Hack Manhattan Wiki - Recent changes [en]

Raphael

Citybadger — Thu, 13 Aug 2026 18:42:09 GMT

acknowledged the changed hostname

← Older revision		Revision as of 18:42, 13 August 2026
Line 26:		Line 26:

	Had trouble booting. Power Supply was not providing enough power. In BIOS, I changed the System Profile to "Dense Configuration".		Had trouble booting. Power Supply was not providing enough power. In BIOS, I changed the System Profile to "Dense Configuration".

			Was originally named "rafael" because of a typo. fixed.

System Administration Group - Documentation

Citybadger — Thu, 13 Aug 2026 18:37:41 GMT

Undo revision 9827 by William (talk)

← Older revision		Revision as of 18:37, 13 August 2026
(One intermediate revision by the same user not shown)
Line 18:		Line 18:
	\|-		\|-
	\| [[DNS]] \|\| [[unbound]] \|\| [[april]]		\| [[DNS]] \|\| [[unbound]] \|\| [[april]]
	\|-
	~~\| Talking Cow \|\| [[cowsay-leonardo]] \|\| [[leonardo]]~~
	\|-		\|-
	\| [[Inventory Management]] \|\| [[Snipe-IT]] \|\| [[michelangelo]] \|\| http://michelangelo.sagroup.hackmanhattan.com/login		\| [[Inventory Management]] \|\| [[Snipe-IT]] \|\| [[michelangelo]] \|\| http://michelangelo.sagroup.hackmanhattan.com/login
	\|-		\|-
	\| [[Configuration Management]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo		\| [[Configuration Management]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo
	\|-
	~~\| [[Web server]] \|\| [[nginx-donatello]] \|\| [[donatello]]~~
	\|}		\|}

	~~Talking Cow~~

	=== ===		=== ===

Project Ideas

Citybadger — Thu, 13 Aug 2026 16:45:22 GMT

Added Progress and Issues lines for the projects that we've actually worked on.

← Older revision		Revision as of 16:45, 13 August 2026
Line 5:		Line 5:
	Solution: A centralized database of user information with a way of authenticating against it.<br>		Solution: A centralized database of user information with a way of authenticating against it.<br>
	Example technologies: LDAP via FreeIPA (requires Fedora or RHEL), Samba, or OpenLDAP. SSO via Keycloak,Authentik, or Authelia		Example technologies: LDAP via FreeIPA (requires Fedora or RHEL), Samba, or OpenLDAP. SSO via Keycloak,Authentik, or Authelia
	Questions: LDAP or SSO?		Questions: LDAP or SSO? <br>
			Progress: [[FreeIPA]] was installed on [[leatherhead]], client installed on [[donatello]], ssh login via password or key is working. <br>
			ISSUES: LDAP authentication isn't working. [[leatherhead]]'s networking/port forwarding situation is not setup right. Setting up a directory services replica would be good and interesting. A backup scheme is needed.

	⭐️Local DNS<br>		⭐️Local DNS<br>
Line 11:		Line 13:
	Solution: a local DNS server that supports dynamic name registration <br>		Solution: a local DNS server that supports dynamic name registration <br>
	Possible technologies: BIND9 or Technitium Questions: Use a hackmanhattan.com subdomain like sagroup.hackmanhattan.com? Implement a canary domain? Or otherwise deal with browser DNS over HTTPS?<br>		Possible technologies: BIND9 or Technitium Questions: Use a hackmanhattan.com subdomain like sagroup.hackmanhattan.com? Implement a canary domain? Or otherwise deal with browser DNS over HTTPS?<br>
			Progress: an [[unbound]] DNS server was installed on [[april]] for the subdomain sagroup.hackmanahttan.com. As part of the [[FreeIPA]] install [[leatherhead]] runs a [[BIND]] DNS server with the records necessary for FreeIPA's operation.<br>
			Issues: We should probably replace [[unbound]] on [[april]] with BIND secondary zone both to allow FreeIPA to operate from a directory service replica without [[leatherhead]] having to be up.

	⭐️VPN<br>		⭐️VPN<br>
Line 16:		Line 20:
	Solution: a host-to-network (remote-access) VPN perhaps using a Raspberry PI or other small platform to minimize idle energy use Possible technologies: Wireguard, OpenVPN, RaspberryPi, PiVPN <br>		Solution: a host-to-network (remote-access) VPN perhaps using a Raspberry PI or other small platform to minimize idle energy use Possible technologies: Wireguard, OpenVPN, RaspberryPi, PiVPN <br>
	Questions: Does Wireguard or OpenVPN better integrate with whatever centralized authentication system we implement? Can we restrict access to just sysadmin group equipment?yste Do we want to? Are we going to conflict with HM's VPN implementation?<br>		Questions: Does Wireguard or OpenVPN better integrate with whatever centralized authentication system we implement? Can we restrict access to just sysadmin group equipment?yste Do we want to? Are we going to conflict with HM's VPN implementation?<br>
			Progress: Wireguard has been installed on [[april]]. One person said the were able to connect remotely to [[april]] and start and ssh session.
			Issues: Other people have not been able to connect. Also does routing through [[april]] and to other equipment work? How about DNS settings for the remote tunnel?

