Install CentOS 6
The first thing that is required is a CentOS machine - this can be physical or virtual.
- Install the operating system via usual mechanism (e.g., net boot CD, ISO in VMware/VirtualBox or the DVD image).
- Choose the following server install options: "Basic server”.
- Create/choose a secure root password and an initial system user account.
- Once installed, make sure you run a
yum updateto ensure your system is fully up to date.
We would recommend using LVM when disk partitioning to allow easier partition/disk expansion on a live system.
After install, you will want to secure/lockdown the server as best practice dictates - for both the server and any extra software installed. This is beyond the remit of this guide but there are many guides available that provide information on how to secure your CentOS servers and applications.
Configure CentOS 6
Next, there are a few CentOS configuration options that need to be set in advance.
There are currently no SELinux policies for Moonshot, and SELinux must be run in Permissive mode.
For production deployments, it is recommended that the machine be assigned a static IP address.
The following ports are required to be accessible from the outside world, both in the local firewall and in any external firewalls:
- 2083/tcp (for RadSec connections to other Moonshot entities)
- 12309/tcp (for Trust Router client connections - if using the Trust Router to broker trust relationships between entities)
These are sample firewall rules that establish incoming and outgoing rules to the Moonshot trust router infrastructure.
IP Tables sample firewall rules
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s 0/0 --dst <IdP/RP Proxy IP address> --dport 2083 -j ACCEPT
-A INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s 18.104.22.168,22.214.171.124,126.96.36.199,188.8.131.52 --dst <IdP/RP Proxy IP address> --dport 12309 -j ACCEPT
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s <IdP/RP Proxy IP address> --dst 0/0 --dport 2083 -j ACCEPT
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp -s <IdP/RP Proxy IP address> --dst 184.108.40.206,220.127.116.11,18.104.22.168,22.214.171.124 --dport 12309 -j ACCEPT
Add the Required Repositories
Moonshot requires two
yum repositories to be added to the system - EPEL (home of some required dependencies), and the Moonshot repository itself.
Install EPEL by running the following command:
Depending on your platform, the
epel-releasepackage is part of one of the optional repositories. On CentOS, it is part of the Extras repository. On RHEL, you must enable both the Optional and Extras repositories. For more information, visit the EPEL homepage.
Install the Moonshot repository by creating a new file at
/etc/yum.repos.d/moonshot.repowith the following content:
Install the Moonshot GPG key:
Verifying the Moonshot GPG key
If you wish to verify the Moonshot GPG key's validity and integrity, please see the Packaging GPG Key for further details.