Creating ODP regional node from scratch Alexander Kolesnikov RIHMI-WDC, Russia

Pre-installation process Unpack the VM images on your computer Make a connection to the ESXi host using Vsphere client Transfer VM-images to the server storage Add virtual machine to ESXi inventory

Pre-installation process Open the tab Configuration -> Storage, then open your datastorage

Pre-installation process Click the icon for downloading files to the storage and select ‘Upload Folder’ Next, select the folder which contains VM image and press OK Wait until the folder will be loaded into the storage

Pre-installation process After that open the folder and upload the VM into the ESXi host inventory

Specification of ODP node virtual machines (for 16GB RAM server) Component CPU RAM DISK IP adress DNS name PORTAL, SECURITY (PORTAL) 2 3 Gb 80 Gb XXX.XXX.XXX.XXX portal-odp.nmdis.gov.cn DATABASE (DB) 230 Gb db-odp.nmdis.gov.cn INTEGRATION SERVER (IS) 4 130 Gb is-odp.nmdis.gov.cn SERVICE BUS (SOI) soi-odp.nmdis.gov.cn DATA PROVIDER (DP) 160 Gb dp-odp.nmdis.gov.cn MONITORING (SYS) 1 Gb sys-dop.nmdis.gov.cn

Basic requirements to install CentOS Component ID User’s functions PORTAL, IS, SOI, DP jboss – management application server’s JBoss 4.2.3, Jboss 5.1.0, Apache-Tomcat 6 zabbix – management monitoring client DB postgres – management DBMS Postgresql 8.4 System localization - UTF-8.en_EN Time zone - GMT+0 All connected hard disk must be in LVM Set of basic software installation– minimal. IMPORTANT: The password must contain Latin characters from az in upper and lower case Special characters!»№~%?*()@#$%^&; The password must be minimum of 8 characters

Users environment Component ID Users Working directory PORTAL/SSO jboss zabbix /opt/portal /opt/portal/zabbix DB postgres /opt/db/PostgreSQL /opt/db/zabbix IS /opt/is /opt/is/zabbix SOI /opt/soi /opt/soi/zabbix DP /opt/dp /opt/dp/zabbix SYS /opt/sys/PostgreSQL /home/zabbix

System environment Component ID PORTAL/SSO DB IS SOI DP Users Working directory PORTAL/SSO $JAVA_HOME $JBOSS_HOME $ZABBIX_HOME /opt/portal/java/jdk1.7.0_51 /opt/portal/jboss-portal-2.7.2 /opt/portal/zabbix DB $PGDATA /opt/db/PostgreSQL/8.4/data /opt/db/zabbix IS /opt/is/java/jdk1.7.0_51 /opt/is/jboss-4.2.3.GA /opt/is/zabbix SOI /opt/soi/java/jdk1.6.0_43 /opt/soi/jboss-5.1.0.GA /opt/soi/zabbix DP /opt/dp/java/jdk1.7.0_51 /opt/dpjboss-4.2.3.GA /opt/dp/zabbix

Software versions Component ID Sotware PORTAL JBoss AS 4.2.3 GA (jboss-portal-2.7.2) Tomcat 6 JDK 1.7 DB PostgreSQL 8.4 IS JBoss AS 4.2.3 GA SOI JBoss AS 5.1.0 GA JDK 1.6 DP 10

Basic installation and configuration Action Command For all components Login via root ----- Install CMD manager configure firewall ‘yum install system-config-firewall-tui’ Install MidNightComander ‘yum install mc’

Basic installation and configuration Action Command For all components Disable Selinux: Open SElinux config Change “SELINUX=enforcing” to “SELINUX=disabled” ‘vi /etc/selinux/config’ Press “i” to enable write mode, edit “SELINUX” option and save file - press “Esc”, then “:wq” and press “Enter” Disable system Firewall system-config-firewall-tui

Basic installation and configuration Action Command For all components Install OpenSSH client and mlocate ‘yum install openssh-clients-5.3p1-94.el6.x86_64 mlocate’ Update you system and further reboot your system ‘yum update && shutdown –r now’

Java installation and configuration Action Command For all components Create a directory for the component (named with component ID) ‘mkdir /opt/<component_ID>’ Installing Java ‘mkdir /opt/<component_ID>/java’ Create Java directory

Java installation and configuration Action Command For components id Portal, DP, IS Download java installer and extract archive ‘tar –xfv jdk-7u51-linux-x64.tar.gz’ For component id SOI Download java installer and extract archive ‘tar –xfv jdk-6u45-linux-x64.tar.gz’ 15