	⭐️NTP:<br>		⭐️NTP:<br>
Line 21:		Line 27:
	Solution: a local NTP server to fetch accurate time from a reliable source and synchronize our local machines, on port 123.<br>		Solution: a local NTP server to fetch accurate time from a reliable source and synchronize our local machines, on port 123.<br>
	Doubts: can an always-on service like NTP be run on a raspberry pi<br>		Doubts: can an always-on service like NTP be run on a raspberry pi<br>
			Progress: [[chrony]] has been installed on all the machines.

	⭐️Configure Router to hand out reserved IP addresses to each server.		⭐️Configure Router to hand out reserved IP addresses to each server.
	Problem: currently ip's are dynamically assigned with a long lease; in principle we are one reboot away from the Wiki ip addresses being inaccurate.		Problem: currently ip's are dynamically assigned with a long lease; in principle we are one reboot away from the Wiki ip addresses being inaccurate.
			Progress: All the main server addresses and the some of the iDRAC addresses have been reserved on the router.
			Issues: The rest of the iDRAC's addresses should be reserved.

	🐣Figure out why "wall" command isn't working<br>		🐣Figure out why "wall" command isn't working<br>
Line 40:		Line 49:
	🪛Router		🪛Router
	Problem: We have a Cisco router it might be fun to play with or even use for something, but we don’t know if it works or how it’s configured.		Problem: We have a Cisco router it might be fun to play with or even use for something, but we don’t know if it works or how it’s configured.
	Solution: Connect up to it, reset it to its default configuration, mount it in the rack, connect it to the switch, set login credentials to the standard password.		Solution: Connect up to it, reset it to its default configuration, mount it in the rack, connect it to the switch, set login credentials to the standard password.<br>
	Possible technologies: serial cable, USB to serial adapter.		Possible technologies: serial cable, USB to serial adapter.

Line 58:		Line 67:
	Possible Technologies: PXE Boot, TFTP, Ventoy Server, LTSP or similar<br>		Possible Technologies: PXE Boot, TFTP, Ventoy Server, LTSP or similar<br>
	Resources: Archwiki has a good page on the subject Questions: Can we boot a Raspberry Pi via PXE? Can we boot Windows?<br>		Resources: Archwiki has a good page on the subject Questions: Can we boot a Raspberry Pi via PXE? Can we boot Windows?<br>
			Progress: set up on[[raphael]. See the [[Diskless Workstations]] progress page for details.<br>
			Issues: need an image that will actually fully boot from the network.

	🪛Install a Wiki<br>		🪛Install a Wiki<br>
Line 70:		Line 81:
	Solution: Automate tests and collect the data into a central dashboard.<br>		Solution: Automate tests and collect the data into a central dashboard.<br>
	Possible technologies: Nagios, Inciga.<br>		Possible technologies: Nagios, Inciga.<br>
			Progress: check_mk was installed on [[raphael]](?)<br>
			Issue: Doesn't work

	🪛VOIP<br>		🪛VOIP<br>

User:LambdaCalculus

LambdaCalculus — Wed, 12 Aug 2026 21:42:26 GMT

← Older revision		Revision as of 21:42, 12 August 2026
Line 8:		Line 8:
	<li>Old school crustpunk, sysadmin, network engineer, and plenty of good security knowledge. Hire me! <br>		<li>Old school crustpunk, sysadmin, network engineer, and plenty of good security knowledge. Hire me! <br>
	<li>Resident of hackers.town, member of DC212, frequents NYC2600 meetups, and will still hit a good punk show <br>		<li>Resident of hackers.town, member of DC212, frequents NYC2600 meetups, and will still hit a good punk show <br>
			<li>Spoke at various hacker confs, including HOPE, DEF CON, JawnCon, PumpCon, PhreakNIC, and more!<br>
	<br>		<br>
	<br>		<br>

Meeting 2026-07-26

LambdaCalculus — Wed, 12 Aug 2026 21:38:18 GMT

← Older revision		Revision as of 21:38, 12 August 2026
(2 intermediate revisions by the same user not shown)
Line 2:		Line 2:

	==Approve Minutes==		==Approve Minutes==
			No objections to last month’s minutes

	==Consensus Agenda==		==Consensus Agenda==
	~~None~~		Nothing on the agenda

	==Member Reports==		==Member Reports==

	=== Board Reports===		=== Board Reports===

	====President's Report====		====President's Report====
			Nothing to report except in New Business

	====Treasurer's Report====		====Treasurer's Report====
			We’re doing decent this month; we’re closing the gap and are only short $75 this month; dues largely stayed the same this month; had to make a $9 adjustment to May due to Stripe reports.

	====Secretary's Report====		====Secretary's Report====
			Nothing to report except in Member Reports

	====Directors-at-Large's Report====		====Directors-at-Large's Report====
			Nothing to report

	===Member and Project Reports===		===Member and Project Reports===
			Robert: Robert is speaking at DEF CON and HOPE in August; details will be posted in the Discord. He also has something planned for the Hack Manhattan table at HOPE.
			Citybadger: Citybadger is going to rebuild the main router with Jay; there’s a plethora of issues and security problems with it. He will try his best to preserve everything if at all possible. He has rebuilt the WiFi router but wants to continue fixing everything up.

	== Old Business ==		== Old Business ==
			No old business.

	== New Business ==		== New Business ==
			* 3D printer updates: someone wrecked the plastic shredder, and someone printed something and used an entire spool’s worth of filament. No donation was recorded via Venmo. Additionally, the printer has been jammed by using non-standard PLA filament.
			The 3D printers are a public service, and anything that damages them prevents others from being able to use them. We should adhere to using standard PLA colors, and not use odd colors (e.g. transparent, glow-in-the-dark). We should also be more accountable on who is printing and when, and what settings are used. We can tackle this in two parts: a) build a 3D print shelf and make it accessible to members only, b) create a system that accounts for every print job and ties it back to a member in good standing. We can also encourage a baseline of donations for filament costs.
			* HOPE is coming up on August 14th to August 16th and Hannah has two options:
			a) We should host a lobbycon, with food and drink, and let attendees come by to visit the space. Hannah would like to allot $200 for buying shelf-stable snacks for the event. (unanimous yes)
			b) We need to restock the T-shirts; Hannah is willing to make them via screen printing instead of vinyl cutting and needs $150 worth of shirts for supplies; we can get a better deal if we buy shirts in bulk; Hannah is willing to front $500 worth of shirts for this. Currently we are out of most sizes.
			* For HOPE, we’re getting one badge for the village, but we can rotate shifts as needed to be at both the space and the village.
			* Jay: 3 weeks ago, citybadger made a Costco order for paper towels but no toilet paper; Jay has purchased toilet paper and we are down to 1 roll. We should make sure no one is taking rolls home with them.
			* Reimbursement policy: Anything under $50 that is relevant to the space, the board can do a vote to reimburse for it.
			* Hack Manhattan is turning 15 in September! We need to plan an event!

	===Sponsored Members Induction===		===Sponsored Members Induction===
			New members: welcome David and Curtis! We have two people in for vote.

	~~========~~


	==Meeting Meta==		==Meeting Meta==
	* Members in Attendance: ~~member1~~, ~~member2~~		* Members in Attendance: Robert, Jay, Hannah, Amanda, Boost, David, Chris F, Robin M, Ed, citybadger, Grant, Curtis (digglesby), Mehir, Chris M
	* Visitors: none		* Visitors: none
	* Called to order at HH:MM by .		* Called to order at 19:35 by Hannah.
	* The meeting was adjourned at HH:MM by .		* The meeting was adjourned at 20:05 by Hannah.
	* Minutes taken and submitted by Robert.		* Minutes taken and submitted by Robert.

	[[Category:Meetings]]		[[Category:Meetings]]

Meeting 2026-07-26

LambdaCalculus — Wed, 12 Aug 2026 19:19:34 GMT

Created page with "Meetings are conducted according to MIBS_Rules. ==Approve Minutes== ==Consensus Agenda== None ==Member Reports== === Board Reports=== ====President's Report==== ====Treasurer's Report==== ====Secretary's Report==== ====Directors-at-Large's Report==== ===Member and Project Reports=== == Old Business == == New Business == ===Sponsored Members Induction=== ======== ==Meeting Meta== * Members in Attendance: member1, member2 * Visitors: none * Called to ord..."

New page

Meetings are conducted according to [[MIBS_Rules]].

==Approve Minutes==

==Consensus Agenda==
None

==Member Reports==
=== Board Reports===
====President's Report====

====Treasurer's Report====

====Secretary's Report====

====Directors-at-Large's Report====

===Member and Project Reports===

== Old Business ==

== New Business ==

===Sponsored Members Induction===

========

==Meeting Meta==
* Members in Attendance: member1, member2
* Visitors: none
* Called to order at HH:MM by .
* The meeting was adjourned at HH:MM by .
* Minutes taken and submitted by Robert.

[[Category:Meetings]]

Main Page

LambdaCalculus — Wed, 12 Aug 2026 19:16:27 GMT

Monthly Business Meetings

← Older revision		Revision as of 19:16, 12 August 2026
Line 29:		Line 29:
	Monthly meetings are held at 7:30PM on the last Wednesday of each month and are conducted in accordance with [[MIBS Rules]]. You can read the [[Meetings\|minutes of previous meetings]] or the next one:		Monthly meetings are held at 7:30PM on the last Wednesday of each month and are conducted in accordance with [[MIBS Rules]]. You can read the [[Meetings\|minutes of previous meetings]] or the next one:

			* [[Meeting_2026-07-26]]
	* [[Meeting_2026-06-24]]		* [[Meeting_2026-06-24]]
	* [[Meeting_2026-05-27]]

	== About the space and building==		== About the space and building==

System Administration Group - Documentation

William — Sun, 09 Aug 2026 19:37:03 GMT

sys admin activity

← Older revision		Revision as of 19:37, 9 August 2026
Line 24:		Line 24:
	\|-		\|-
	\| [[Configuration Management]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo		\| [[Configuration Management]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo
			\|-
			\| [[Web server]] \|\| [[nginx-donatello]] \|\| [[donatello]]
	\|}		\|}

User:William

Citybadger — Sun, 09 Aug 2026 19:30:06 GMT

User account William was created by Citybadger sysadmin group

Cowsay-leonardo

Ducky — Sun, 09 Aug 2026 19:26:27 GMT

Created page with "Test page"

New page

Test page

System Administration Group - Documentation

Ducky — Sun, 09 Aug 2026 19:25:59 GMT

← Older revision		Revision as of 19:25, 9 August 2026
Line 18:		Line 18:
	\|-		\|-
	\| [[DNS]] \|\| [[unbound]] \|\| [[april]]		\| [[DNS]] \|\| [[unbound]] \|\| [[april]]
			\|-
			\| Talking Cow \|\| [[cowsay-leonardo]] \|\| [[leonardo]]
	\|-		\|-
	\| [[Inventory Management]] \|\| [[Snipe-IT]] \|\| [[michelangelo]] \|\| http://michelangelo.sagroup.hackmanhattan.com/login		\| [[Inventory Management]] \|\| [[Snipe-IT]] \|\| [[michelangelo]] \|\| http://michelangelo.sagroup.hackmanhattan.com/login
Line 23:		Line 25:
	\| [[Configuration Management]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo		\| [[Configuration Management]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo
	\|}		\|}

			Talking Cow

	=== ===		=== ===

User:Ducky

Citybadger — Sun, 09 Aug 2026 19:21:50 GMT

User account Ducky was created by Citybadger and password was sent by email sysadmin group

Identity Management

Citybadger — Sat, 08 Aug 2026 17:32:31 GMT

Entered three goals of the project

New page

The goals of this project are:

Have a single user database for login purposes via ssh and LDAP, either with passwords or keys. As opposed to having to create accounts on each machine or application.

Be able to add or remove accounts in that database and have them added or removed from all machines.

Have a PKI/CA system that could issue user certificates for OpenVPN.

Snipe-IT

Citybadger — Thu, 06 Aug 2026 15:45:01 GMT

Removed LDAP user example.

← Older revision		Revision as of 15:45, 6 August 2026
Line 8:		Line 8:

	LDAP (not LDAPS) configured to pull from [[FreeIPA]] using the snipe-it system account. Have not been able to get LDAPS to work.		LDAP (not LDAPS) configured to pull from [[FreeIPA]] using the snipe-it system account. Have not been able to get LDAPS to work.

	~~Sample ldap user: uid=citybadger,cn=users,cn=accounts,dc=sagroup,dc=hackmanhattan,dc=com~~

	LDAP account synchronization not set up. Manually synced in Users page. This works to create accounts, but login still does not work.		LDAP account synchronization not set up. Manually synced in Users page. This works to create accounts, but login still does not work.

	URL should be https://michelangelo.sagroup.hackmanahttan.com/snipeit not just http://michelangelo.sagroup.hackmanhattan.com. What if we want to put another web based app on the server?		URL should be https://michelangelo.sagroup.hackmanahttan.com/snipeit not just http://michelangelo.sagroup.hackmanhattan.com. What if we want to put another web based app on the server?

FreeIPA

Citybadger — Thu, 06 Aug 2026 15:41:35 GMT

Initial, incomplete notes

New page

Installed on [[leatherhead]].
Username: admin
Password: p...

Sample ldap user: uid=citybadger,cn=users,cn=accounts,dc=sagroup,dc=hackmanhattan,dc=com

Snipe-IT

Citybadger — Tue, 04 Aug 2026 18:33:11 GMT

Changed info about LDAP using admin account to LDAP using snipe-it system account

← Older revision		Revision as of 18:33, 4 August 2026
Line 7:		Line 7:
	Installed with ./install.sh. This configures Apache. nginx would be nicer.		Installed with ./install.sh. This configures Apache. nginx would be nicer.

	LDAP (not LDAPS) configured to pull from [[FreeIPA]]~~. Uses~~ the ~~admin~~ account. ~~It should use a service account~~.		LDAP (not LDAPS) configured to pull from [[FreeIPA]] using the snipe-it system account. Have not been able to get LDAPS to work.

