: $ sudo apt install nagios4 monitoring-plugins-basic lm-sensors \
: _ nagios-nrpe-plugin
-Next, the administrator concatenated a personal public ssh key and the
-key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The CA Command][The CA Command]]) into an
-=admin_keys= file, copied it to Core, and installed it as the
-=authorized_keys= for ~sysadm~.
+Now Core no longer needed the Internets so it was disconnected from
+the cable modem and connected to the campus Ethernet switch. Its
+primary Ethernet interface was manually configured with its private IP
+address and a default route, using commands similar to the examples
+below. In the example commands, the address ~192.168.56.1~ is the
+example value of ~core_addr~ set in [[*Subnets][Subnets]]. The second address,
+~192.168.56.2~, is likewise the example value of ~gate_addr~.
+
+: sysadm@core$ sudo ip address add 192.168.56.1 dev enp82s0
+: sysadm@core$ sudo ip route add default via 192.168.56.2 dev enp82s0
+
+Next, the administrator connected their notebook to the campus
+Ethernet and adopted an unused IP address, e.g. ~192.168.56.100~.
+
+: notebook$ sudo ip address add 192.168.56.100 dev eth0
+
+On their notebook, the administrator concatenated their personal
+public SSH key with Ansible's (found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]], created
+by [[*The CA Command][The CA Command]]) into an =admin_keys= file, copied the file to Core,
+and installed it as the =authorized_keys= for ~sysadm~.
: notebook$ cat ~/.ssh/id_ed25519.pub \
: notebook_ Secret/ssh_admin/id_ed25519.pub \
: notebook_ > admin_keys
-: notebook$ scp admin_keys sysadm@core.lan:
-: The authenticity of host 'core.lan' can't be established.
+: notebook$ scp admin_keys sysadm@192.168.56.1:
+: The authenticity of host '192.168.56.1' can't be established.
: ....
: Are you sure you want to continue connecting (...)? yes
: ...
-: sysadm@core.lan's password: oingstramextedil
-: notebook$ ssh sysadm@core.lan
-: sysadm@core.lan's password: oingstramextedil
+: sysadm@192.168.56.1's password: oingstramextedil
+: notebook$ ssh sysadm@192.168.56.1
+: sysadm@192.168.56.1's password: oingstramextedil
: sysadm@core$ ( umask 077; mkdir .ssh; \
: sysadm@core_ cp admin_keys .ssh/authorized_keys )
: sysadm@core$ rm admin_keys
: notebook$ rm admin_keys
: notebook$
-Note that the name ~core.lan~ should be known to the cable modem's DNS
-service. An IP address might be used instead, discovered with an ~ip
--4 a~ command on Core.
-
-Now Core no longer needed the Internets so it was disconnected from
-the cable modem and connected to the campus Ethernet switch. Its
-primary Ethernet interface was temporarily (manually) configured with
-a new, private IP address and a default route.
-
-In the example command lines below, the address ~10.227.248.1~ was
-generated by the random subnet address picking procedure described in
-[[*Subnets][Subnets]], and is named ~core_addr~ in the Ansible code. The second
-address, ~10.227.248.2~, is the corresponding address for Gate's
-Ethernet interface, and is named ~gate_addr~ in the Ansible
-code.
-
-: sysadm@core$ sudo ip address add 10.227.248.1 dev enp82s0
-: sysadm@core$ sudo ip route add default via 10.227.248.2 dev enp82s0
-
At this point Core was prepared for provisioning with Ansible.
** The Gate Machine
physical network shown in the [[*Overview][Overview]] wherein Gate has three network
interfaces.
-The following example prepared a new gate on a PC with Debian 11
+The following example prepared a new gate on a PC with Debian 13
freshly installed. During installation, the machine was named ~gate~,
-no desktop or server software was installed, no root password was set,
-and a privileged account named ~sysadm~ was created (per the policy in
-[[*The Administration Accounts][The Administration Accounts]]).
-
-: New password: icismassssadestm
-: Retype new password: icismassssadestm
-: ...
-: Full Name []: System Administrator
-: ...
-: Is the information correct? [Y/n]
+no desktop nor server software was installed, no root password was
+set, and a privileged account named ~sysadm~ was created (per the
+policy in [[*The Administration Accounts][The Administration Accounts]]).
-The password was generated by ~gpw~, saved in the administrator's
-password keep, and later added to [[file:Secret/become.yml][=Secret/become.yml=]] as shown below.
-(Producing a working Ansible configuration with [[file:Secret/become.yml][=Secret/become.yml=]]
-file is described in [[*The Ansible Configuration][The Ansible Configuration]].)
+The password for ~sysadm~ was generated by ~gpw~, saved in the
+administrator's password keep, and later added to [[file:Secret/become.yml][=Secret/become.yml=]]
+as shown below. (Producing a working Ansible configuration with
+[[file:Secret/become.yml][=Secret/become.yml=]] file is described in [[*The Ansible Configuration][The Ansible Configuration]].)
