Editing Archive (section)

=Lab Server Configuration=
This is for administration info for the server "mike".

==Maintenance and Administration==

===Administration Tools===

Most administration tasks for mik.kin can be performed with the Server Admin tool installed remotely on any Mac.  This is available on the DVD that came with mighty-mac.  I believe that it is also a free download from Apple, but I don't have a link for it.

For managing users, you need the Workgroup Manager tool, which is typically installed along with the Server Admin tool.

A few things require a command line, in which case you can ssh to mike.kin .

Finally, if neither the Server Admin tool nor a command line is sufficient, you can use vnc (Screen Sharing) to log in remotely.  From any mac, from the Finder choose Go -> Connect To Server and enter vnc://mike.kin.ucalgary.ca .  vnc is not mac-specific, and in principle you could use a vnc client on some other kind of system.


===Manual Backups===

mike.kin is using TimeMachine for automated backups.  We also do occasional manual backups with an external hard drive that goes into a drawer.  I've written a little script the updates the manual backup.  To run it, connect the backup drive and run this command:

 sudo /usr/local/bin/backup-drawer

This will mirror the contents of /Volumes/Data0 , /Library/WebServer and /Library/Subversion to the external drive.

==Installation==

===Configure External Drives as Concatenated Disk Set===

Start Disk Utility.

Select the volume that will be the first in the set and choose "Erase".  Make sure that the Format is set to Mac OS Extended (Journaled).  I named it backup0.

Select backup0 and click the RAID tab.  Set the name to backup and the RAID type to Concatenated Disk Set.  Drag backup0 to the box and click "Enable".

===Subversion===

====Create a Subversion repository====

Since Snow Leopard already has Subversion, no software installation is required.

 sudo mkdir -p /Library/Subversion/Repository
 sudo svnadmin create /Library/Subversion/Repository/bonelab

We also need to ensure that the repository is editable by the webserver user.

 chown -R www /Library/Subversion


====Configure the server via Server Admin====

=====Enable Apache modules=====

# Click Web in the Sidebar
# Click Settings in the top bar
# Select the Modules tab
# Check the following modules:
#* authz_svn_module
#* dav_module
#* dav_fs_module
#* dav_svn_module

=====Enable WebDAV on your site=====

# Click Sites in the top bar
# Select your site
# Click the WebDAV checkbox

=====Create a Realm=====

# Select the Realms tab
# Click �+� under the Realms box and enter the following:
#* Realm Name: subversion
#* Authentication: Basic
#* Location: /svn (Note: You have to change the dropdown)
# Click �+� under the Users & Groups box, and drag/drop the users/groups that you want to give access to. Also be sure to give them read/write privileges.
# Click the Save button.

====Tweak the config file====

Edit the file /etc/apache2/sites/0001_any_443_default.conf. TIn the <Location "/svn"> section, add the following two lines:

 DAV svn
 SVNParentPath /Library/Subversion/Repository

====Restart the web server====

You can do this from Server Admin.

====Fixing it if it breaks====

Note: It often happens that when you use the Server Admin utility, it will overwrite the following line.  The symptom of this is "page not found" error when you try to access svn.  SImply change, in /etc/apache2/sites/0001_any_443_default.conf, 

        <Location "/svn/">
                DAV Off

Back to

        <Location "/svn/">
                DAV svn

After you modify this file, you will need to do this:

 sudo apachectl restart

===Trac===

====Installation====

Get and install the source code for trac.

 sudo easy_install --prefix=/usr/local --install-dir=/Library/Python/2.6/site-packages http://svn.edgewall.org/repos/trac/tags/trac-0.11


====Create Project====

Now make a directory for the trac project.

 sudo mkdir -p /Library/Trac/Environment

Create a project.

 sudo trac-admin /Library/Trac/Environment/bonelab initenv

Answer the questions.  Here are the questions for which I entered something different than the default:

 Project Name [My Project]> bonelab
 Path to repository [/path/to/repos]> /Library/Subversion/Repository/bonelab

Now set permissions on the project directory

 sudo chown -R www:admin /Library/Trac/Environment
 sudo chmod -R ug+rwX,o= /Library/Trac/Environment

====Testing====

You can test that everything worked by running

 sudo tracd --port 8000 /Library/Trac/Environment/bonelab

Then browsing to http://localhost:8000/bonelab .

