opsi manual opsi version 4.0.2 - opsi Download - uib

opsi manual opsi version 4.0.2
If you configure an admin networks parameter, all administrative accesses are restricted to these network(s).
97 / 193
Setting the option [global] admin networks at the /etc/opsi/opsiconfd.conf will restrict the administrative
access to the opsiconfd to connections coming from the specified network address(es).
You may give multiple addresses separated by comma.
Non administrative access may also come from other networks.
The default is:
admin networks = 0.0.0.0/0
and allows administrative access from all networks.
A configuration like e.g.
admin networks = 127.0.0.1/32, 10.1.1.0/24
restricts administrative access to the server itself and to the network 10.1.1.0/24.
12.9 The user pcpatch
With opsi 4 the user pcpatch is used just by the opsi-client-agent to mount the depot shares (and at the moment by
the netboot products ntfs-write-image and ntfs-restore-image to read and write the image files via ssh).
The password of the user pcpatch is usually stored and transmitted encrypted. Under special circumstances it might
be possible to catch the clear password. To reduce risks arising from that, you should do the following:
Deny for the user pcpatch the access to all other shares than the opsi_depot share. You should do this by adding the
following entry to all share definitions (besides the opsi_depot) at the /etc/samba/smb.conf:
invalid users = root pcpatch
Alternative
At the /etc/samba/smb.conf restrict privileges for the user pcpatch to global read only by setting in the [global]
section:
read list = pcpatch
As an additional task you should frequently change the password of the user pcpatch. You may set the password to a
random string which no one knows (besides opsi). You may do this by calling the following command e.g by a cronjob:
opsi-admin -d task setPcpatchPassword $(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)
If you do not plan to use the netboot products ntfs-write-image or ntfs-restore-image, you may deny a unix logon for
the user pcpatch by setting at the /etc/passwd the shell /bin/false for the user pcpatch.
13 opsi-backup
13.1 Introduction
Your opsi-server should be backuped (like any other important system). This chapter shows what to backup and how.
And of course - how to restore.
13.2 Preconditions for a backup
You should run the opsi-backup command as root.
You have to install the mysqldump program before you can use the opsi-backup in connection with the mysql backend.
Usually this program is part of the mysql client packages.