7JwoTDHYIczQu2tHjiXmNyIdw98Ykc0B4o03
2in+EqQwNli23A3MtMz2SCCoqGVyJB+kQb/DYxKqq3JEizOJ9nitxuneHoHaf/EL
wnXW6KagH+Ag60E1XKnf/T3qURmL4/gJTfHln9h68X/cYrGS/+1tjson1GFpzDGe
dBVmEA4UiiOObeKUywIWitaNazwpvjhg+2QZX3lCW8cm0d2FN5QxVBFscc7wsbim
3x6WNVCqYPZgcWzo1WDw9uhNnI5nTXIgdSwo9PyGvAVC
-----END CERTIFICATE-----',
idp_sso_target_url: 'https://login.dersllc.com/SAAS/auth/federation/sso',
issuer: 'ders-gitlab',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
},
label: 'DERs Login'
}
]

* Go to vIDM administrative Console
* Go to Catalog Tab -> Web Apps
* Click the Settings Button.
* Go to the SAML Metadata Tab.
* Copy the Signing Certificate and paste it in the idp_cert section of the gitlab.rb file.
* Click the Identity Provider (IdP) metadata Link.
* Find the following location in the metadata
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://login.dersllc.com/SAAS/auth/federation/sso"/>
* Copy the Location URL: https://login.dersllc.com/SAAS/auth/federation/sso and paste it in the idp_sso_target_url section of the gitlab.rb file.
* Set the Issuer as a friendly name for your gitlab sevrer.
* set the assertion_consumer_service_url to 'https://<gitlab_URL>/users/auth/saml/callback'
* Set the label as a friendly name for the button on the sign-on page.
* Save and Exit the gitlab.rb file.
* Run the reconfigure command.
gitlab-ctl reconfigure
* After this is complete. Go back to the vIDM Administrative Console.
* Go to Catalog Tab -> Web Apps
* Click the New button.
* Create a name for the App and click next.
* make sure the Authentication Type is set to SAML 2.0
* On the gitlab server run the following to get the metadata xml for the gitlab server.
curl --insecure https://gitlab.dersllc.com/users/auth/saml/metadata
* Copy the output and paste it into the URL/XML: section of the new app form.
* Click Next and Save & Assign.
* Assign users to the App and attempt to login!

VMware/Converter

2023-06-02T19:08:39Z

Admin: Created page with "= vCenter Converter Standalone = == Installing vCenter Converter Standalone == == Troubleshooting Errors == === After the Conversion === '''Error:''' error: can't find command ':' '''Solution:''' 1. Boot the server 2. Login as Root 3. run the following command: sed -i 's/:\ #/#/g' /boot/grub2/grub.cfg '''Reference:''' https://communities.vmware.com/thread/590670 === Before the Conversion === '''Error:''' unable to query the live source machine '''Solution..."

= vCenter Converter Standalone =
== Installing vCenter Converter Standalone ==
== Troubleshooting Errors ==
=== After the Conversion ===
'''Error:'''
error: can't find command ':'
'''Solution:'''
1. Boot the server
2. Login as Root
3. run the following command:
sed -i 's/:\ #/#/g' /boot/grub2/grub.cfg
'''Reference:'''
https://communities.vmware.com/thread/590670

=== Before the Conversion ===
'''Error:'''
unable to query the live source machine
'''Solution:'''
1. Make sure you do not have any drives double mounted.
2. Also Turn off Docker.
systemctl stop docker
'''Reference:'''
https://community.spiceworks.com/topic/2209325-unable-to-query-the-live-source-machine-in-p2v-convert
https://communities.vmware.com/thread/597168

------------------------------------------------------------------------------------------------------
'''Error:'''
Unable to find supported boot loader
'''Solution:'''

'''Reference:'''
https://communities.vmware.com/thread/520440
https://www.rit.edu/researchcomputing/instructions/Clearing-the-known_hosts-SSH-File
---------------------------------------------------
== Reference Documentation ==
https://kb.vmware.com/s/article/1010056

https://kb.vmware.com/s/article/1004588

https://kb.vmware.com/s/article/1010633

VMware/FedContacts

2023-06-02T19:08:19Z

Admin: Created page with "= Federal Contacts = == Education == Richard Covel"

= Federal Contacts =
== Education ==
Richard Covel

VMware/vIDM

2023-06-02T19:07:51Z

Admin: Created page with "===Configure ADFS and vIDM === https://jadijkstra.nl/2017/12/12/vmware-idm-3-0-with-adfs-3-0-single-sign-on-to-portal-configuration/"

