upgrade sftp servers to jammy

[kayiwa]

What maintenance needs to be done?

We need to upgrade our sftp servers to jammy jellyfish

Level of urgency

• High
• Moderate
• Low

Why is this maintenance needed?

• When we attempted to set these servers up the SSSD software would not work with Active Directory. The software seems to be broken again (on focal). While the machine is bound to Active Directory. It is unable to actually authenticate successfully

Acceptance criteria

• Ansible playbook runs and sets up and endpoint
• All users can authenticate with AD users getent passwd netid provides the Active Directory UID/GID
• Document how to reset a re-bind to Active Directory

Implementation notes, if any

[kayiwa]

related to #4879

[kayiwa]

Ensure that SSSD_AD tests stop the playbook from running with useful information. #5511 (comment)

[kayiwa]

Blocked by this SNow ticket

[kayiwa]

Add active directory certs. New adventure

[acozine]

See also notes in this private gdoc.

[kayiwa]

• grab MAC address of lib-sftp-test2
• wipe out lib-sftp-test2
• register machine on Active Directory (delete or reset)
• run lib-sftp --limit lib-sftp-test2.princeton.edu
• create private/pub keys on almasftp (user on prod) copy public keys to (test2 vm)
  • rsync contents of /alma/* lib-sftp-test2:/alma --exclude='aspace'
• create private/pub keys on lib-aspacesftp (user or prod) copy public keys to (test2 vm)
  • rsync contents of /alma/aspace/* lib-sftp-test2:/alma/aspace

Once DACS signs off on downtime (possibly repeat rsyncs)

• power off current lib-sftp-prod1 (name it lib-sftp-prod1-focal - on vsphere prod)
• grab the MAC address
• create new rocky vm call it lib-sftp-prod1 (use MAC address from above)
• follow steps for new VM
• register machine on Active Directory (delete or reset)
• run lib-sftp --limit lib-sftp-prod1.princeton.edu -e runtime_env=production
• create private/pub keys on almasftp (user on test2) copy public keys to (prodvm)
  • rsync contents of /alma (except aspace) from lib-sftp-test2 to lib-sftp-prod1
• create private/pub keys on lib-aspacesftp (user on test2) copy public keys to (prodvm)
  • rsync contents of /alma/aspace from lib-sftp-test2 to lib-sftp-prod1

[VickieKarasic]

Next steps:

• After this is complete, we need to adjust the time from CST to EST on lib-sftp-prod1

  timedatectl list-timezones
  timedatectl list-timezones | grep America
  sudo timedatectl set-timezone America/New_York

• Update almasftp user password to password manager, ansible vault
  • Re-run lib-sftp.yml playbook

[kayiwa]

closed by #5686