1. Creating ODP regional node from scratch
Alexander Kolesnikov
RIHMI-WDC, Russia

2. Pre-installation process
Unpack the VM images on your computer
Make a connection to the ESXi host using Vsphere client
Transfer VM-images to the server storage
Add virtual machine to ESXi inventory

3. Pre-installation process
Open the tab Configuration -> Storage, then open your datastorage

4. Pre-installation process
Click the icon for downloading files to the storage and select ‘Upload Folder’
Next, select the folder which contains VM image and press OK
Wait until the folder will be loaded into the storage

5. Pre-installation process
After that open the folder and upload the VM into the ESXi host inventory

6. Specification of ODP node virtual machines (for 16GB RAM server)
Component
CPU
RAM
DISK
IP adress
DNS name
PORTAL, SECURITY (PORTAL) 2
3 Gb
80 Gb
XXX.XXX.XXX.XXX
portal-odp.nmdis.gov.cn
DATABASE (DB)
230 Gb
db-odp.nmdis.gov.cn
INTEGRATION SERVER (IS) 4
130 Gb
is-odp.nmdis.gov.cn
SERVICE BUS (SOI)
soi-odp.nmdis.gov.cn
DATA PROVIDER (DP)
160 Gb
dp-odp.nmdis.gov.cn
MONITORING (SYS)
1 Gb
sys-dop.nmdis.gov.cn

7. Basic requirements to install CentOS
Component ID
User’s functions
PORTAL, IS, SOI, DP
jboss – management application server’s JBoss 4.2.3, Jboss 5.1.0, Apache-Tomcat 6
zabbix – management monitoring client DB
postgres – management DBMS Postgresql 8.4
System localization - UTF-8.en_EN
Time zone - GMT+0
All connected hard disk must be in LVM
Set of basic software installation– minimal.
IMPORTANT:
The password must contain Latin characters from az in upper and lower case
Special
The password must be minimum of 8 characters

8. Users environment Component ID Users Working directory PORTAL/SSO
jboss
zabbix
/opt/portal
/opt/portal/zabbix DB
postgres
/opt/db/PostgreSQL
/opt/db/zabbix IS
/opt/is
/opt/is/zabbix
SOI
/opt/soi
/opt/soi/zabbix DP
/opt/dp
/opt/dp/zabbix
SYS
/opt/sys/PostgreSQL
/home/zabbix

9. System environment Component ID PORTAL/SSO DB IS SOI DP Users
Working directory
PORTAL/SSO
$JAVA_HOME
$JBOSS_HOME
$ZABBIX_HOME
/opt/portal/java/jdk1.7.0_51
/opt/portal/jboss-portal-2.7.2
/opt/portal/zabbix DB
$PGDATA
/opt/db/PostgreSQL/8.4/data
/opt/db/zabbix IS
/opt/is/java/jdk1.7.0_51
/opt/is/jboss GA
/opt/is/zabbix
SOI
/opt/soi/java/jdk1.6.0_43
/opt/soi/jboss GA
/opt/soi/zabbix DP
/opt/dp/java/jdk1.7.0_51
/opt/dpjboss GA
/opt/dp/zabbix

10. Software versions Component ID Sotware PORTAL
JBoss AS GA (jboss-portal-2.7.2)
Tomcat 6
JDK 1.7 DB
PostgreSQL 8.4 IS
JBoss AS GA
SOI
JBoss AS GA
JDK 1.6 DP 10

11. Basic installation and configuration
Action
Command
For all components
Login via root
-----
Install CMD manager configure firewall
‘yum install system-config-firewall-tui’
Install MidNightComander
‘yum install mc’

12. Basic installation and configuration
Action
Command
For all components
Disable Selinux:
Open SElinux config Change “SELINUX=enforcing” to “SELINUX=disabled”
‘vi /etc/selinux/config’
Press “i” to enable write mode, edit “SELINUX” option and save file - press “Esc”, then “:wq” and press “Enter”
Disable system Firewall
system-config-firewall-tui

13. Basic installation and configuration
Action
Command
For all components
Install OpenSSH client and mlocate
‘yum install openssh-clients-5.3p1-94.el6.x86_64 mlocate’
Update you system and
further reboot your system
‘yum update && shutdown –r now’

14. Java installation and configuration
Action
Command
For all components
Create a directory for the component (named with component ID)
‘mkdir /opt/<component_ID>’
Installing Java
‘mkdir /opt/<component_ID>/java’
Create Java directory

15. Java installation and configuration
Action
Command
For components id Portal, DP, IS
Download java installer and extract archive
‘tar –xfv jdk-7u51-linux-x64.tar.gz’
For component id SOI
Download java installer and extract archive
‘tar –xfv jdk-6u45-linux-x64.tar.gz’ 15

