(Message inbox:3706) Return-Path: jh@ATHENA.MIT.EDU Received: by JASON.MIT.EDU (5.45/4.7) id AA14629; Fri, 22 May 87 09:47:52 EDT Received: by ATHENA (5.45/4.7) id AA02895; Fri, 22 May 87 09:47:31 EDT Received: by M4-035-U.MIT.EDU (5.45/4.7) id AA14463; Fri, 22 May 87 09:46:24 EDT Date: Fri, 22 May 87 09:46:24 EDT From: Joe Harrington Message-Id: <8705221346.AA14463@M4-035-U.MIT.EDU> To: alix@ATHENA.MIT.EDU, athena-ws@ATHENA.MIT.EDU, connie@ATHENA.MIT.EDU, hoffmann@ATHENA.MIT.EDU, watchmakers@ATHENA.MIT.EDU, billb@ATHENA.MIT.EDU, lbm@ATHENA.MIT.EDU, keltie@ATHENA.MIT.EDU Subject: [jh@ATHENA.MIT.EDU: ZBT is up!] Cc: jh@ATHENA.MIT.EDU Reply-To: jh@ATHENA.MIT.EDU The emacs mail auto-fill-mode killed you guys in the To: line of the message I just sent. Here it is... (sorry to those in the original To: list and also on athena-ws) --jh-- From: Date: Fri, 22 May 87 09:11:53 EDT To: lgmaint@ATHENA.MIT.EDU, lgnews@ATHENA.MIT.EDU, lgconsult@ATHENA.MIT.EDU, lgcontact@ATHENA.MIT.EDU, geer@ATHENA.MIT.EDU, treese@ATHENA.MIT.EDU, nessus@ATHENA.MIT.EDU, bjk@ATHENA.MIT.EDU, pjhoward@ATHENA.MIT.EDU alix, athena-ws, connie, hoffmann, watchmakers, billb, lbm, keltie Subject: ZBT is up! Full-Name: Joe Harrington CC: jh@athena.mit.edu Reply-To: jh@athena.mit.edu (This is a long message describing the details of the setup at ZBT. The To: list is also long. Please be careful about the inclusivity of To: fileds in replies. --jh--) Athena installed the ZBT cluster on Wednesday, completing the deployment of the first round of off-campus living group clusters. Things look pretty stable now, though a few loose ends still remain. ZBT is the first group to receive a set of modifications we at pika developed and tested to make the cluster easier to work in than a standard Athena public cluster. These modifications went into the system with little hassle in about a night's worth of hacking. The rest of this message describes the setup as a whole. ZBT has eleven machines, an LN03, and an LA-100, and is connected to the campus through a 14.4kB modem. The modem is directly connected to a gateway (gw.zbt.mit.edu) which no one touches but Telecommunications. The gateway talks to a thin ethernet which runs around the room. The ethernet reaches all the machines via a small transceiver (one fits inside each machine's back cover), which transfers the signal to the thick ethernet cable which DEC machines use. The eight client machines (all DEC VAXStation II/RC's), riddler.zbt.mit.edu, mrfreeze.zbt.mit.edu, falseface.zbt.mit.edu, catwoman.zbt.mit.edu, kingtut.zbt.mit.edu, bookworm.zbt.mit.edu, minstrel.zbt.mit.edu, and egghead.zbt.mit.edu, mount RVD's for their /usr software from joker.zbt.mit.edu, and access penguin.zbt.mit.edu for users' files. The printers are both connected to joker's tty ports, and joker also acts as the local nameserver. Joker and penguin are both BA-123 MicroVAX II's. The cluster was originally configured as a regular public cluster, with a few modifications to site-specific files. A different /etc/named.boot, /etc/named.local, and /etc/resolv.conf allow them to be in their own namespace (.zbt.mit.edu), with names being served by joker from its /etc/named.zbt.db and /etc/named.zbt.invdb. Joker has a special /etc/named.boot to accomodate this. Since the 70 MB disks in joker are not large enough to hold the entire 114 MB of /usr, the /usr directories are on two RVD's rather than the standard single RVD. /etc/rvdtab and the /usr symlinks are therefore different from the public model. Joker has files /site/rvd/rvdenable, /site/rvd/rvddb, and has the rvd server variable set in /etc/rc.common. We added two new entries in /etc/printcap for their printers, and gave penguin a new /etc/fstab, to accomodate its two extra disks. Joker has the same fstab as the public workstations, since its extra disks are occupied by RVD's. We then made modifications for user-friendliness. We replaced /bin/login with the version from paris.mit.edu, and we turned off pwserv in /etc/rc.common. This way only people in the local password file may log in, the system attempts to get Kerberos tickets (but does nothing different if it fails), no directories are created or destroyed, and the password file is not changed by the system. After we delivered the system, installed the machines, and got them working, Jeff Arenberg (their contact and system maintainer for the summer) and I spent until Thursday morning putting in the pika changes. The details I leave for their system.mods.zbt file (attached below), but the basic system is centered on penguin (the non-RVD-serving worldbox) operating in a timesharing emulation mode, and the eight "clients" having the same software configuration and no user files. The clients receive password file propagation from penguin, and have several RFS-based links to penguin. They otherwise remain the same as they came. Penguin becomes the hub of the universe. It is there to which they rlogin from campus, and their home directories and community software are all located there, to be accessed via the RFS links on the clients. When NFS becomes available later this summer, it should replace the RFS almost invisibly. Penguin also has the master password and group files, runs a nightly backup, and has services like at. In the near future, I will install mail, and then system messages will work. The addition of mail and messages will complete the additions from pika. Jeff installed the XV10R4 xterm as the system standard. The following is their system.mods.zbt file. Each living group would be well advised to keep such a file if they make any changes to the basic system. This will help Athena to identify possible problems, and will make installing a new release much easier for all concerned. Please send me mail if you have questions about any of this, or ideas for how we might improve the system in the living groups. --jh-- --------Inserted file: penguin:/zbt/etc/system.mods.zbt--------- (sys) Non-standard filed on penguin compiled with -DTRUSTED_HOSTS_KLUDGE. (from pika) penguin runs /etc/athena/mountd, but does not mount anything by default. (sys) pwserv startup eliminated from rc.common. Login replaced by version from PARIS.MIT.EDU. (sys) /etc/syslog.conf modified on clients to turn off /dev/console Kerberos notices. (sys) Made at work by adding atrun to crontab on penguin. /site/usr/spool/at is symlinked to /penguin/site/usr/spool/at on the clients. Had to make /site/usr/spool/at and /site/usr/spool/at/past on penguin. Atrun runs every five minutes for the moment. Note: it's running on penguin even if you submit the job on a client. But this should be ok because the only files that aren't shared between penguin and the clients are those in /tmp. (sys) Root password changed. (sys) Nightly backup script (/zbt/etc/backup) in crontab on penguin. (sys) Put /etc/rmtmnt penguin /penguin in all client crontabs to run every five minutes. (sys) Added zbt1 and zbt2 to #-file search in /usr/lib/crontab. (community) Directory structure on penguin: /penguin --> / to preserve equivalent file structure with clients /zbt1 mount point for /dev/ra1c, home directories /zbt2 mount point for /dev/ra2c, home directories /zbt --> /penguin/site/zbt, common files /zbt/bin executables /zbt/doc documentation /zbt/etc etc-ish files /zbt/games games /zbt/games/lib auxiliaries for zbt-specific games /zbt/lib useful directories full of things /zbt/lib/newuser.template generic new user files (for newuser program) /zbt/man man pages /zbt/src source files; both zbt-specific and for browsing /zbt/usr/games/lib common non-zbt-specific games auxiliary files Most /zbt directories are mode 1775, group zbt readable but sticky. Links on clients: /penguin rfs mount point for penguin, mounted in /etc/rc.common. /zbt -> /penguin/zbt /zbt1 -> /penguin/zbt1 /zbt2 -> /penguin/zbt2 /site/usr/games -> /zbt/usr/games Brought over a bunch of things from pika to /zbt/bin, /zbt/etc, /zbt/man, and /zbt/doc. (users) Split