RT server configuration - Revision history

Ghudson at 13:05, 25 June 2026

2026-06-25T13:05:37Z

Ghudson at 05:59, 25 June 2026

2026-06-25T05:59:40Z

Ghudson at 21:55, 17 July 2025

2025-07-17T21:55:04Z

Ghudson at 17:13, 13 April 2022

2022-04-13T17:13:51Z

Ghudson at 06:01, 13 April 2022

2022-04-13T06:01:07Z

Ghudson at 23:20, 12 April 2022

2022-04-12T23:20:18Z

Ghudson: /* User accounts */

2022-04-12T23:09:22Z

‎User accounts

Ghudson: /* Testing */

2021-06-01T23:52:38Z

‎Testing

Ghudson at 23:44, 1 June 2021

2021-06-01T23:44:06Z

Ghudson at 22:42, 1 June 2021

2021-06-01T22:42:39Z

← Older revision		Revision as of 13:05, 25 June 2026
Line 150:		Line 150:

	==Apache httpd configuration==		==Apache httpd configuration==
		+
		+	Create a basic-auth password entry for each committer:
		+
		+	# Omit "-c" after the first invocation.
		+	htpasswd -c /var/rt2/htpasswd ghudson@mit.edu

	Create /etc/apache2/ssl.crt and /etc/apache2/ssl.key.		Create /etc/apache2/ssl.crt and /etc/apache2/ssl.key.

← Older revision		Revision as of 05:59, 25 June 2026
Line 156:		Line 156:

	Install /etc/apache2/ssl.crt/chain.crt from /mit/apache-ssl/certificates/InCommon-chain.crt.txt (requires tokens). Cutting and pasting is effective for transferring certificates as they are represented as short text files.		Install /etc/apache2/ssl.crt/chain.crt from /mit/apache-ssl/certificates/InCommon-chain.crt.txt (requires tokens). Cutting and pasting is effective for transferring certificates as they are represented as short text files.
−
−	Install /etc/apache2/ssl.crt/clientCA.crt from /mit/apache-ssl/certificates/mitCAclient.pem (requires tokens).

	Install the rt.conf file from the krbdev-services repository as /etc/apache2/sites-available/rt.conf .		Install the rt.conf file from the krbdev-services repository as /etc/apache2/sites-available/rt.conf .

@@ Line 8: / Line 8: @@
 * handle RT_SiteConfig.pm permissions: yes
 * use dbconfig-common: no
 The data in RT is stored in a PostgreSQL database.  The postgresql Ubuntu package will install the recommended version of PostgreSQL for the current Ubuntu version.

← Older revision		Revision as of 17:13, 13 April 2022
Line 221:		Line 221:
	==Git repository==		==Git repository==

−	The authoritative git repository lives in /git/krb5.git. If this repository needs to be reconstructed from another mirror of the repository, install the hooks from the githooks directory of krbdev-services, add the krbsnap private and public SSH key to the hooks directory, and run the git configuration commands from gitconvert/krb5-convert.sh in krbdev-services.	+	The authoritative krb5 git repository lives in /git/krb5.git. If this repository needs to be reconstructed from another mirror of the repository, install the hooks from the githooks directory of krbdev-services, add the krbsnap private and public SSH key to the hooks directory, and run the git configuration commands from gitconvert/krb5-convert.sh in krbdev-services.
		+
		+	The authoritative krbdev-services repository lives in /git/krbdev-services.git.

@@ Line 16: / Line 16: @@
 The server host acts as an authoritative name server for the kerberos.org zone, so the bind9 package must be installed.
 In sum, the following packages must be installed on the RT server:
@@ Line 21: / Line 23: @@
   apache2
   bind9
   libapache2-mod-fcgid
   libsendmail-pmilter-perl
@@ Line 50: / Line 53: @@
     groupadd krbwrite
     useradd -u 3622 -s /usr/bin/git-shell -G krbwrite ghudson
     mkdir /home/ghudson
@@ Line 214: / Line 218: @@
 If the IP address if kerberos.org needs to be changed, the glue record at hover.com must be updated. In the current Hover UI, glue records can be found under "advanced". The transfer lock on the domain must be temporarily disabled (via the Overview screen) to update glue records.

@@ Line 45: / Line 45: @@
   useradd -r -m -g rt -d /var/rt2 -s /bin/false rt
-Some of the above accounts may be created by ops during provisioning.  /var/rt2 and /var/rt2/.ssh must be owned by rtcvs or sshd will reject logins as rtcvs from drugstore.
+Some of the above accounts may be created by ops during provisioning.  /var/rt2 and /var/rt2/.ssh must be owned by rtcvs or sshd will reject logins as rtcvs.
 For the authoritative repository, create a group named "krbwrite" and an account for each committer, with a root-owned home directory and git-shell configuration:

@@ Line 46: / Line 46: @@
 Some of the above accounts may be created by ops during provisioning.  /var/rt2 and /var/rt2/.ssh must be owned by rtcvs or sshd will reject logins as rtcvs from drugstore.
 Create /var/rt2/bin and copy in the following scripts from the krbdev-services repository:
@@ Line 56: / Line 64: @@
 The scripts and directory should be mode 755 and owned by user rt and group rt.
-/var/rt2 should contain an empty .k5login file, managed by ops.  It should contain a .ssh/authorized_keys file, managed by ops, containing the krbsnap key from /git/krb5.git/hooks/krbsnap_rsa_key.pub on drugstore.mit.edu.
+/var/rt2 should contain an empty .k5login file, managed by ops.  It should contain a .ssh/authorized_keys file, managed by ops, containing the krbsnap key from hooks/krbsnap_rsa_key.pub in the authoritative repository.
 Create /var/psqlbackups (owned by root).
@@ Line 68: / Line 76: @@
 * The empty /var/rt2/.k5login file is managed by ops.
 * The /var/rt2/.ssh/authorized_keys file is managed by ops.
-* On drugstore.mit.edu, the krb5 git repository rt-ssh-cmd config value references the rtcvs user and /var/rt2/bin/rt-cvsgate.
+* The authoritative krb5 git repository rt-ssh-cmd config value references the rtcvs user and /var/rt2/bin/rt-cvsgate.
-* On drugstore.mit.edu, the krb5 git repository hooks/krb5-rt-id script references the rtcvs user and /var/rt2/bin/rt-reserve-ticket.  This script comes from the krbdev-services repository's githooks/krb5-rt-id.
+* The authoritative krb5 git repository hooks/krb5-rt-id script references the rtcvs user and /var/rt2/bin/rt-reserve-ticket.  This script comes from the krbdev-services repository's githooks/krb5-rt-id.
 * Some of the same references are present in the krbdev-services repository, but they aren't used.

@@ Line 190: / Line 190: @@
 To test rt-cvsgate, create a test message in /tmp/testmsg like so:
   ticket: new
   subject: rt-cvsgate test
   tags: pullup

@@ Line 197: / Line 197: @@
   test commit message
-As rt-cvsgate, run "/var/rt2/bin/rt-cvsgate ''username'' < /tmp/testmsg", where ''username'' is an authorized user.
+As rtcvs, run "/var/rt2/bin/rt-cvsgate ''username'' < /tmp/testmsg", where ''username'' is an authorized user.
 Undo the temporary changes and restore the database from a dump file.

@@ Line 36: / Line 36: @@
 * group rt
 * user rtcvs: primary group rt, homedir /var/rt2, shell /bin/sh
 These accounts could be created with:
   groupadd -r rt
   useradd -r -g rt -d /var/rt2 rtcvs
-Some of the above accounts may be created by ops during provisioning.
+Some of the above accounts may be created by ops during provisioning.  /var/rt2 and /var/rt2/.ssh must be owned by rtcvs or sshd will reject logins as rtcvs from drugstore.
 Create /var/rt2/bin and copy in the following scripts from the krbdev-services repository: