8.3 KiB
Installing a Debian 8 Guest on the Arrcus SJC Ganeti Cluster
For this example, I will use the vm/host name build6.sjc.arrcus.com on the San Jose office cluster. Modify to suit your needs.
Before I start the install, I put the new host in the DNS so that it has time to propagate.
Create the VM and do the Debian install
I cheat and use a script.
vm0.sjc.arrcus.com:/root# ./do-add vm1 16 4 build6.sjc.arrcus.com
Thu Nov 15 16:23:29 2018 * disk 0, size 16.0G
Thu Nov 15 16:23:29 2018 * creating instance disks...
Thu Nov 15 16:23:30 2018 adding instance build6.sjc.arrcus.com to cluster config
Thu Nov 15 16:23:30 2018 adding disks to cluster config
Thu Nov 15 16:23:31 2018 - INFO: Waiting for instance build6.sjc.arrcus.com to sync disks
Thu Nov 15 16:23:31 2018 - INFO: Instance build6.sjc.arrcus.com's disks are in sync
Thu Nov 15 16:23:31 2018 - INFO: Waiting for instance build6.sjc.arrcus.com to sync disks
Thu Nov 15 16:23:31 2018 - INFO: Instance build6.sjc.arrcus.com's disks are in sync
Find the VNC console of the new VM
gnt-instance info build6.sjc.arrcus.com | grep console
console connection: vnc to 127.0.0.1:11012 (node vm1.sjc.arrcus.com) (display 5112)
serial_console: default (True)
Remember that 11012 for VNC.
Spin up the VM but boot from the Debian install CD-ROM
gnt-instance start -H boot_order=cdrom,cdrom_image_path=/ISOs/debian-8.9.0-amd64-netinst.iso build6.sjc.arrcus.com
From your local host, go for the VNC concole over a nice safe ssh tunnel. Tunnel to vm1.sjc.arrcus.com because that is where the instance lives. The ssh tunnel means you are relatively safe doing passwords etc over the wire.
$ ssh -N -L 5900:127.0.0.1:11012 vm1.sjc.arrcus.com
On my local host, a Mac, I start a VNC client (I use Chicken of the VNC) to localhost, port 5900, display 0, with the password of vnc on the target ganeti cluster.
Do the Debian install over the VNC GUI. The options I choose are:
-
US English and US keyboard. This means I am not offered the UTC timezone option and have to set it manually later. But it sets the
/etc/apt/sources.listto the US servers. -
I would like to manually set the IP address, but the Deb8 install seems be dhcp only.
-
Use the entire disk.
-
OpenSSH server as well as the standard system utilities. Not the desktop stuff. No print server.
-
Install the GRUB boot loader so that you can make serial console work. You may have to select /dev/vda.
Reboot the VM
The installation completes, and the darn thing reboots the CD-ROM. So get brutal, and back on the VM node I
gnt-instance reboot --shutdown-timeout=3 build6.sjc.arrcus.com
This usually whacks my VNC session, so I have to restart the client.
Because it forced DHCP, you'll have to stay with the VNC session and set up networking as below.
Set Up Networking
Manually set up /etc/network/interfaces
auto eth0
iface eth0 inet static
address 10.9.42.48/16
gateway 10.9.1.1
dns-nameserver 10.9.101.207
dns-nameserver 127.0.0.1
dns-search arrcus.com sjc.arrcus.com
And reboot to get the config
First Configuration
Now we can actually ssh into the machine ssh build6.sjc.arrcus.com.
As we're he first thing is set the password to something nasty.
Then I su to root so I can make things easier for myself.
I set root's password to something nasty so that I can get in over the serial console if things get wedged during operation.
Customize VM
If it does not run Emacs, it is not a computer. And install unbound so we have a local nameserver, and ntpd so we have a local chime. We will do detailed configuration of unbound and chrony later.
apt install emacs-nox unbound chrony rsync sudo screen
chown -R unbound:unbound /etc/unbound/
ack /etc/sudoers to make it passwordless for members of the sudo group.
%sudo ALL=(ALL) NOPASSWD: SETENV: ALL
Add the initial user to /etc/group in group sudo
usermod -a -G sudo randy
I want to disable ssh passwording as soon as reasonable, so I install randy's ssh credentials.
