System Administration

System Administration information

• 
dnf install -y epel-release
dnf install -y tar postgresql-server postgresql-contrib java-11-openjdk

#optional
dnf install -y vim tmux bc id3lib html2text p7zip-plugins libjpeg-turbo poppler-utils unzip netpbm-progs perl-Image-ExifTool
#optional manual install catdoc unrtf ffmpeg

newcfg (){
	F="$1"
	chown --reference="$F" "$F".new
	chmod --reference="$F" "$F".new
	mv -f "$F".new "$F"
}

#PostgreSQL
/usr/bin/postgresql-setup --initdb --unit postgresql
systemctl enable postgresql
TMP=/var/lib/pgsql/data/pg_hba.conf
cp $TMP $TMP.original
cat $TMP | grep -vP "^ *host.*127" > $TMP.new
echo -e "host\tall\tall\t127.0.0.1/32\tpassword" >> $TMP.new
newcfg $TMP
TMP=/var/lib/pgsql/data/postgresql.conf
cp $TMP $TMP.original
MT=$(cat /proc/meminfo | grep MemTotal | perl -pe 's/^[^ ]* *([0-9]+) *kB$/$1\/1000/g');
#java+linux=(512+256)
ECS=$(echo "($MT-(512+256))/2" | bc);
SB=$(echo "($MT-(512+256))/4" | bc);
cat $TMP | perl -pe 's/^#?(effective_cache_size)[ \t]*=[ \t]*[^ \t]+([ \t].*)?$/$1 = '$ECS'MB$2/g' \
| perl -pe 's/^#?(shared_buffers)[ \t]*=[ \t]*[^ \t]+([ \t].*)?$/$1 = '$SB'MB$2/g' \
| perl -pe 's/^#?(max_locks_per_transaction)[ \t]*=[ \t]*[^ \t]+([ \t].*)?$/$1 = 512$2/g' \
| perl -pe 's/^#?(max_connections)[ \t]*=[ \t]*[^ \t]+([ \t].*)?$/$1 = 60$2/g' \
| perl -pe 's/^#?(checkpoint_segments)[ \t]*=[ \t]*[^ \t]+([ \t].*)?$/$1 = 30$2/g' \
| perl -pe 's/^#?(log_min_duration_statement)[ \t]*=[ \t]*[^ \t]+([ \t].*)?$/$1 = 30000$2/g' \
| perl -pe 's/^#?(log_line_prefix)[ \t]*=[ \t]*[^#]+(#.*)?$/$1 = '\''%m: '\''\t\t$2/g' \
> $TMP.new
newcfg $TMP
systemctl start postgresql

#Noodle
cd /opt
tar -zxf ./Noodle.tar.gz
su postgres -c 'cd;/usr/bin/psql -d postgres -U postgres --file /opt/Noodle/init.sql' 
cd Noodle
cp noodle.service /lib/systemd/system/
systemctl enable noodle
systemctl start noodle

Other Linux Installation examples available.

•

Any user with access to system tools can reset the admin password with a web browser.

Any person with access to the SQL server can change the admin password to another users password

select object_id, username, password from users where username = 'admin' or username = '$ME';
update users set password = '$PASS' where object_id = '$ID';

For example

update users set password = 'P3b*cH.5fOBTJl5ELM)W' where username = 'admin';

•

Example scripts for a High availability install of Noodle 7.08.05+.

1) Install 3+ Linux instances with password-less key authentication, run the following on each (using real IPs and domains);

hostname must match domain name.

IP1=192.168.0.141 #dn1
IP2=192.168.0.142 #dn2
IP3=192.168.0.143 #dn3
IP="$(ip addr show | grep "inet " | grep -v 127.0.0.1 | head -n 1 | perl -pe 's/\/.*//g;s/.* //g')"

apt update
apt -y dist-upgrade
apt -y install ceph-fuse openjdk-11-jre
apt -y purge snapd landscape-common
apt -y autoremove

#if public domains are not in use;
echo "
$IP1 dn1 dn
$IP2 dn2 dn
$IP3 dn3 dn
" >> /etc/hosts

2) Install Ceph from the admin node (all nodes will wipe /dev/xvdb);

(Ubuntu 20.04 requires this patch first.)

