Scientific Linux Fermi 309 Release Candidate 2.5 for i386 October 25, 2007
Please send bug reports to dawson@fnal.gov,csieh@fnal.gov
----------------------------------------------------------------------------
Please read the Release Notes for Scientific Linux. It is located at
SL.releasenote
All of the info in the SL.releasenote is valid unless this document
states otherwise. This document only contains info that is specific
to the Fermi site. Any reference to SL.releasenote is done to emphasis
that it contains important information.
----------------------------------------------------------------------------
Lines that start with "*" are changed compared to "lts308".
This is based on the rebuilding of RPMS out of SRPMS's that form Scientific
* Linux Fermi. This includes Update 9 with the following changes.
Please read this entire document before installing.
Table of contents
HARDWARE REQUIREMENTS
INSTALLATION INFO
ADDED compared to Scientific Linux 3.0.8
UPDATED compared to Scientific Linux 3.0.8
Installer modifications
/contrib
/docs
/notsupported
MISC Notes
HARDWARE SPECIFIC ISSUES
SOFTWARE ISSUES/BUGS
SUPPORT INFO
vendor ERRATA
Each has a "---" line above and below it.
_____________________________________________________________________________
HARDWARE REQUIREMENTS
_____________________________________________________________________________
- See SL.releasenotes
- Common "Fermi Generic Desktop" Installation : 4.5GB
_____________________________________________________________________________
INSTALLATION INFO
_____________________________________________________________________________
Installation Locations
Via NFS
linux.fnal.gov:/export/linux/lts30rolling/i386/
with floppy
The floppy install situation is the same as Fermi Linux 9.0.1 .
There was not enough space on 1 floppy so the vendor redesigned the install
to have a "generic" boot floppy. With all of the device drivers on driver
floppies. There is a net , pcmcia, and a block driver floppy. With a Fermi
Linux install you will need the "generic" bootdisk.img floppy. And either
the "net" drvnet.img or the "pcmcia" pcmcia.img floppy for your network
drivers. I have modified the boot.img install floppy image to automatically
put in the nfs server and nfs install directory. To override this you can
select the original redhat choice with
linux
at the install floppy prompt.
You will have to make your own floppies from
ftp://linux.fnal.gov/linux/lts30rolling/i386/images/Fermi/bootdisk.img
and one of these
ftp://linux.fnal.gov/linux/lts30rolling/i386/images/Fermi/drvnet.img
ftp://linux.fnal.gov/linux/lts30rolling/i386/images/Fermi/pcmcia.img
To make the install floppies. Put a scratch floppy in "/dev/fd0" for
each image.
dd if=bootdisk.img of=/dev/fd0
dd if=drvnet.img of=/dev/fd0 If you are making the drvnet
with cdrom
There is also a boot.iso which is small iso image which includes all the
drivers on the driver floppies and the generic boot info. This can be used
instead of the above floppies. After download you can use cdrecord to
create a cdr with this image on it.
ftp://linux.fnal.gov/linux/lts30rolling/i386/images/Fermi/boot.iso
Via CDROM
Download and then burn cdrom iso images from
ftp://linux.fnal.gov/linux/iso/lts30rolling/i386/
-----------------------------------------------------------------------------
ADDED compared to Scientific Linux
-----------------------------------------------------------------------------
Fermi-release
Made change so that /etc/issue and /etc/issue.net showed Fermi
Linux instead of RedHat.
* Changed release number to 3.0.9
* Put seamonkey default bookmarks in Fermi-release
flpr
I am installing the flpr rpm by default. I got the latest version
from Randy. This does NOT require ups/upd. The flpr binary will
reside in /usr/local/bin/ . This should just make using flpr
easier for all.
flpr-2.4-4f.9x.i386.rpm
OpenAFS
See SL.releasenote
Kerberos -- Fermi version
** krb5-fermi-config-2.7a-1.noarch.rpm
** krb5-fermi-krb5.conf-2.7a-1.noarch.rpm
* krb5-getcert-1.8d-3.LTS3.i386.rpm
* krb5-libs-fermi-1.8d-3.LTS3.i386.rpm
* krb5-workstation-fermi-1.8d-3.LTS3.i386.rpm
release 1.8a-LTS30x.1 fixes a security problem.
kx509 and kxlist were fixed. RPM had stripped them and they broke.
