Procedure:New Host / Reinstallation setup

There are several basic steps necessary to getting a new host up and running on the OACISS research network.

0 - Security

The following few iptables commands will set up a basic firewall for input: Local loopback is unfiltered, established connection packets are allowed, SSH is allowed from the OACISS network (128.223.202/24).

If the host is on the storage network, the 4th line permits all traffic from the 172.17.0.0/16 network on the private interface (note that you probably need to set the correct -i INTERFACE). If it isn't, don't copy this line.

Finally anything not matching these rules disappears into the howling binary void, i.e. the host may as well not exist so far as the rest of the Interbutts are concerned and we're okay with that.

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -s 128.223.202.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 172.17.0.0/24 -i enP1p3s0f2 -j ACCEPT
iptables -A INPUT -j DROP
iptables-save

1 - Network services

• Authentication setup: Follow the steps outlined for new LDAP clients at Procedure:New_LDAP_Client
• NFS setup: Follow the steps at Procedure:New host filesystems