#language en #refresh 999999 ## nearly two weeks until an update occurs [[TableOfContents(2)]] = Overview = == Basic data == || Hostname || `gs2.fluid.tuwien.ac.at` || || Model || [https://www.supermicro.com/en/products/motherboard/X10SRW-F Supermicro X10SRW-F] S/N: NM154S015315|| || Purpose || graphics server || || Operating system || debian || || Management interface || http://mgs2.fluid.tuwien.ac.at || || Authentication options || TU password || == Hardware == || CPU || [https://ark.intel.com/content/www/us/en/ark/products/82763/intel-xeon-processor-e51620-v3-10m-cache-3-50-ghz.html Intel(R) Xeon(R) CPU E5-1620 v3 @ 3.50GHz (4 cores)]; Socket: FCLGA2011-3 || || RAM || 32 GiB; up to 256 GB DDR4-2400MHz || || Storage || 500 GB (/) Samsung SSD 850 EVO 500GB || || Graphics card || !GeForce GTX 960 || || BMC || AST2400 controller || || Motherboard battery type || CR2032 || == Firmware == || BIOS || Version 3.4, Build Date 2021-06-05 || || BMC || User's manuals for [:gs1?action=AttachFile&do=get&target=MNL-1570.pdf: motherboard/BIOS] and [:gs1?action=AttachFile&do=get&target=IPMI_Users_Guide.pdf: BMC/IPMI]. == Configuration == All customized configuration files are usually marked by group `oswat`, sometimes also user `oswat`,[[BR]] `find /etc -user oswat -o -group oswat` == BIOS == press DEL to enter BIOS, F11 for boot menu == Admins == * Thomas Loimer * Rudolf Ladner (ZID) = Firmware update = == Baseboard Management Controller (BMC) == Update firmware, because newer version provides iKVM/HTML5 virtual console.[[BR]] Initially, IP Address of BMC was set to static 128.131.183.xxx - needed to go to the server room and access BMC from the console. On 2024-04-24, download firmware BMC_X10AST2400-32M_20210528_03.93_STD.zip from https://www.supermicro.com/en/support/resources/downloadcenter/firmware/MBD-X10SRW-F/BMC [[BR]] Unzip, trying to dump current firmware with binary `AlUpdate` contained in zip-file resulted in core dump.[[BR]] Log in into GUI of BMC -> Maintenance -> Update Firmware[[BR]] upload exactly 32 MiB file BMC_X10AST2400-32M_20210528_03.93_STD.bin '''Uncheck''' box `Preserve configuration`; Network settings thankfully remain. == BIOS == Download firmware on 2024-04-24 from https://www.supermicro.com/en/support/resources/downloadcenter/firmware/MBD-X10SRW-F/BIOS, file X10SRW1.605.zip, unzip. BIOS update needs an activation key, get one by using the tool from https://github.com/bwachter/supermicro-ipmi-key.[[BR]] Generate activation key, `./supermicro-ipmi-key 0c:c4:7a:37:57:9d`, output: `90d4 cdb7 ab21 0cf7 33d0 96fa`. Log in into GUI of BMC -> BIOS Update, Choose file (exactly 16 MiB) `X10SRW1.605`, uncheck any preserve-boxes (ME region, NVRAM, SMBIOS). Click Start Upgrade. === Settings === Advanced -> PCIe/PCI/PnP Configuration:[[BR]] `RSC-R1UW-E8R SLOT1 PCI-E X8 OPROM`, `RSC-R1UW-2E16 SLOT1 PCI-E X16 OPROM`, `RSC-R1UW-2E16 SLOT1 PCI-E X16 OPROM`: Set type to `EFI`, was `Legacy`. [[BR]] `Onboard LAN OPROM Type`: `EFI`, was `Legacy`. Boot: Set boot type to `EFI`, was `Dual`. = Installation of the base system (2024-04-29) = Boot - the only boot media present is PXE booting - choose[[BR]] Linuxe Network Installs -> Debian -> Text Based Install == Debian Installer == Language: C - no localization[[BR]] Select your location: Europe -> Austria[[BR]] keymap to use: American English (since this is the keymap on the virtual iKVM/HTML5 keyboard)[[BR]] Configure the network: eno1 (yields a dhcp address during installation) -> hostname: gs2[[BR]] -> domain name: fluid.tuwien.ac.at[[BR]] Choose a mirror of the Debian archive: enter information manually[[BR]] -> mirror hostname: gd.tuwien.ac.at[[BR]] -> mirror directory: /opsys/linux/debian[[BR]] -> proxy information: (blank)[[BR]] Set up users and passwords: -> root password: ***[[BR]] -> Full name for user account: (blank)[[BR]] -> username: oswat[[BR]] -> Password for the new user: (same as root)[[BR]] Partition disks:[[BR]] -> Guided - use entire disk[[BR]] -> Select disk to partition: SCSI5 (0,0,0) (sda) - 500.1 GB ATA Samsung SSD 850[[BR]] -> All files in one partition ... then, change partition to[[BR]] #1 267.4 MB B f ESP efi_fs EFI System Partition, bootable (choose 265 