View source for Machine/template-fedora13

== Guest installation ==

 qemu-img create -f qcow2 /srv/vm/template-fedora13.qcow2 10G
 virt-install -v --accelerate --nographics -x console=ttyS0,115200 \
    --name template-fedora13 --vcpus=4 --ram $((1*1024)) \
    --os-type=linux --os-variant=fedora13 \
    --network bridge:br0 \
    --disk /srv/vm/template-fedora13.qcow2 \
    --location http://download.fedora.redhat.com/pub/fedora/linux/releases/13/Fedora/x86_64/os/

* In Anaconda, select graphical installation over vnc
* Layout the disk with a single primary partition for root
* In package selection, choose "minimal system"

== Initial configuration ==

At the end of installation, boot with:

 virsh start --console template-fedora13

* Set ssh keys of Sugar Labs sysadmins:

 mkdir ~/.ssh
 cat >>~/.ssh/authorized_keys
 paste keys

* Configure the SSH daemon:

 vi /etc/ssh/sshd_config
   PermitRootLogin yes
   PermitEmptyPasswords no
   PasswordAuthentication no
 service sshd restart
 setsebool -P ssh_sysadm_login on

* Put selinux in permissive mode (while we patiently wait for the day in which selinux in Fedora will become sort of usable out of the box without major tweaks):

 vi /etc/sysconfig/selinux

* Remove root password (this lets us login from the console with no password):

 vipw -s

* Enable traditional networking (no NetworkManager nonsense):

 chkconfig network on
 start network

* Optimize creation of new users

 mkdir /etc/skel/.ssh
 cat >/etc/skel/.ssh.authorized_keys <<__EOF__
 # Place your ssh public keys here, one per line
 __EOF__
 chmod g-w -R /etc/skel/.ssh


* Create sysadmin accounts:

 useradd -c "Bernie Innocenti" -m bernie
 cat >>/home/bernie/.ssh/authorized_keys
 chown -R bernie:bernie /home/bernie/.ssh
 ...

* Add users to wheel group (no better way in Fedora?):

 vigr

* Edit sudoers with visudo:
** Uncomment "%wheel ALL=(ALL) NOPASSWD: ALL"
** Add these lines 

 #bernie: forward agent
 Defaults env_keep += "SSH_AUTH_SOCK"


* Switch from serial console to ssh

 ssh root@template-fedora13.sugarlabs.org

* Install a bunch of useful rpms:

 yum install etckeeper bash-completion git-core strace munin-node duplicity postfix vim devtodo man

* insert into /etc/munin/munin-node.conf

 #SMParrish
 allow ^140\.186\.70\.53$      # sunjammer.sugarlabs.org
 allow ^10\.3\.3\.1$           # trinity.trilan
 allow ^2001:4830:1100:48::2$  # sunjammer.sugarlabs.org (IPv6)

 cd /etc/munin/plugins
 rm if_err_eth0 entropy

* turn on munin-node

 chkconfig munin-node on
 service munin-node start

* generate key for root

 ssh-keygen -N "" -f /root/.ssh/id_rsa -t rsa

* Install our standard scripts

 rsync -aP bernie@sunjammer.sugarlabs.org:/usr/src/devtools/ /usr/src/devtools/
 ln -sf /usr/src/devtools/sysadm/bashrc.sh /etc/skel/.bashrc
 ln -sf /usr/src/devtools/sysadm/bashrc.sh /root/.bashrc
 ln -sf /usr/src/devtools/sysadm/zzz_profile.sh /etc/profile.d/zzz_profile.sh
 ln -sf /usr/src/devtools/conf/vimrc /etc/vim/vimrc.local


* create /etc/system-full-backup.conf

 #bernie: This file MUST have permissions 600
 echo "Please configure /etc/system-full-backup.conf and run"
 echo "  ssh-copy-id -i /root/.ssh/id_rsa.pub sugarbackup@backup.sugarlabs.org"
 echo "then, comment out these lines to enable backups"
 exit 1

 PASSPHRASE=ChangeMe
 TARGET="scp://sugarbackup@backup.sugarlabs.org/backup/`hostname`"

* Install /root/.ssh/id_rsa.pub key on sugarbackup@backup.sugarlabs.org

 ssh-copy-id -i /root/.ssh/id_rsa.pub sugarbackup@backup.sugarlabs.org

* log in for the first time on backup server to accept ssh fingerprint
 
 ssh sugarbackup@backup.sugarlabs.org

* create /etc/profile.conf

 #SMParrish
 HOST_COLOR='\033[1;33m'
 HOST_CFLAGS='-march=core2'
 HOST_CORES=2

* Add the machine to /etc/munin/munin.conf on Machine/sunjammer for monitoring.

  [VM Name]
         address vmname.sugarlabs.org