Correct permissions were put on all files
your old krb5.conf is now checked to see if it needs to be
completely fresh or not. If it does not need a fesh krb5.conf
then only the top half is changed.
kx509 and kxlist were added.
krb5-fermi-krb5.conf will ONLY put on a /etc/krb5.conf that points
to the fermi domain. If you have krb5-fermi-config you DO NOT
need this. This is intended for use with the Redhat provided
kerberos. Many offsite users will find this of use.
krb5-fermi-config-1.9-4 and later has a seperate script that only
adds or removes aklog from your krb5.conf. This script now get's
run (via triggers) whenever openafs get's added or removed.
SLIP
Scientific Linux Inventory Project
ocsinventory-client-0.9.9-7.noarch.rpm
This client will run daily via cron
perl-XML-Simple-2.14-2.rf.noarch.rpm
Dependency of ocsinventory-client
upsupdbootstrap
This version does NOT make the links in /usr/local/bin/ to /usr/bin
upsupdbootstrap-4.1-1.i386.rpm
upsupdbootstrap-local-4.0-1.i386.rpm
upsupdbootstrap-generic-4.0-1.i386.rpm
Yum -- From Duke University
yum-2.0.7-11.SL.noarch.rpm
** yum-conf-309-2.LTS.noarch.rpm
** yum-conf-3x-2-2.LTS.noarch.rpm
*
* yum.cron now uses /etc/yum.conf for a template for it's configuration
* file. If /etc/yum.conf has an excludes line, it will append the
* excludes in /etc/yum.d/yum.cron.excludes. If /etc/yum.conf does
* not have an excludes line, it will add the one from
* /etc/yum.d/yum.cron.excludes
*
* yum-conf-3x was created for those users who want to be at the latest
* stable release. It is always pointing at the 3x area.
zz_a2ps_stdout-1.0-2.noarch.rpm
Change the output of a2ps to go to stdout vs the printer.
zz_cups_nobrowse-1.0-4.noarch.rpm
By default the cups deamon constantly searches the network to find
and check on other cups printers. This rpm turns that feature off.
It also turns off the cupd server as it is not really needed.
zz_dhcp_resolv-2.2-1.noarch.rpm
This rpm fixes that so that when your network starts, as it checks
your resolv.conf, if you have dhcp.fnal.gov, but not fnal.gov it will
put it in, so that you will have "search fnal.gov dhcp.fnal.gov" in
your /etc/resolv.conf file.
zz_emacs_link-1.1-3.noarch.rpm
Make a symbolic link from "emacs" to "xemacs" when xemacs is installed
and emacs is not installed. This version uses triggers to make or
remove the link when emacs, or xemacs is added or removed.
zz_fermi-logos
zz_fermi-logos-3.0.2-1.noarch.rpm
redhat-artwork-0.73.2-1.LTS.i386.rpm
redhat-logos-1.1.14.3-5.LTS.noarch.rpm
Because we were required to change redhat-logos, we didn't have
to do all the little tweeks that we were doing in zz_fermi-logos
This version has most of those tweeks taken out.
Since it is related, and the license permits us, we have also
taken out the most glaring redhat logo's from redhat-artwork.
Fixed a bug with the gdm greeeter theme.
Put in gnome-foot for menu icon so you can tell it is gnome.
zz_firstboot_fix-1.0-1.noarch.rpm
Make changes to firstboot.
1.0 - removes the question about adding users
zz_lang_collate-1.0-2.noarch.rpm
Changes LANG so that sorting is done the same as 6.1 and
earlier. (ABCabc instead of AaBbCc). This is not installed by
default except for a few workgroups. Can be added later with
a "yum install zz_lang_collate" .
zz_logwatch_df-1.0-2.noarch.rpm
By default logwatch does a df -h when looking at disk usage. This
can be unwanted if you have alot of NFS mounted disks. This rpm
change the command to be df -h -l, which looks at local disks only.
zz_ntp_configure-4.0-1.noarch.rpm
Configure ntp for Fermi site network.
zz_pine_user_domain-1.0-1.noarch.rpm
By default when a user sends mail from pine their email address
is myname@mycomputer.fnal.gov. This rpm changes it so that the
default is myname@fnal.gov by modifying the /etc/pine.conf config file.
zz_rhnsd_off-1.0-1.noarch.rpm
This rpm turns off rhnsd, which is on by default.
zz_sendmail_fermi_gateway-2.0-1.noarch.rpm
This rpm is designed to send outbound sendmail e-mail through
the fermilab e-mail gateway(smtp.fnal.gov).
zz_sshd_aklog-3.9-4.noarch.rpm
Turns the KerberosGetAFSToken setting on in your sshd_config
As of Fermi's version openssh-3.9p1-8.SLF.4.17 this option was
taken out of the sshd_config due to it not working and causing
an error. This rpm currently does nothing.
This script is 'trigger'able, so that when you update your
openssh-server or your afs client, it will re-run to keep the
sshd_config file up to date.
zz_sshd_nonkerberized-3.9-1.noarch.rpm
Fermi's openssh is normally kerberized out of the box. This rpm
will make it non-kerberized. Should only be used offsite.
version 3.9 was changed to work with the configurations of openssh 3.9
zz_sshd_pam-3.9-3.noarch.rpm
This changes the setting in sshd_config from "UsePAM = no" to "UsePAM = yes"
When used with the new pam_krb5 (version 2.2.8-2) this allows your
ssh deamon to do cryptocard prompting.
zz_tcp_wrappers_change-3.0-3.noarch.rpm
Disable all offsite access to common network services. Also
puts in the "DOE required login banners". If it determines that
you have already modified /etc/hosts.allow or host.deny it leaves
them alone.
zz_tex_tweaks-1.0-1.noarch.rpm
Changes the default paper size to 8.5 x 11 vs A3
apt-get
Scientific Linux Fermi is NOT aptable.
We only support yum handling the daily "auto update" function.
Only YUM is installed by default and ONLY YUM is SUPPORTED at Fermi.
Workgroup tag files
These are used to specify which workgroup you belong to.
Astro-tag-3.0-4.noarch.rpm
BooNE-tag-3.0-4.noarch.rpm
BooNEDataServer-tag-3.0-5.noarch.rpm
BTeV-tag-3.0-5.noarch.rpm
BTeVTrigger-tag-3.0-5.noarch.rpm
BTeVSimulation-tag-3.0-7.noarch.rpm
BTeVWorker-tag-3.0-7.noarch.rpm
CDFCAFworker-tag-3.0-4.noarch.rpm
CDFlevel3-tag-3.0-4.noarch.rpm
CDFoffsite-tag-3.0-4.noarch.rpm
CDFonline-tag-3.0-4.noarch.rpm
CDF-tag-3.0-4.noarch.rpm
ClueD0Workstation-tag-3.0-4.noarch.rpm
CMSdesktop-tag-3.0-4.noarch.rpm
CMSfarm-tag-3.0-4.noarch.rpm
CMSserver-tag-3.0-4.noarch.rpm
ConsoleServer-tag-3.0-4.noarch.rpm
CPD-tag-3.0-4.noarch.rpm
CPDserver-tag-3.0-5.noarch.rpm
CSS-tag-3.0-4.noarch.rpm
FarmsConsole-tag-3.0-4.noarch.rpm
Farms-tag-3.0-4.noarch.rpm
FermiStandAlone-tag-3.0-4.noarch.rpm