Java installation and configuration Action Command For components id Portal, DP, IS Create alternatives: /usr/bin/java /usr/bin/javac /usr/bin/jar ‘alternatives --install /usr/bin/java java/opt/portal/java/jdk1.7.0_51/bin/java 100 && alternatives --install /usr/bin/javac javac /opt/portal/java/jdk1.7.0_51/bin/javac 100 && alternatives --install /usr/bin/jar jar /opt/portal/java/jdk1.7.0_51/bin/jar 100’ For component id SOI Create alternatives: /usr/bin/java /usr/bin/javac /usr/bin/jar ‘alternatives --install /usr/bin/java java/opt/portal/java/jdk1.6.0_45/bin/java 100 && alternatives --install /usr/bin/javac javac /opt/portal/java/jdk1.6.0_45/bin/javac 100 && alternatives --install /usr/bin/jar jar /opt/portal/java/jdk1.6.0_45/bin/jar 100’

Java installation and configuration Action Command For components id Portal, DP, IS Add link to JAVA_HOME in ‘/etc/profile’ run: ‘vi /etc/profile’ add following line: ‘export JAVA_HOME="/opt/portal/java/jdk1.7.0_51"’ save file ‘echo $JAVA_HOME && cd $JAVA_HOME’ && $JAVA_HOME/bin/java -- version’ Test JAVA_HOME

Java installation and configuration Action Command For component id SOI Add link to JAVA_HOME in ‘/etc/profile’ run: ‘vi /etc/profile’ add following line: ‘export JAVA_HOME="/opt/portal/java/jdk1.6.0_45“’ save file ‘echo $JAVA_HOME && cd $JAVA_HOME’ && $JAVA_HOME/bin/java -- version’ Test JAVA_HOME 18

For components id PORTAL, IS, SOI, DP For component id PORTAL JBoss AS installation Action Command For components id PORTAL, IS, SOI, DP Create user ‘jboss’ and set password in your system ‘useradd jboss && passwd jboss’ For component id PORTAL Download tar archive your component in folder ‘/opt/portal’, extract it and set the destination folder owner to user ‘jboss’ ‘tar –xfv jboss-portal-2.7.2.tar.gz && chown –R jboss. /opt/portal/jboss-portal-2.7.2’

JBoss AS installation Action Command For component id IS Download tar archive your component in folder ‘/opt/is’, extract it and set the destination folder owner to user ‘jboss’ ‘tar –xfv jboss-4.2.3.GA.tar.gz && chown –R jboss. /opt/is/jboss-4.2.3.GA’ For component id DP Download tar archive your component in folder ‘/opt/dp’, extract it and set the destination folder owner to user ‘jboss’ ‘tar –xfv jboss-4.2.3.GA.tar.gz && chown –R jboss. /opt/dp/jboss-4.2.3.GA’ 20

JBoss AS installation Action Command For component id SOI Download tar archive your component in folder ‘/opt/soi’, extract it and set the destination folder owner to user ‘jboss’ ‘tar –xfv jboss-5.2.0.GA.tar.gz && chown –R jboss. /opt/soi/jboss-4.2.3.GA’ 21

For components id PORTAL, IS, SOI, DP JBoss AS installation Action Command For components id PORTAL, IS, SOI, DP Copy JBoss application server run script in ‘/etc/init.d’ ‘cp $JBOSS_HOME/bin/jboss_init_redhat.sh /etc/init.d’ ‘chkconfig --add jboss_init_redhat.sh && chkconfig --levels 2345 jboss_init_redhat.sh on’ Add JBoss AS run script in autorun on the 2345 run levels

Monitoring client installation Action Command For all components Create user ‘zabbix’ and set password in your system ‘useradd zabbix && passwd zabbix’ Download tar archive of zabbix client to ‘/opt/<component_ID>’,extract it and set the destination folder owner to user ‘zabbix’ ‘tar –xfv zabbix.tar.gz chown –R zabbix. /opt/<component_ID>/zabbix’

Monitoring client installation Action Command For all components Copy zabbix run script in ‘/etc/init.d’, change $ZABBIX_HOME in script ‘cp /opt/<componeni_id> /zabbix/zabbixd /etc/init.d’ Add zabbix run script in autorun on the 2345 run levels ‘chkconfig --add zabbixd && chkconfig --levels 2345 zabbixd on’

Monitoring client configuration Action Command Configure zabbix_agentd.conf ‘vi$ZABBIX_HOME/conf/zabbix_agentd.conf’ For example: PidFile=$ZABBIX_HOME/log/zabbix_agentd.pid LogFile= $ZABBIX_HOME/log/zabbix_agentd.log DebugLevel=3 Server=XXX.XXX.XXX.XXX ListenPort=10050 StartAgents=3 Hostname=portal-odp Timeout=3 LogFileSize=2 EnableRemoteCommands=1 Set IP address for Zabbix server Set host name for Zabbix server

Only for component ID PORTAL Tomcat installation Action Command Only for component ID PORTAL ‘tar –xfv apache-tomcat-6.0.29.tar.gz chown –R jboss. /opt/portal/apache-tomcat-6.0.29’ Download tar archive sso application server in ‘/opt/portal’ Extract and set the destination folder owner to user ‘jboss’ ‘cp /opt/”componetn” /apache-tomcat-6.0.29/bin/tomcat.sh /etc/init.d’ Copy run script in ‘/etc/init.d’ ‘chkconfig --add tomcat.sh chkconfig --levels 2345 tomcat.sh on’ Add the script to auto run mode on the 2345run levels

PostgreSQL installation Action Command Only for component ID DB Download and install postgresql-8.4.19-1-linux-x64.run to the folder ‘/opt/db’ ‘chmod +x postgresql-8.4.19-1-linux-x64.run’ Install DBMS postgresql-8.4.19 ‘./postgresql-8.4.19-1-linux-x64.run’ Set db directory /opt/db/PostgreSQL and password for super user db

PostgreSQL installation Action Command Only for component ID DB Edit $PGDATA/pg_hba.conf file ‘vi /opt/db/PostgreSQL/8.4/data/pg_hba.conf’ Add lines how may connected to data base server For example: host all all IP/prefix md5 Set owner postgres to $POSTGERS_HOME ‘chown –R postgres. /opt/db/PostgreSQL’ ‘service postgres-8.4 restart’ Restart DBMS

Increase security CentOS Action Command For all components Add mount option's in ‘/etc/fstab’ to directories ‘/tmp’, ‘/var/tmp’ and ‘/dev/shm’ ‘vi /etc/fstab’ add option’s nodev,nosuid,noexec for /tmp, /vat/tmp and /dev/shm and save file Locked to launch shell programs: ‘/usr/bin/curl’, ‘/usr/bin/perl*’, ‘/bin/chmod’, ‘/usr/bin/*ftp*’, ‘/bin/umount’ ‘chmod 754 /usr/bin/curl && chmod 744 /usr/bin/perl* && chmod 754 /bin/chmod && chmod 754 /usr/bin/*ftp* && chmod 754 /bin/umount &&’

Networking

Networking NAT routing Redirecting requests for public port connections handled by the iptables, by creating rules in the table NAT chain PREROUTING and OUTPU Component ID Destination Port Redirect Port PORTAL 80 8081 IS 8080 SOI 18080 DP

Networking (local interaction) Source IP or Domain Source port Destination IP or Domain Destination port portal-odp.nmdis.gov.cn db-odp.nmdis.gov.cn is-odp.nmdis.gov.cn soi-odp.nmdis.gov.cn dp-odp.nmdis.gov.cn sys-dop.nmdis.gov.cn any

Networking Interaction ODP Regional node to a ODP Global node Source IP or Domain Source port Destination IP or Domain Destination port portal-odp.nmdis.gov.cn db-odp.nmdis.gov.cn is-odp.nmdis.gov.cn soi-odp.nmdis.gov.cn dp-odp.nmdis.gov.cn sys-dop.nmdis.gov.cn any portal.odp.meteo.ru 80,8080,8081 db.odp.meteo.ru none is.odp.meteo.ru 80,8080 soi.odp.meteo.ru 80,18080 dp.odp.meteo.ru 80,8081 mon.odp.meteo.ru 10050,10051

Networking Interaction ODP Global node to a ODP Regional node Source IP or Domain Source port Destination or Domain Destination port portal.odp.meteo.ru db.odp.meteo.ru is.odp.meteo.ru soi.odp.meteo.ru dp.odp.meteo.ru sys.odp.meteo.ru any portal-odp.nmdis.gov.cn 20,21,22,80,8080,8081 db-odp.nmdis.gov.cn 20,21,22,5432 is-odp.nmdis.gov.cn 20,21,22, 80,8080 soi-odp.nmdis.gov.cn 20,21,22, 80,18080 dp-odp.nmdis.gov.cn 20,21,22, 80,8081 sys-dop.nmdis.gov.cn 20,21,22,5432, 10050,10051

Networking with in Internet user’s Source IP or Domain Source port Destination IP or Domain Destination port Interaction node *. nmdis.gov.cn (China) to a Internet portal-odp.nmdis.gov.cn any 80,443 db-odp.nmdis.gov.cn is-odp.nmdis.gov.cn soi-odp.nmdis.gov.cn dp-odp.nmdis.gov.cn sys-dop.nmdis.gov.cn Interaction Internet to a node *. nmdis.gov.cn (China) 80,8080,8081 none 80,8080 80,18080 80,8081

Questions?