Page tree
Skip to end of metadata
Go to start of metadata

System Preparation

Install Debian

The first thing that is required is a Debian machine - this can be physical or virtual.

  1. Install the operating system via usual mechanism (e.g., netboot CD, ISO in VMware/VirtualBox or the DVD image.
  2. Choose the following server install options: "Debian desktop, SSH server, Standard system utilities”.
  3. Create/choose a secure root password and an initial system user account.
  4. Once installed, make sure you run an apt-get update and apt-get upgrade to ensure your system is fully up to date.

Tip

We would recommend using LVM when disk partitioning to allow easier partition/disk expansion on a live system.

Warning

After install, you will want to secure/lockdown the server as best practice dictates - for both the server and any extra software installed. This is beyond the remit of this guide but there are many guides available that provide information on securing your Debian servers and applications.

Configure Debian

Next, there are a few Debian configuration options that need to be set in advance.

Networking configuration

For production deployments, it is recommended that the machine be assigned a static IP address.

For Debian networking information please refer to the Debian documentation: https://wiki.debian.org/NetworkConfiguration

Firewall configuration

The following ports are required to be accessible from the outside world, both in the local firewall and in any external firewalls:

  • 2083/tcp (for RadSec connections to other Moonshot entities)
  • 12309/tcp (for Trust Router client connections - if using the Trust Router to broker trust relationships between entities)

Here are sample firewall rules that establish incoming and outgoing rules to both the Test and Live (Jisc Assent) Moonshot trust router infrastructures. If you connect to another Trust Router, adjust these rules to suit:

IP Tables sample firewall rules (Jisc Assent)

-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s 0/0 --dst <IdP/RP Proxy IP address> --dport 2083 -j ACCEPT
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s <IdP/RP Proxy IP address> --dst 0/0 --dport 2083 -j ACCEPT
 -A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s 212.219.179.130,212.219.179.131,212.219.179.138,212.219.179.146 --dst <IdP/RP Proxy IP address> --dport 12309 -j ACCEPT
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s <IdP/RP Proxy IP address> --dst 212.219.179.130,212.219.179.131,212.219.179.138,212.219.179.146 --dport 12309 -j ACCEPT

IP Tables sample firewall rules (Test Network)

-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s 0/0 --dst <IdP/RP Proxy IP address> --dport 2083 -j ACCEPT
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s <IdP/RP Proxy IP address> --dst 0/0 --dport 2083 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s 13.79.134.211,13.79.128.103,52.169.31.104 --dst <IdP/RP Proxy IP address> --dport 12309 -j ACCEPT
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s <IdP/RP Proxy IP address> --dst 13.79.134.211,13.79.128.103,52.169.31.104 --dport 12309 -j ACCEPT

Add the Moonshot Repository

Supported versions

At the moment, Debian (8, 9, and 10) and Ubuntu (16.04 and 18.04) are supported.

  1. Add the Moonshot Debian repository to your system. To do this, run the following command (as root, or using sudo):

    Debian 8
    wget https://repository.project-moonshot.org/debian-moonshot/moonshot-repository.debian8.deb
    dpkg -i moonshot-repository.debian8.deb
    Debian 9
    wget https://repository.project-moonshot.org/debian-moonshot/moonshot-repository.debian9.deb
    dpkg -i moonshot-repository.debian9.deb
    Debian 10
    wget https://repository.project-moonshot.org/debian-moonshot/moonshot-repository.debian10.deb
    dpkg -i moonshot-repository.debian10.deb
    Ubuntu 16.04
    wget https://repository.project-moonshot.org/debian-moonshot/moonshot-repository.ubuntu16.deb
    dpkg -i moonshot-repository.ubuntu16.deb
    Ubuntu 18.04
    wget https://repository.project-moonshot.org/debian-moonshot/moonshot-repository.ubuntu18.deb
    dpkg -i moonshot-repository.ubuntu18.deb

    This installs the apt repository, the current Moonshot GPG key, and a package that can update both. This is the preferred method of deploying repository information.

    Verifying the Moonshot GPG key

    If you wish to verify the Moonshot GPG key's validity and integrity, please see the Packaging GPG Key for further details.

  2. Update the apt cache with the new repository information:

    apt-get update

  • No labels