This page is a reference for ProgClub system administrators. For information about ProgClub domains, see Domains. For information about member services, see Services. See Machines for information about hosts on the ProgClub network. See Projects for current projects or check out our Forums to get in touch.
So the new systems integrity and strength have been deployed as part of the Network v2 migration. They are mostly managed via AWS and Salt. If you're watching the web-logs and see a brute force attempt against WordPress etc. then you can issue a "temporary" ban for the offending IP address (it's "temporary" because you should remove it after a day or two once the problem has gone away). The actual firewall for our services is with AWS and its security groups, so we leverage this fact to simplify our UFW rules, for example, by using a default allow incoming policy.
As a ProgClub administrator you have a lot of power. You have the capability to destroy ProgClub's files and configuration, to access all of ProgClub's databases, to pretend to be other users, and to access other users' private data. We expect you won't abuse your power. Specifically, under no circumstances should you:
All of your systems administration activity should be documented, and you shouldn't be doing anything evil. If you're not sure what qualifies as evil, if you have any doubt at all, please ask.
Although ProgClub doesn't make any guarantees, members should be able to feel as though their privacy is respected at ProgClub, and they should be able to feel confident that administrators aren't spying on them by reading their email or their other data.
Your administrator login on charity and your member account in LDAP will give you sudo privs on all of the ProgClub machines, both administrative and user machines. Some tools require special purpose logins, and for those you will find login details in the /home/jj5/login_* files which you can access from any of the machines.
Note: don't use screen while administering systems, because it frags PuTTY's scroll buffer, and you need that in order to copy-and-paste your session log.
It's not a bad idea to link to the relevant section(s) of the admin page(s) from the network administration 'done' note, but that's not strictly necessary.
As explained on the Machines page ProgClub separates its machines into two groups: administrative machines and user machines. There is only one administrative machine, charity. There are two user machines, hope and honesty. If you're doing sysadmin work on the user machines, make sure you duplicate your work and create an identical system configuration on each machine. Both user machines should have the same configuration. And, yes, this means that you have to duplicate your documentation too. If you're doing some experimental configuration I'd suggest doing it on honesty first, and then once you've got everything figured out and stable duplicating onto hope. You can use hope first though if it suits you. Try not to let too much time pass with the systems in different configurations, generally you should do your sysadmin work on both systems immediately one after the other.
The way logins work for administrators (as opposed to normal users) is that you have two logins. One login is for the administrative server (currently there is only one of these, charity), and the other login is your Kerberos/LDAP login that gets you access to the user machines. You can use different passwords if you want, but the usernames (and UIDs) will be the same. All administrators are members of the 'sudo' group on charity and in LDAP. This means that you can use your sudo privileges on either administrative machines or user machines.
Etckeeper is now installed on charity (and hope and honesty), which means the correct procedure after making edits to files in /etc is to issue:
after you're done with your changes. There's an auto commit every day, and an autocommit whenever you apt-get install something. You can manually commit your changes as above. To see the commit log for a particular file:
To revert an unwanted or bad change, work out which revision you want to revert to (see log above) and run:
ProgClub uses the Mailman software to manage its mailing lists. From time to time some spam makes it through the mail filters onto the list. Such spam then really needs to be removed otherwise it will become a part of the HTML list archives published on our site.
Your virtual server will be configured as an SSH system accessible by root. SSH to your new system as root and then change the password:
Before logging in as jj5, from an existing system that has access (e.g. sixsigma), copy in the authorised keys:
Note: don't forget to change the email address from log@blackbrick.com for jj5.net and ProgClub servers.
Copy in the SSH deny rules that are applicable to the new server. These start on the second line after the *filter line.
Check the /etc/mailname file and confirm it's the fully qualified domain name, e.g. charity.progclub.org.
If you need to allocate a user id for a member, use their member number from the Members page. Member numbers start at 1000 and increment from there.
If you need to allocate a user id for a system user, such as a user that a process will run as, check for UIDs starting from 500 and use the next available one. If you create a user on one machine with a particular UID you should create the same user with the same UID on all the other machines too.
At the moment member information is recorded in Members. A member should have a Wiki account to start with (create one for them if they haven't already created their own), then an entry in the Members page (where they are allocated a member number), then the "User info" on their user page should be filled out (leave fields as "Not disclosed" unless you have their permission to publish their details). After the Members page has been updated you will have:
replacing 'username' as appropriate. You need to restart the Kerberos administration server after this change:
Name: if the member gave you permission to use their name, then their name. Otherwise their username.
Once you've done that, login to the user email administration facility with the member's username and the password you generated.
Now send an email to the member at their new email address (username@progclub.org) letting them know the details of their new account. You should include:
You should already have subscribed them to the announcement list. You might also like to subscribe their new ProgClub email address to any or all of the following:
The HasOffers iOS SDK by ram interacts with the API to implement performance marketing solutions in social media applications. Configuration is available, in addition to debugger, launcher, and actions.
The ProPublica Congress .NET SDK by Justin Skiles allows developers to integrate most of the ProPublica Congress API's functions into their C#/.NET applications.