POOL=noodle
apt-get -y install ceph-deploy

ceph-deploy new dn1 dn2 dn3
ceph-deploy install dn1 dn2 dn3
ceph-deploy mon create-initial
ceph-deploy admin dn1 dn2 dn3
ceph-deploy mgr create dn1 dn2 dn3
for N in dn1 dn2 dn3 ; do
        ceph-deploy osd create $N --data /dev/xvdb
done
ceph-deploy mds create dn1 dn2 dn3
for N in dn1 dn2 dn3 ; do
        ceph-deploy mon add $N
done
ceph osd pool create ${POOL}_data 16
ceph osd pool create ${POOL}_meta 16
ceph fs new ${POOL}_fs ${POOL}_meta ${POOL}_data
for N in dn1 dn2 dn3 ; do
	ssh $N "echo 'none /opt/Noodle/FSDB fuse.ceph ceph.name=client.admin,_netdev,defaults 0 0' >> /etc/fstab && mount -a"
done

3) Install CockroachDB on all nodes;

cd /opt
wget -qO- https://binaries.cockroachdb.com/cockroach-v19.2.2.linux-amd64.tgz | tar  xvz
cp /opt/Noodle/cockroachdb.service /lib/systemd/system/
perl -pi -e "s/\$IPS/${IP1},${IP2},${IP3}/g;s/\$IP/${IP1}/g" /lib/systemd/system/cockroachdb.service
systemctl enable cockroachdb
systemctl start cockroachdb

4) initialize CockroachDB from the admin node;

./cockroach-v19.2.2.linux-amd64/cockroach init --insecure --host=${IP}
echo "CREATE USER noodleuser; CREATE DATABASE noodledb WITH ENCODING = 'UNICODE'; GRANT ALL ON DATABASE noodledb to noodleuser;" | ./cockroach-v19.2.2.linux-amd64/cockroach sql --insecure --host=${IP}:26257

5) Install Noodle on all nodes;

cd /opt
tar -xf Noodle.tar.gz
cd ./Noodle
echo "NoodleNodes[] = ${IP1}, ${IP2}, ${IP3}
FSDB = /opt/Noodle/FSDB" >> conf/noodle.properties
perl -pi -e 's/^(DatabaseManager.DB.intranet.Connection.Url = ).*/$1"jdbc:postgresql:\/\/'"$IP"':26257\/noodledb"/g' conf/noodle.properties
cp noodle.service /lib/systemd/system/
perl -pi -e 's/postgreql.service/ceph.target cockroachdb.service/g' /lib/systemd/system/noodle.service
systemctl enable noodle
systemctl start noodle

•

letsencrypt offers free HTTPS certificates with the limitation that you need to set them up to auto renew every ~3 months. Below are some example scripts that last of which should be called from cron.

Settings

DOMAIN=noodle.example.com
EMAIL=me@example.com
PASS=example
DIR=/opt/Noodle/ACME

Initialize

. /opt/Noodle/settings.sh
apt install -y certbot
systemctl disable certbot
mkdir $DIR
certbot register --agree-tos --no-eff-email -m "$EMAIL"
certbot certonly --webroot \
	--webroot-path $DIR \
	--cert-name "$DOMAIN" \
	-d "$DOMAIN"
/opt/Noodle/deploy.sh

Deploy

systemctl restart noodle.service

Renew

. /opt/Noodle/settings.sh
certbot renew --webroot \
	--webroot-path $DIR \
	--cert-name "$DOMAIN" \
	--deploy-hook /opt/Noodle/deploy.sh

Currently Noodle must be restarted to reload the keystore.

•
  • 1995; Sun Microsystems created Java
  • 2006; Sun released Java under the GPL
  • 2010; Oracle Corporation acquired Java with the purchase of Sun
  • 2019; Oracle stopped releasing security updates for LTS releases under a permissive license

OpenJDK is the upstream for all Java builds but does not release builds itself, so there are now many java distributions, some with additional patches. In addition to the Linux distributions (Debian/Ubuntu, Fedora/RedHat, Arch, openSUSE, etc) building off OpenJDK for their package managers the following are available;

BuildPermissivePureCommercial Support
Adoptium (AdoptOpenJDK) / IBMYesOptionalYes
Microsoft (JClarity)YesNoNo
Azul ZuluYesNoYes
Amazon CorrettoYesNoYes
SAPYesNoYes
LibericaYesNoYes
RedHat for WindowsYesNoYes
ojdkbuildYesYesNo
OracleNoNoYes

Windows users can subscribe to releases on github until the windows store catches up with Linux repositories since the year 1998

• 
sudo -i
apt update
apt -y upgrade
apt -y dist-upgrade
apt install -y postgresql-contrib openjdk-11-jre

#optional
apt install -y p7zip-full sysstat catdoc antiword html2text unrtf libid3-tools ffmpeg

#postgresql
su postgres -c 'cd;psql --file /opt/Noodle/init.sql'
echo "host all all 127.0.0.1/32 password" >> /etc/postgresql/12/main/pg_hba.conf
systemctl restart postgresql.service

#Noodle
cd /opt
tar -xf Noodle.tar.gz
cd Noodle
mv noodle.service /lib/systemd/system/
systemctl enable noodle.service
systemctl start noodle.service

Other Linux Installation examples available.

