Server/Setup
This is a list of things to do when buying a new server for Wikimedia Italia.
Distribution
We usually opt for Debian GNU/Linux stable.
Register codename
Pick a server codename from this page:
You can open a discussion in the talk page.
Do not root, we sudo
We do not enter via root in our servers. This is bad auditing practice.
Create unprivileged users. They can be added in the sudo group.
Configure sudo
Our users are authenticated via SSH keys and they have not any password. So we can remove password authentication from sudo, for sudoers.
Run visudo and do this change:
/root/scripts/ -%sudo ALL=(ALL:ALL) ALL:ALL +%sudo ALL=(ALL:ALL) NOPASSWD:ALL
Add Unix user with sudo and SSH key
To add an Unix user with sudo and SSH key, just run this script:
# fill USERNAME="FOO..." KEY="ssh-key....." adduser "$USERNAME" --disabled-password mkdir --parents /home/"$USERNAME"/.ssh echo "$KEY" >> /home/"$USERNAME"/.ssh/authorized_keys chown "$USERNAME":"$USERNAME" -R /home/"$USERNAME"/.ssh chmod 640 /home/"$USERNAME"/.ssh/authorized_keys chmod 755 /home/"$USERNAME"/.ssh
You can create a script in your server if you want:
Version configuration
We hold server configurations in a public repository. Download it in your server:
cd /etc git clone "https://gerrit.wikimedia.org/r/wikimedia-it/wmit-infrastructure"
Then please create some symbolic links pointing to that repository so you can save the history of your changes.
For example, to have /etc/apache2/sites-available pointing to /etc/wmit-infrastructure/servers/FOO/conf/apache2/sites-available or something like that.
NOTE: Remember to do not save passwords or other secrets in this way.
NOTE: Please commit old changes if someone have not committed them.
NOTE: Please commit your changes when you finished.
NOTE: Then push.
NOTE: You will need to be added in the Gerrit wikimedia-it-wmit-infrastructure group to be able to push.
Mirrored source code: