Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| en:sorm:sorm3:sorm3_serv:start [2018/11/07 13:15] – kvazikrav | en:sorm:sorm3:sorm3_serv:start [2024/03/19 07:33] (current) – removed elena.krasnobryzh | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== 4 OS installation requirements for SORM-3 information system ====== | ||
| - | {{indexmenu_n> | ||
| - | CentOS 7 x86_64 OS should be installed (http:// | ||
| - | After rebooting, perform the installation of the supplementary software using the following command: < | ||
| - | |||
| - | **1. I/O subsystem specifications** | ||
| - | |||
| - | a. Disk drives available for the operating system have to be organized in RAID (> RAID0), which implies that the system will operate when a single physical disk fails; | ||
| - | |||
| - | b. The volumes used to create the file system for PostgreSQL should provide latency at most 10-12 ms with 3000 iops to write (sequential write) and 7000 iops to read (sequential read). | ||
| - | |||
| - | **2. OS disk space allocation: | ||
| - | |||
| - | a. The installation should use LVM for all file systems; | ||
| - | |||
| - | b. At least 100GB is required when combining the root file system and the /var file system; | ||
| - | |||
| - | c. Otherwise, | ||
| - | |||
| - | d. The /opt file system should be located on a separate logical volume in a separate volume group; its size should be at least 100GB; | ||
| - | |||
| - | e. The / | ||
| - | |||
| - | **3. OS configuration requirements** | ||
| - | |||
| - | a. Users of the wheel group are given permission to use all commands in the context of all users: you should add to the / | ||
| - | |||
| - | b. and create the following users: | ||
| - | |||
| - | < | ||
| - | useradd -m -g wheel -u 3000 AAlekseenko | ||
| - | useradd -m -g wheel -u 3001 Ilya.Volzhev | ||
| - | useradd -m -g wheel -u 3002 denis.alexandrov | ||
| - | useradd -m -g wheel -u 3003 stanislav.polevik | ||
| - | useradd -m -g wheel -u 3004 andrey.voloshin | ||
| - | useradd -m -g wheel -u 3005 alexander.suleymanov | ||
| - | useradd -m -g wheel -u 3006 kirill.ivanov | ||
| - | useradd -m -g wheel -u 3007 konstantin.mikhaylov | ||
| - | |||
| - | openssl rand -base64 32 | passwd --stdin AAlekseenko | ||
| - | openssl rand -base64 32 | passwd --stdin Ilya.Volzhev | ||
| - | openssl rand -base64 32 | passwd --stdin denis.alexandrov | ||
| - | openssl rand -base64 32 | passwd --stdin stanislav.polevik | ||
| - | openssl rand -base64 32 | passwd --stdin andrey.voloshin | ||
| - | openssl rand -base64 32 | passwd --stdin alexander.suleymanov | ||
| - | openssl rand -base64 32 | passwd --stdin kirill.ivanov | ||
| - | openssl rand -base64 32 | passwd --stdin konstantin.mikhaylov | ||
| - | |||
| - | </ | ||
| - | |||
| - | using corresponding SSH keys, available to authentification: | ||
| - | |||
| - | < | ||
| - | |||
| - | mkdir ~AAlekseenko/ | ||
| - | mkdir ~Ilya.Volzhev/ | ||
| - | mkdir ~denis.alexandrov/ | ||
| - | mkdir ~stanislav.polevik/ | ||
| - | mkdir ~andrey.voloshin/ | ||
| - | mkdir ~alexander.suleymanov/ | ||
| - | mkdir ~kirill.ivanov/ | ||
| - | mkdir ~konstantin.mikhaylov/ | ||
| - | |||
| - | </ | ||
| - | |||
| - | c. Add the following keys used for authentification to the root user: | ||
| - | |||
| - | < | ||
| - | |||
| - | mkdir /root/.ssh | ||
| - | echo ' | ||
| - | echo ' | ||
| - | |||
| - | </ | ||
| - | |||
| - | Furthermore, | ||
| - | |||
| - | d. Firewalld is used as a firewall. | ||
| - | |||
| - | e. Switch sshd to port 22022 / tcp. | ||
| - | |||
| - | In SELinux add a non-standard port to the list of allowed ones using the following command: | ||
| - | < | ||
| - | semanage port -a -t ssh_port_t -p tcp 22022 | ||
| - | </ | ||
| - | |||
| - | Add corresponding changes to the''/ | ||
| - | < | ||
| - | sed -i.BAK -e ' | ||
| - | </ | ||
| - | |||
| - | or you can do it manually by modifying the '' | ||
| - | |||
| - | Allow ssh access from ssh.vasexperts.ru (5.101.76.50): | ||
| - | |||
| - | < | ||
| - | firewall-cmd --permanent --add-rich-rule=' | ||
| - | firewall-cmd --reload | ||
| - | </ | ||
| - | |||
| - | in order you changes (usage of non-standard port) take effect you should issue the following command: | ||
| - | < | ||
| - | systemctl reload sshd | ||
| - | </ | ||
| - | |||
| - | g. the same way, if necessary, you should add " | ||
| - | |||
| - | h. create '' | ||
| - | |||
| - | < | ||
| - | useradd -m -s / | ||
| - | openssl rand -base64 32 | passwd --stdin cdr | ||
| - | </ | ||
| - | |||
| - | i. ensure that the vsftpd configurations (the ''/ | ||
| - | < | ||
| - | listen=YES | ||
| - | background=YES | ||
| - | pam_service_name=vsftpd | ||
| - | tcp_wrappers=YES | ||
| - | anonymous_enable=NO | ||
| - | local_enable=YES | ||
| - | write_enable=YES | ||
| - | connect_from_port_20=NO | ||
| - | xferlog_enable=NO | ||
| - | xferlog_file=/ | ||
| - | async_abor_enable=YES | ||
| - | chroot_local_user=YES | ||
| - | chroot_list_enable=NO | ||
| - | chroot_list_file=/ | ||
| - | allow_writeable_chroot=YES | ||
| - | userlist_enable=NO | ||
| - | userlist_deny=NO | ||
| - | user_config_dir=/ | ||
| - | force_dot_files=YES | ||
| - | local_umask=022 | ||
| - | dirmessage_enable=YES | ||
| - | pasv_enable=YES | ||
| - | pasv_max_port=10100 | ||
| - | pasv_min_port=10090 | ||
| - | hide_file=NO | ||
| - | tcp_wrappers=YES | ||
| - | ascii_upload_enable=YES | ||
| - | ascii_download_enable=YES | ||
| - | local_umask=022 | ||
| - | </ | ||