•
  • Upgrade
  • Drive Space low
    • Add more storage space (a SSD preferably) (can be done without service interruption if you are using a Logical Volume Manager)
  • Out of RAM
    • Add more Memory
    • This warning is not yet supported for MSSQL or remote databases.
  • Index Queue not empty
    • Can be ignored if intermittent small numbers
    • Contact support if large numbers persist
  • HTTP pool too full
    • in server.xml increase HTTP pools like to at least double the number of active users. (you may also have a connection per port HTTP and HTTPS)
  • DB pool full
    • The default setting of 30 in noodle.properties for DatabaseManager.DB.intranet.Connection.MaxPoolSize is already fairly high so normally this is an indication that the SQL server getting bogged down by slow spinning storage (LVMCache is recommended).
    • Increasing the number without ensuring the DB pool was filled because of volume (not latency) will likely cause out of memory or deadlock errors on the database instead of just slowness.
  • User limit
    • Remove users from the imported Active Directory security group or contact us for a larger License.
    • Additionally and optionally delete disabled users that will not be added back to the imported Active Directory security group.

•

Overview

IWA allows for SSO using the Operating System users credentials.

Prerequisites

LDAP users have been successfully populated from AD; if not please refer to the AD Configuration Guide.

Quick reference

  1. setspn -U -S HTTP/%noodle.domain.tld %service_account
  2. Add Noodle to "Microsoft Internet Explorer > Tools > Internet Options > Security > Local intranet > Sites > Advanced"
  3. Use https://yourNoodle.tld/SPNEGO.po

Supported configurations

Browsers

Microsoft Internet Explorer, Mozilla Firefox, Google Chrome
Note: Microsoft Edge does not support this feature.

Protocols

Kerberos in SPNEGO in GSS-API (RFC 2478)
Note: NTLM, and NegoExts are not supported.

The "Please enable the Kerberos Security Support Provider (SSP)" error indicates the wrong protocol was used.

Endpoints

AD, Azure, and F5
Note: Others may work but have not been tested

Server configuration

Define the appropriate SPN for the account which Noodle is using to bind to LDAP using one of the 4 options;

  • Within the AD Users and Groups snap-in Navigate to Noodle’s service (admin) account and set the follow attribute:
    • servicePrincipalName = HTTP/%noodle.domain.tld
  • This may also be set via command line:
    • setspn -U -S HTTP/%noodle.domain.tld %service_account
  • For Windows server 2008R2 or older command line instead use
    • setspn -A HTTP/%noodle.domain.tld@DOMAIN.TLD %service_account
  • For AES instead of RC4
    • ktpass -out noodle.keytab -mapUser NoodleServiceAccount@%DOMAIN.TLD -pass  %NoodleServiceAccountPassword -mapOp set +DumpSalt -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ HTTP/%my.noodle.tld@%DOMAIN.TLD
    • Check the box "This account supports Kerberos AES 256 bit encryption" in the NoodleServiceAccount user.

Note:

  • Logins from the AD Kerberos Server itself are not supported because Windows will attempt NTLM.
  • Using an IP in place pf a domain name is not supported because Windows will attempt NTLM.
  • For local installs, non-primary domains can be used with IWA by placing “IgnoreIWADomain = true” into noodle.properties
  • Use an A record in the DNS, CNAMEs will break Kerberos
    • check with
      • nslookup domain.intra.net
    • workaround with
      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149=true
  • Enable NTP services If the Noodle logs contain the following;
    • .intranet,ERROR+ Caused by: KrbException: Clock skew too great (37)

Browser configuration

The next step in enabling IWA requires browser configurations to attempt authentication with the Noodle intranet website.

Once the configuration is in place users will need to access Noodle via the SPNEGO.po URL (ie. https://yourNoodle.tld/SPNEGO.po).

The following section of this guide explains this process.

Microsoft Internet Explorer & Google Chrome

Both of these browsers are configured with Microsoft Internet Explorer in "Tools > Internet Options > Security > Local intranet". 

Note:  If a non-default level is in use be sure “Automatic logon only in Intranet zone” is selected in "the Custom Level".

Next we will need to add the URL of your Noodle instance in "Sites > Advanced".

Mozilla Firefox

Enter “about:config” in the address bar, press “Enter”, and click “I Accept the Risk” when prompted.

Next, search for “auth.trusted”, enter your Noodle URL in the attribute entitled “network.negotiate-auth.trusted-uris” and select OK.

At this point IWA should be fully operational for your Noodle Intranet site!