Peter Woods

IDEV Support: This month I have done a lot of work with the IDEV team to support various projects that they are working on. The majority of this time is being spent on working with Bluestem authentication. In theory, Bluestem is something that as an organization we are moving away from; however, we are still propagating it to new servers. Initially, my Bluestem involvement was going to be with the life cycle replacement of our central Bluestem server. This has grown to assisting with the integration of Bluestem into our Jboss/Tomcat environment. This integration is turning out to be rather problematic and is consuming quite a bit of my operational time. We are running into a conflict between the configuration the mod_cgi module required by Bluestem and the mod_jk connector required by Java services. Even though we can successfully load both modules at the same time, the CGI support does not work when we include configuration directives for mod_jk.

Java Upgrade on Jboss/Tomcat Servers: The Java version on Jtest1 was upgraded from 1.5.0._07 to 1.5.0_12, and the approval was given to move forward with this change in the production environment. The change was scheduled for a standard change window; however, the change had to be rolled back due to missing properties files that were not detected in the testing on Jtest1. During the change window in attempting to troubleshoot the upgrade, I also learned that the applications running on Jprod1 and Jprod2 are no longer symmetric.  When these two servers were implemented, they were supposed to be near mirrors, and Jprod2 would be the warm failover to Jprod1. I'm not sure that this is still the case. As for the original intent, I have identified the missing files and rescheduled the upgrade for this weekend.

Samsara Decommissioning: All user services on this system have been shutdown and are no longer available to ITS staff members. They have been migrated to the other bastion hosts. The only process left on samsara is the DHCPD service, and that will require coordination with NetSec to add the DHCP helper to the firewall. No other static reservations are being accepted on this network. The final step will be scheduled for low impact time.

AppHosting Network Implementations: The AppHosting team is now utilizing two new networks in our daily operations- a desktop network and a build network. For all intents and purposes, we have abandoned the 129.59.115.128/25 network (commonly known as the 115 network) which completely utilizing all of the IP space with workstations, test servers and production servers. Both of the networks are fully DHCP to discourage the of this as a permanent home for servers. The new build network also provides the AppHosting team with a secure location to get servers scanned by the NetSec team.

Midyear Evals: I have met with each member of the Unix team to discuss the feedback that I would be providing, and I believe that they all went pretty well. One nice thing that came of out the discussions- we each recognize each others positives and improvement points. The feedback that I received on my work efforts was nearly identical.  (This leads me to believe that it's either true or there has been some collusion on their part.  Given our aversion to meetings, I'll go with option one.)

Website Unmirroring: One website has been unmirrored in the shared web architecture. This particular site utilizes its own virtual hosts on one of the servers, and it was not well suited to mirroring due to the extremely large numbers of files placed in a single directory. The content replication was consistently failing due to "too many arguments". The single copy site was created by removing the CSM configuration and removing the necessary virtual host configuration from the mirror server. There was no outage with these changes. 

Sitemason Replacements: The new Sitemason servers have built and have been passed over to the Sitemason staff for completion. These servers are basically minimal Linux installations with the necessary compilers to build their utilities from source.

Nagios Replacement: The Nagios server is built and I am working on the configuration of the Nagios and Fruity software.

Commons VM: I created the virtual machine for the Commons application and worked with their developer to get access to the VM.

Backup Server Support: I have been intermittently involved in troubleshooting backup operations.

I've been working lately on rebuilding our Nagios installation on a RHE5 server. The new server is going to take advantage of Fruity to aid with the configuration. While not entirely different, there are some which caused me to slow my pace a bit.  The first was the introduction of yum rather than up2date to manage RPMs.  After a little bit of tinkering to find the yum commands that where equivalent to the up2date syntax that I was used to, I was back on my merry way. The hurdle that I'm working on is the SELinux environment. The SELinux policies are much more stringent than in RHEL4. I've never previously run into a situation where SELinux prevented root from deleting or modifying files. I could go the "off-fix-on" route, but I figured that I'd better take the time to get this mastered since RHEL5 systems are going to be a reality in our environment. The source files for the policies are not installed, but now tools exist to create modular policies, which is a nice addition. In addition, I'm taking the time to layer on all of the miscellaneous security tools that I built into our production RHEL4 web environment.