Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 1 Institutional Install of Red Hat Enterprise Linux From One CD In The LANL Environment “Set it and forget it” - one-stop shop to install and secure Red Hat Enterprise Linux LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 2 What is ExpressWay for Red Hat? Automated installer was needed to provide LANL a secure way to install, configure and harden Red Hat Linux according to LANL security recommendations Installing from Red Hat factory CDs required lots of intermediate steps and manual commands executed by the user / sysadmin to register with update server, harden system, etc. LANL environment includes a mixture of static and DHCP (dynamic) IP addresses – with static networking and install CDs, user has to enter networking multiple times to get installer to work ExpressWay for Red Hat (EWRH) does it all! LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 3 RHEL Security Triangle Red Hat Network Satellite Server (RHUS) Stores distribution install packages Patch management capabilities Used for getting latest updates on clients Generates kickstart file LANL ExpressWay Red Hat Network based installation tool Express vs. interactive install Static vs. dynamic networking LANL Security Tool On Red-Hat (STOR) Hardens the system and provides compliance reporting LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 4 ExpressWay for Red Hat (EWRH) Current Version is 7.1 Internally Developed Web server back-end to get client data and generate kickstart Web server stores kickstart and stor.conf (STOR config. file) Kickstart and stor.conf can be customized via web interface Installation CD uses SYSLINUX menus and COMBOOT32 API to get info from user Uses rhusreg rpm to register system with Red Hat Satellite Server Able to install OR rescue system using installation CD LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 5 EWRH – Quick Install Steps Generate kickstart (web page) Customize kickstart file and stor.conf file (web) Download CDROM ISO and burn it to CD Boot up system off of CD Tell installer what you want to install and network address information Installer downloads kickstart file and stor.conf %pre portion of kickstart finds the CD and validates version Distribution is downloaded from RHNSS Installer runs rhusreg and stor from %post portion of kickstart Rhusreg registers with Satellite Server and fully updates the system Stor fully hardens the system LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 6 EWRH – Architecture Web cgi perl script Step 1. Asks user for Z#, which version of OS (3,4,5), which Product (WS, AS, ES), hostname, networking info (static vs dynamic) Step 2. Validates license for product/version selected against Z# in ESD (LANL Electronic Software Distribution db) Step 3. Verifies network information and gets LANL Property# from LANL's Hostmaster registration db if static IP Step 4. Generates kickstart file and stor.conf Step 5. Allows user to view and customize kickstart file and stor.conf (python scripts) Kickstart file Tells server what/how to install/configure system (packages, networking, %pre, %post, root password, etc.) LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 7 EWRH – Architecture Stor configuration file (stor.conf) stored on web server contains parameters used by stor to harden the system (i.e. Who to send root's mail to, services to start, etc.) Installation ISO contains syslinux boot scripts, syslinux menus comboot32 api (getnet.c) to ask user for network info kernels, initial ramdisks (used to install OR rescue) and a fix for RHEL4 to the kickstart.py file in the stage2 image which causes RHEL 4 install to die if no available partitions exist on interactive install Rhusreg and stor rpms are stored on RHN server, downloaded in %post LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 8 EWRH - Development Red Hat comes out with new version of OS (i.e. 5.2, 4.7, etc) Developer updates perl code on web server to reflect new version Developer gets kernel and initrd from OS Install CD on Satellite Server Developer modifies syslinux menus on ISO to reflect install versions getnet.c uses the syslinux COMBOOT32 API, gets input from user (hostname, ip, netmask, dns, etc.) - is compiled and called by isolinux.bin Developer generates ISO using mkisofs Rhusreg (rpm used to register client with Satellite Server and fully update the system) is also updated to match current version(s) of OS %pre can expire boot media (validates version on CD vs server) LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 9 EWRH – Development cont. Central Services and Development Standards and R&D Team members test installer during an internal alpha test period Internal beta test period Public beta test period Production LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 10 EWRH – Tips and Tricks Script to set root password at end of %post /bin/list-cd in initrd – python script /bin/checkver is built using same idea, gets VERSION file from CD, is compared in %pre against wget’d version file from server Fix partitioning issue in RHEL4 that won’t allow installer to continue if no partitions available during interactive install (commented out two lines in /usr/lib/anaconda/kickstart.py) – required recompile of kickstart.pyc, rebuild of stage2.img, stage2.img added to initrd – RAMDISK_SIZE=xxx Soft links of /RedHat (RHEL3,4) and /image (RHEL5) on CD to point to /RedHat in initrd LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 11 EWRH - Demo LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 12 Resources SYSLINUX – we use v in EWRH 7.1 Previously used CDShell – – compiles isolinux into CDShell modules (and messes things up) – lots of CDShell Scripting involved Portions of rhusreg.pl code (used in LANL-rhusreg RPM) RHN API: (also locally on Satellite Server) – we use mainly system.* (deleteSystems, setGroupMembership, setProfileName, listGroups) Getnet.c code LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 13 Resources – Example syslinux menu /menus/rh5.cfg on Installation CD: LABEL rh5x32 MENU LABEL Install RH5U1 WS i386 KERNEL getnet.c32 APPEND /vmlinuzs/vmlinuz5.x64 initrd=/initrds/initrd5.x64 LABEL rh5sx64 MENU LABEL Install RH5U1 Srv x86_64 KERNEL getnet.c32 APPEND /vmlinuzs/vmnlinuz5.x64 initrd=/initrds/initrd5s.x64 LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 14 Resources – Installation CD Structure EWRH71/: boot/ boot.catalog initrds/ isolinux/ menus/ vmlinuzs/ images -> /images RedHat -> /RedHat EWRH71/boot: memtest memtestp EWRH71/initrds: initrd3.x32 initrd3.x64 initrd4.x32 initrd4.x64 initrd5s.x32 initrd5s.x64 initrd5.x32 initrd5.x64 EWRH71/isolinux: chain.c32 getnet.c32 isolinux.bin isolinux.cfg memdisk menu.c32 splash.jpg vesamenu.c32 EWRH71/menus: defaults.cfg main.cfg rh3.cfg rh3resc.cfg rh4.cfg rh4resc.cfg rh5.cfg rh5resc.cfg selmenu.cfg EWRH71/vmlinuzs: vmlinuz3.x32 vmlinuz3.x64 vmlinuz4.x32 vmlinuz4.x64vmlinuz5.x32 vmlinuz5.x64 LA-UR

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 15 Questions? EWRH authors: Jimmy G. Devenport, Giacomo G. Brussino Computing, Telecommunications and Networking Central Services and Development Team LA-UR