Deployment
For our first effort, we will set up 3 machines as shown in the diagram above.
We expect that we'll have to do some experimenting to get these "right".
Once we are happy with these 3 VMs and the "application",
we plan to clone the VMs to create a QA, and a PROD environment.
...
Carinet, please review this section.
We plan to move these VMs to our datacenter by midyear 2011.
We want to insure that these VMs are potable.
We expect to do a simple VM copy and do not need v-motion.
Carinet Responsibilities
- Provision hardware
- Provide 3 VMs using barebones
VMWare version x.x (todo - need version number) - install Centos 5 64 bit on each VM
- install Apache web server on the web server VM
- install package manager (yum or Apt-get)
All other software will be installed by city employees.
Security
We assume the following.
- The data center is physically secure.
- VMware installation has latest kernel updates/patches
Please let us know if any of these assumptions is incorrect.
...
SE Linux
...
Do not enable SE Linux.
...
SSH Access
...
All VMs shall be accessible via ssh.
The city will provide public keys for those that will have linux root access.
...
All services shall be disabled unless otherwise requested.
...
The following shall be disabled:
...
- outgoing mail
- SSH
- firewall (see below)
...
Firewall Configuration
...
Web Server VM
Allow access from
...
- ssh
- port 5432 from web server
- port 5432 from geo server
...
TCP Wrapper
...
Can we restrict port level access?
...
- Allow request from web & geo server on port 5432
- Allow ssh request from all
- Deny request from all other host on port 5432
SFGov Responsibilites
...
Install application software including the following.
...
You will need to see the SVN readme for all the excruciating details.
...
- gdal
- python
- django
- geo-django
...
linux admin
...
- set up appropriate new linux users
- Password & Access security
- use of public/private keys
- limit root access
- use sudo as needed
- provide file system security
- umask settings
- setting up appropriate file permissions
...