System Administrator Documentation

Mediawiki Installation Procedures

Build a Centos 7 Server
Set Selinux to Permissive and allow port 80 through the firewall:

sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
setenforce 0
firewall-cmd --add-port 80/tcp
firewall-cmd --add-port 80/tcp --permanent

Install EPEL Repository:

yum install -y epel-release

Install Required Packages:

yum install -y mediawiki mariadb-server php-mysql

Enable and Turn on Services:

systemctl enable httpd
systemctl enable mariadb
systemctl start httpd
systemctl start mariadb

Configure Mariadb:

mysql
create database wiki;
GRANT ALL PRIVILEGES ON wiki.* to 'wiki'@'localhost' IDENTIFIED BY '<password>';
exit

Edit the /etc/httpd/conf.d/mediawiki123.conf to look like:

 Alias /mw-config               /var/www/mediawiki123/mw-config

 Alias /index.php           /var/www/mediawiki123/index.php
 Alias /api.php             /var/www/mediawiki123/api.php
 Alias /load.php            /var/www/mediawiki123/load.php
 Alias /opensearch_desc.php /var/www/mediawiki123/opensearch_desc.php
 Alias /skins               /var/www/mediawiki123/skins
 Alias /images              /var/www/mediawiki123/images
 Alias /                     /var/www/mediawiki123/index.php

<Directory /var/www/mediawiki123>
  Options FollowSymLinks
</Directory>

Restart the httpd service and go http://wiki.tdkc.com/mw-config to configure the Site.
- Click Continue.
- Click Continue.
- Select the MySQL radio button.
- Set the Database Name to wiki.
- Set the Database Username to wiki.
- Set the Database Password.
- Click Continue.
- Click Continue.
- Set the Wiki Name to TDKC Wiki.
- Set the Administrator Username to admin.
- Set the Administrator Password and Confirm it.
- Set the Administrator E-mail to [email protected].
- Select the Ask me more questions radio button.
- Click Continue.
- Select the Authorized Editors Only radio button.
- Check all of the Extensions.
- Check Enable File Uploads .
- Check Enable Instant Commons
- Click Continue.
Download the LocalSettings.php and place it at /var/www/mediawiki123/LocalSettings.php on the wiki server.
After the install comment the mw-config line in the /etc/httpd/conf.d/mediawiki123.conf:

 #Alias /mw-config               /var/www/mediawiki123/mw-config

Restart httpd and go to http://wiki.tdkc.com

Disable Account Creation for everyon but admins

Edit the LocalSettings.php file and add the following to the bottom.

$wgGroupPermissions['*']['createaccount'] = false;

LDAP Integration

Install required Software

yum -y install php-ldap
systemctl restart httpd

Allow httpd to make network calls

setsebool -P httpd_can_network_connect on

Get Latest Plugin for your Version of MediaWiki

https://www.mediawiki.org/wiki/Extension:LDAP_Authentication

Download Snapshot and copy tar file to the wiki server

tar -zxvf <tar> -C /var/www/mediawiki123/extensions/

Add the following to the /var/www/mediawiki123/LocalSettings.php file

#LDAP Settings
require_once "extensions/LdapAuthentication/LdapAuthentication.php";
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDomainNames = array("TDKC");
$wgLDAPServerNames = array("TDKC" => "<IP>");
$wgLDAPEncryptionType = array("TDKC" => "clear");
$wgLDAPUseLocal = true;
$wgMinimalPasswordLength = 1;
$wgLDAPBaseDNs = array("TDKC" => "dc=tdkc,dc=com");
$wgLDAPSearchAttributes = array("TDKC" => "sAMAccountName");
$wgLDAPRetrievePrefs = array("TDKC" => true);
$wgLDAPPreferences = array("TDKC" => array("email" => "mail", "realname"  => "displayname"));
$wgLDAPProxyAgent = array("TDKC" => "[email protected]");
$wgLDAPProxyAgentPassword = array("TDKC" => "<PASS>");

Restricting Wiki Pages

Get Latest Plugin for your Version of MediaWiki

https://www.mediawiki.org/wiki/Extension:AccessControl

Download Snapshot and copy tar file to the wiki server

tar -zxvf <tar> -C /var/www/mediawiki123/extensions/

Add the following to the /var/www/mediawiki123/LocalSettings.php file

require_once "$IP/extensions/AccessControl/AccessControl.php";
$wgAdminCanReadAll = true;
$wgAccessControlRedirect = false;

Add the below tag to the top of each page you want restricted:

<accesscontrol>Administrators</accesscontrol>

Add / Remove users to the Administrators Group
- Go to Special Pages
- User Right Management
- Enter the username you wish to add/remove
- Check or Uncheck the administrator box
- Click Save user groups

Note: You may need to do this as the admin user.