16. Java installation and configuration
Action
Command
For components id Portal, DP, IS
Create alternatives:
/usr/bin/java
/usr/bin/javac
/usr/bin/jar
‘alternatives --install /usr/bin/java java/opt/portal/java/jdk1.7.0_51/bin/java 100 && alternatives --install /usr/bin/javac javac /opt/portal/java/jdk1.7.0_51/bin/javac 100 && alternatives --install /usr/bin/jar jar /opt/portal/java/jdk1.7.0_51/bin/jar 100’
For component id SOI
Create alternatives:
/usr/bin/java
/usr/bin/javac
/usr/bin/jar
‘alternatives --install /usr/bin/java java/opt/portal/java/jdk1.6.0_45/bin/java 100 && alternatives --install /usr/bin/javac javac /opt/portal/java/jdk1.6.0_45/bin/javac 100 && alternatives --install /usr/bin/jar jar /opt/portal/java/jdk1.6.0_45/bin/jar 100’

17. Java installation and configuration
Action
Command
For components id Portal, DP, IS
Add link to JAVA_HOME in ‘/etc/profile’
run: ‘vi /etc/profile’
add following line:
‘export JAVA_HOME="/opt/portal/java/jdk1.7.0_51"’
save file
‘echo $JAVA_HOME &&
cd $JAVA_HOME’ &&
$JAVA_HOME/bin/java --
version’
Test JAVA_HOME

18. Java installation and configuration
Action
Command
For component id SOI
Add link to JAVA_HOME in ‘/etc/profile’
run: ‘vi /etc/profile’
add following line:
‘export JAVA_HOME="/opt/portal/java/jdk1.6.0_45“’
save file
‘echo $JAVA_HOME &&
cd $JAVA_HOME’ &&
$JAVA_HOME/bin/java --
version’
Test JAVA_HOME 18

19. For components id PORTAL, IS, SOI, DP For component id PORTAL
JBoss AS installation
Action
Command
For components id PORTAL, IS, SOI, DP
Create user ‘jboss’ and set password in your system
‘useradd jboss && passwd jboss’
For component id PORTAL
Download tar archive your component in folder ‘/opt/portal’, extract it and set the destination folder owner to user ‘jboss’
‘tar –xfv jboss-portal tar.gz && chown –R jboss. /opt/portal/jboss-portal-2.7.2’

20. JBoss AS installation Action Command For component id IS
Download tar archive your component in folder ‘/opt/is’, extract it and set the destination folder owner to user ‘jboss’
‘tar –xfv jboss GA.tar.gz && chown –R jboss. /opt/is/jboss GA’
For component id DP
Download tar archive your component in folder ‘/opt/dp’, extract it and set the destination folder owner to user ‘jboss’
‘tar –xfv jboss GA.tar.gz && chown –R jboss. /opt/dp/jboss GA’ 20

21. JBoss AS installation Action Command For component id SOI
Download tar archive your component in folder ‘/opt/soi’, extract it and set the destination folder owner to user ‘jboss’
‘tar –xfv jboss GA.tar.gz && chown –R jboss. /opt/soi/jboss GA’ 21

22. For components id PORTAL, IS, SOI, DP
JBoss AS installation
Action
Command
For components id PORTAL, IS, SOI, DP
Copy JBoss application server run script in ‘/etc/init.d’
‘cp $JBOSS_HOME/bin/jboss_init_redhat.sh /etc/init.d’
‘chkconfig --add jboss_init_redhat.sh &&
chkconfig --levels 2345 jboss_init_redhat.sh on’
Add JBoss AS run script in autorun on the 2345 run levels

23. Monitoring client installation
Action
Command
For all components
Create user ‘zabbix’ and set password in your system
‘useradd zabbix && passwd zabbix’
Download tar archive of zabbix client to ‘/opt/<component_ID>’,extract it and set the destination folder owner to user ‘zabbix’
‘tar –xfv zabbix.tar.gz
chown –R zabbix. /opt/<component_ID>/zabbix’

24. Monitoring client installation
Action
Command
For all components
Copy zabbix run script in ‘/etc/init.d’, change $ZABBIX_HOME in script
‘cp /opt/<componeni_id> /zabbix/zabbixd /etc/init.d’
Add zabbix run script in autorun on the 2345 run levels
‘chkconfig --add zabbixd &&
chkconfig --levels 2345 zabbixd on’

25. Monitoring client configuration
Action
Command
Configure zabbix_agentd.conf
‘vi$ZABBIX_HOME/conf/zabbix_agentd.conf’
For example:
PidFile=$ZABBIX_HOME/log/zabbix_agentd.pid
LogFile= $ZABBIX_HOME/log/zabbix_agentd.log
DebugLevel=3
Server=XXX.XXX.XXX.XXX
ListenPort=10050
StartAgents=3
Hostname=portal-odp
Timeout=3
LogFileSize=2
EnableRemoteCommands=1
Set IP address for Zabbix server
Set host name for Zabbix server

