Computers

Computers on the network

hostname	ws	location	description
zebra		data center	Connected directly to tdrive; virtually connected to finch with IPsec. Is also the VPN gateway.
finch		LKS	Runs dhcp (assigns ip addresses to mac addresses), dns (maps domain names to ip addresses, computers on the network look up ip's using finch).
tdrive		data center	Data storage (13TB)
zdrive		data center	Data storage (48TB)
nashome		LKS	Raid0 SSD fileserver user = ubuntu
aquila	x	LKS	64GB RAM, GPU, Frederic's desk
corvus	x	LKS	64GB RAM, GPU, Kevin's desk
tucana	x	LKS	64GB RAM, GPU, Bill's desk
goats	x	LKS	32GB RAM
sirius	x	LKS	8GB RAM
strfinator	x	LKS
quaint-produce	x	LKS
?	x	LKS
della17ec9		LKS	is a printer. settings here. connect by USB or by network
chubbyninja	x	125 NAF	not connected to the rest of the network
pumpkin	x	125 NAF	not connected to the rest of the network

Printer connecting instruction here

zebra (10.0.1.11)

Located in colo. Hosts home directories and is connected by ethernet to the internet and to tdrive. This computer is the gateway to the VPN and is currently the LDAP server as well.

Connect

Can only be accessed with key login (cannot log in with password), need public key to be added to authorized_keys. Connect as ubuntu user, through ssh ubuntu@zebra or ssh [email protected] when not on the network. The key that is on "finch" as ubuntu is the same as the lab's root password.

Runs

• IPsec (strongSwan): virtual connection between zebra and finch

• LDAP (slapd, openldap): controls user credentials for network login ("ou=People,dc=fet,dc=local"), and automount info ("ou=autofs,dc=fet,dc=local")

• RAID (mdadm): data backup/replication

• VPN (openvpn): vpn stuffs

Setting up/Rebooting

• Set correct routing on rebooting by running: ~/route-up.sh as ubuntu user. It runs the following commands /sbin/iptables-save > /etc/openvpn/iptables.save /sbin/iptables -t nat -F /sbin/iptables -t nat -A POSTROUTING -s 10.10.1.0/24 -j MASQUERADE

finch (10.0.2.1)

Located in LKS it is the network's DHCP and DNS server. When a new computer connects to the network, finch will assign it an IP and associate its hostname.

Connect

You connect via key or directly by login in the console as ubuntu and using the lab's root password. Finch is also fet.neuro.berkeley.edu from the outside (169.229.146.178). ssh as ubuntu if your key is in authorized. Note finch does not have any "users" except for ubuntu and root.

Runs

• IPsec (strongSwan): virtual connection between zebra and finch

• DHCP (isc-dhcp-server): maps mac addresses to ip addresses

• DNS (Bind9): maps domain names to ip addresses

Checking the Virtual Connection.

If zebra is not accessible from finch, you might want to check the ipsec connection. To do this try sudo ipsec status

You should get something that looks like:

Security Associations (1 up, 0 connecting): 
   tlab-lab[1]: ESTABLISHED 2 minutes ago, 169.229.146.178[169.229.146.178]...169.229.219.169[169.229.219.169]  
   tlab-lab{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c2eb3265_i c82afb2f_o  
   tlab-lab{1}:   10.0.2.0/24 === 10.0.1.0/24

If you see this instead:

Security Associations (0 up, 0 connecting):    
   none

You can restart the tunnel using the command sudo ipsec restart. The other end will automatically reconnect.

tdrive (10.0.1.203)

Located in colo. Data server.

zdrive (10.0.1.204)

Located in colo. Data server.

goats, strfinator, sirius, quaint-produce, ... (10.0.2.x)

Regular ol computers located in LKS, connected by ethernet to and assigned ip addresses by finch. Can be accessed by key login or password. When on these computers, fhome and tdrive should be automounted when accessing /auto/fhome and /auto/tdrive respectively.

Connect

Connect by ssh USERNAME@HOSTNAME while on the network or VPN.

Runs

• autofs (autofs-ldap): automatically mounts directories by looking to the ldap server (defined in /etc/ldap.conf). The ldap server ldap currently points to 10.0.1.11 which is zebra's current ip.

Troubleshooting

• When tdrive and/or fhome are not accessible, check network connection and try sudo service autofs restart

Computers in NAF

The two computers in NAF are pumpkin and chubbyninja and are not connected in the same private network as the rest of our computers. They are connected to the router in 123E and are physically located in 125.

Connect

The router is a virtual server for the 2 computers, and you can ssh to them by ssh-ing to the router at a particular port:

router ip: 169.229.251.200

pumpkin port: 65455

chubbyninja port: 65454

You can add this to your ssh config file

Host pumpkin
  HostName 169.229.251.200
  Port 65455
  User fet
Host chubbyninja
  HostName 169.229.251.200
  Port 65454
  User fet

NOTE For now anyone can ssh to the computer and just authenticate using the computer's password. It would be nicer to authenticate using RSA keys only and then enforce it by changing the ssh config in /etc/ssh/sshd_config, and uncomment the line Password authentication no? or is it yes?