===Configure ADFS and vIDM ===
https://jadijkstra.nl/2017/12/12/vmware-idm-3-0-with-adfs-3-0-single-sign-on-to-portal-configuration/

VMware/PowerCLI Scripts

2023-06-02T19:07:28Z

Admin: Created page with "=PowerCLI Scripts= ===PowerCLI on MAC=== *Install Docker engine https://docs.docker.com/docker-for-mac/install/ https://docs.docker.com/engine/installation/linux/docker-ce/centos/ *Pull the powerclicore container docker pull vmware/powerclicore *Run the powerclicore container docker run --rm -it vmware/powerclicore ===Find the Total number of Virtual CPU's per vCenter Server=== Connect-VIServer -Server <VCENTER_SERVER> -Protocol https -User <ADMIN_USER> -Password..."

=PowerCLI Scripts=

===PowerCLI on MAC===
*Install Docker engine
https://docs.docker.com/docker-for-mac/install/
https://docs.docker.com/engine/installation/linux/docker-ce/centos/
*Pull the powerclicore container
docker pull vmware/powerclicore
*Run the powerclicore container
docker run --rm -it vmware/powerclicore

===Find the Total number of Virtual CPU's per vCenter Server===
Connect-VIServer -Server <VCENTER_SERVER> -Protocol https -User <ADMIN_USER> -Password <PASS>
$Total_vCPU = 0
ForEach ($VM in (Get-VM)){
If (($VM).PowerState -eq "PoweredOn"){
$Total_vCPU += ($VM).NumCpu
}
}
Write-Host “Total number of Virtual CPU’s: “$Total_vCPU

===Find the Total number of Physical CPU's per vCenter Server===
Connect-VIServer -Server <VCENTER_SERVER> -Protocol https -User <ADMIN_USER> -Password <PASS>
$Total_pCPU = 0
ForEach ($VMHOST in (Get-VMHOST)){
If (($VMHOST).PowerState -eq "PoweredOn"){
$Total_pCPU += ($VMHOST).NumCpu
}
}
Write-Host “Total number of Physical CPU’s: “$Total_pCPU

VMware/Product Contacts

2023-06-02T19:07:02Z

Admin: Created page with "= App Defense = Not Urgent: * appdefense-help@vmware.com * https://vmware-com.socialcast.com/groups/310417-appdefense Urgent: * Chris Corde, Sr. Director Product Management, ccorde@vmware.com * Vijay Ganti, Director Product Management, vganti@vmware.com = Wavefront = Not Urgent: * wavefront@vmware.com * https://vmware-com.socialcast.com/groups/187508-wavefrontgroup Urgent: * Bill Roth, Director, Demand Gen Marketing, broth@vmware.com, (650) 427-5756"

= App Defense =
Not Urgent:
* appdefense-help@vmware.com
* https://vmware-com.socialcast.com/groups/310417-appdefense
Urgent:
* Chris Corde, Sr. Director Product Management, ccorde@vmware.com
* Vijay Ganti, Director Product Management, vganti@vmware.com

= Wavefront =
Not Urgent:
* wavefront@vmware.com
* https://vmware-com.socialcast.com/groups/187508-wavefrontgroup
Urgent:
* Bill Roth, Director, Demand Gen Marketing, broth@vmware.com, (650) 427-5756

VMware/Contacts

2023-06-02T19:06:35Z

Admin: Created page with "= Product Specialists = ==== vSphere Certificates ==== * Sujish Suresh Kumar (GSS)(India) === vRealize Automation=== * Chris Kuum (Broomfield TSE) * Arash Rakeen (Broomfield TSE Premier Services) Helpful!!! * Adnan Bhatti (Cork TSE) * Sean Jones * David Stockland ==== Licensing ==== *Krista Squires (IB Services)(Austin, TX) *Ameena Sultana (GSS)(India) *Jose Garcia Rojas License Escalations Rep *EPP (Tokens) Manager jdangi@vmware.com Goes by JD *EPP (Tokens) Worker Be..."

= Product Specialists =
==== vSphere Certificates ====
* Sujish Suresh Kumar (GSS)(India)
=== vRealize Automation===
* Chris Kuum (Broomfield TSE)
* Arash Rakeen (Broomfield TSE Premier Services) Helpful!!!
* Adnan Bhatti (Cork TSE)
* Sean Jones
* David Stockland

==== Licensing ====
*Krista Squires (IB Services)(Austin, TX)
*Ameena Sultana (GSS)(India)
*Jose Garcia Rojas License Escalations Rep
*EPP (Tokens) Manager jdangi@vmware.com Goes by JD
*EPP (Tokens) Worker Bee shandigund@vmware.com