====Web Access====

=====Create a Trac Deploy=====

 sudo trac-admin /Library/Trac/Environment/bonelab deploy /tmp/deploy
 sudo mv /tmp/deploy/* /Library/Trac/
 sudo chmod -R ug+rwX,o= /Library/Trac
 sudo chown -R www:admin /Library/Trac
 sudo chmod +x /Library/Trac/cgi-bin/*

=====Configure Apache=====

* Server Admin -> Web -> Settings -> Modules. Find fastcgi_module and select it.
* Go to Sites and select the entry for the service on port 443, which you created when setting up web access to Subversion.
* From the Realm tab, click the + button below the Realms column.  Fill it it with Realm Name "trac", Authentication "Basic" and Location "/trac/".
* In the Users and Groups column, add the Local Accounts group and give it Browse and Read/Write access.
* In the Options tag, make sure "CGI Execution" is selected.
* Click Save.

Now edit /etc/apache2/sites/0001_any_443_default.conf .  Find the /trac section and edit it to be like this:

        <Location "/trac/">
                AuthType Basic
                SetEnv TRAC_ENV_PARENT_DIR "/Library/Trac/Environment"
                <Limit GET HEAD OPTIONS CONNECT POST PROPFIND PUT DELETE PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
                        Require group  localaccounts
                </Limit>
                AuthName "trac"
        </Location>

Restart apache with:

 sudo apachectl restart

===MediaWiki===

MediaWiki is not actually installed on mike (it is on caerostris), but instructions are here just in case.

The instructions follow http://www.mediawiki.org/wiki/Manual:Running_MediaWiki_on_Mac_OS_X , but are somewhat customized.

 sudo mkdir /Library/MediaWiki

====MySQL====

On Mac OS Server, MySQL is preinstalled, but is not enabled by default.

Enable it with the GUI <code>Server admin</code>:
* Click on the server name
* Choose <code>Settings</code> and underneath <code>Services</code>
* In the list, enable <code>MySQL</code>

* Click on the triangle at the right of the server name to open the list of services
* Choose the <code>MySQL</code> service
* Set the root password
* Click on <code>Save</code>
* On the bottom of the window, click on <code>Start MySQL</code>

==== Creating MediaWiki Database ====
In order for the MediaWiki software to be able to read and write to the MySQL database, you need to create and give it access to a new database by issuing the following commands:
 mysqladmin -u root -p create wikidb
 mysql -u root -p -e "GRANT ALL PRIVILEGES ON wikidb.* TO wikiuser IDENTIFIED BY 'wiki_password'"
 mysql -u root -p -e "SET PASSWORD FOR wikiuser = OLD_PASSWORD('wiki_password')"
 mysql -u root -p -e "FLUSH PRIVILEGES"
Replace 'wiki_password' with a string of your choice. You will need to enter it later in the MediaWiki configuration.


==== PHP ====
On Mac OS Server, PHP is preinstalled, but is not enabled by default.

Enable it with the GUI <code>Server admin</code>:
* click on the triangle at the right of the server name to open the list of services
* Choose the <code>Web</code> service
* Choose <code>Settings</code> and underneath <code>Modules</code>
* In the list, enable <code>php5_module</code>
* Click on <code>Save</code>

==== WikiMedia Files ====

Get it from http://www.mediawiki.org/wiki/Manual:Downloading_MediaWiki .

Unpack it to /Library/WikiMedia/

 cd /Library/MediaWiki
sudo chown -R www .
sudo chgrp -R admin .
chmod -R a+rw config
sudo mkdir uploads
sudo chown www uploads
sudo chgrp admin uploads

=====Create a Realm=====

# Server Admin -> Web -> Sites -> 443
# Select the Realms tab
# Click �+� under the Realms box and enter the following:
#* Realm Name: wiki
#* Authentication: Basic
#* Folder: /Library/MediaWiki (Note: You have to change the dropdown)
# Click �+� under the Users & Groups box, and drag/drop the users/groups that you want to give access to. Also be sure to give them read/write privileges.
# Click the Save button.