	Sample ldap user: uid=citybadger,cn=users,cn=accounts,dc=sagroup,dc=hackmanhattan,dc=com		Sample ldap user: uid=citybadger,cn=users,cn=accounts,dc=sagroup,dc=hackmanhattan,dc=com

Snipe-IT

Citybadger — Tue, 04 Aug 2026 17:36:30 GMT

Basic installation and post installation info entered

New page

A Web Based IT Inventory Database

Username: Admin password: p...

Downloaded from github: git clone https://github.com/grokability/snipe-it into /opt

Installed with ./install.sh. This configures Apache. nginx would be nicer.

LDAP (not LDAPS) configured to pull from [[FreeIPA]]. Uses the admin account. It should use a service account.

Sample ldap user: uid=citybadger,cn=users,cn=accounts,dc=sagroup,dc=hackmanhattan,dc=com

LDAP account synchronization not set up. Manually synced in Users page. This works to create accounts, but login still does not work.

URL should be https://michelangelo.sagroup.hackmanahttan.com/snipeit not just http://michelangelo.sagroup.hackmanhattan.com. What if we want to put another web based app on the server?

System Administration Group - Documentation

Citybadger — Tue, 04 Aug 2026 17:24:57 GMT

Applications: Added Snipe-IT. Changed Version Control to Configuration Management for git

← Older revision		Revision as of 17:24, 4 August 2026
Line 19:		Line 19:
	\| [[DNS]] \|\| [[unbound]] \|\| [[april]]		\| [[DNS]] \|\| [[unbound]] \|\| [[april]]
	\|-		\|-
	\| [[~~Version Control~~]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo		\| [[Inventory Management]] \|\| [[Snipe-IT]] \|\| [[michelangelo]] \|\| http://michelangelo.sagroup.hackmanhattan.com/login
			\|-
			\| [[Configuration Management]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo
	\|}		\|}

Smart Power Strip

Citybadger — Mon, 03 Aug 2026 15:50:25 GMT

Added model number and firmware information

← Older revision		Revision as of 15:50, 3 August 2026
Line 1:		Line 1:
	Sentry Switched PDU		Sentry Pro2 Switched PDU

	Two logins are valid:		Two logins are valid:
	* username:sysadmin-group password: p...		* username: sysadmin-group password: p...
	* username: admn password: r...		* username: admn password: r...

	The first only allows access to the [[System_Administration_Group]] equipment. The second is the default administrator login with the password changed.		The first only allows access to the [[System_Administration_Group]] equipment. The second is the default administrator login with the password changed.

			Firmware version is: Sentry Switched PDU Version 8.0i

			Firmware downloads are available from: https://www.servertech.com/support/rack-pdu-firmware-downloads

			Most recent firmware version is 8.1c released 4 May 2026. It appears that to upgrade to the latest version we need to upgrade to v8.0z first.

			We should upgrade to the latest version. For one thing, the algorithms supported by the SSH server are so obsolete you can't connect from a modern system.

System Administration Group - Documentation

Citybadger — Sun, 02 Aug 2026 19:23:40 GMT

Added link to FreeIPA web gui

← Older revision		Revision as of 19:23, 2 August 2026
Line 11:		Line 11:
	\| [[Diskless Workstations]] \|\| [[NFS]] \|\| [[raphael]] \|\|		\| [[Diskless Workstations]] \|\| [[NFS]] \|\| [[raphael]] \|\|
	\|-		\|-
	\| [[Identity Management]] \|\| [[FreeIPA]] \|\| [[leatherhead]] \|\|		\| [[Identity Management]] \|\| [[FreeIPA]] \|\| [[leatherhead]] \|\| https://leatherhead.sagroup.hackmanhattan.com/ipa/ui/
	\|-		\|-
	\| [[Time Synchronization]] \|\| [[chrony]] \|\| [[april]]		\| [[Time Synchronization]] \|\| [[chrony]] \|\| [[april]]

Git

Citybadger — Thu, 30 Jul 2026 18:03:48 GMT

Created page with basic info

New page

A headless git repository lives in /home/user/sysadminrepo on [[raphael]]. This is perhaps not an ideal long term place. It contains configuration and code bits for hosts and services.

System Administration Group - Documentation

Citybadger — Thu, 30 Jul 2026 17:44:28 GMT

Reformatted Time Synchronization and VPN applications and changed links to the renamed pages.

