IPMI Installation (Wheezy)

From Hexwiki
Revision as of 03:50, 12 May 2014 by Vekseid (talk | contribs) (Created page with " == Initial Steps == # If you aren't connecting using a VPN (and possibly even if you are), most IPMI software has ssl support, so access through https. # Create a new usern...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search


Initial Steps

  1. If you aren't connecting using a VPN (and possibly even if you are), most IPMI software has ssl support, so access through https.
  2. Create a new username/password pair.
  3. Some hosts get anal about what accounts you can nuke for IPMI settings. Make things as tight as you are allowed. Reasonably though, they are the ones with physical access. I really do try to get rid of the default login names, however.
  4. SuperMicro iKVM seems to 'bind' to a single computer... You may need to reset it if you get 'connection failed'.
  5. Grab the NetInst CD Image and mount it in iKVM.
  6. You'll probably want to set the boot orders so the non-UEFI IPMI CDROM comes first.

Over-IPMI OS Installation

  1. Advanced Options -> Expert install
  2. Language settings -> Add single byte version of locale, set single byte as default.
  3. Keyboard settings, 'CDROM' detect/mount - straightforward
  4. Components to load: choose-mirror and parted-udeb
  5. Network detect/configure - don't autoconfigure. If using CIDR appending be sure to base from the second IP given to you. Use Google's nameservers if others aren't provided (8.8.8.8 8.8.4.4)
    1. If you're having difficulty, be sure you're using the right interface. Not every host plugs in eth0.
  6. Hostname: Most people choose a scheme of some sort, at least for lower numbers of machines.
  7. The Steadfast mirror is quite handy if your machine is actually at Steadfast or a reseller (e.g. HostVenom).
  8. Enable shadow passwords, allow root login, give good password (Mine are alphanumeric, mixed case, 12 characters, with symbols.
  9. There's a pattern to my admin usernames, but I prefer to keep them secret. Generally use a temp password, set it to something ridiculous later as only logins will be via ssh keys
  10. Setup clock, configure. Should probably consider standardizing on UTC time.
  11. Detect disks, partition manually. Use gpt for new disks (GUID partition table), though may want to stick with msdos for ssds to help with overprovisioning (and some ssds don't support gpt at all), if you can't make use of the manufacturer's provisioning tool.

Partitioning

(I need to seriously clean up what I wrote for this.)

Over-IPMI OS Install - Finishing

  1. Installing base system - non-versioned kernel (for upgrades), targeted initrd (not going to be changing hardware much, if ever).
  2. I prefer to turn popularity contest on, personally.
  3. When getting to the abominable Tasksel/Software selection screen, deselect everything except for SSH server and Standard system utilities.
  4. Install grub to MBR
  5. Reboot, login as root
  6. /etc/init.d/ssh stop
    1. We're listening on the standard port to start. No need to let it get hammered.
  7. vi /etc/network/interfaces
    1. Setup remaining interfaces - or at least one for your desired sshd binding.
    2. Restart networking, ifup eth# if necessary.
  8. vi /etc/ssh/sshd_config
  9. Set new port and specific IP to bind to.
    1. Not really doing this to hide (though our IPTables will help with that). If you ever run a major server, though, you are going to get a lot of attempts at port 22, and a fair amount on various common server ports, and it clutters your logs. Just set it somewhere out of your way. My preference is to pick a single port number for all of my servers and stick with that.
  10. PermitRootLogin no
    1. This is just common sense.
    2. If you're going to be copy/pasting a key from your local machine, leaving PasswordAuthentication on for a minute is not going to kill you.
  11. X11Forwarding no
    1. This system will never use X, or any graphical manager.
  12. UsePAM no
    1. ssh for life. Or something.
  13. /etc/init.d/ssh start
  14. Sign in as your admin user over SSH.
  15. If works, can exit out of IPMI