Admin information

All information or instructions regarding admin related tasks.

Guest comes

• Add user to chair wiki → Admin → UserManager → Add new user
• Add user to chair mailing list → ssh lsadmin → /tuminfo/schlichter/lists/cm-guest
• Give MAC address IP address → rbgstruktuapp (cm.in.tum.de - guest%%)
• Add guest entry in wiki → here

Guest goes

• Remove from LDAP group (optional il11)
• Delete server access (optional)
• Delete chair wiki account (dokuwiki)
• delete IP addresses (guest%)
• Move guest entry to old chair members → here

There are two optinos to configure an RGB-Account for a guest:

1. Local Guest Account
2. complete user request

(1) is for purposes like access to the VPN through the LRZ-Network or usage of local services of the chair while (2) should be considered for long-term users with access to all services and devices like Printers,PCs,Mailing Services etc..

RBG-Webapp → Benutzer → Lokalen Gast anlegen

Now you should see the form for all needed Information of the user.
If the user needs access to the VPN you should additionally set the “modem”-Flag
After confirming the id and the password are displayed. The Guest Account is now set and the user himself has to connect to the Network.

More instructions on how to use the local guest account for the LRZ-VPN can be found here.

To get a fully RBG-Account first you have to request an .in.tum.de E-Mail from RBG-Systemgruppe so the user is reachable. After the user confirms his account and changes his password via ucentral feel free to add the user to the relevant groups and projects especially the official Connected Mobility Group. For more Information for the user visit New Members

The chair has five printers, the ones described in the printers section and the secretary printer in room 01.05.052.

Only the color cartridge needs to be replaced. An empty maintenance kit can be ignored. To change the toner cartridge write a mail to RBG-Wartung with the following text:

Hallo Hardwaregruppe,

könnt ihr bitte den folgenden Toner bestellen:
Lehrstuhl: I11 - Ott
Telefon: <phone>
Druckertyp: <printer-device>
Toner: <printer-cartridge-name-from-web-interface>

Viele Grüße
<your-name>

Most of the time they have the matching toner cartridge on stock and ready to pick up. The hardware group is in room 00.07.054 or 00.07.040. After replacing the respective cartridge bring the old one back to the RBG hardware group for disposal. Instructions on how to replace the cartridge is inside the new cartridge package.

The webapp offers several settings that can be controlled by the chair administrator. To get access the RBG-Systemgruppe needs to be contacted. Those things can be controlled by the webapp:

• LDAP groups
• Host entries (new/edit)
• update user information
• new users (guest/employees)

TODO add more INFOs

The rooms can be modified, more electrical plugs, ventilation, different windows, etc. Contact Ms. Karin Peraus by E-Mail or phone (+49 (173) 3874720). She takes care of coordination with Caverion and the financial department. After checking out the conditions in the room and wish list with modifications she will present an estimate of costs. After the decision usually she is contacted or the financial department (Sabine Bayer E-Mail) to start the process.

Dokuwiki is the central knowledge database for the chair.

There are two ways to log in on dokuwiki. LDAP authentication is activated and the in.tum LDAP server is set.

1. in.tum Account, as long as the account is assigned to the il11 LDAP group
2. Settings → Administrative Tasks → User Manager → Add/Delete new users

Guests for example can get a normal User account without going through the hassle of applying for an in.tum account.

Once a week a change notification is sent to the chair mailing list. This is achieved by a rather hacky way. User can usually subscribe to wiki pages on their own. They have to go on the respective page and can choose the page (whole subtree/single page) and the quantity (each change, once every N hours). The account of the secretary (lissner@in.tum.de) is set for a subscription, each week a Mail about all sites that were changed is sent. In the dokuwiki subscription mechanism some hacking was done. Each time the mechanism sees the secretary Mail address it is substituted by the chair mailing list (lissner@in.tum.de → cm-team@in.tum.de). So instead of the secretary the whole chair recieves the subscription.

dokuwiki/inc/subscription.php
#addition after line 602
        if($subscriber_mail == "lissner@in.tum.de"){
            $mail->bcc("cm-team@in.tum.de");
        }   
        else{
            $mail->bcc($subscriber_mail);
        }