Now edit /etc/apache2/sites/0001_any_443_default.conf so it looks something like this:

        Alias /wiki "/Library/MediaWiki"
        <Directory "/Library/MediaWiki">
                AuthType Basic
                <Limit GET HEAD OPTIONS CONNECT POST PROPFIND PUT DELETE PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
                        Require group  localaccounts
                </Limit>
                AuthName "wiki"
        </Directory>
        <Directory "/Library/MediaWiki/web/uploads">
                AllowOverride None
                AddType text/plain .html .htm .shtml
                php_admin_flag engine off
        </Directory>

Now restart Apache:

 sudo apachectl restart


====Configure MediaWiki====

Point your browser at https://caerostris.kin.ucalgary.ca/wiki/index.php .

Fill out everything.

# As prompted by the webpage, copy the <tt>LocalSettings.php</tt> file from the <tt>config</tt> folder up one level.
# Eventually, you should be led to <nowiki>https://caerostris.kin.ucalgary.ca/wiki/index.php/Main_Page</nowiki> and you should see a nice new wiki waiting to be populated.
# Once this is working, change the permissions of the config folder to prevent reading by anyone.  If the wiki is working, you may as well just delete this folder.

===Time Machine Backup===

First change the system settings, on the computer with the backup drives physically connected, to allow non-Apple authorized volumes to be used with Time Machine:

 sudo defaults write com.apple.systempreferences TMShowUnsupportedNetworkVolumes 1

You now also have to ensure that the external drives will be mounted at boot time (and not just at log in), and that they will stay mounted when someone logs out:

 sudo defaults write /Library/Preferences/SystemConfiguration/autodiskmount AutomountDisksWithoutUserLogin -bool true

On the server you want to back up, from the Finder menu, choose Go -> Connect to Server and enter afp://mighty-mac.kin.ucalgary.ca .  Select the backup0 volume.

Start Time Machine.  It will ask if you want to configure it.  Choose Yes and select "backup0 on mighty-mac".

Click on Options.  data0 will be in the Exclude list (external volumes are by default).  Remove it from the Exclude list.

===File Sharing Permissions===

We want everyone to be able to read/write anything on Data0.

Connect to mike.kin.ucalgary.ca with Server Admin.

Select File Sharing.

Select Data0.  Click the Permissions tab about the middle of the window.  Click the + button.  From the Users and Groups panel that pops up, click groups and drag Staff to ACL.  Set the Permission to Read & Write.  It should apply to "This folder, Child folders, Child files, All descendants".

===NFS===

====Create a user for NFS access====

We are going to create a user for NFS access.  The user name will be "microct".  All access and file permissions from the VMS systems will correspond to this user.

Using Workgroup Manager.

* Click the New User button.
* On the Basic tab, set the name to microct.  Note the UID (in this case it was 1027).  Deselect the checkbox Access Account.  We don't intend to allow the user microct to log in, as it is not a real user.
* On the Groups tab, make sure that the primary group is Staff (this is the default).
* On the Home tab select None.
* Click Save.

====Set up NFS Service====

Using Server Admin:

* Settings -> Services -> Check NFS
* Select File Sharing from the top tab.
* Select Share Points:
* Only volume shared is Data0
* Select Data0, and then select Share Point from the tab bar in the box in the lower right.
* Click Protocol Options button.
* Select the NFS tab.
* Make sure that Export this item is selected and set to Client List.
* Add percy.kin.ucalgary.ca and thomas.kin.ucalgary.ca to the client list.
* Set Mapping to Root to Nobody
* Set Minimum Security to Standard.


====Configuring OpenVMS client====

I used the following documentation:

http://h71000.www7.hp.com/doc/73final/4584/4584pro.html

http://h71000.www7.hp.com/doc/732final/6524/6524pro_002.html#sec_comprocedure

http://h71000.www7.hp.com/doc/732final/6526/6526pro_contents_006.html#toc_chapter_23

=====License=====

First enable the license on thomas.  Log into thomas as system.   Then run:

 LICENSE REGISTER UCX-IP-NFS /ISSUER=MONTAGAR /AUTHORIZATION=EDU-807977-808201 /PRODUCER=DEC /UNITS=0 /TERMINATION_DATE=1-OCT-2010 /ACTIVITY=CONSTANT=100 /CHECKSUM=2-LFIC-ENCF-IKOA-EADI

The license needs to be loaded into memory:

 lic load ucx-ip-NFS

I believe that this has to be done on every node.

