Difference between revisions of "Internal GCManage Server Setup"

From GrandCare Systems
Jump to navigation Jump to search
Line 41: Line 41:
** Attach /etc/openvpn/ClientCA/*.key files
** Attach /etc/openvpn/ClientCA/*.key files
** Attach /root/.gnupg files
** Attach /root/.gnupg files
** Attach any Apache SSL keys

Revision as of 17:54, 3 May 2013

Preparation

  • Verify requirements
    • Two IP addresses
  • Do an apt-get update and dist-upgrade before doing anything.

Install GCManage Release

  • Upload latest production release from buildmgr
  • untar release and run install-gcmanage script as root
    • While installing, check out the subnet allocation spreadsheet and add new unique subnets for client and management VPNs. We'll refer to these later.
  • When postfix prompts for server type, choose Satellite option and gcmmail.grandcare.com as the SMTP relay.
  • Eventually you will be prompted for SSL certificate information. Details here are not important (self-signed cert).

Post GCM Install Tasks

Configure OpenVPN

  • Edit /etc/openvpn/server-*.conf.
    • Change the local value with the secondary IP address and the server subnet. Increment each subnet per config.
  • Edit /etc/openvpn/management.conf
    • Change the local value with the secondary IP address and the server subnet to the next available management subnet.
    • Also change the route pushed to the subnet covering the four client subnets
# example
push "route 10.100.32.0 255.255.252.0"
  • Edit /etc/openvpn/ClientCA/keys/000-client.conf and make changes to the remote hostname if necessary. Usually vpn01.foobar.com.
  • Restart openvpn and verify tun0 through tun4 interfaces are UP.

Configure and test postfix

Refer to docs: Configuring Postfix

Install Apache SSL Cert

Refer to docs: Installing Apache SSL Certs

Configure Backup

Refer to docs: Configuring BackupPC Client

Finalize GCManage Installation

  • Turn off GCManage maintenance mode
  • Upload latest Como production full installer
  • Create and set default distributor under settings

Document Sensitive Data

  • Create a new entry in the password store with login credentials
    • Attach /etc/openvpn/ClientCA/*.key files
    • Attach /root/.gnupg files
    • Attach any Apache SSL keys