To change the footer to a link to our Impressum you need to change the tpl_footer file in the correct theme folder. Have a look what theme is activated under “Configuration Settings” and activate the tpl»bootstrap3»showBadges setting for the Bootstrap3 theme. The file can be found under /var/www/dokuwiki/lib/tpl/boostrap3/tpl_badges.php. Replace the badges buttons with a link to the Impressum:

<?php
/**
 * DokuWiki Bootstrap3 Template: Badges
 *
 * @link     http://dokuwiki.org/template:bootstrap3
 * @author   Giuseppe Di Terlizzi <giuseppe.diterlizzi@gmail.com>
 * @license  GPL 2 (http://www.gnu.org/licenses/gpl.html)
 */

// must be run from within DokuWiki
if (!defined('DOKU_INC')) die();

if (bootstrap3_conf('showBadges')):

  $target  = ($conf['target']['extern']) ? 'target="'.$conf['target']['extern'].'"' : '';
  $dw_path = dirname(tpl_basedir());

?>
<div class="text-center hidden-print">
  <a href="https://wiki.cm.in.tum.de/doku.php?id=wiki:impressum" title="Impressum" >
    Impressum
  </a>
</div>
<?php endif; ?>

• Log in on the Dell Support Website
• Click on Support → Contact and fill in the Service Tag
• Describe the problem and send an E-Mail or call the phone number provided there, usually the conversation is held in German

The LRZ provides a GPU server for Machine Learning tasks. Currently the system has 8 x NVIDIA Tesla P100 cards with each 16GB RAM connected to a 40 core (Intel Xeon) host machine. This system is called DGX-1 and can run complex machine-learning tasks which are available via Docker images.

1. First a LRZ Linux Cluster account is required
2. Create an incident ticket servicedesk@lrz.de with subject 'Linux Cluster' and ask for DGX-1 access. Briefly describe the research (what to do - nlp, image processing, etc.) and the nature (how to do - libraries, etc.) of the application.
3. The above two steps can also be merged into one. When sending a request for the Linux Cluster write in the description that you want to use the Machine Learning System (DGX-1).
4. After the application/incident ticket got accepted you can log in with your LRZ account credentials to the reservation system that is only reachable from the MWN network.
5. Upload an SSH key into the MyAccount settings
6. Reserve the system for up to a maximum of 6 hours
7. When your reservation starts you will receive an E-Mail with further instructions on the address of the machine and how to connect - The SSH Key in the previous step is mandatory for this!
8. READ THIS WEBSITE → LRZ Information

The mailing lists are created and managed on the lsadmin (vmrbg9) machine from the RBG. The RBG needs to manually add new user accounts to the machine, the password is also kept locally a LDAP password change won't change it here.

ssh vmrbg9.informatik.tu-muenchen.de
cd /tuminfo/schlichter/lists/
ls -lah

There is one admin mailing list (admin@cm.in.tum.de) which is used for various purposes/automatic E-Mails:

• wiki - vpn account activation
• wiki - ethernet ip address
• wiki - new opennebula account
• wiki - add publication to chair website/mediatum

For a inter-faculty project we requested the domain mobility.tum.de for this domain the MX (Mailserver) is configured to mailschlichter. We can create mobility mail addresses by prepending “mobility-” to the list name.
E.g. the file mobility-info in the /tuminfo/schlichter/lists/ directory corresponds to the address info@mobility.tum.de

Um in.tum Mails schon auf dem Mailserver zu filtern kann man entsprechende Regeln auf ucentral einrichten:

Ucentral Mail Anleitung

Damit lassen sich Abwesenheitsnotizen, Weiterleitungen oder Sortieren realisieren. Die Ordner müssen vorher erstellt werden!

if header :contains "To" "promotionsvortrag@in.tum.de" {
       #Wird als gelesen markiert
        addflag "\\Seen";

        fileinto "INBOX.Promotionsvortrag";
        stop;
}
# iDrac Patrol Read Operationen
if header :contains "Subject" "Patrol Read operation" {
       #Wird als gelesen markiert
        addflag "\\Seen";

        fileinto "INBOX.idrac";
        stop;
}
# Cron Mails -> sollte man ab und zu überprüfen
if header :contains "Subject" "Cron" {
       #Wird als gelesen markiert
       addflag "\\Seen";

        fileinto "INBOX.cron";
        stop;
}
 

Netzwerkprotokoll zur Abfrage und Änderung von Informationen von verteilten Verzeichnisdiensten.

