HannibalWiki hannibal

hannibal:61samba.ldif

2011-06-13T19:42:59+02:00

# #******************************************************************** # dn: cn=schema # #******************************************************************** # attributeTypes: ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) # #******************************************************************** # attributeTypes: ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DES…

hannibal:62postfix.ldif

2008-06-26T07:37:12+02:00

# #******************************************************************** # dn: cn=schema # #******************************************************************** # attributeTypes: ( 1.3.6.1.4.1.4203.666.1.200 NAME 'mailacceptinggeneralid' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) # #******************************************************************** # attributeTypes: ( 1.3.6.1.4.1.4203.666.1.201 NAME 'maildrop' EQUALIT…

hannibal:63ldapdns.ldif

2008-06-26T07:34:40+02:00

# #******************************************************************** # dn: cn=schema # #******************************************************************** # attributeTypes: ( 0.9.2342.19200300.100.1.32 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # #******************************************************************** # attributeTypes: ( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12…

hannibal:64ldapdhcp.ldif

2008-06-26T07:33:23+02:00

# #******************************************************************** # dn: cn=schema # #******************************************************************** # attributeTypes: ( 2.16.840.1.113719.1.203.4.1 NAME 'dhcpPrimaryDN' EQUALITY distinguishedNameMatch DESC 'The DN of the dhcpServer which is the primary server for the configuration.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) # #******************************************************************** # attributeTypes: …

hannibal:apache

2008-06-26T07:41:42+02:00

Apache 2.2.x Installation apt-get install apache2 apache2-doc libapache2-mod-perl2 libapache2-mod-php5 \ php5 php5-ldap php-pear If you need PHP to be able to connect to a MySQL-database, you also need php5-mysql. apt-get install php5-mysql

hannibal:aptmirror

2008-06-25T11:56:34+02:00

Local mirror When installing a serious set of almost equal Debian or Ubuntu machines, it might be useful to create a local apt mirror. This has the advantage of saving bandwidth when installing more machines but more important, this gives the option to have 100% certaincy in doing reproducible upgrades on internal development, test and production systems.

hannibal:bacula

2008-06-25T12:23:24+02:00

TBD. If you want an enterprise level centralized backup solution with tape and tape robot support check the Bacula project website. If you want a user friendly solution that allows you to backup your desktops, notebooks and/or some server shares to disk, check the Backuppc website.

hannibal:bind

2008-06-25T12:43:22+02:00

The DNS server DNS data stored in LDAP The Hannibal project is centralized around an LDAP store. So, why not put the DNS data into it. The option below describes a method to do this. Part 1: the Authorative zones Ldapdns The backend authorative nameserver for our project is Ldapdns. It's fast, robust and secure. No LDAP to

hannibal:bonding

2009-01-07T10:35:30+02:00

Linux bonding Bonding allows to aggregate two or more network interface cards into one virtual device with aggregated bandwith. It also adds the possibillity to implement failover of the members of the newly created bond-device. We use ethernet bonding for our

hannibal:ca

2008-06-25T11:44:22+02:00

The Openssl software offers all the features that are required to create ourselves some certificate requests and/or self-signed certificates. Note that the Fedora Directory Server does NOT support openssl. It uses the Network Security Services (NSS) library available from the Mozilla Project (

hannibal:cyrus

2011-06-22T14:51:11+02:00

Mailstore Hannibal promotes the use of Cyrus-imapd as the scalable solution for building mailstores. It supports POP, IMAP, SSL/TLS, serverside mailfiltering and the software appeared very robust during years of usage. We assume you build the mailstore apart from the frontend SMTP-server(s) on a separate server or virtual server. LMTP over TCP will be used to deliver mail to the backend mailstore. User access to mailboxes will be authenticated via SASL to your LDAP directory server.

hannibal:cyrus_with_users_in_files

2013-12-18T12:54:06+02:00

verplaatst

hannibal:devserver

2008-06-25T11:49:21+02:00

The Hannibal team tries to make use of existing binary software packages that form part of the Debian stable repositories as much as possible. However, some software just isn't available at the required version/patch-level or isn't available at all within the Debian stable repositories. In this case it might be required to (re)build binary packages ourselves from a source package or to manually compile software that isn't available as a Debian package at all.

hannibal:etherpadserver

2011-04-27T14:14:32+02:00

Etherpad server Realtime document collaboration. Installation preparation Requirements: * one Ubuntu 10.04 or a Debian 6 (squeeze) system Software: * sun-java6-jdk 1.6 place software Extra repository: # etherpad.org: deb http://etherpad.org/apt all . deb http://archive.canonical.com/ lucid partner

hannibal:fds-init-script

2008-06-26T07:26:16+02:00

An init.d script for the Fedora-directory-server-1.0.x on Debian-4.0 #!/bin/sh -e # Start or stop Fedora Directory Server # # Olivier Brugman (Pref Sourcing) NAME=FDS DESC="Fedora Directory Server" DEFAULTS="/etc/default/fds" PATH=/bin:/usr/bin:/sbin:/usr/sbin # Source defaults file; edit that file to configure this script if [ -e "${DEFAULTS}" ]; then . "${DEFAULTS}" fi # If the daemon is not to be started, then exit if [ "${START}" != "yes" ]; then echo "${DESC} is not to be autos…

hannibal:fds

2011-06-14T09:34:16+02:00

LDAP, the Lightweight Directory Access Protocol is used as the foundation for our single (source of) sign on solution. It allows us to create a centralized database to store data for a corporate directory. The protocol supports replication for redundancy and high-availability. Secure connections via SSL/TLS are also supported.

hannibal:fileserver

2015-04-12T01:08:13+02:00

The Hannibal fileserver offers its services to all kinds of workstations, e.g. GNU/Linux-platform, MacOSX-platform, Microsoft Windows-platform. A client can communicate to the server via several open standard protocols. At this moment the Hannibal fileserver offers NFS, SMB/CIFS,

hannibal:glpiserver

2008-06-26T07:43:54+02:00

GLPI is an Information Resource Manager that also supplies a webbased trouble ticket system. It integrates very well with OCS Inventory. Additional information can be found on the GLPI website. Pre-installation GLPI is a web application that is written in PHP. It stores it's information in a MySQL-database. We'll use LDAP for user authentication.

hannibal:gosa2

2008-06-26T07:42:16+02:00

Gosa Prerequisites The Gosa framework is an PHP-application so we need a webserver that supports PHP. Although most data will be stored in a LDAP-database, some data for Gosa plugins will be stored in a MySQL-database. * Hannibal documentation on

hannibal:hannibal-dnsstuff

2008-06-26T07:35:39+02:00

dn: ou=Domains,dc=intra,dc=example,dc=com objectClass: organizationalUnit ou: Domains dn: dc=arpa,ou=Domains,dc=intra,dc=example,dc=com dc: arpa objectClass: top objectClass: dcObject objectClass: dnsDomain dn: dc=in-addr,dc=arpa,ou=Domains,dc=intra,dc=example,dc=com dc: in-addr objectClass: top objectClass: dcObject objectClass: dnsDomain dn: dc=192,dc=in-addr,dc=arpa,ou=Domains,dc=intra,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: dNSDomain dc: 192 dn: dc=com,ou=Do…

hannibal:instant_messaging

2008-06-26T07:44:23+02:00

Instant messaging might be a valuable service for your organization. Of course you might use an existing application service provider to address your needs, however we prefer to run our own instant messaging server based on open source software and supplying open standards. Furthermore we want to be able to use our existing LDAP-environment for user management. Jabberd2 meets our needs and is available for the Debian GNU/Linux platform. Jabberd2 provides the Extensible Messaging and Presence Pro…