Customizing the Logo

Copy the logo to the wiki server and replace the /var/www/mediawiki123/skins/common/images/wiki.png file:

mv /var/www/mediawiki123/skins/common/images/wiki.png /var/www/mediawiki123/skins/common/images/wiki.png.old
mv /tmp/logo.png /var/www/mediawiki123/skins/common/images/wiki.png

Refresh the Webpage

Spacewalk Installation Procedures

Build a Centos 7 Server
Set Selinux to Permissive and allow port 80 through the firewall:

sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
setenforce 0
firewall-cmd --add-port 80/tcp
firewall-cmd --add-port 80/tcp --permanent
firewall-cmd --add-port 443/tcp
firewall-cmd --add-port 443/tcp --permanent

Install the Required Server Repositories:

# Spacewalk Server Repository
rpm -Uvh http://yum.spacewalkproject.org/2.3/RHEL/7/x86_64/spacewalk-repo-2.3-4.el7.noarch.rpm

# JPackage Repository
cat <<EOF> /etc/yum.repos.d/jpackage-generic.repo
[jpackage-generic]
name=JPackage generic
mirrorlist=http://www.jpackage.org/mirrorlist.php?dist=generic&type=free&release=5.0
enabled=1
gpgcheck=1
gpgkey=http://www.jpackage.org/jpackage.asc
EOF

Install The Spacewalk Database:

yum -y install spacewalk-setup-postgresql

Install Spacewalk:

yum -y install spacewalk-postgresql
# EPEL Repository
yum -y install epel-release

Spacewalk Configuration

Basic Configuration

Start the installation wizard:

spacewalk-setup --disconnected

Answer the questions:

Admin Email Address? [email protected]

Should setup configure apache's default ssl server for you (saves original ssl.conf) [Y]? Y

CA certificate password? <pass>
Re-enter CA certificate password? <pass>
Organization? TDKC
Organization Unit? IT
Email Address [[email protected]]? [email protected]
City? Fairborn
State? OH
Country code (Examples: "US", "JP", "IN", or type "?" to see a list)? US

Cobbler requires tftp and xinetd services be turned on for PXE provisioning functionality. Enable these services [Y]? Y

On complete, start the Spacewalk service if not started automatically.

/usr/sbin/spacewalk-service start

Go to https://spacewalk.tdkc.com and create an admin account

File:Spacewalk1.png

Changing the Spacewalk Logo

Resize the TDKC logo to 44px wide
Change spacewalk logo to TDKC:

mv /var/www/html/img/logo_vendor.png /var/www/html/img/logo_vendor.png.old
mv /tmp/logo.png /var/www/html/img/logo_vendor.png

Creating Software Channels

Base Channels

Go to the Channels Tab.
Click the Manage Software Channels Tab on the Left Menu.
Click the Create Channel Button.
Fill out the form.

Channel Name: CentOS 7
Channel Label: centos-7
Parent Channel: None
Architecture: x86_64
Yum Repository Checksum Type: sha512
Channel Summary: CentOS Base Channel
Channel Description: CentOS Base Channel

Click Create Channel.
Repeat the above steps for each needed Base Channel

Sub Channels

Go to the Channels Tab.
Click the Manage Software Channels Tab on the Left Menu.
Click the Create Channel Button.
Fill out the form.

