1. Providers

See http://wiki.sugarlabs.org/go/Sugar_Server_Kit/Mace#Providers for more information.

1.1. Supported systems

Current Mace providers support and were tested on following GNU/Linux distributions. New distributions might be added on purpose.

  • Ubuntu-10.04
  • Fedora-14 (experimental)

1.2. List of providers

Each of following section describe one particular Mace provider. Except provider specific information, sections describe common parameters.

Mace configuration details, i.e., how this provider might be used in Mace configuration sources:

Service:the name of directory with .d suffix that will contain configuration supported by this provider
Confiles:if there are no confiles, configuration files should be placed directly to .d directory; otherwise they need to be placed to directory with a name of particular cofile
Variables:variables that provider exports, they might be used in configuration sources

Final configuration details, i.e., how Mace will affect the system after applying Mace configuration on the final system:

Replaces:list of files on the final system that will be changed; if this list is empty, it is possible to have non-Mace and Mace configuration on the final system simultaneously
Removes:list of files on the final system that will be removed; if this list is empty, it is possible to have non-Mace and Mace configuration on the final system simultaneously
New:list of files on final system that will be added after applying Mace configuration

1.2.1. Apache

Provider will do some extra work:

  • make sure that log directories, mentioned in Mace-level configuration, are properly created
Mace configuration:
Service:

apache.d

Confiles:
  • modules, line per module in format module filename, where filename is exactly a file name, the prefix path will be added depending on the final distribution; add modules only on purpose preserving modules enabled on distro level
  • conf, the rest of configuration except vhosts
  • vhosts, convenient confile to collect all vhosts declarations
Variables:
  • HTTP_USER system user http server uses
  • HTTP_GROUP system group http server uses
Fedora final configuration:
New:
  • /etc/httpd/conf.d/zzz-mace.conf
Ubuntu final configuration:
New:
  • /etc/apache2/sites-enabled/zzz-mace.conf

1.2.2. dnsmasq

Provider will change /etc/resolv.conf to point it to the localhost. The upstream server needs to be chnaged using /etc/resolv.conf.dnsmasq.

Mace configuration:
Service:dnsmasq.d
Confiles:No
Variables:No
Final configuration for all distributions:
Replaces:
  • /etc/resolv.conf
New:
  • /etc/resolv.conf.dnsmasq
  • /etc/dnsmasq.d/zzz-mace.conf

1.2.3. Files and directories

Configure arbitrary files and directories.

This provider uses artificial Mace-level configuration syntax in ini-files format. Each ini section name is a path to configure.

List of supported options:
content:if specified, file will be processed and directory otherwise
mode:file mode; default mode if ommited
user:owner name or uid; root if ommited
group:owner group or gid; root if ommited
exec:call shell command if file was changed
Mace configuration:
Service:files.d
Confiles:No
Variables:No
Final configuration for all distributions:
Depends on mace configuration.

1.2.4. IPTables

All configuration content should be in iptables-save format. But COMMIT directive should not be used, it will be added automatically by Mace.

Mace configuration:
Service:
  • iptables.d
Confiles:
  • mangle for mangle table rules
  • nat for nat table rules
  • filter for filter table rules
Variables:

No

Fedora final configuration:
Replaces:
  • /etc/sysconfig/iptables
Ubuntu final configuration:
New:
  • /etc/init.d/iptables
  • /etc/iptables.rules

1.2.5. Munin node

Provider will do some extra work:

  • escape IPs in allow directive in munin-node.conf
  • resolve hostnames in allow directive in munin-node.conf
  • make sure that only mace level plugins exist
Mace configuration:
Service:

munin-node.d

Confiles:
  • conf configuration
  • plugins node plugin names per line; for wildcard plugins, the suffix needs to be space separated
Variables:

No

Fedora final configuration:
Replaces:
  • /etc/munin/munin-node.conf
Removes:
  • /etc/munin/plugins/
New:
  • /etc/munin/plugins/

1.2.6. OpenSSH

Mace configuration:
Service:

openssh.d

Confiles:
  • ssh_config
  • sshd_config
Variables:

No

Final configuration for all distributions:
Replaces:
  • /etc/ssh/ssh_config
  • /etc/ssh/sshd_config

1.2.7. PAFM

PHP AJAX File Manager patched to have configuration file in /etc/pafm.conf.

Provider will do some extra work:

  • set httpd user as an owner for /etc/pafm.conf
  • set 0600 permissions for /etc/pafm.conf to hide password for others
  • ensure that files_root directory specified in configuration file created
  • symlink php files adn files_root to the www_root directory
Mace configuration:
Service:pafm.d
Confiles:No
Variables:No
Fedora final configuration:
Replaces:/etc/pafm.conf

1.2.8. Prosody

Provider will do some extra work:

  • make sure that data directory is properly created
  • make sure that log directory is properly created
  • make sure that server self-signed SSL cerificate is good and recreate it oterwise
Mace configuration:
Service:
  • prosody.d
Confiles:
  • conf, global settings
  • vhosts, vhost declarations with settings releted only to particular vhost
Variables:

No

Fedora final configuration:
Replaces:
  • /etc/prosody/prosody.cfg.lua

1.2.9. Sarg

Squid Analysis Report Generator.

Provider will do some extra work:

  • language configuration option should be in ISO-639-1 notation that will be replaced to language names that Sarg supports
  • make sure that output_dir is created and have 0755 access permissions
Mace configuration:
Service:sarg.d
Confiles:No
Variables:No
Fedora final configuration:
Replaces:/etc/sarg/sarg.conf

1.2.10. Squid

Provider will do some extra work to make sure that:

  • swap directory is properly created
  • log directories are properly created
  • squidGuard db files have proper ownership

If configuration template contains filter confile, squidQuard will be enabled.

Mace configuration:
Service:

squid.d

Confiles:
  • access only for access rules
  • conf the rest of configuration
  • filter squidQuard configuration
Variables:

No

Fedora final configuration:
Replaces:
  • /etc/squid/squid.conf
  • /etc/squid/squidGuard.conf

1.2.11. sugar-server

Mace configuration:
Service:sugar-server.d
Confiles:No
Variables:No
Final configuration for all distributions:
Replaces:/etc/sugar-server.conf