← Older revision		Revision as of 17:44, 30 July 2026
Line 13:		Line 13:
	\| [[Identity Management]] \|\| [[FreeIPA]] \|\| [[leatherhead]] \|\|		\| [[Identity Management]] \|\| [[FreeIPA]] \|\| [[leatherhead]] \|\|
	\|-		\|-
	\| [[~~NTP~~]] \|\| [[~~NTP on april~~]] \|\| [[april]]		\| [[Time Synchronization]] \|\| [[chrony]] \|\| [[april]]
	\|-		\|-
	\| [[VPN]] \|\| [[Wireguard ~~on april~~]] \|\| [[april]]		\| [[VPN]] \|\| [[Wireguard]] \|\| [[april]]
	\|-		\|-
	\| [[DNS]] \|\| [[unbound]] \|\| [[april]]		\| [[DNS]] \|\| [[unbound]] \|\| [[april]]

NTP on april

Citybadger — Thu, 30 Jul 2026 17:39:39 GMT

Citybadger moved page NTP on april to Chrony

New page

=== NTP Server, Purpose ===
Provides NTP service for devices on the network so systems maintain syncronization and accurate time even if external NTP sources become unavailable. Synchronized time provides basis for logs correlation. Local service enables disallow of random incoming NTP packets -> better security.

=== Host ===

hostname: april 
hardware: raspberry pi 
OS: ? 
IP: DHCP reserves 192.168.42.186? for april on sysadmin group VLAN 
Maintainer: Sysadmin Study Group 
Software: chronyd (daemon) and chronyc (command line) 
Package: chrony 
Main Config: <code> /etc/chrony/chrony.conf</code> 
Backup Configs: <code> /etc/chrony/chrony.conf.mm-dd-yyyy.bak </code> 

=== Currently Have, Summary ===
April is running chrony, an NTP client and server.
April is currently getting time from the default Debian pool
<blockquote><code>2.debian.pool.ntp.org</code>
</blockquote>
The other servers (leonardo, michaelangelo, donatello, and rafael) are still getting their time from the same default Debian ntp.org pool via the default client, systemd-timesyncd

=== Would Like to Have / Next Steps ===

* Reconsider whether april should continue to be time server (b/c [[NTP on april#RTC | no Real Time Clock]])
* Reconsider whether NTP and VPN should coexist on same machine, because DDOS potential.
* If yes, point timesyncd config on servers to get time from april.
* Contemplate whether to use chrony on servers.
* Add appropriate public NTP servers to april.

=== Verification and Troubleshooting ===

Check service status: <code> systemctl status chrony.service </code> 
Check connected sources: <code>chronyc sources</code> 
Check synchronization: <code>chronyc tracking</code> 
Chrony allows reloading the config without restarting the service. 

=== Foreseeable Complications ===
April - like all raspberry pi's - lacks a Real Time Clock. If turned off, she will need to get re-synced to an internet time server. Another solution is to [https://www.instructables.com/Set-up-Real-Time-Clock-RTC-on-Raspberry-Pi Add a Real Time Clock to Raspberry Pi]

Wireguard on april

Citybadger — Thu, 30 Jul 2026 17:38:28 GMT

Citybadger moved page Wireguard on april to Wireguard

New page

Wireguard is still in progress. So far:

1. Install wireguard package on april. 
2. created interface for wireguard, wg0 
3. Assigned it IP 192.168.44.1 (/24) with the idea that 192.168.44.X ip's will eventually be reserved for remote-connected machines. 
4. generated a private/public keypair on april and placed them in /etc/wireguard/

System Administration Group - Documentation

Citybadger — Thu, 30 Jul 2026 17:36:31 GMT

added Application entry for the git repository

← Older revision		Revision as of 17:36, 30 July 2026
Line 17:		Line 17:
	\| [[VPN]] \|\| [[Wireguard on april]] \|\| [[april]]		\| [[VPN]] \|\| [[Wireguard on april]] \|\| [[april]]
	\|-		\|-
	\| [[DNS]] \|\| [[unbound]] \|\| [[april]]		\| [[DNS]] \|\| [[unbound]] \|\| [[april]]
			\|-
			\| [[Version Control]] \|\| [[git]] \|\| [[raphael]] \|\| user@192.168.42.170:sysadminrepo
	\|}		\|}

Leatherhead

Citybadger — Thu, 30 Jul 2026 17:28:32 GMT

Created basic info and comment on port forwarding

New page

A docker container running on [[raphael]]

Created from the offical FreeIPA docker image freeipa/freeipa-server:fedora-44-4.13.1 from Docker Hub.

Its IP address on the virtual network is routable. Clients directly access services though the IP address, not via port forwarding from the the host.

A script containing the docker run command with all its parameters is in the git repository. That script as well as the running container forwards the ports FreeIPA uses to the host. I'm not sure this is required or desirable anymore now that leatherhead's network interface is routable. It interferes with using those ports on raphael, most notably the http and https ports.

DNS

Citybadger — Thu, 30 Jul 2026 17:05:44 GMT

info on ubound on april, bind on leatherhead, and DNS forwarding in the routers

New page

There are two DNS servers running on the equipment, plus the DNS services provided by the routers.

[[Unbound]] - The primary DNS server for the whole hackerspace network. Running on [[april]].