: notebook$ gpw 1 16
: icismassssadestm
: _ ufw postfix wireguard lm-sensors \
: _ nagios-nrpe-server munin-node emacs
-The host then needed to be rebooted to get its name service working
-again after ~systemd-resolved~ was installed. (Any help with this will
-be welcome!) After rebooting and re-logging in, the administrator was
-ready to proceed.
+Manual installation of Postfix prompted for configuration type and
+mail name. The answers given are listed here.
-Next, the administrator concatenated a personal public ssh key and the
-key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The CA Command][The CA Command]]) into an
-=admin_keys= file, copied it to Gate, and installed it as the
-=authorized_keys= for ~sysadm~.
+- General type of mail configuration: Internet Site
+- System mail name: gate.small.private
+
+Now Gate no longer needed the Internets, and needed to be rebooted to
+get its name service working again after installing
+~systemd-resolved~. (Any help with this will be welcome!) It was
+shutdown and disconnected from the cable modem, then connected to the
+campus Ethernet switch and restarted. Logged in on the console, the
+administrator configured the primary Ethernet interface with Gate's
+private IP address using a command similar to the example below. In
+the example command, the address ~192.168.56.2~ is the example value
+of ~gate_addr~, set in [[*Subnets][Subnets]].
+
+: sysadm@gate$ sudo ip address add 192.168.56.2 dev eth0
+
+Next, the administrator connected their notebook to the campus
+Ethernet and adopted an unused IP address, e.g. ~192.168.56.100~.
+
+: notebook$ sudo ip address add 192.168.56.100 dev eth0
+
+On their notebook, the administrator concatenated their personal
+public SSH key with Ansible's (found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]], created
+by [[*The CA Command][The CA Command]]) into an =admin_keys= file, copied the file to Gate,
+and installed it as the =authorized_keys= for ~sysadm~.
: notebook$ cat ~/.ssh/id_ed25519.pub \
: notebook_ Secret/ssh_admin/id_ed25519.pub \
: notebook_ > admin_keys
-: notebook$ scp admin_keys sysadm@gate.lan:
-: The authenticity of host 'gate.lan' can't be established.
+: notebook$ scp admin_keys sysadm@192.168.56.2:
+: The authenticity of host '192.168.56.2' can't be established.
: ....
: Are you sure you want to continue connecting (...)? yes
: ...
-: sysadm@gate.lan's password: icismassssadestm
-: notebook$ ssh sysadm@gate.lan
-: sysadm@gate.lan's password: icismassssadestm
+: sysadm@192.168.56.2's password: icismassssadestm
+: notebook$ ssh sysadm@192.168.56.2
+: sysadm@192.168.56.2's password: icismassssadestm
: sysadm@gate$ ( umask 077; mkdir .ssh; \
: sysadm@gate_ cp admin_keys .ssh/authorized_keys )
-: sysadm@core$ rm admin_keys
-: sysadm@core$ logout
+: sysadm@gate$ rm admin_keys
+: sysadm@gate$ logout
: notebook$ rm admin_keys
: notebook$
-Note that the name ~gate.lan~ should be known to the cable modem's DNS
-service. An IP address might be used instead, discovered with an ~ip
-a~ command on Gate.
-
-Now Gate no longer needed the Internets so it was disconnected from
-the cable modem and connected to the campus Ethernet switch. Its
-primary Ethernet interface was temporarily (manually) configured with
-a new, private IP address.
-
-In the example command lines below, the address ~10.227.248.2~ was
-generated by the random subnet address picking procedure described in
-[[*Subnets][Subnets]], and is named ~gate_addr~ in the Ansible code.
-
-: $ sudo ip address add 10.227.248.2 dev eth0
-
Gate was also connected to the USB Ethernet dongles cabled to the
-campus Wi-Fi access point and the campus ISP and the values of three
+campus Wi-Fi access point and the campus ISP, and the values of three
variables (~gate_lan_mac~, ~gate_wild_mac~, and ~gate_isp_mac~ in
-[[file:private/vars.yml][=private/vars.yml=]]) match the actual hardware MAC addresses of the
+[[file:private/vars.yml][=private/vars.yml=]]) were set to the hardware MAC addresses of the
dongles. (For more information, see the tasks in the [[Configure Gate
NetworkD]] section.)
+Finally, a new WireGuard™ private key was generated. The following
+commands generated the key without revealing it, and displayed the
+corresponding public key.
+
+: sysadm@small$ umask 077
+: susadm@small$ wg genkey \
+: sysadm@small_ | sudo tee /etc/wireguard/private-key \
+: sysadm@small_ | wg pubkey
+: S+6HaTnOwwhWgUGXjSBcPAvifKw+j8BDTRfq534gNW4=
+: sysadm@small$ logout
+: notebook$
+
+The public key is copied and pasted into [[file:private/vars.yml][=private/vars.yml=]] as the
+value of ~front_wg_pubkey~ (as in the example [[pubkeys][here]]).
+
At this point Gate was prepared for provisioning with Ansible.
projects / Institute / commitdiff