Diff for "InstallingControlOnRocky9"

You need to install a "minimal install" of Rocky 9.x, using the minimal install CD.

This is for 9.1: https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9.1-x86_64-minimal.iso

If using binarylane, directly upload the image by keying in the URL and creating "a new backup file"

Select a language, click continue.

Hostname should be called xxxx. Configure Network for DHCP and to "Connect Automatically"

Partition sizes should be as follows (Create Custom Layout):.

/        20-50GB, depending on size of drive, format as EXT4
swap     2-32GB, the same size as physical RAM
/u       with the rest of available space (Fill to maximum available size), formatted as EXT4

Make sure you tell us what the root password is set to.

Lock root account, and do not allow ssh with password.

Add a user "ccc" called "Creative Computing", make this user administrator, and require a password (funky).

After install is finished click restart. If using binarylane, now is the time to detach CD.

When rebooted, you have to log in as ccc, then run su -i to get root.

Next, turn off firewall and selinux.

systemctl disable firewalld

edit /etc/sysconfig/selinux and make sure the SELINUX line is as follows:

SELINUX=disabled

For linode only:

edit /etc/resolv.conf and add:

nameserver 8.8.8.8

Then make the file immutable

chattr +i /etc/resolv.conf

install wget and ppp:

dnf install wget ppp openssh-clients tar

download the following file into the server:

http://customers.creativecomputing.com.au/concare/vpn.tgz

untar the file into /etc/

cd
wget http://customers.creativecomputing.com.au/concare/vpn.tgz
cd /etc
tar xvzf ~/vpn.tgz

************** fix this later ***********************

then as root, accept the fingerprint:

# ssh 220.233.135.250
The authenticity of host '220.233.135.250 (220.233.135.250)' can't be established.
RSA key fingerprint is f6:f0:5c:21:74:0e:03:db:fc:71:e6:21:63:b5:c0:43.
Are you sure you want to continue connecting (yes/no)?

Type "yes" and cancel the connection (ctrl-c).

Reboot to connect the vpn

*******************continue here ********************

Make sure all existing packages are up to date

dnf upgrade --refresh

Add epel repository:

dnf config-manager --set-enabled crb
dnf install \
    https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
    https://dl.fedoraproject.org/pub/epel/epel-next-release-latest-9.noarch.rpm

Download fixed copy of polkit:

cd
wget http://customers.crecom.com.au/concare/polkit-0.96-12.el6.1.x86_64.rpm
yum install ./polkit-0.96-12.el6.1.x86_64.rpm

use yum to install additional packages

dnf groupinstall "Workstation"

dnf install fail2ban tigervnc tigervnc-server glibc.i686 libstdc++.i686 unixODBC.i686 libcurl.i686 openssl-libs.i686 expat.i686 glib2.i686 freetype.i686 libSM.i686 libXrender.i686 fontconfig.i686 libXext.i686 libxcrypt-compat.i686 libnsl.i686 gnome-flashback guacd

Turn on fail2ban

systemctl enable fail2ban

Load the /u partition:

Download the following tar file: http://customers.creativecomputing.com.au/concare/rel15_u_partition2.tgz

untar it into /u

cd
wget https://customers.creativecomputing.com.au/concare/rel16_u_partition.tgz
cd /u
tar xvzf ~/rel16_u_partition.tgz

Add "control" group

groupadd -g 3232 control

start tigervnc:

cd
#wget https://customers.creativecomputing.com.au/concare/turbovnc-2.2.5.x86_64.rpm
#yum install turbovnc-2.2.5.x86_64.rpm
wget https://customers.creativecomputing.com.au/concare/tigerstartup2.tgz
cd /etc
tar xvzf ~/tigerstartup2.tgz
cd
#wget http://customers.creativecomputing.com.au/concare/vncserver
wget https://customers.creativecomputing.com.au/concare/deletelocks.sh
wget https://customers.creativecomputing.com.au/concare/orbit-cleanup
wget https://customers.creativecomputing.com.au/concare/vncserver@.service
wget https://customers.creativecomputing.com.au/concare/arial.tgz
#mv vncserver /opt/TurboVNC/bin/
mv deletelocks.sh /usr/local/bin/
mv orbit-cleanup /usr/local/sbin/
mv vncserver@.service /usr/lib/systemd/system/
#chmod 755 /opt/TurboVNC/bin/vncserver
cd /
tar xvzf ~/arial.tgz

Edit /etc/X11/xinit/Xsession and add ". /u/cc/usr/commonx11.sh" before the line for SWITCHDESKPATH=. Note there is a space between "." and "/".

Edit /usr/libexec/vncsession-start and add "export NODEID="vnc$DISPLAY" before the final exec line.

