siddou.tk

Install rancid and cvsweb on Debian 8 Jessie

Rancid is a nice tool that connect to your network devices and backup their configuration.
Cvsweb is the web interface to check the configurations files and diff.

Rancid:

apt-get install rancid cvsweb
nano /etc/rancid/rancid.conf
...
LIST_OF_GROUPS="group1 group2"; export LIST_OF_GROUPS
...
su - rancid
nano .cloginrc
#switch01
add user 192.168.0.252 user
add password 192.168.0.252 ssh-password   enable-password
#switch02
add user 192.168.0.253 user
add password 192.168.0.253  ssh-password   enable-password
exit
chmod 600 /var/lib/rancid/.cloginrc
su - rancid
/usr/lib/rancid/bin/rancid-cvs
nano /var/lib/rancid/group1/router.db
192.168.0.252:cisco:up:switch01
nano /var/lib/rancid/group2/router.db
192.168.0.253:cisco:up:switch02
/usr/lib/rancid/bin/rancid-run
exit

Cvsweb:

modify these lines:

...
'my switches'   => ['my switches Repository', '/var/lib/rancid/CVS'],
...
"hidecvsroot" => "1",
...

go to http://server_name/cgi-bin/cvsweb to check switches configs

Cron every week:

nano /etc/cron.d/rancid
# Job Definition
00 04 * * 0  rancid  find /var/log/rancid -type f -mtime +2 -exec rm {} \; ;/usr/bin/rancid-run

Mail alias:

nano /etc/aliases
rancid: [email protected]
rancid-group1: [email protected]
rancid-admin-group1: [email protected]
rancid-group2: [email protected]
rancid-admin-group2: [email protected]
newaliases

Mail alias fix for exim4:

Thanks to : http://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost

nano /etc/exim4/conf.d/router/175_cathedral-config_system_aliases
.ifdef DCconfig_smarthost DCconfig_satellite

cathedral_aliases:
  debug_print = "R: cathedral_aliases for [email protected]$domain"
  driver = redirect
  domains = $qualify_domain
  allow_fail
  allow_defer
  data = ${lookup{$local_part}lsearch{/etc/aliases}}
  .ifdef SYSTEM_ALIASES_USER
  user = SYSTEM_ALIASES_USER
  .endif
  .ifdef SYSTEM_ALIASES_GROUP
  group = SYSTEM_ALIASES_GROUP
  .endif
  .ifdef SYSTEM_ALIASES_FILE_TRANSPORT
  file_transport = SYSTEM_ALIASES_FILE_TRANSPORT
  .endif
  .ifdef SYSTEM_ALIASES_PIPE_TRANSPORT
  pipe_transport = SYSTEM_ALIASES_PIPE_TRANSPORT
  .endif
  .ifdef SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  directory_transport = SYSTEM_ALIASES_DIRECTORY_TRANSPORT
  .endif

cathedral_userforward:
  debug_print = "R: cathedral_userforward for [email protected]$domain"
  driver = redirect
  domains = $qualify_domain
  check_local_user
  file = $home/.forward
  require_files = $local_part:$home/.forward
  no_verify
  no_expn
  check_ancestor
  allow_filter
  forbid_smtp_code = true
  directory_transport = address_directory
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
  skip_syntax_errors
  syntax_errors_to = [email protected]$domain
  syntax_errors_text = \
    This is an automatically generated message. An error has\n\
    been found in your .forward file. Details of the error are\n\
    reported below. While this error persists, you will receive\n\
    a copy of this message for every message that is addressed\n\
    to you. If your .forward file is a filter file, or if it is\n\
    a non-filter file containing no valid forwarding addresses,\n\
    a copy of each incoming message will be put in your normal\n\
    mailbox. If a non-filter file contains at least one valid\n\
    forwarding address, forwarding to the valid addresses will\n\
    happen, and those will be the only deliveries that occur.

.endif
nano /etc/exim4/update-exim4.conf.conf
dc_eximconfig_configtype='satellite'
dc_other_hostnames='localhost'
dc_local_interfaces='127.0.0.1'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost='mail_server_name'
CFILEMODE='644'
dc_use_split_config='true'
dc_hide_mailname='true'
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'
systemctl restart exim4

Apache2 ldap config:

conf apache2:

       ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
       <Directory "/usr/lib/cgi-bin">
               Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
               AllowOverride None
               Order allow,deny
               Allow from all
               AuthType Basic
               AuthName "admin Authentication"
               AuthBasicProvider ldap
               AuthLDAPURL ldaps://ldap/ou=Users,dc=siddou,dc=com?uid
               AuthLDAPBindDN cn=ldap,dc=siddou,dc=com
               AuthLDAPBindPassword xxxxxxxxxxxx
               AuthLDAPGroupAttributeIsDN off
               AuthLDAPGroupAttribute memberUid
               ErrorDocument 401 "Wrong credentials!<br>"
               Require ldap-group cn=it,ou=Groups,dc=siddou,dc=com
       </Directory>

ScriptAlias /cvsweb/cvsweb /usr/lib/cgi-bin/cvsweb
Alias /cvsweb /usr/share/cvsweb
a2enmod authnz_ldap
systemctl restart apache2

2 thoughts on “Install rancid and cvsweb on Debian 8 Jessie

  1. moerbst

    Hi siddou!

    Thanks for this helpful tutorial. I hope its ok, that i have linked from my blog to your tutorial (and done a screenshot for mirror/backup reasons).

    greets from germany and happy hacking 😉

Leave a Reply

Your email address will not be published. Required fields are marked *