NOTE: The above instructions didn't actually work.  Instead we attempted to load ALL licenses.  The first step is to convert the long list of LICENSE REGISTER commands to a VMS license file format.  Something like this should do it.  (On a system with sed.  I used OS-X.)

 sed -i .bak -f convert_license.sed license.txt

Where license.txt contains the commands looking like this:

 $ LICENSE REGISTER X500-DIRECTORY-SERVER - 
 /ISSUER=MONTAGAR - 
 /AUTHORIZATION=EDU-807977-808196 - 
 /PRODUCER=DEC - 
 /UNITS=0 - 
 /TERMINATION_DATE=1-OCT-2010  - 
 /ACTIVITY=CONSTANT=100 - 
 /CHECKSUM=2-PDFG-FFGC-OJGH-OHBM 
 $ LICENSE REGISTER VAXCLUSTER - 
 ...

and convert_license.sed has the following commands:

 s/=/ = /g
 s/ - $//g
 s/^\///g
 s/\$ LICENSE REGISTER/PRODUCT_NAME =/g
 /^PRODUCT_NAME/ i\
 \<NEXT\>

Copy license.txt over to the VMS system with FTP, then run:

 @SYS$UPDATE:VMSLICENSE REGISTER DISK1:[MICROCT]LICENSE.TXT

If everything worked, then all the licenses can be loaded with

 lic load

=====Enable NFS client=====

Enable the NFS client as follows:

 @SYS$MANAGER:TCPIP$CONFIG

Select option 2 (Client components).  Then select 3 (NFS client).  Then 2 (Enable & Start service on this node).

This must be done on both percy and thomas.

=====Mount the NFS volume=====

As the user "system", start TCPIP with

 TCPIP

Then enter

 MOUNT DNFS1: /HOST="mike.kin.ucalgary.ca" /PATH="Data0" /UID=1027 /GID=20 /USER=microct

Make sure that UID agrees with the actual UID for the user microct on mike.kin.  Similarly GID must match the actual GID for the group staff on mike.kin .  Here /USER=microct refers to the user microct on VMS.

This must be done on both percy and thomas.

===FTP===

Connect to mike.kin.ucalgary.ca with Server Admin.

Go to Settings -> Services and make sure that FTP is selected.

Click the FTP icon in the left panel, and then click "Start FTP" button on the bottom if it is not already started.

Go to Share Points, select Data0, click the Share Point tab, click the Protocol Options button and then select the FTP tab.  Select "Share the item with FTP" and then click OK.

===FTP for Remote Access===

Transfer of large data amounts can be achieved by making the data available to outside users. The outside user needs to know the following:

 ftp mike.kin.ucalgary.ca
 Login: france
 Password: bonelab0

Note that the password may have been changed, or the account disabled.  It can be changed by anyone with administrative access.  On OS-X, use the Workgroup Manager to do this (this can be run from any OS-X client, you do not need to use VNC to log into mike.kin directly).  After selecting the "france" account in the Workgroup Manager, you can check or uncheck "access account" to enable or disable this account.

To access the server from a command line, do the following:

 $ ftp mike.kin.ucalgary.ca
 Connected to mike.kin.ucalgary.ca.
 220 mike.kin.ucalgary.ca FTP server ready.
 Name (mike.kin.ucalgary.ca:skboyd): france
 331 Password required for france.
 Password: 
 230-No directory! Logging in with home=/
 230 User france logged in.
 Remote system type is UNIX.
 Using binary mode to transfer files.
 ftp> cd Guests
 250 CWD command successful.
 ftp> prompt off
 Interactive mode off.
 ftp> binary
 200 Type set to I.
 ftp> mget *.*

At our end, we need to make the data available.  This is possible by moving the data of interest onto mike.kin.ucalgary.ca into the Guests folder and setting proper permissions.
 ssh skboyd@mike.kin.ucalgary.ca
 cd /Shared Items/Guests/       ! and so on
 chmod 755 *.*                  ! to get rwxr-xr-x

Remember to remove the data after the outside party has downloaded it.

==Original Proposal==

See [[Computing Resources Proposal]]