Create the ccc user and start up its vnc session

#adduser -m ccc
#passwd ccc
cd ~ccc
rsync -av /etc/skel/ ./
chown -R ccc:control ./
systemctl start vncserver@:5
systemctl enable vncserver@:5

Create a new file ~ccc/.profile with the following lines

xhost +

Install pdftk

cd
wget http://customers.creativecomputing.com.au/concare/pdftk
mv pdftk /usr/bin/
chmod 755 /usr/bin/pdftk

*********************************at this point there is now vnc session available********************************

Install guacamole:

systemctl enable guacd
cd
wget --no-check-certificate https://archive.apache.org/dist/guacamole/0.9.13-incubating/binary/guacamole-0.9.13-incubating.war
mv ~/guacamole-0.9.13-incubating.war /var/lib/tomcat6/webapps/guacamole.war
wget http://customers.creativecomputing.com.au/concare/guacdb3.sql
chkconfig mysqld on
service mysqld start
mysql < ~/guacdb3.sql
chkconfig tomcat6 on

Restart once more. guacadmin password is gu4c4dm1n

Try logging into guacamole on "http://<ip address>:8080/guacamole/" and connect to the pre configured "ccc" session. If you see a menu on top, go to System->log out ccc, then say "Log out" to the dialog box that comes up. This will close the session and start it over. If the screen has been locked out and screen saver has activated, forcibly restart the vnc session:

initctl stop turbo VNC=5

wait a few seconds, then:

initctl start turbo VNC=5

Install cups-cloudprint:

cd
wget http://customers.creativecomputing.com.au/concare/cups.tgz
cd /etc
tar xvzf ~/cups.tgz
yum install cupscloudprint
service cups restart

Prior to running the following, please make sure you have a cloudprint account set up with Google and have at least one A4 printer there. This link will give you some more idea about Google cloud print: https://www.google.com/cloudprint/learn/printers.html . It is advisable that you create a Google account just for the sole purpose of printing and not use a pre-existing one.

The following command will initiate setting up cups cloudprint. (This will ask you to enter a URL into a browser and log in to your Google cloud print account) /usr/share/cloudprint-cups/setupcloudprint.py

For now, only add the account and do not add any printers just yet.

Set up chroot sftp

In /etc/ssh/sshd_config change the following near the bottom:

#Subsystem    sftp    /usr/libexec/openssh/sftp-server
Subsystem     sftp    internal-sftp
Match Group sftpusers
        ChrootDirectory /sftp/%u
        ForceCommand internal-sftp

Add a new group sftpusers and create a chroot subdirectory

groupadd -g 3255 sftpusers
mkdir /sftp/

Restart sshd if you want to use it straight away

service sshd restart

Set up OpenVPN

Install the OpenVPN package

yum install openvpn easy-rsa
cd /usr/share/easy-rsa/3.0
cp /usr/share/doc/easy-rsa-3.0.3/vars.example ./vars

Edit the file "vars" and change the items near the end (this is just an example, you can use your real location details):

set_var EASYRSA_KEY_SIZE        4096
set_var EASYRSA_CRL_DAYS        3650
set_var EASYRSA_DIGEST          "sha512"

build the certificate authority (just accept all the defaults and say yes to sign the certificate and commit):

./easyrsa init-pki
./easyrsa build-ca nopass

It will ask you for your Common name, this is just for display, but better if you put the hostname (or customer company)

./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-crl
openssl dhparam -out ./pki/dh4096.pem 4096

This will generate a secure key, it usually takes a long time.

openvpn --genkey --secret ./pki/ta.key
wget http://customers.creativecomputing.com.au/concare/server.conf
mv server.conf /etc/openvpn/
chkconfig openvpn on
mkdir /var/log/openvpn
service openvpn start

Reset the vnc password for ccc (vnc session number 5) to control. Do not set a view-only password.

/opt/TurboVNC/bin/vncpasswd ~ccc/.vnc/passwd

At this point the OS is installed and a very rudimentary version of Control (based on what's installed in the original test VM) is now installed in the system. The following instructions are for adding sessions and printers which I will do a live demo for.

To Add a new session:

This section moved to Installing Control

For users of previous release (upgrade):

populate:

/u/cc/usr/vncusers.sh

based on the lines that start with v in:

/etc/inittab

take a copy of the untarer.sh and lockdown.tgz:

cd
wget http://customers.creativecomputing.com.au/concare/lockdown.tgz
wget http://customers.creativecomputing.com.au/concare/untarer.sh
chmod 755 untarer.sh

Get a list of users from inittab:

cat /etc/inittab|grep ^v|cut -d: -f4| cut -d\- -f2|xargs

run untarer.sh using the output of the above as parameters

./untarer.sh <paste-output-of-above-command>

you can skip over users that you dont think need a vnc session in the new release.

