Shell: Unterschied zwischen den Versionen
imported>Burghardt |
imported>Burghardt |
||
| Zeile 47: | Zeile 47: | ||
All of this is run off of one virtualization Host |
All of this is run off of one virtualization Host |
||
| − | + | == Self defense of the servers == |
|
Usually we do utilize "<tt>fail2ban</tt>" to chase brute force attempts to hack login credentials. For technical reasons this is not possible for this "<tt>haproxy</tt>" approach. The workaround is: |
Usually we do utilize "<tt>fail2ban</tt>" to chase brute force attempts to hack login credentials. For technical reasons this is not possible for this "<tt>haproxy</tt>" approach. The workaround is: |
||
| + | {| style="border: 1pt black dashed" |
||
| ⚫ | |||
| + | |- |
||
| ⚫ | |||
| + | |- |
||
| + | |} |
||
| + | |||
| ⚫ | |||
| ⚫ | |||
== Tips 'n' Tricks == |
== Tips 'n' Tricks == |
||
Version vom 30. Mai 2016, 13:52 Uhr
 |
Preliminary information! Does not work as intended yet. Will reboot often! |
|
Usage
Simply use SSH to login to this machine:
ssh user@shell.stud.informatik.uni-goettingen.de
Note that the intially presented banner contains something like
####### shell.stud.informatik.uni-goettingen.de - login vm: shell5.cip.loc
...telling you the actual local name of the automatically chosen destination machine.
For Windows: use PuTTY (simple) or Cygwin (more complex and powerful) or any other SSH-implementation.
Target audience
These machines are meant to be used by students. But of course they can be used by any staff members! For new users the only requirement is to logon one single time using one of the (physical) pool computers - this will make them "known" to our systems.
Load Balancing
This term is misleading on this specific installation: the default algorithm being used is simply "round-robin" - you'll get connected the "next" machine one after another. If you landed on an overcrowded system simply disconnect/reconnect to use another machine.
Legacy login.stud
Both login.stud.informatik.uni-goettingen.de and login.informatik.uni-goettingen.de are not affected by this new approach. They "old" machines will continue to work unmodified.
Timeout
- The session Timeout is set to 36 hours -- this the HAproxy related Timeout regarding the TCP connection
- Kerberos/OpenAFS have separate/shorter timeouts. You need to kinit && aklog after timeout.
Availability
Take a look at: http://shell.stud.informatik.uni-goettingen.de/ -- use ifi/ifi to login ("bots not welcome")
Some technical details
Machine "Hardware"
The six currently implemented virtual machines offer:
- 6 GiB Ram
- Quad Core CPU
- these VMs are placed into the computer pool network. This makes sure users have exactly the same experience as if being physically present in the pool
All of this is run off of one virtualization Host
Self defense of the servers
Usually we do utilize "fail2ban" to chase brute force attempts to hack login credentials. For technical reasons this is not possible for this "haproxy" approach. The workaround is:
|
We do limit the rate of new (tcp-) connections from any given source IP address to 1 per minute. |
|
When you're going to login via ssh you usually have three tries to enter your password. Technically this is one single connection! The next three tries come with the next connection, which is only possible after one minute.
Tips 'n' Tricks
Connect to the same machine again
Circumventing the Round-Robin mechanism is possible: connect to a specific port 42000+n withh n={1..6} :-)
For maschine number 4:
~$ ssh -p 42004 username@shell.stud.informatik.uni-goettingen.de ####### ####### shell.stud.informatik.uni-goettingen.de - login vm: shell4.cip.loc
Todo
- Documentation
- Testing! -- currently in BETA
See also
Links
- https://help.ubuntu.com/ -- common help regarding Ubuntu
- http://shell.stud.informatik.uni-goettingen.de/ -- current state