MiB)[[BR]] #2 465 GB f ext4 root_fs /[[BR]] #3 34.8 GB f swap [[BR]] Configuring popularity-contest: Yes[[BR]] Software selection: (nothing except)[[BR]] [*] SSH server[[BR]] [*] standard system utilities[[BR]] Reboot == Installation of the base system == Log in, set up the base system {{{ ssh oswat@dhcp1 (the temporary address) cat >/etc/systemd/network/20-gs2.network <~/.ssh/authorized_keys systemctl enable systemd-networkd # do not install recommended packages echo 'APT::Install-Recommends "false";' >/etc/apt/apt.conf.d/90recommended_false chgrp oswat /etc/apt/apt.conf.d/90recommended_false # although here recommended packages are useful apt install sytemd-resolved apt install libnss-myhostname libnss-resolve }}} Debian bookworm (12.0) was installed on the 500 GB SSD, one partition (≈100 MB) for the efi (/boot/efi), the reminder of the disk for root (/), ext4 filesystem. The file systems were labelled, `root_fs` and `home_fs`.[[BR]] While in the debian installer, ssh-server was chosen, no localications, only C and C.utf8.[[BR]] Install grub2 as bootloader; The kernel efi-stub needs a commandline (root=/dev/sda2 initrd=\EFI\debian\initrd.img), no way to set that from the BIOS.[[BR]] Had to create an administrative user: oswat, the home directory is `/opt/oswat`! == Partitioning == || /dev/sda || 500 GB || || || || /dev/sda1 || 94 MB || /boot/efi || vfat || || /dev/sda2 || 500 GB || / || ext4 || || /dev/sdb+c || 2 TB || /home || btrfs-raid1 || == Network == {{{ echo gs1 >/etc/hostname }}} Note, the resolver (Domains=) and NTP-server is set per interface, see below. This keeps the configuration in one file. {{{ cat >/etc/systemd/network/10-gs1.network <>/etc/fstab </etc/apt/sources.list </etc/apt/apt.conf.d/90recommended_false }}} == User access == === sshd customization === Do not forward the client's locale, since there is only C/POSIX on gs1. Also, there is no sudo, allow root to login. {{{ echo "PermitRootLogin yes" >/etc/ssh/sshd_config.d/permitrootlogin.conf apt install patch patch </etc/nslcd.conf <** # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off tls_reqcert never tls_cacertfile /etc/ssl/certs/ca-certificates.crt # The search scope. #scope sub # Here ends the shipped configuration file, customisation starts ... base passwd ou=people,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at base shadow ou=people,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at base group ou=groups,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at # Mappings filter passwd (memberOf:1.2.840.113556.1.4.1941:=cn=E322_ALL,ou=groups,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at) map passwd uid sAMAccountName map passwd uidNumber employeeID map passwd gecos cn map passwd homeDirectory "/home/${sAMAccountName}" map passwd loginShell "/bin/bash" map passwd gidNumber "2153" filter shadow (memberOf:1.2.840.113556.1.4.1941:=cn=E322_ALL,ou=groups,ou=TU,dc=intern,dc=tuwien,dc=ac,dc=at) map shadow uid sAMAccountName filter group (cn=E322*) map group userPassword "" map group gidNumber objectSid:S-1-5-21-527783839-1561677997-9029855232 EOF }}} Do not forget to have users have a home directory, {{{ pam-auth-update mkhomedir # Installation of libpam-ldapd most probably runs # pam-auth-update ldap }}} == Enable hibernation == Create a swap file (not a swap partition), enable swap and modify the kernel command line to search for a RAM image.[[BR]] Use `filefrag` to get the offset of the swap file.[[BR]] It is not necessary to modify `etc/initramfs-tools/conf.d/resume`. {{{ touch /swap chmod 600 /swap dd if=/dev/zero of=/swap bs=1M count=32768 filefrag -v /swap | head # Use the number in the first row, first column of the "physical offset:" columns. # This number has two dots appended (here: 202752..). echo GRUB_CMDLINE_LINUX_DEFAULT=\"resume=PARTLABEL=root_partition resume_offset=202752\" \ >/etc/default/grub.d/resume.cfg echo "/swap swap swap defaults 0 0" >>/etc/fstab }}} == Mark customized files == {{{ cd etc chgrp oswat hostname fstab apt/sources.list apt/apt.conf.d/90recommended_false \ systemd/network/10-gs1.network sshd_config sshd_config.d/permitrootlogin.conf \ default/grub.d/resume.cfg chown oswat nslcd.conf }}}