FermiVeryGeneric-tag-3.0-4.noarch.rpm
FnaluBatch-tag-3.0-4.noarch.rpm
FnaluInteractive-tag-3.0-4.noarch.rpm
FOCUS-tag-3.0-4.noarch.rpm
GenericFarm-tag-3.0-4.noarch.rpm
Minos-tag-3.0-4.noarch.rpm
OAA-tag-3.0-4.noarch.rpm
RIP-tag-3.0-4.noarch.rpm
SDSS-tag-3.0-4.noarch.rpm
Sidet-tag-3.0-4.noarch.rpm
Theory-tag-3.0-4.noarch.rpm
FermiGenericDesktopOffsite-tag-3.0-6.noarch.rpm
D0-online-tag-3.0-8.noarch.rpm
EAG-tag-3.0-8.noarch.rpm
GenericServer-tag-3.0-9.noarch.rpm
DcacheServer-tag-3.0-10.noarch.rpm
---------------------------------------------------------------------------
UPDATED compared to 3
----------------------------------------------------------------------------
authconfig
Authconfig needed to be tweeked because it was putting a line into
the /etc/pam.d/system-auth that would not allow you to log into
root or a group account if there was a .k5login file in the accounts
home area. This is the same change that was done in Fermi Linux 9.0.x
We also changed it so that it quit putting the kerberos realm, as a
line by itself in the top of krb.conf. This was causing some
authentications to never return.
authconfig-4.3.7-1f1.i386.rpm
authconfig-gtk-4.3.7-1f1.i386.rpm
OpenSSH
This is the openssh from S.L. 4.x with some patches and modifications.
It does kerberos with both fermi's old openssh(old gssapi), as well as
generic new openssh's(new gssapi) for both the server and the client.
So end users won't need a special openssh.
It works with multiple IP address's (if you are behind a load balancer)
It has the "High Performance Networking" patch (a command line option)
http://www.psc.edu/networking/projects/hpn-ssh/
It does 'kerberos only' by default
It does not do cryptocard. Users needing this need to install
the modified pam module (pam_krb5-2.2.8-2) and then either change
the sshd_config to say "UsePAM = yes" or install the
zz_sshd_pam rpm.
If a workgroup wants to install openssh-server then they just need
to add the entry from their "comps" file as it is NOT installed by
default.
* openssh-3.9p1-8.SLF.3.22.i386.rpm
* openssh-askpass-3.9p1-8.SLF.3.22.i386.rpm
* openssh-askpass-gnome-3.9p1-8.SLF.3.22.i386.rpm
* openssh-clients-3.9p1-8.SLF.3.22.i386.rpm
* openssh-server-3.9p1-8.SLF.3.22.i386.rpm
pam_krb5
This pam module is the same as the old one, but it adds cryptocard
authentication.
This has been compiled with static libraries so it doesn't matter which
kerberos you have installed.
* pam_krb5-2.2.11-4.slf3.i386.rpm
*redhat-lsb-1.3-3.1.LTS.309.i386.rpm
Changed to have LTS 309 be lsb compliant
vnc
Issue with vnc allowing more than just localhost to connect by
default.
The starting point was the latest Fedora Core SRPM of vnc,
back-ported to use the XFree86-4.3.0-78.EL sources instead of x.org
and javac instead of the (too-old) gcc-java, and patched to set the
"localhostOnly" parameter to true by default. Note that it is still
possible to return to RISKY behavior by invoking:
vncserver -localhost="no" (or 0, or "off")
Note that vncviewer has the new option "-via", meaning that the
command line:
vncviewer -via <host>.fnal.gov localhost:1
will set up an SSH tunnel and use it to access the local vncserver
running on <host>.fnal.gov, all in one step.