Set up a Printer:

These instructions are mostly just an outline.

If using a printer that will be hooked up to a windows PC, We will need to make sure that the windows printer driver is installed and a test page can be printed.

If using cloudprint, a google account should be created solely for printing.

If using cloud print (A4 printers):

On native cloudprint printer

set up cloudprint on device (this is device specific)

https://support.google.com/cloudprint/answer/1686197?hl=en

On classic printer

set up cloudprint on attached windows PC and Chrome.

https://support.google.com/cloudprint/answer/1686197?hl=en

for both of the above: set up cups-cloudprint using python script

/usr/share/cloudprint-cups/setupcloudprint.py

If direct printing (40 column thermal receipt printers and label printers)

set up openvpn account on the server:

cd /usr/share/easy-rsa/3.0
./easyrsa gen-req <session name> nopass

Then we sign our own request:

./easyrsa sign-req client <session name>

If signing the request fails, check the file /usr/share/easy-rsa/3.0/index.txt and make sure you have not used this common name before. If you have and you are sure you want to reuse it, erase the line from the above file

It will then ask you a series of questions, similar to the ones asked when you built the server key. You should only need to answer the "Common Name" field and "Confirm request details:"

In the pki directory under current a configuration file <session_name>.ovpn similar to openvpn.conf must be created.

# Configuration for connecting into Creative computing internal network
tls-client
dev tap
proto udp
remote <server_hostname> 1194
resolv-retry infinite
nobind
ifconfig <assigned_IP> 255.255.255.0
ca ca.crt
cert <session_name>.crt
key <session_name>.key
verb 3
mute 10
cipher AES-256-CBC
auth SHA512
tls-auth ta.key 1
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384

Then zip all these file you just created ( .crt, .key,.opvn and etc may be 6 or so files)

cd pki
zip -j <session_name>.zip <session_name>.ovpn private/<session_name>.key issued/<session_name>.crt dh4096.pem ca.crt ta.key

Load into client machine. An external method may be needed to load the OpenVPN files into the client computer.

Use the latest stable installer (whether 32 bit or 64 bit) from the following:

https://openvpn.net/index.php/open-source/downloads.html

Unzip all the files into the config directory under where OpenVPN is installed (Usually C:\Program Files\OpenVPN\config). Create a shortcut to OpenVPN on the desktop if the installer has not done so.

set up windows driver and make sure test page works.

turn on Unix printing for windows and make sure it auto starts the service.

use system-config-printer to set up cups

At this point, you have a cups printer, either to a cloud printer device, or a direct printing device.

run printer management from inside Control:

prnaad (as end user)

cloud print printer use "graphics" printing, the rest choose appropriate printer model.

Go to Control "terminal details" screen to set up printers.

yum install sendmail

chkconfig --levels 235 sendmail on

chmod 755 -R /etc/mail

service sendmail restart

update all the binaries to the latest:

From SAM:

rsync -avzk --delete /u/ccstandard/ root@<server IP>:/u/ccstandard/

ssh to the server.

cd /u/ccr.15/
rsync -av /u/ccstandard/ ./

Copy the <standard company> to <company name>

chmod a+w -R /u/ccr.15/<company> /u/ccr.15/adm

./contrl =>put address and phone

/u/cc/std/localbin/brarep

Setting up CRON

ln -s /u/cc /cc
crontab -e

* * * * * /u/cc/binl/auto_postal > /u/cc/LOG/auto_postal.out 2>&1
0 1 * * * /u/cc/binl/post_sum > /u/cc/LOG/post_sum.out 2>&1
0 1 1 * * /u/cc/binl/auto_eom > /u/cc/LOG/auto_eom.out 2>&1
su -
<enter root password>
crontab -e
1 2 * * * /usr/local/sbin/orbit-cleanup > /cc/LOG/orbit-cleanup.out 2>&1
30 1 * * * /u/cc/binl/initda > /u/cc/LOG/initda.out

be sure to modify $CCDIR/binl/auto_eom with the correct CCDIR so that it will run for the correct company (specially if you have custom CCDIR)

Setting up printers

system-config-printer
prnaad

Makesure /u/cc/std/ have the qtsdk-2010.05/ thing

and "qtx11-4.7.0 -> qtsdk-2010.05/" is placed in /u/cc/std/

cp /u/ccdev/binl/email_pdf to the new server as well.

If using postfix (no reason other than if already set up before)

increase default message size limit:

postconf -e message_size_limit=102400000
postconf -e mailbox_size_limit=819200000