cd ~randy
mkdir .ssh
chmod 700 .ssh
cat > .ssh/authorized_keys << EOF
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID9DzOVboz/9daQwQRPkxD/D4PZ4ZVNgMLqd+zc79Gl+ randy@ryuu.psg.com
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAww1WTCBezBK1snfUKi1LAwIIvQEQuhgV63toCMnTrYZfkp9/jyI1WVmKf4FIiodJWWeUtjCkt2E7t0oPZ7BxNbP8bn6HTso8qTexng8kM23UCgdzorp0ofatO0esdIdbuXd8qu9uJRlJn1TwVYeY7qY10eF60CbSZawuwSsM0iq0EbKTJQkHBtytd1zC7a7geGfieR4D3sHB9b33YhUgP9b1EO+CYtS8Qbb8xbMboD1eIB0UH0jcSUVZvb2DRtnsyIVQioW6zaAbIbFz7x+5zJBsFjkDvjR/80atOvNYJTyYZRD71D3kBu2peYup2XrsTPvrsKh5hJCVlJFCuFQaNQ== randy@psg.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8yvE/UBwHdLVDk708/U81ZQdtDLF9Y7grMkVBfUoclF4BGFCcH1bIv6y0p1I/2PATSRnK/B5ndvWP/SrQ6y0DqnQugHKoFMR3idkzVagjjXOhcZkpitcp5hRCdjn/y/88QEiIKItEM66q48nW0OtCgcq7ENXQuYUVt0e6kh6UKRDfrPP3i2D7m8o3/W+xYt8QkYZ0iFanCfhxHAP7w3SOezmThu+p7V6yxVcy+G0WTvPHrs2JlgSaI+4SoJ2btPgqIrmKu1ILfyoAr9/RjSVHr74LijsdUKec7OXnKnV2v1VfMRglBXFgXVaWyX/adA2tMuh9nMk3Y3a3+xDqPIz6RnzQAupqUmPZ/1qbFIrVSNmhygWTC9jgemaNNC/B1nFG7em6m+fmxKjauuWoIdpybaofWiJElUDBBT4bHU+L8NF7zbNROt1GtaDnbL4W9/asqzPu+aJy7L6uJQHtkc/eoXsheajztFC9I5qxW/29ja+FcQsVoDJpe96XmBtJ7elOGXaq3YtDRURwrdu9fGUBDWqwP1IFECVkeVh/NrXbQRHtgp4v533D+0MubA+hDhVTsUk6G93WLyX3usUprU1cJjyhrVzZ9U23eCPOj8J18Ixw4sJFuNeUhSCaN6j+rmOyGor3PYYysKTp1VfLNAYdcc/AYC0jDy9mYjjfCDwKfQ== randy@ryuu.psg.com
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2qXA3uRFGv7Q0yolQtC5bcF7kVW94c/aOhf0xbU3i8 randy@kappa.local
EOF
chmod 600 .ssh/authorized_keys
chown -R randy:randy .
Copy the ssh authority to the root account
rsync -vlpPStgoHxr ~randy/.ssh ~root
chown -R root:root ~root/.ssh
Disallow plaintext password logins by editing /etc/ssh/sshd_config as
root
# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
PasswordAuthentication no
Take the new sshd config
service ssh restart
I want my standard dot files, so I go to a recently customized Debian system and rsync them over.
rsync -vlpPStgoHx .bashrc .emacs .exrc .forward .inputrc build6.sjc.arrcus.com:
ssh randy@build6.sjc.arrcus.com chown -R randy:randy .
And a bit of decoration from the other system
rsync -vlpPStgoHx /usr/bin/xtitle root@build6.sjc.arrcus.com:/usr/bin/xtitle
Configure GRUB and the Network
Configure GRUB for
- longer timeout
- serial console
- use ntp not kvm clock
- make the base ether eth0 instead of ens5
Edit /etc/default/grub
GRUB_TIMEOUT=6
...
GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,9600n8 no-kvmclock"
...
GRUB_TERMINAL="console serial"
GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"
And remember to update GRUB
update-grub
Last Cosmetics Before Reboot
There is a hidden DNS service inside the firewall, which you will want unbound to know. So copy the file over and restart unbound
rsync server207.sjc.arrcus.com:/etc/unbound/unbound.conf.d/stubs.conf /etc/unbound/unbound.conf.d/
service unbound restart
Edit /etc/hostname to fill out the full FQDN.
Set the timezone. All my servers are in UTC
dpkg-reconfigure tzdata
I still have the VNC console open, so it would be a good time to reboot and watch for problems. I could tell the VM to reboot, or whack it from the Ganeti master. To ensure it is really clean, I do the latter. I do not force the timeout so I can ensure that APCI works.
gnt-instance reboot build6.sjc.arrcus.com
Use Ansible to Install and Configure a Bunch of Things
Now the barrage of ansible, which for me is based on my Mac laptop.
ansible-playbook -l build6.sjc.arrcus.com no-depends.yml snmpd.yml syslog-ng.yml unattended-upgrades.yml
Make Amol's Account
build6.sjc.arrcus.com:/root# adduser amol
Adding user `amol' ...
Adding new group `amol' (1001) ...
Adding new user `amol' (1001) with group `amol' ...
Creating home directory `/home/amol' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for amol
Enter the new value, or press ENTER for the default
Full Name []: Amol Iyer
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n]
Then get his ssh key
rsyr build1.sjc.arrcus.com:/home/amol/.ssh /
And let him sudo
usermod -a -G sudo amol
2018.11.16