hannibal:iptables

2008-06-25T12:04:39+02:00

firewall We haven't selected a specific application as a firewall yet. Until then we'll provide some examples howto NAT your LAN to the net and howto do portforwarding (i.e. reverse masquerading of traffic to servers in our LAN or DMZ) using iptables. If you don't already have iptables installed install the software:

hannibal:iscdhcp

2008-06-25T12:44:34+02:00

ISC dhcp3-server with LDAP backend For large networks it might be a good idea to store DHCP-information in a central LDAP-database. Brian Masney has written a patch that gives the ISC DHCP-server an LDAP backend. You can find more information and download the patch at

hannibal:ldap-administration

2008-06-26T07:44:47+02:00

We frequently use these tools for user and systems management and for manually editing of the LDAP-database. Operating system commandline tools * The .deb package 'ldap-utils' provides cli-tools as ldapadd, ldapcompare, ldapdelete, ldapmodify, ldapmodrdn, ldappasswd, ldapsearch and ldapwhoami.

hannibal:ldap-auth

2010-03-08T12:27:56+02:00

PAM and NSSwitch are necessary for LDAP-authentication/authorization of users on our GNU/Linux servers (and possibly also our GNU/Linux workstations). Furthermore you could configure several applications such as the Cyrus IMAPd, Openvpn, ProFTPd, Jabberd2 etc. to use PAM/NSSwitch for user authentication/authorization against LDAP. In this case you won't need to add special LDAP-patches to your services. Just configure them to use PAM/NSSwitch.

hannibal:ldap_directory_oldversions

2008-06-26T07:38:31+02:00

OLD VERSIONS LDAP, the Lightweight Directory Access Protocol is used as the base for our single (source of) sign on solution. It allows us to create a centralized database to store data for the corporate directory. The protocol supports replication for redundancy/high-availability. Secure connections via SSL/TLS are also supported.

hannibal:mailman

2008-06-25T12:07:14+02:00

Let's install a mailinglist manager. We chose Mailman because it's robust, scalable and easy to administrate. Mailman has a webinterface for list members, administrators and access to the list archives. The Mailman application is built on Python. First install the software:

hannibal:mysqlserver

2008-06-25T11:42:14+02:00

Several application that form part of the Hannibal systemstack rely on a MySQL-database for data storage. You could of course install a RDBMS per server or per virtual server, however we prefer to install a centralized storage backend that is available via TCP/IP. This documentation describes how to install a MySQL-server on Debian Etch.

hannibal:nagios

2008-06-25T12:22:12+02:00

As you probably have about two eyes and two hands max, you might need some help to monitor the health of all services on your network. We use the Nagios (version 2) monitor-software as our monitoring backbone. In addition to Nagios we install Centreon, which provides a very nice webinterface that allows webbased configuration of Nagios. Centreon also provides some graphing (based on rrdtool) and reporting functions.

hannibal:nagios1_with_mysql

2008-06-26T07:47:19+02:00

Important: this is an older version of the Hannibal monitoring server documentation. The current documentation is available at nagios. For monitoring of system resources, network status and service availability we use the open source monitoring software Nagios. It is highly configurable and offers all necessary communication features required for the enterprise environment. Visit the Nagios website at

hannibal:ntp

2008-06-25T11:59:38+02:00

NTP-server Let's start keeping time on our server. Otherwise logging and Kerberos won't work as expected and you might forget your coffee break! If you have a static IP and a somewhat reliable internet connection, you might consider joining the pool.ntp.org initiative. See

hannibal:openvpn

2011-02-25T23:32:34+02:00

Several open source solutions are available to build your own virtual private network. These solutions have different ways to do their job. E.g. some use ipsec, others use plain TCP/IP. Anyway, we chose the Openvpn software to build our vpn. It does not require an ipsec-supporting network infrastructure, but it is save nontheless as it supports all of the encryption, authentication, and certification features of the Openssl library (any cipher, key size, or HMAC digest). Openvpn supplies our fun…