26. Only for component ID PORTAL
Tomcat installation
Action
Command
Only for component ID PORTAL
‘tar –xfv apache-tomcat tar.gz
chown –R jboss. /opt/portal/apache-tomcat ’
Download tar archive sso application server in ‘/opt/portal’
Extract and set the destination folder owner to user ‘jboss’
‘cp /opt/”componetn” /apache-tomcat /bin/tomcat.sh /etc/init.d’
Copy run script in ‘/etc/init.d’
‘chkconfig --add tomcat.sh
chkconfig --levels 2345 tomcat.sh on’
Add the script to auto run mode on the 2345run levels

27. PostgreSQL installation
Action
Command
Only for component ID DB
Download and install postgresql linux-x64.run to the folder ‘/opt/db’
‘chmod +x postgresql linux-x64.run’
Install DBMS postgresql
‘./postgresql linux-x64.run’
Set db directory /opt/db/PostgreSQL and password for super user db

28. PostgreSQL installation
Action
Command
Only for component ID DB
Edit $PGDATA/pg_hba.conf file
‘vi /opt/db/PostgreSQL/8.4/data/pg_hba.conf’
Add lines how may connected to data base server
For example: host all all IP/prefix md5
Set owner postgres to $POSTGERS_HOME
‘chown –R postgres. /opt/db/PostgreSQL’
‘service postgres-8.4 restart’
Restart DBMS

29. Increase security CentOS
Action
Command
For all components
Add mount option's in ‘/etc/fstab’ to directories ‘/tmp’, ‘/var/tmp’ and ‘/dev/shm’
‘vi /etc/fstab’
add option’s nodev,nosuid,noexec for /tmp, /vat/tmp and /dev/shm and save file
Locked to launch shell programs:
‘/usr/bin/curl’, ‘/usr/bin/perl*’, ‘/bin/chmod’, ‘/usr/bin/*ftp*’, ‘/bin/umount’
‘chmod 754 /usr/bin/curl && chmod 744 /usr/bin/perl* && chmod 754 /bin/chmod && chmod 754 /usr/bin/*ftp* && chmod 754 /bin/umount &&’

30. Networking

31. Networking NAT routing
Redirecting requests for public port connections handled by the iptables, by creating rules in the table NAT chain PREROUTING and OUTPU
Component ID
Destination Port
Redirect Port
PORTAL 80
8081 IS
8080
SOI
18080 DP

32. Networking (local interaction)
Source IP or Domain
Source port
Destination IP or Domain
Destination port
portal-odp.nmdis.gov.cn
db-odp.nmdis.gov.cn
is-odp.nmdis.gov.cn
soi-odp.nmdis.gov.cn
dp-odp.nmdis.gov.cn
sys-dop.nmdis.gov.cn
any

33. Networking Interaction ODP Regional node to a ODP Global node
Source IP or Domain
Source port
Destination IP or Domain
Destination port
portal-odp.nmdis.gov.cn
db-odp.nmdis.gov.cn
is-odp.nmdis.gov.cn
soi-odp.nmdis.gov.cn
dp-odp.nmdis.gov.cn
sys-dop.nmdis.gov.cn
any
portal.odp.meteo.ru
80,8080,8081
db.odp.meteo.ru
none
is.odp.meteo.ru
80,8080
soi.odp.meteo.ru
80,18080
dp.odp.meteo.ru
80,8081
mon.odp.meteo.ru
10050,10051

34. Networking Interaction ODP Global node to a ODP Regional node
Source IP or Domain
Source port
Destination or Domain
Destination port
portal.odp.meteo.ru
db.odp.meteo.ru
is.odp.meteo.ru
soi.odp.meteo.ru
dp.odp.meteo.ru
sys.odp.meteo.ru
any
portal-odp.nmdis.gov.cn
20,21,22,80,8080,8081
db-odp.nmdis.gov.cn
20,21,22,5432
is-odp.nmdis.gov.cn
20,21,22, 80,8080
soi-odp.nmdis.gov.cn
20,21,22, 80,18080
dp-odp.nmdis.gov.cn
20,21,22, 80,8081
sys-dop.nmdis.gov.cn
20,21,22,5432, 10050,10051

35. Networking with in Internet user’s
Source IP or Domain
Source port
Destination IP or Domain
Destination port
Interaction node *. nmdis.gov.cn (China) to a Internet
portal-odp.nmdis.gov.cn
any
80,443
db-odp.nmdis.gov.cn
is-odp.nmdis.gov.cn
soi-odp.nmdis.gov.cn
dp-odp.nmdis.gov.cn
sys-dop.nmdis.gov.cn
Interaction Internet to a node *. nmdis.gov.cn (China)
80,8080,8081
none
80,8080
80,18080
80,8081

36. Questions?