*SPP@vmware.com, HPP@vmware.com, EPP@vmware.com are aliases for anything license related. Just like there is a support-escalations alias for hot SR's I just found out we have a similar alias for licensing issues. licensing-escalations@vmware.com

====vRealize Business for Cloud Advanced====
*Jay Weber (TSE Broomfield)
*Mandip Gill (TSE Broomfield)
====vCloud Director====
*Dave Achten (Todd Hansz equivalent for vCD)
*Zach Brown (Good Dude)
*Tommy Lightfoot

====vRealize Life Cycle Manager====
*Jimmy Alvarez (Worthless but Tech Marketing POC)
*Jay Weber (TSE Broomfield)
====Networking====
*Kiwi Ssennyonjo (TSE Home Office Canada)
*Daniel Backhaus
====NSX====
*Todd Hansz (Broomfield EE) (NSX God)
*Daryl Marcus (Broomfield Staff EE)
*Jeff Wholey (Broomfield EE)
*Andrew George (Broomfield TSE)
====HCX====
*Brian McGhie (Broomfield TSE)
*Daryl Allen (Broomfield TSE)
*Jamey Holbrook (Atlanta HCX SE)

====Network Insight====
*Trey Tyler
==== vRealize Operations ====
*Neeraj Gandhi (PSO)(Maryland)
*Kyle Pittman
*Kelly Bryan
*Kyle Jett

==== EUC ====
*Jason Misleh (TAM)(Michigan)
*Bob Johnston (TAM)(Michigan)
*Scott McDermott (TSE Broomfield)
====Orchestrator====
*Justin Dowe (TSE Broomfield)
*Galina Kostova (Product Manager)
*Adam Frost (Really knows his shit)

====Site Recovery Manager-vSphere Replication====
*Corey Cogan (TSE Broomfield)
*Stephen Van Siclen
*Thomas Simpson

====vSphere Integrated Containers====
*Jonathan Wilk (Cork Senior TSE)
*Melissa O-Sullivan (Cork Senior TSE)
*Daniel Cerne (Cork Senior TSE)

====Update Manager====
*Don Bessee (TSE Broomfield)
*Andrew Stiff (TSE Broomfield)
====vSAN====
*Jesse Horne (TSE Broomfield) Rock Star
====Sys-Ops====
*Chris Griffis
*Matt Griffin
*Keenan Matheny (TSE Broomfield) Rock Star

*From Global Connect use gss.vmware.com as search engine for problems....better than ikb.vmware.com.
====SDK Support====
*Duncan Upton

====GS Lightning-SalesForce Administration Support=====
*Ramesh Anthati

====WS1 Support====
*Aimee Goncalves

= GSS Managers =
* Bambie Ransdell (Broomfield)
* Sudipta Chakraborty (India)
* Timothy Reimer (Broomfield Weekend Duty Manager) Solid Dude
* Megan Coppin (Leads America Premier Support)
* Victor Perez (Director....Leads Escalations with Engineering-Broomfield)
* Paul Walsh (EMEA REM)
* Kalidas Chakravarthy G (APJ REM)
* Solomon Fadese (AMER REM)
* Paul Clark (REM and over Seal Team 6 SA's)
* Seena Rehman (REM)

VMware/ovftool

2023-06-02T19:06:15Z

Admin: Created page with "= Build OVFTOOL Docker = == 1. Download OVFTOOL from My VMware == == 2. Create Dockerfile == FROM ubuntu:20.04 LABEL MAINTAINER "Daniel Roessner" # Suppress warning about UTF-8 ENV LC_CTYPE=POSIX ENV OVFTOOL_FILENAME=VMware-ovftool-4.4.2-17901668-lin.x86_64.bundle ADD $OVFTOOL_FILENAME /tmp/ WORKDIR /root RUN /bin/sh /tmp/$OVFTOOL_FILENAME --console --required --eulas-agreed && \ rm -f /tmp/$OVFTOOL_FILENAME ENTRYPOINT ["ovftool"] == 3. Build t..."

= Build OVFTOOL Docker =

== 1. Download OVFTOOL from My VMware ==

== 2. Create Dockerfile ==
FROM ubuntu:20.04
LABEL MAINTAINER "Daniel Roessner"

# Suppress warning about UTF-8
ENV LC_CTYPE=POSIX
ENV OVFTOOL_FILENAME=VMware-ovftool-4.4.2-17901668-lin.x86_64.bundle

ADD $OVFTOOL_FILENAME /tmp/

WORKDIR /root

RUN /bin/sh /tmp/$OVFTOOL_FILENAME --console --required --eulas-agreed && \
rm -f /tmp/$OVFTOOL_FILENAME

ENTRYPOINT ["ovftool"]