NOTE that vnc is ONLY allowed if used with a SSH tunnel onsite at
Fermi. See the above info.
Thanks to Chris Green for this patched vnc.
----------------------------------------------------------------------------
Installer modifications
---------------------------------------------------------------------------
Kerberos is enabled by default on the normal authentication
screen. The installer does NOT know if what you put in here is
accurate so if you change something make sure it is right because
that is what you are going to get.
Changes to "defaults" from vendor installer.
Firewall is off by default. vendor default was Medium.
US/Central is default timezone. vendor default was New York.
Kerberos is on by default with a realm of FNAL.GOV . vendor default
was off.
flpr
Now installed by default. No need for ups/upd as this is
a rpm.
---------------------------------------------------------------------------
/contrib/
---------------------------------------------------------------------------
The packages in this section have been contributed by various people. They
are presented AS IS and there is no guarantee of them working. These packages
are NOT supported by us. They will only get security updates if the
contributor provides them. If you have questions about them then ask the
contributor.
There are really 2 contrib trees. One for the base Scientific Linux and one
for this site. To use with yum you will need to uncomment out either/both of
the "contrib" lines in /etc/yum.conf
See README's in the RPMS/ directorys for specific info.
/sites/Fermi/contrib/RPMS/
/contrib/RPMS/
---------------------------------------------------------------------------
MISC NOTES
---------------------------------------------------------------------------
Upgrades from prior versions.
UPDATES are NOT supported for all versions of Fermi Linux.
UPDATES will NOT work from anything except RedHat AS 2.1. Vendor
seems to really want users to start from scratch. We will support
yum upgrades from Fermi Linux 9.0.1 to LTS 3.0.4 . Note that the
workgroup maintainers will have to enable the after.rpms.yum.sh
with the same contents as after.rpms.sh for their workgroups to
work via a yum upgrade.
---------------------------------------------------------------------------
SUPPORT INFO
---------------------------------------------------------------------------
Fermi site users should start with the "Fermi" specific support areas and
use the Scientific Linux next.
Fermi Linux web pages
http://www.fnal.gov/cd/unix/linux
Fermi Linux Community support mailing list
linux-users@fnal.gov
Which is archived at
http://listserv.fnal.gov/archives/linux-users.html
Scientific Linux web page
http://www.scientificlinux.org
------------------------------------------------------------------------------
ERRATA
------------------------------------------------------------------------------
* krb5-devel-1.2.7-67.i386.rpm
* krb5-libs-1.2.7-67.i386.rpm
* krb5-server-1.2.7-67.i386.rpm
* krb5-workstation-1.2.7-67.i386.rpm
* libpng10-1.0.13-18.i386.rpm
* libpng10-devel-1.0.13-18.i386.rpm
* libpng-1.2.2-28.i386.rpm
* libpng-devel-1.2.2-28.i386.rpm
* tzdata-2007h-1.el3.noarch.rpm
* openssl-0.9.7a-33.24.i386.rpm
* openssl-0.9.7a-33.24.i686.rpm
* openssl-devel-0.9.7a-33.24.i386.rpm
* openssl-perl-0.9.7a-33.24.i386.rpm
* seamonkey-1.0.9-0.5.el3.i386.rpm
* seamonkey-chat-1.0.9-0.5.el3.i386.rpm
* seamonkey-devel-1.0.9-0.5.el3.i386.rpm
* seamonkey-dom-inspector-1.0.9-0.5.el3.i386.rpm
* seamonkey-js-debugger-1.0.9-0.5.el3.i386.rpm
* seamonkey-mail-1.0.9-0.5.el3.i386.rpm
* seamonkey-nspr-1.0.9-0.5.el3.i386.rpm
* seamonkey-nspr-devel-1.0.9-0.5.el3.i386.rpm
* seamonkey-nss-1.0.9-0.5.el3.i386.rpm
* seamonkey-nss-devel-1.0.9-0.5.el3.i386.rpm