Channel Name: CentOS 7 Updates
Channel Label: centos-7-updates
Parent Channel: CentOS 7
Architecture: x86_64
Yum Repository Checksum Type: sha512
Channel Summary: CentOS 7 Updates Sub Channel
Channel Description: CentOS 7 Updates Sub Channel

Click Create Channel.
Repeat the above steps for each needed Sub Channel

Syncing Software Channels

SSH to the spacewalk server
Create a scripts directory

mkdir -p /usr/share/rhn/scripts

Create a file called reposync.sh

vi /usr/share/rhn/scripts/reposync.sh

mkdir -p /var/log/scripts/
date > /var/log/scripts/spacewalk-repo-sync.log
echo ##################################################### >> /var/log/scripts/spacewalk-repo-sync.log
CENT7LATEST=`curl --silent http://mirror.centos.org/centos/ | grep folder | grep ">7\." | cut -d '"' -f 8 | cut -d '/' -f 1 | sort -g | tail -1`
 
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/os/x86_64/ -c centos-7  >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/extras/x86_64/ -c centos-7-extras  >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://mirror.centos.org/centos/$CENT7LATEST/updates/x86_64/ -c centos-7-updates >> /var/log/scripts/spacewalk-repo-sync.log
spacewalk-repo-sync -u http://dl.fedoraproject.org/pub/epel/7/x86_64/ -c centos-7-epel >> /var/log/scripts/spacewalk-repo-sync.log 
spacewalk-repo-sync -u http://yum.spacewalkproject.org/latest-client/RHEL/7/x86_64/ -c centos-7-spacewalk-client  >> /var/log/scripts/spacewalk-repo-sync.log

chmod -R 777 /var/satellite/redhat/1/ 
echo #################################################### >> /var/log/scripts/spacewalk-repo-sync.log
date >> /var/log/scripts/spacewalk-repo-sync.log

Change permissions to the reposync.sh file

chmod 755 /usr/share/rhn/scripts/reposync.sh

To run it manually simply use the following command:

/usr/share/rhn/scripts/reposync.sh

To schedule the script use cron as root:

crontab -e

Add the following line to the crontab: (This will run the script once a week on sunday morning at 00:01)

1 0 * * 0 /usr/share/rhn/scripts/reposync.sh

This script is logged at /var/log/scripts/spacewalk-repo-sync.log

Creating System Groups

Go to the Systems Tab.
Click the System Groups Tab on the Left Menu.
Click the Create Group Button.
Fill out the form.

Name: Centos 7 Servers
Description: Centos 7 Servers

Repeat for all of the groups you wish to create.

Creating Configuration Channels

These are groups of configuration files that are managed by spacewalk. These files can be pushed to the servers that are subscribed to the channel.

Go to the Configuration Tab.
Click the Configuration Channels Tab on the Left Menu.
Click the Create Config Channel Button.
Fill out the form.

Name: Centos 7 Servers
Label: centos-7-config
Description: Centos 7 Servers

Click the Add Files Tab and add any configuration files you wish.

Note: These can be added at anytime.
Note: These files can be pulled to each server that is subscribed, by running the command rhncfg-client get

Repeat for all of the channels you wish to create.

Creating Activation Keys

These are used during kickstarts to join the spacewalk server. They are also use to assign kickstarted machines to the appropriate System Groups, Software Channels, Configuration Channels and more.

Go to the Systems Tab.
Click the Activation Keys Tab on the Left Menu.
Click the Create Key Button.
Fill out the form.

Description: Centos 7 Servers
Key: centos-7-key
Base Channel: CentOS 7
Check Provisioning

Under the Child Channels tab add all desired Software channels by pressing ctrl and clicking each channel you wish.
Then click the Update Key button.
Under the Packages Tab, add all of the software packages you wish to install at spacewalk registration time.
Then click the Update Key button.
Under the Configuration Tab and the Subscribe Channels Sub-Tab, add all of the configuration channels you wish the servers be added to.
Then click the Update Key button.
Under the Groups Tab and the Join sub-tab, check the groups you wish the activation key to add the server to.
Then click the Join Selected Group button.

Joining Existing Servers

Spacewalk Setup

Create a Repository file on the spacewalk server

mkdir -p /var/www/html/pub/repo_files/
vi /var/www/html/pub/repo_files/centos7.repo

[local-centos-7]
name=local-centos-7
baseurl=http://spacewalk.tdkc.com/ks/dist/org/1/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-updates]
name=local-centos-7-updates
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-updates/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-extras]
name=local-centos-7-extras
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-extras/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-spacewalk-client]
name=local-centos-7-spacewalk-client
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-spacewalk-client/centos-7-latest
enabled=1
gpgcheck=0

[local-centos-7-epel]
name=local-centos-7-epel
baseurl=http://spacewalk.tdkc.com/ks/dist/child/centos-7-epel/centos-7-latest
enabled=1
gpgcheck=0