hannibal:operatingsystem

2008-06-26T08:52:37+02:00

Linux core Currently the Hannibal is developed, tested and supported on the Debian GNU/Linux 4.0 (a.k.a. Etch) platform. We assume a minimal installation of the operating system as a foundation to be present. Just install the base system. Don't add additional packages via tasksel, dselect and / or aptitude at the moment. You could use a separate machine per module or use a virtualization tool. As we chose Xen as our preferred virtualization solution, some of our own considerations and documenta…

hannibal:phpagaserver

2008-06-25T12:40:13+02:00

Billing Two options on this page. Pick your choice... PHPAga Are you an independent contractor, sole proprietor, freelancer, or perhaps you run a small business? Then surely you need a system to handle your billing. PHPAGA is a billing application that can keep track of your personal or small business finances, and is built on the LAMP or LAPP framework.

hannibal:postfix

2013-11-04T21:22:43+02:00

Mail transfer agent Wietse Venema's Postfix hasn't caused us a single bug or security issue in several years of usage, pretty impressive right!? In order to fight spam the deployment of greylisting software (we chose postgrey) appeared very adequate. Tnx. to Arjen Baart for mentioning this!

hannibal:postfix_with_users_in_files

2013-12-18T12:45:35+02:00

verplaatst

hannibal:pound

2008-06-25T12:24:54+02:00

Load Balancing Pound Pound is both a non-caching reverse http-proxy and a https offload service. The concept of pound is to be a small and audittable program with limited functionality, but to be good in what is does. See: Install the package: apt-get install pound

hannibal:rbl

2013-12-18T12:49:37+02:00

verplaatst naar

hannibal:rsyslog

2008-06-25T12:31:12+02:00

If you have more than a few nodes on your network, their logs could easily drive you crazy! In order to preserve your mental state, we'll build a centralized logging server that collects all those logs and puts them into a database. In addition we'll install a small web application that supplies a sysadmin friendly userinterface to the database and that allows to deploy some basic filtering. Nothing fancy, but enough to keep you from going nuts!

hannibal:samba_legacy

2008-06-26T07:40:05+02:00

Samba version-2 This documentation regards samba 2 and samba 3 running samba2-compatibility-mode. We used to configure samba like so, however nowadays this part of the documentation is obsolete and non-maintained! Install the software apt-get install samba samba-doc

hannibal:squid

2008-06-25T12:25:55+02:00

Install with: apt-get install squid The external authentication program that authenticates your proxy users against LDAP is now available as a module in the Squid package. (parts of) /etc/squid.conf .... http_port proxy.intra.example.com:3128 .... auth_param basic program /usr/lib/squid/ldap_auth -b ou=People,dc=intra,dc=example,dc=com -h ldap.intra.example.com -f "(&(objectClass=posixAccount)(uid=%s))" auth_param basic realm Squid proxy-caching web server auth_param basic children 30 auth_par…

hannibal:start

2010-09-13T23:18:47+02:00

Installation The technical documents below describe the complete Hannibal stack. Starting to build from the top, all dependencies should be met. Foundation modules * Operatingsystem Base (A Debian-Linux system and ip-numberplan convention) * DNS and DHCP * Time server * Centralized syslog server * LDAP autorisation (client) *

hannibal:webmail

2008-12-10T10:55:14+02:00

Webmail-client If you have a webserver running on your network, you could deploy a webmail solution very easily. We suggest squirrelmail (see ) and maybe in the future Roundcube () For instance the Dutch ISP XS4ALL (www.xs4all.nl) uses Squirrelmail as a webmail solution. They also do a huge amount of development for the Squirrelmail project.

hannibal:wikiserver

2008-06-26T07:43:29+02:00

Documentation in a changing environment When an easy to use textual documentation system is needed, with the option to make several namespaces (for example, each department its own) and have the option to secure them, Dokuwiki is a good choice. Dokuwiki contains a LDAP-module for user authentication. More details on Dokuwiki are available on the