[[Bind]] - Installed by [[FreeIPA]] on [[leatherhead]]. Supports the records necessary for FreeIPA to function. FreeIPA clients will need these records, so either BIND on [[leatherhead]] or a slave DNS server will have to be serving at least those clients. Plan to be determined.

The main [[MicroTik router]] provides DNS forwarding and probably caching, sending out resolution to somewhere out on the internet.

The [[wireless router]] presumably does likewise.

Unbound

Citybadger — Thu, 30 Jul 2026 16:48:16 GMT

Various additions of records and config changes

← Older revision		Revision as of 16:48, 30 July 2026
Line 1:		Line 1:
	I installed unbound on april and added dns entries for rafael, leonardo, michelangelo, donatello, and april itself.		I installed unbound on [[april]] and added dns entries for rafael, leonardo, michelangelo, donatello, and april itself.

	The base domain is sagroup.hackmanhattan.com.		The base domain is sagroup.hackmanhattan.com.

			I added a zone for hackmanhattan.com. I added a record for mk4-prusa.hackmanhattan.com as an experiment to see if it would resolve. It does.

			I changed the DHCP configuration on HM's main and wireless routers to give out april as the default DNS server, with the main router as a secondary.

			I added a record for the docker container leatherhead.sagroup.hackmanhattan.com. A route to [[leatherhead]]'s virtual network was added to the main router.

			I added a record for rackpower.hackmanhattan.com. This is the [[Smart_Power_Strip]] on the rack.

			I added records for the iDRAC controllers on the server (idrac-donatello.sagroup.hackmanhattan.com.

			I created /var/log/unbound.log and changed the owner and group to unbound:unbound. This eliminates an error on service startup.

Meeting 2026-07-29

Mugenity — Wed, 29 Jul 2026 01:32:42 GMT

New Business

← Older revision		Revision as of 01:32, 29 July 2026
(One intermediate revision by the same user not shown)
Line 22:		Line 22:

	== New Business ==		== New Business ==
			3D printer updates
			* someone shattered the shredder
			* someone printed $20 dollars worth of filament in supports + $10 dollars in failed
			* printer was jammed again by non-standard PLA
			* something needs to change

	===Sponsored Members Induction===		===Sponsored Members Induction===
Line 29:		Line 34:
	* Has the member received the briefing? When, and who was the briefer?		* Has the member received the briefing? When, and who was the briefer?
	* Has the member's bio and photo been circulated on the members list? (not just Discord)		* Has the member's bio and photo been circulated on the members list? (not just Discord)


	==Meeting Meta==		==Meeting Meta==

Meeting 2027-07-28

Mugenity — Wed, 29 Jul 2026 00:37:37 GMT

Created page with "Meetings are conducted according to MIBS_Rules. ==Approve Minutes== ==Consensus Agenda== * Consensus Item 1 * Consensus Item 2 ==Member Reports== === Board Reports=== ====President's Report==== * No report. ====Treasurer's Report==== * No report. ====Secretary's Report==== * No report. ====Directors-at-Large's Report==== * No report. ===Member and Project Reports=== == Old Business == == New Business == ===Sponsored Members Induction=== For each prospective mem..."

New page

Meetings are conducted according to [[MIBS_Rules]].

==Approve Minutes==

==Consensus Agenda==
* Consensus Item 1
* Consensus Item 2

==Member Reports==
=== Board Reports===
====President's Report====
* No report.
====Treasurer's Report====
* No report.
====Secretary's Report====
* No report.
====Directors-at-Large's Report====
* No report.
===Member and Project Reports===

== Old Business ==

== New Business ==

===Sponsored Members Induction===
For each prospective member, please confirm no later than Thursday before the meeting:

* Has the member visited 3 times at the regular Tuesday and Thursday open nights?
* Has the member received the briefing? When, and who was the briefer?
* Has the member's bio and photo been circulated on the members list? (not just Discord)

==Meeting Meta==
* Members in Attendance: member1, member2 | latemember1
* Visitors: visitor1, visitor2
* Called to order at 23:59 by MEMBER.
* The meeting was adjourned at 23:59 by MEMBER.
* Minutes taken and submitted by MEMBER.

[[Category:Meetings]]

Meeting 2027-06-30

Mugenity — Wed, 29 Jul 2026 00:37:34 GMT

New page

Meeting 2027-05-26

Mugenity — Wed, 29 Jul 2026 00:37:31 GMT

New page

Meeting 2027-04-28

Mugenity — Wed, 29 Jul 2026 00:37:28 GMT

New page

Meeting 2027-03-31

Mugenity — Wed, 29 Jul 2026 00:37:25 GMT

New page

Meeting 2027-02-24

Mugenity — Wed, 29 Jul 2026 00:37:22 GMT

New page

Meeting 2027-01-27

Mugenity — Wed, 29 Jul 2026 00:37:19 GMT

New page

Meeting 2026-12-30

Mugenity — Wed, 29 Jul 2026 00:37:16 GMT

New page

Meeting 2026-11-25

Mugenity — Wed, 29 Jul 2026 00:37:13 GMT

New page

System Administration Group - Documentation

Citybadger — Tue, 28 Jul 2026 14:19:05 GMT

Created a section for Virtual Machines, Containers, & Cloud Instances with an entry for leatherhead, and an entry for FreeIPA in the Applications Section