== 3. Build the Container ==

#ON PLEX SERVER
cd /nfs/Download
mkdir ovftool
cd ovftool
mv ../VMware-ovftool-4.4.2-17901668-lin.x86_64.bundle .
vi Dockerfile
docker build -t harbor.dersllc.com/ders/ovftool:4.4.2 -t harbor.dersllc.com/ders/ovftool:latest .
docker push harbor.dersllc.com/ders/ovftool:4.4.2
docker push harbor.dersllc.com/ders/ovftool:latest

== 4. Run Container ==
cd /nfs/DERs_Drive/Scripts/nested_vsphere_8/
docker run --rm -it -v $(pwd):/tmp harbor.dersllc.com/ders/ovftool:latest --schemaValidate /tmp/Nested_ESXi8.0a_Appliance_Template_v1.ova

VMware/vSphereNested

2023-06-02T19:05:38Z

Admin: Created page with "https://williamlam.com/nested-virtualization/nested-esxi-virtual-appliance"

https://williamlam.com/nested-virtualization/nested-esxi-virtual-appliance

VMware/k8s

2023-06-02T19:05:15Z

Admin: Created page with "= General Kubernetes Documentation = == Setup Artifactory Proxy to GCR == https://jfrog.com/knowledge-base/artifactory-how-to-proxy-a-google-container-registry-gcr/#:~:text=ARTIFACTORY%3A%20How%20to%20proxy%20a%20Google%20Container%20Registry%20(GCR)%3F,-Elina%20Floim&text=Google%20offers%20the%20https%3A%2F%2F,according%20to%20the%20needed%20endpoint.&text=Click%20on%20%E2%80%9CADD%20KEY%E2%80%9D%2C,file%20in%20an%20accessible%20location. == Setup GCR.IO Registry == 1..."

= General Kubernetes Documentation =
== Setup Artifactory Proxy to GCR ==
https://jfrog.com/knowledge-base/artifactory-how-to-proxy-a-google-container-registry-gcr/#:~:text=ARTIFACTORY%3A%20How%20to%20proxy%20a%20Google%20Container%20Registry%20(GCR)%3F,-Elina%20Floim&text=Google%20offers%20the%20https%3A%2F%2F,according%20to%20the%20needed%20endpoint.&text=Click%20on%20%E2%80%9CADD%20KEY%E2%80%9D%2C,file%20in%20an%20accessible%20location.

== Setup GCR.IO Registry ==
1. Enable Google Container Registry

2. Setup Service Account via IAM Console. https://console.cloud.google.com/iam-admin/serviceaccounts 
3. Create a Key for the Service Account (JSON) and download the JSON file. 
4. Transfer the JSON file to the JUMPBOX. 
5. Log into GCR via docker.
docker login -u _json_key --password-stdin https://gcr.io < {{highlight|keyfile.json}}
6. Push image to GCR.IO
docker pull gcr.io/kuar-demo/kuard-amd64:blue
docker tag gcr.io/kuar-demo/kuard-amd64:blue gcr.io/{{highlight|<GCR PROJECT>}}/kuard:latest
docker push gcr.io/{{highlight|<GCR PROJECT>}}/kuard:latest
7. Create docker Registry Secret
kubectl create secret docker-registry gcr-json-key \
--docker-server=gcr.io \
--docker-username=_json_key \
--docker-password="$(cat ~/{{highlight|keyfile.json}})" \
--docker-email={{highlight|<valid-email>}}
8. Set Default K8s Service Account to use the registry secret
kubectl patch serviceaccount default \
-p '{"imagePullSecrets": [{"name": "gcr-json-key"}]}'
9. Create the KUARD deployment YAML
cat <<EOF > kuard-deployment-gcr.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: kuard-deployment
labels:
app: kuard
spec:
replicas: 3
selector:
matchLabels:
app: kuard
template:
metadata:
labels:
app: kuard
spec:
imagePullSecrets:
- name: regcred
containers:
- image: gcr.io/{{highlight|<GCR PROJECT>}}/kuard:latest
name: kuard
ports:
- containerPort: 8080
name: http
---
apiVersion: v1
kind: Service
metadata:
name: kuard-service
spec:
type: LoadBalancer
selector:
app: kuard
ports:
- port: 80
targetPort: 8080
EOF
10. Deploy the KUARD Deployment.
kubectl apply -f kuard-deployment-gcr.yaml
11. Check that the containers are up and running.
kubectl get pods
12. Get the External Service IP that will be hosting KUARD.
kubectl get service kuard-service
13. Test that you can access the KUARD URL from a Web Browser
http://{{highlight|<EXTERNAL-IP>}}