Changes between Version 1 and Version 2 of schleuder-setup

Timestamp:

Feb 7, 2017, 5:02:36 AM (9 years ago)

Author:

JaimeV

Comment:

--

schleuder-setup

@@ -13 +13 @@
 
 === No recommends ===
-Make sure all subsequent package instals with apt default to using the '''--no-install-recommends''' preference by adding a line to apt.conf
+Make sure all subsequent package installs with apt default to using the '''--no-install-recommends''' preference by adding a line to apt.conf
 
 {{{0 herman:~# echo 'APT::Install-Recommends "0";' >> /etc/apt/apt.conf}}}
@@ -55 +55 @@
 {{{ 0 herman:~# apt install gnupg/unstable schleuder-cli/unstable schleuder/unstable }}}
 
-Omitting the emacs-nox package and its's dependencies that aren't essential here the above setup should give us a package list very close to what is on herman now. 
+At this point the above setup should give us a package list very close to what is on herman now with the exception of the emacs-nox package and its dependencies.
 
 === Networking ===
@@ -180 +180 @@
 In the master.cf this line {{{schleuder_destination_recipient_limit = 1}}} means, "if a message comes in headed for the schleuder transport and it is headed for multiple recipients, feed it to each of them separately, one at a time." {{{compatibility_level = 2}}} just disables backwards compatibility. 
 
-=== Dedicated user for schleuder-cli ===
-
-Create a separate "schleuder-mgmt" user that is able to talk to the API but doesn't have r/w access to the sqlitedb
+
+=== Schleuder configuration ===
+
+Lots of useful information in [https://schleuder.nadir.org/docs/| Schleuder3's official documentation].
+
+The following commands and file edits should be performed under the dedicated schleuder user created by the installer.
+
+{{{
+0 root@herman:~# su - schleuder -s /bin/bash
+}}}
+ 
+Schleuder reads its basic settings from a file that it by default expects at {{{/etc/schleuder/schleuder.yml}}}  The only initial change from the default settings that has been made there on herman is to comment out the default keyserver. 
+{{{#keyserver: pool.sks-keyservers.net}}} 
+
+The Schleuder API is provided by schleuder-api-daemon. Configuration clients (schleuder-web, schleuder-cli) use it to access information about lists, subscriptions, and keys. schleuder-api-daemon uses transport encyrption (TLS) for all connections. The required TLS-certifcates should have been generated during the setup (schleuder install) but can be regenerated if necessary by running the following command as schleuder user: {{{schleuder cert generate}}}
+
+In order to verify the connection, each client needs to know the fingerprint of the API-certificate. Execute the following command to receive the fingerprint of the current cert.
+
+{{{schleuder@herman:~$ schleuder cert fingerprint}}}
+
+The Schleuder API uses API-keys to authenticate clients. To enable a client to connect, their API-key must be added to the section valid_api_keys in Schleuder’s configuration file. You can generate new API-keys by executing the following command:
+
+{{{schleuder@herman:~$ schleuder new_api_key}}}
+
+''All current schleuder api keys should remain private. Always use secure channels to transport this information.''
+
+Add the new api key to file {{{/etc/schleuder/schleuder.yml}}} below the directive {{{valid_api_keys:}}}
+
+{{{
+valid_api_keys:
+  - abcdef...
+  - zyxwvu...
+}}}
+
+Restart the schleuder api daemon as root to apply changes.
+
+{{{0 root@herman:~# systemctl restart schleuder-api-daemon}}}
+
+==== Dedicated user for schleuder-cli ====
+
+Create a separate "schleuder-manager" user that is able to talk to the API but doesn't have r/w access to the sqlitedb
+
 {{{
 adduser schleuder-manager --gecos 'Schleuder Manager,,,' --disabled-password
 }}}
+
+Become the new user, create a new configuration file and ensure that only the schleuder-manager user has read and write access to this file.
+
+{{{
+0 root@herman:~# su - schleuder-manager -s /bin/bash
+schleuder-manager@herman:~$ touch /home/schleuder-manager/.schleuder-cli/schleuder-cli.yml
+schleuder-manager@herman:~$ chmod 600 /home/schleuder-manager/.schleuder-cli/schleuder-cli.yml
+}}}
+
+Edit this file with details for the connection of the schleuder-cli client to the schleuder-api-daemon including the tls fingerprint and api key retrieved above.
+
+{{{
+host: localhost
+port: 4443
+tls_fingerprint: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+api_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+}}}
+
+''The api_key and tls fingerprint have been removed in this example and should not be public. Always use secure channels to transport this information.''
+
+Check that the schleuder-cli client is able to establish a connection to the api.
+
+{{{
+schleuder-manager@herman:~$ schleuder-cli version -r
+3.0.1
+}}}
+
+Create an {{{.ssh/authorized_keys}}} file to allow authorized members of the support team to connect remotely and use the schleuder-cli.
+
+=== List creation and management ===
+
+Review the output of {{{schleuder-cli help}}}.