← Older revision		Revision as of 14:19, 28 July 2026
Line 11:		Line 11:
	\| [[Diskless Workstations]] \|\| [[NFS]] \|\| [[raphael]] \|\|		\| [[Diskless Workstations]] \|\| [[NFS]] \|\| [[raphael]] \|\|
	\|-		\|-
	\| [[~~Web server~~]] \|\| [[~~nginx-leonardo~~]] \|\| [[~~leonardo]] \|\|~~		\| [[Identity Management]] \|\| [[FreeIPA]] \|\| [[leatherhead]] \|\|
	\|-
	~~\| [[Web server]] \|\| [[nginx-donatello]] \|\| [[donatello~~]] \|\|
	\|-		\|-
	\| [[NTP]] \|\| [[NTP on april]] \|\| [[april]]		\| [[NTP]] \|\| [[NTP on april]] \|\| [[april]]
Line 19:		Line 17:
	\| [[VPN]] \|\| [[Wireguard on april]] \|\| [[april]]		\| [[VPN]] \|\| [[Wireguard on april]] \|\| [[april]]
	\|-		\|-
	\| [[DNS]] \|\| [[unbound]] \|\| april		\| [[DNS]] \|\| [[unbound]] \|\| [[april]]
	\| -		\|}
	\| [[~~Web server~~]] \|\| [[~~nginx- Agent Cross~~]] \|\| [[~~Agent Cross~~]] \|\|
			=== ===

			{\| class="wikitable" style="margin:auto"
			\|+ Virtual Machines, Containers, & Cloud Instances
			\|-
			! Project \|\| Name \|\| Type \|\| Host \|\| Main IP \|\| links
			\|-
			\| [[Identity Management]] \|\| [[leatherhead]]\|\| Docker Container \|\| [[raphael]] \|\| 172.17.0.2 \|\|
	\|}		\|}

Audio Equipment

Boostfox — Fri, 24 Jul 2026 21:10:01 GMT

Added current audio equipment

New page

== DJ Gear ==
* 2x CDJ-1000MK3 Players
* Numark DM2002X 3ch Analog Mixer
* Denon MCX8000 Standalone Controller

== Speakers ==
* 2x Yamaha HS8 Monitors
* 2x Rockit5 Monitors

== Misc ==
* Klark Teknik Bluetooth Receiver

Facility Resources

Boostfox — Fri, 24 Jul 2026 21:05:25 GMT

Added audio equipment page

← Older revision		Revision as of 21:05, 24 July 2026
Line 12:		Line 12:
	* [[Equipment Wishlist]]		* [[Equipment Wishlist]]
	* [[Vinyl Cutting]]		* [[Vinyl Cutting]]
			* [[Audio Equipment]]

System Administration Group - Documentation

Mili — Sun, 19 Jul 2026 20:44:18 GMT

Documentation for the nginx webserver installed on leonardo to provide web hosting services for web-based applications to be deployed in the future.

← Older revision		Revision as of 20:44, 19 July 2026
Line 11:		Line 11:
	\| [[Diskless Workstations]] \|\| [[NFS]] \|\| [[raphael]] \|\|		\| [[Diskless Workstations]] \|\| [[NFS]] \|\| [[raphael]] \|\|
	\|-		\|-
			\| [[Web server]] \|\| [[nginx-leonardo]] \|\| [[leonardo]] \|\|
	\|-		\|-
	\| [[Web server]] \|\| [[nginx-donatello]] \|\| [[donatello]] \|\|		\| [[Web server]] \|\| [[nginx-donatello]] \|\| [[donatello]] \|\|

System Administration Group - Documentation

Markitareed — Sun, 19 Jul 2026 20:37:45 GMT

← Older revision		Revision as of 20:37, 19 July 2026
(One intermediate revision by the same user not shown)
Line 19:		Line 19:
	\|-		\|-
	\| [[DNS]] \|\| [[unbound]] \|\| april		\| [[DNS]] \|\| [[unbound]] \|\| april
			\| -
			\| [[Web server]] \|\| [[nginx- Agent Cross]] \|\| [[Agent Cross]] \|\|
	\|}		\|}

User:Markitareed

Citybadger — Sun, 19 Jul 2026 20:18:51 GMT

User account Markitareed was created by Citybadger and password was sent by email Sysadmin group

User:Mili

Citybadger — Sun, 19 Jul 2026 19:51:39 GMT

User account Mili was created by Citybadger and password was sent by email Sysadmin group