Adresse:   ldap.in.tum.de
Port:      389
base:      'ou=IN,o=TUM,c=DE'
group:     'cn=il11admin,ou=dnGruppen'

Vorausgesetzt ldap-utils ist installiert, kann man die Parameter auch testen:

ldapsearch -x -ZZ -h ldap.in.tum.de -p 389 -b "<base>" "<filter>"

-x Simple authentication

-ZZ TLS request with successful response

-h Host

-p Port

-b Base

Certificates for a domain are requested through the RBG-System group. Write an E-Mail to them asking for a certificate for this domain. After they are created you can pick them up with a USB stick or they can be sent to your in.tum mail address if you have an installed user certificate and can receive encrypted E-Mails.
Instructions on how to convert the certificate file

• Extract private key

  openssl pkcs12 -in <p12-file> -nocerts -out private.key -nodes 

• Extract certificates

  openssl pkcs12 -in <p12-file> -clcerts -nokeys -out cert.pem

• Get a full certificate chain

  # post content of certificate into this website
  https://tools.keycdn.com/certificate-chain
  # copy content to a new file
  vim fullchain.pem
  # delete last certificate section (anchor)

• Copy them to the right place on the server/vm

  # certificate first
  sudo mv cert.pem /etc/ssl/certs/
  # now private key
  sudo mv private.key /etc/ssl/private/
  sudo chmod o-r /etc/ssl/private/private.key
  sudo chown root:ssl-cert /etc/ssl/private/private.key

• Apache Configuration /etc/apache2/sites-available/defaul-ssl.conf

  <VirtualHost *:443>
  
          SSLEngine on
          SSLCertificateFile /etc/ssl/certs/one09_fullchain.pem
          SSLCertificateKeyFile /etc/ssl/private/one09_key.key
          SSLCACertificateFile /etc/ssl/certs/Deutsche_Telekom_Root_CA_2.pem
          SSLCertificateChainFile /etc/ssl/certs/one09_fullchain.pem
          SSLHonorCipherOrder on
          SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
          SSLProtocol all -SSLv2 -SSLv3
  
          DocumentRoot /var/www/html
  
          <Directory "/var/www/hotcrp-internet-qoe18">
                  Options Indexes Includes FollowSymLinks
                  AllowOverride all
                  Require all granted
          </Directory>
          Alias /internet-qoe18 /var/www/hotcrp-internet-qoe18
  
          ErrorLog ${APACHE_LOG_DIR}/error.log
          CustomLog ${APACHE_LOG_DIR}/access.log combined
  
  </VirtualHost>

Following steps have to be performed for a new admin/user:

Struktur:

• Uni (TUM) - Fakultät (Informatik) - Lehrstuhl (I11 CM - Connected Mobility)
  • Lehrstuhl relativ jung (2014), alter Lehrstuhl Prof. Schlichter, Post-Docs+Doktoranden übernommen
  • “Drei” Gruppen am Lehrstuhl: Recommender, Social, Mobility; Social Gruppe nur formell unter i11
• Service-Dienstleister: TUM-IT (zentral TUM), LRZ, RBG (nur Mathematik+Informatik, paar Ausnahmen)

Räume zeigen + erklären:

• Archiv (Alte Klausuren, Getränke eigentlich für Gäste)
• Küche (Benutzung der Teller, Besteck, Kaffee, Tee) - Kaffeekasse (Kitty) bei Christine im Büro
• Studentenraum (Arbeitspläte Thesis Studenten, Schliesfächer für eigenes Zeug)
• Serverraum (gute Kühlung, Social Server, WLAN-Testbed, eigentlichen Server stehen im Keller)
• Druckerraum (Arbeitsplatz Elektronik, 3D-Drucker, normale Drucker)
• Glaskasten (Besprechungen Studenten/Mitarbeiter, Fernseher für Präsentationen)
• Meeting Raum (Beamer, Anschlüsse am Tisch - Netzwerk+Beamer, Netzwerk zwei Kabelzugänge für Gäste il11_4)
• Büros Christine (Sekretärin, Büromaterial im Schrank) + Jörg (Professor)
• Drei Hardwareschränke (01.05.041, 01.05.034B und Gang, Schlüssel bei Christine)

