Service Desk Knowledgebase: Scratch space

Return to the Service Desk Knowledgebase SERVICE PORTFOLIO

Help Desk Scratch Space

Common case of setting up a new machine

Requires insertion into https://wiki.cam.ac.uk/cl-sys-admin/Service_Desk_Knowledgebase:_Resources#New_arrivals when the appropriate steps for machines other than Linux OS are defined.

There is a ticklist of steps to ensure a lab system is setup and documented correctly at http://www.wiki.cl.cam.ac.uk/rowiki/SysInfo/MachineSetup whose Table of Contents can be used as an aide-memoire to check that everything has been done, or by going into the text itself, to see what needs to be done.

The common case of a new machine called '$HOST' for user '$CRSID' is run through below. To be able to run the commands which use $HOST & '$CRSID' , you can set the shell environment variables. So for a machine called "foo" with an assigned user with the CRSid of "spqr1" , run:

HOST=foo
CRSID=spqr1

Essentially the HelpDesk sets some things up, asks oper to do their bit, and when the Helpdesk is told that it is done, test it and finish off the job.

• 2.1 Gather info - first thing: collect all the information required using the RT ticket, such as the machine name, the subdomain (i.e. 'special' subnet, such as the Security Group, DTG or SRG experimental networks (if any)), VLAN, assigned user, etc. Check that the RT Subject: line contains the user's '$CRSID' and the '$HOST' , e.g. "2015/10 RS Christopher Bryant cjb255 kit albacore"
• 2.2 DNS - pre use if needed (e.g. Linux): create an entry in the DNS for the machine on the correct subnet, with the appriorate subdomain (if any), and any BMC. Include a TXT RR with the owner and the RT ticket number. BMCs on the same VLAN as the host (typically user workstations using iAMT) should have the same name as host, with a -bmc suffix, but if using the BMC subnet (typically servers with dedicated BMC NICs) they should be on the BMC VLAN in the .bmc subdomain. If a 'same VLAN' BMC is in a subdomain, create a DNS alias for the BMC in the root domain. On the Managed Linux subnet, the top half of the subnet is used for the BMCs, with the address being in the class C which is 8 larger. Some subnets (e.g. SRG) have 'port blocked' CIDR blocks for BMCs, so look to see where other BMCs are. Thus a standard machine might be

foo         IN      A       128.232.65.83
            IN      TXT     "pb22 RT#12345"
...
foo-bmc     IN      A       128.232.73.83

while a machine on the security subnet might be

foo.sec     IN      A       128.232.18.83
            IN      TXT     "pb22 RT#12345"
foo-bmc.sec IN      A       128.232.18.84
foo-bmc     IN      CNAME   foo-bmc.sec

To update the dns for $HOST (change vi to ed, pico, etc as preferred), install and test it, on an omnipotent server:

cd /global/src/etc/named
co -l src/cl.data
vi src/cl.data
ci -u src/cl.data
make install
host $HOST dns0

• 3 Machine install: tell the operators which equipment to use (some way to identify it, DNS name, where it is, who the assigned user is, what its Inventory Number is, etc) and the info listed below if they need it:
  • 3.0 Inventory - pre use if using DHCP (Windows) <Done by a Computer Lab CO>: create or update the Inventory information, telling them any equipment details which are not already on the Inventory (e.g. "PC WoC ASUS 1150 Q87M-E i5-4670 32GB"), name, PO number, supplier, owner, user, RT ticket number and any other info for the 'comment', print off and stick on a label
  • 3.1 Network setup <Done by Oper>: tell them the office, desk, floorbox and VLAN to use
  • 3.2 BMC BIOS setup - if present <Done by Oper>: tell them if there is a BMC
  • 3.3 OS install <Done by Oper>: tell them to do a 'standard Linux install'
  • 3.4 Wiring database - once physically installed <Done by Oper>: check that the wiring info is up to date
  • 3.5 Info & Ticket <Done by Oper>: The oper will confirm the Inventory number and the 'old' name of the system used before returning the RT to the Sysadmin queue.
• 4 Return to above and update the information - once the OS has been installed:
  • 2.2 DNS - pre use if needed (e.g. Linux) - names and addresses are assigned, but once 3.3 is done, update TXT RR
  • 3.0 Inventory - pre use if using DHCP (Windows) <Done by a Computer Lab CO> - once 3.3 is done, put RT# in comment, set user and office
• 4.0 keytab install (Linux): Ensure $HOST has a keytab. If the command below fails, create a new keytab <Contact gt19 is necessary>. Login to $HOST (this will probably need to be done from laira using 'sudo ssh $HOST', if the host doesn't have a keytab) and run:

cl-onserver --keytab

---

Check if below is already in the Post-install instructions at https://wiki.cam.ac.uk/cl-sys-admin/Service_Desk_Knowledgebase:_Resources#New_arrivals

• 4.1 User Admin - when running if needed (Linux): If Oper were not told the 'assigned user', then SSH to the machine $HOST and set it's assigned user by running:

cl-asuser cl-hostid-fix --user '$CRSID' -a

• 4.2 Arrivals - when done: update https://dbwebserver.ad.cl.cam.ac.uk/SCG/Equipment/PhDArrivals.aspx or https://dbwebserver.ad.cl.cam.ac.uk/SCG/Visitors/VisitorStatus.aspx (depending on whether a PhD Arrival or not) and update RT ticket to include machine name ($HOST) in ticket Subject:
• 4.3 Tell the user - when done: Send a final 'standard email' to user. The email might be along the lines of:

The machine mentioned in the Subject: line has now been re-installed for you and should be ready to use.
When you arrive on October 5th, Please login and check that the basics work, i.e. that you can login, access the web, and send email.
If not, please reply to this ticket, which will re-open it, and we will try to sort the problem.

If you have other requests, please do NOT reply to this ticket, but instead open a new ticket, and mention this one.

Now may be a good time to look again at
http://www.wiki.cl.cam.ac.uk/rowiki/SysInfo/BedtimeReading
and the pages to which it points.

• 4.5 hosts.props - at leisure: All machines should be added to hosts.props in /global/src/usr.lib. The format is somewhat overwhelming, so it may be easiest to copy a similar existing entry (note that they are sorted alphabetically). You can find a basic HW spec of the machine $HOST (e.g. backus for a Q87M-E system), and then type that string in place of $type to see which others machines are similar. If there are no other matches, try removing words from the end of $type to look for more generic information. If there is no useful match, email sys-admin asking for help. When a suitable machine '$from' has been found, clone its information. So for $HOST, try

type=$(/anfs/repl/etc/wtfi -S CL_Equipment-raw -q -f Equipment -w $$HOST)
echo trying type=\"$type\"
/anfs/repl/etc/wtfi -S CL_Equipment-raw -q -f name "$type" | sort -u
# set from to be a suitable host, e.g.: from=backus
/global/src/usr.lib/hosts.props-add.pl $from $HOST

• 4.6 ssh_known_hosts - at leisure if needed (Linux): when the machine is running, on a different machine run:

/global/src/usr.bin/ssh/fetch-host-key scan $HOST

• 4.7 BMC ACL - when up if present: check that the user has BMC credentials in /homes/$CRSID/.amtpw, then from a Computer Lab machine, open a browser to the BMC (typically http://$HOST-bmc.cl.cam.ac.uk:16992) login as user admin, delete any previous assigned user, and add the new one with all privileges. The command to setup credentials on an omnipotent server is:

/usr/groups/netmaint/setamt $CRSid

• 4.8 ownfiles - at leisure if needed (Linux): to ensure that ownfiles data is collected, run:

(umask 2; touch /usr/groups/linux/ownfiles/CKSUM/$HOST)

• 4.9 Wake on LAN (WoL) - at leisure: to ensure that Wake on Lan (WoL) is available, on an omnipotent server run:

/usr/groups/netmaint/boot_wol_file-add.pl $HOST

• Check that the RS or "Visitors" work queue has the task "completed" in the first case, or "OK" in the second (also adding the Inventory number and name of the PC after, e.g. "OK #16200 ouse")
• Resolve the RT ticket.

Connecting to the Lab from a remote computer outside the CUDN

(Based on RT Ticket #96190

First setup a VPN to the University. The generic VPN service is documented by the UIS at https://www.ucs.cam.ac.uk/vpn/ where you will find detailed information for making connections from a variety of client systems. This is the preferred VPN service to use.

The way to get into a computer on the Computer Lab network depends on what OS you are running.

---

From Windows:

You need to install both PuTTY and Pageant from http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html There is a downloadable .ZIP file containing all the binaries (except PuTTYtel), and also the help files

Generate a new public and private keypair by following the instructions at http://www.cl.cam.ac.uk/local/sys/microsoft/putty/#keysetup-windows

With the VPN is setup and running you should then use Remote Desktop Connection to login to a Computer Lab windows terminal server (e.g. ts01.ad.cl.cam.ac.uk) over the VPN.

Use Start>All Programs>Accessories>Notepad to edit the following to include your personal CRSid: \\filer\userfiles\CRSid\unix_home\.ssh and copy the resulting string.

Open windows exlorer with Start>Computer. Click in the "Breadcrumb Bar" at the top of the Explorer window and use Ctrl+V to paste in your edited string. \\filer\userfiles\CRSid\unix_home\.ssh then press the Enter key.

Double-click the file authorized_keys and select Notepad to open it for editing.

Edit authorized_keys to add the new public key with an apppropraite from field e.g.

from="*.cam.ac.uk" ssh-rsa AABAB3NzaC1yc2EAAAABJQAAAIB/OVp4Ql8gNsD52sXXn2u1Ucc2DQ6r2GG5KEf2NdigJhN/CYSbcLt5pu/twZEW6egEuWcmELJAaorBBT/evigksBla+zEkNqaaiY7SWL2cpFK8+1oo2OakYSqF40FmjJQNz/5TLOC1e+87WhJlGMZJTOAgbSN98zWNMBH6ocz+aw== rsa-key-20141217

and save the file.

(See http://www.cl.cam.ac.uk/local/sys/ssh/index.html for more information)

You should then be able to connect from your remote computer using PuTTY and SSH to a computer on the Computer Lab network such as slogin-serv.cl.cam.ac.uk.

See http://www.cl.cam.ac.uk/local/sys/microsoft/putty/ for PuTTY configuration details

---

For Mac or Linux:

Once the VPN is setup and running, if you have a Mac or Linux box or if running some Cygwin variant under windows you could just do:

kinit CRSid@AD.CL.CAM.AC.UK

then

ssh -K sandy@cl.cam.ac.uk

cd /home/CRSid/.ssh

ssh-keygen -t rsa

view id_rsa.pub

copy the contents

pico authorized_keys

and then edit in the new public key in the following format:

from="*.cam.ac.uk" ssh-rsa AABAB3NzaC1yc2EAAAABJQAAAIB/OVp4Ql8gNsD52sXXn2u1Ucc2DQ6r2GG5KEf2NdigJhN/CYSbcLt5pu/twZEW6egEuWcmELJAaorBBT/evigksBla+zEkNqaaiY7SWL2cpFK8+1oo2OakYSqF40FmjJQNz/5TLOC1e+87WhJlGMZJTOAgbSN98zWNMBH6ocz+aw== rsa-key-20141217

and save the file.

You should then be able to easily connect from your remote computer using SSH to a computer on the Computer Lab network such as slogin-serv.cl.cam.ac.uk.

---