Equipment/Turing: Difference between revisions
No edit summary |
m (Updated LDAP info (no more Denning as it goes to ldap-secondary now, and it does work)) |
||
| (8 intermediate revisions by one other user not shown) | |||
| Line 28: | Line 28: | ||
Access is limited to Trustees only since it contains the membership db. | Access is limited to Trustees only since it contains the membership db. | ||
== LDAP == | |||
Turing has an [[LDAP]] db on it that is replicated to ldap-secondary (Hackspace VM in Wembley) for use on machines in the space. | |||
Turing has iptables rules that allow access to the [[LDAP]] server from ldap-secondary (Hackspace VM). | |||
We use a schema that is compatible with Samba for 2 reason: | |||
* We might want user logins to Samba at some point | |||
* The sambaNTPassword attribute is understood by FreeRADIUS and is needed for MS-CHAP auth for spacefed. | |||
however the sambaNTPassword hash is quite weak, and the sambaLMPassword hash is silly, so ideally: | |||
* the sambaLMPassword attribute would contain nonsense that can never be authenticated against | |||
* the sambaNTPassword attribute would be for a different password from the userPassword | |||
Currently we are not adding sambaLMPassword attribute's to the database. | |||
=== cheat sheet at the moment === | |||
==== list a users details ==== | |||
<nowiki> | |||
smbldap-usershow <username></nowiki> | |||
or: | |||
<nowiki> | |||
smbldap-userinfo -l <username></nowiki> | |||
==== add a user to a group ==== | |||
<nowiki> | |||
smbldap-usermod -G +<groupname> <username></nowiki> | |||
==== List the members of a group ==== | |||
<nowiki> | |||
smbldap-groupshow <group name></nowiki> | |||
==== Remove a member from a group ==== | |||
<nowiki> | |||
smbldap-usermod -G -<groupname> <username></nowiki> | |||
==== Edit the acl's ==== | |||
(assuming ldapvi is installed) | |||
<nowiki> | |||
ldapvi -Y EXTERNAL -h ldapi:/// -b olcDatabase={1}hdb,cn=config -v "(olcAccess=*)" olcAccess</nowiki> | |||
=== Issues === | |||
* might need to add an index to memberUid | |||
=== Changes to tools on Turing === | |||
The smbldap tools were patched with these patches | |||
* http://svn.gna.org/viewcvs/smbldap-tools/trunk/smbldap-userlist.pl?view=patch&r1=135&r2=134&pathrev=135 | |||
* http://svn.gna.org/viewcvs/smbldap-tools/trunk/smbldap-grouplist.pl?view=patch&r1=135&r2=134&pathrev=135 | |||
... and a few others, you can see them all here: | |||
https://github.com/londonhackspace/hackspace-foundation-sites/tree/ldap/ldap | |||
== Graphs == | == Graphs == | ||
Latest revision as of 17:33, 23 November 2018
| Turing | |
|---|---|
 | |
| Model | Virtual |
| Sub-category | Systems |
| Status | Good working order |
| Last updated | 23 November 2018 17:33:32 |
| Consumables | Unknown |
| Accessories | Unknown |
| Training requirement | yes |
| Training link | Unknown |
| ACnode | no |
| Owner | LHS |
| Origin | Sponsorship |
| Location | A Bitfolk datacenter |
| Maintainers | The Trustees |
Purpose
Runs the UK Hackspace website and hosts wikis for any spaces that want. Also hosts the membership system and forwards the webcams for London Hackspace.
Name
Named after Alan Turing.
See also: System naming
Access
Access is limited to Trustees only since it contains the membership db.
LDAP
Turing has an LDAP db on it that is replicated to ldap-secondary (Hackspace VM in Wembley) for use on machines in the space.
Turing has iptables rules that allow access to the LDAP server from ldap-secondary (Hackspace VM).
We use a schema that is compatible with Samba for 2 reason:
- We might want user logins to Samba at some point
- The sambaNTPassword attribute is understood by FreeRADIUS and is needed for MS-CHAP auth for spacefed.
however the sambaNTPassword hash is quite weak, and the sambaLMPassword hash is silly, so ideally:
- the sambaLMPassword attribute would contain nonsense that can never be authenticated against
- the sambaNTPassword attribute would be for a different password from the userPassword
Currently we are not adding sambaLMPassword attribute's to the database.
cheat sheet at the moment
list a users details
smbldap-usershow <username>
or:
smbldap-userinfo -l <username>
add a user to a group
smbldap-usermod -G +<groupname> <username>
List the members of a group
smbldap-groupshow <group name>
Remove a member from a group
smbldap-usermod -G -<groupname> <username>
Edit the acl's
(assuming ldapvi is installed)
ldapvi -Y EXTERNAL -h ldapi:/// -b olcDatabase={1}hdb,cn=config -v "(olcAccess=*)" olcAccess
Issues
- might need to add an index to memberUid
Changes to tools on Turing
The smbldap tools were patched with these patches
- http://svn.gna.org/viewcvs/smbldap-tools/trunk/smbldap-userlist.pl?view=patch&r1=135&r2=134&pathrev=135
- http://svn.gna.org/viewcvs/smbldap-tools/trunk/smbldap-grouplist.pl?view=patch&r1=135&r2=134&pathrev=135
... and a few others, you can see them all here:
https://github.com/londonhackspace/hackspace-foundation-sites/tree/ldap/ldap
Graphs
IP
212.13.195.146 85.119.83.146 (hackspace.vps.bitfolk.com)
Services
These run as daemons automatically:
- Apache
- postgres
- mjpegproxy-webcams (in screen, no logging)