Accounts:

• Unterschied in.tum und tum Account erklären (RBG-LRZ)
• in.tum Account Passwort (zurücksetzen beim Helpdesk/Systemgruppe)
• in.tum Zertifikat beantragen (Student Servicebüro, Mitarbeiter RBG)
• StrukturDB (LDAP) in.tum Kennung in Gruppen eintragen: vpn, il11, il11admin, il11lsadmin
  • LDAP Erklärung (zentrale Verwaltung von Kennungen)
  • Zwei LDAPs: in.tum (nur Informatik) und tum LDAP (tum Account)
  • meisten Services am Lehrstuhl über in.tum
  • Wiki, Icinga, Orders, Inventory, Awx
• LRZ Gitlab der Lehrstuhl Gruppe als Owner hinzufügen

Arbeitsrechner:

• Laptop oder PC
  • In der Probezeit, NUC oder Optiplex, eigenen Laptop eher nicht, Arbeit und Privates trennen
  • Nach der Probezeit mit Jörg reden eigener Laptop Budget, Bestellung aus Rahmenvertrag (Apple oder Lenovo)
  • Festplatte verschlüsseln - Voraussetzung für Privaten! (Passwörter, ssh-keys, etc.)
  • Am besten Linux, nicht zu kompliziert
• Thunderbird einrichten (Mail Prinzip, Inbox immer leer verschieben in: Archiv, Wait, Action, Nostalgy Plugin für verschieben durch Shortcuts)
• Nextcloud-Sync Client einrichten (nextcloud.in.tum.de)
• Riot Chat einrichten (I11 Admins Gruppe)

Webseiten:

• RBG - StrukturDB
  • Verwaltung von in.tum Accounts (Verlängerung, Gastaccounts), DHCP+DNS Verwaltung (Hosteinträge), LDAP, etc.
• Chair Wiki
  • von außerhalb des Lehrstuhlnetzes nur über https erreichbar
  • Dokumentation von Abläufen, Informationen → wichtiges Tool!
  • Kalender für Abwesenheit, Urlaub, Konferenzen, etc.
  • Bereich “Infrastructure” sehen nur Admins (il11admin Gruppe)
  • Jede Seite durchlesen, anfangen mit overview
• Icinga Monitoring
  • Monitoring System
  • Überwachen von VMs und Server, überprüfen von ping, ssh, load und disk
  • E-Mails an icinga@cm.in.tum.de bei Fehlern oder Problemen
• Orders
  • Verwalten von Bestellungen
  • Vor allem Bestellungen bei der RBG werden hier eingetragen
  • Bei der Bestellung neu anlegen und auf Pending setzen
  • Bei Hardwareabholung Informationen vom Zettel im System ergänzen (Preis) und auf Delivered und Delivery Date
• Inventory
  • Zuweisen von Hardwareartikeln zu Personen
  • Wichtig bei großen/teuren Artikeln
  • Auch bei Adaptern versuchen
• LRZ Gitlab
  • Lehrstuhl Gruppe, Git Projekte unbegrenzte Anzahl, nur Code, keine großen Dateien
• RBG Gitlab
  • Verwaltung und Zuweisung von Aufgaben im Issue Board
  • Zuerst Anmelden, dann den Account von der RBG (Application Services) freischalten lassen
• AWX - Ansible
  • Ansible Tower, Automatisierung mit Ansible, langfristiges Projekt alles zu automatisieren
  • Zentrale Verwaltung und Ausführung von Ansible Skripten
• Opennebula
  • Eigene Platform für Virtualisierung,
  • Mitarbeiter können selber VMs erstellen für Datenanalyse, Thesis-Studenten,etc
• LRZ Opennebula
  • Gleich wie unser Opennebula nur begrenzt durch Kontingent und maximale Höhe von Resource (RAM, Speicher, CPU)
• TUM Nutzer+Mail Zertifikate
  • Weitere Informationen: https://wiki.in.tum.de/Informatik/Helpdesk/Tumzertifikat

erweiterte Informationen nichts wiederholen was in "Overview Infrastructure" steht!!
TODO mehr ausbauen:

Max Mustermann
TUM I11 Connected Mobility
Boltzmannstrasse 3
85748 Garching bei Muenchen

  https://www.rbg.tum.de/rbg/beschaffung/hardware/online-bestellung.html

  https://www.rbg.tum.de/rbg/beschaffung/hardware/reparatur.html

  https://www.rbg.tum.de/rbg/beschaffung/hardware/kontakt.html

  https://www.rbg.tum.de/rbg/beschaffung/software/online-bestellung.html

Mailingliste eintragen und erklären:

• Verwaltung der Listen auf lsadmin, Zugang von der RBG, Gruppe in der StrukturDB momentan nur zur Dokumentation
• Welche Mail Adresse soll für die Arbeit verwendet werden? in.tum → Trennung von Arbeit/Privat und in.tum Zertifikat für verschlüsselte Mails
• cm-team (→ cm-guest Student)
• admin (dadurch automatisch auf idrac, icinga)

Kommunikation:

• Hauptsächlich über E-Mail
  • Eigene in.tum Adresse verwenden, nicht admin!
  • Bei Antwort auf Mail aus admin-Liste immer admin in CC
• Momentan noch Slack https://tum-cm.slack.com
  • Bald ersetzen durch RBG Matrix (Riot) oder LRZ Rocketchat
• Telefon: Mitbenutzen falls eines im Büro, kein eigener Eintrag (Anrufanzeige) für Studenten

Nextcloud Setup:

• new folder with in.tum Username + copy “stundenzettel” and vacation
• new calendar share with other admins e.g. “Work TP”

Externe Accounts Freigaben/Zugänge:

• Bei Christine Chip Karte holen (Lehrstuhltüre) + Schlüssel für eigenes Büro
• StrukturDB RBG LDAP/Procedures (rbg-system@in.tum.de)
  • hostadmin-schlichter Liste (ersetzt durch admincm shared Mailbox?)
  • rbg-noc Anfragen für Firewalls und Netzwerk
• lsadmin mailing list server (LDAP Gruppe il11lsadmin)
• Hardware-Bestellung geht einfach so, keine spezielle Freischaltung nötig
• Matomo Chair Website (typo3@tum.de) Account for piwik.tum.de
• Freigabe für vcenter.in.tum.de und Eintragung als Ansprechpartner für die RBG
• mediatum.ub.tum.de Account

Hallo liebes Mediatum Team,

könnt ihr bitte den Bereich für unseren Lehrstuhl für <User> (<tum-account>) freigeben?

Informatik 11 - Lehrstuhl für Connected Mobility (Prof. Ott)
https://mediatum.ub.tum.de/?id=1245351 

- First try to update iDrac system

We have a central database where information about the infrastructure is stored. It is used to provide information for the ansible playbooks (awx) and save information for documentation purpose. Steps to connect to the dabase with Libreoffice/Openoffice:

• Host: db.cm.in.tum.de (service-ip)
• Connect to the database via Libreoffice/Openoffice
• Install mysql java connector

  sudo apt install libmysql-java

• Open libreoffice add connector Tools→Options→Advanced→Class Path…→Add Archive
• Choose /usr/share/java/mysql-connector-java.jar
• Restart Libreoffice/Openoffice

After that in the nextcloud il11admin/database folder config files exist (open with office) to open several databases or follow this steps to open a new database:

• Connect to an an existing database: Mysql
• Connect using JDBC
• Server: “db.cm.in.tum.de” Port: “3306” Mysql JDBC driver class: “com.mysql.jdbc.Driver”
• Database Name: “onevms” / “rbgvms” / “server” .. etc.
• From the outside and localhost only the awx user is valid (password in vault)
• Root user can create databases and manage db users, only allowed from localhost and from root (sudo)