home directories between /zbt1 and /zbt2. Put same in passwd file. (users) Created zbt group in /etc/group and assign everybody to it. (users) /etc/group, /etc/passwd, and /etc/passwd.local propagation working in crontab. Script is in /zbt/etc/passwd.prop. (games) Copied /usr/games/lib from the RVD to /zbt/usr/games/lib, reset ownerships. This way, site-wide high scores exist, and problems with read-only files don't exist. ----------- Still to do: (sys) Sendmail running. Server config file on penguin stolen with some hacking from eddie.mit.edu. Client config file made by modifying athena workstation config file to send to penguin instead of athena. Penguin's /etc/rc.local edited for automatic sendmail startup. All clients except eve get links from /usr/spool/mail -> /penguin/usr/spool/mail. (community) Msgs work. /site/usr/msgs -> /penguin/site/usr/msgs on clients. Needed to hack penguin's config file to point to /site/usr/lib/aliases instead of /usr/lib/aliases, since the latter is on the RVD. ---------- Ideas from pika: (relevant directories in parens. You are invited to copy pika files from pika by either anonymous ftp to adam.pika.mit.edu, or rlogin as guest with no password. We would appreciate your being considerate and copying large files in the off-hours, so the phone line doesn't get clogged.) To get rid of toehold (no more "hit any key to start", login server always displayed, rvd's never unmount, so login is faster): Comment out console line in /etc/ttys on clients. Insert line in /etc/ttys on clients: ttyv0 "/etc/xterm -L =80x65+0+0 -fn vtsingle -i :0" xterms on secure window="/etc/Xqvss 0" Insert line in /site/usr/lib/crontab on all clients: 0,10,20,30,40,50 * * * * root /etc/athena/up -d Delete /etc/passwd.local line in /etc/athena/deactivate (this way there are fewer passwd files to worry about keeping identical), and passwd.real works permanently, so password changes with passwd.real on the server are correct and never get overwritten). You get this automatically by killing toehold. Add some hostname aliases on joker in named.* (one is there for you to look at). You can also add aliases for the campus machines that you use, so you don't have to type .mit.edu all the time. (Ask how it is done at pika if unsure how). To promote sharing, we would really encourage you to make an anonymous ftp account (with home directory /), and a passwordless guest account. We have done these things, and find that they are used a lot in the spirit they were intended for. The system is secure from breakins over the net to the extent that an Athena timesharing system is secure, so you needn't be worried about crackers coming in and crashing your machines much. We find it useful to share software this way, and it was useful for SIPB members to use when we asked them to debug rrn. It also cuts down on the sharing of housemembers' accounts by short-term visitors (brothers, sisters, friends from other schools, etc.). We create accounts fairly readily for anyone who asks (alums, friends, etc., but not total strangers). Get some games, and better versions of software than Athena's (explore /pika/*): working clu language (/pika/clu) gnuplot, phantasia, xstar, othello, gnuchess, hpchess, warp. (/pika/bin /pika/games /pika/lib /pika/doc /pika/man /pika/src) /usr/games/adventure doesn't work. Version in /pika/games works. We recompiled hunt without -DBROADCAST and put it in /pika/games. Old hunt is still in /usr/games and /usr/games/lib, but hoses the net. Non-broadcast hunt requires /etc/hosts to contain all client machines. You must comment out the rebuild of /etc/hosts in /etc/rc.local for this to work, and then add the names of your clients and home directory server to /etc/hosts. See adam's /etc/hosts and /etc/rc.local if you have questions. hack source is in /pika/src/games so people can look at it. -------- Random notes: Sail still doesn't work. Doesn't work on Athena either, so... Compatibility mode games don't work.