Friday, August 2, 2013

Installing & Configuring an Enterprise Geodatabase (ArcGIS 10.2)
Implementation on PostgreSQL DBMS and Red Hat Enterprise Linux

1.     PostgreSQL Installation


1.1.   Launch the installer by issuing the below command

./postgresql-9.2.2-1-linux-x64.run
NB.
·         Must have 755 rights on the above *.run file
·         Must install as root

PostgreSQL installer launches     

Click Next

1.2.   Installation directory
Click Next
1.3.   Data Directory
Click Next 

1.4.   Postgres Super User Password
Supply a password for the super user named postgres.

Click Next
1.5.   Port
Default port settings for PostgreSQL DBMS are 5432. The installer will choose the next available port if port 5432 is occupied by another program.
Click Next

1.6.   Locale Settings
Accept default locale settings.
Click Next
1.7.   Ready to Install

Click Next


1.8.   Installation Progress
1.9.   Stack Builder

Alternatively, you can launch the “Application Stack Builder” later by going to Applications > PostgreSQL 9.2 > Application Stack Builder.
For now Click Finish to continue installing add-ons by launching Stack Builder.
Choose from drop down PostgreSQL 9.2 on port 5432
Click Next
Click Next

Accept default “tmp” directory. This is the location where all the downloads will be placed.

                                                                 Click Next.

Wait until the downloads complete.
                                                                            Click Next.

2.      PostGIS 2.0 Installation (Optional)
Installation of PostGIS enables the use of PG_Geometry spatial type in addition to the Esri supported ST_Geometry geometry type.
Click Next
Accept the default setting by ensuring the upgrade checkbox is switched off.
Click Next
  
2.1.   Database Authentication
Click Next
In the ready to Install dialog box, click Next
Wait until a template spatial database is created.
Click Finish on the PostGIS Setup Wizard.
3.      PSQLODBC Setup.

Follow the wizard in the installation steps enabling you installation of ODBC drivers.
4.      Setup Slony
                                                                             Click Next
click Next in the Ready to Install dialog box. Follow the installation wizard until the replication tool installs successfully.

Successful installation of the Add-Ons
Click Finish and reboot server by issuing below command as root in the terminal window.
Reboot

2.     Configuration

2.1.    Change PostgreSQL Account password.
a)      Issue command below
                passwd postgres 

a)      Check postgres user home directory by issuing below command and search for postgres
vim etc/passwd
Confirm that Postgres home folder is /opt/PostgreSQL/9.2 . However, this may differ with the PostgreSQL installation method.
c)      Change owner of home folder from root to postgres by issuing below command.
chown -R postgres.postgres /opt/PostgreSQL/9.2
Confirm rights by running by issuing command below.
ls -lh /opt/PostgreSQL/9.2
2.1.    Environment settings
a)      Set Environment variable in the file /etc/profile as root user
PGDATA=/opt/PostgreSQL/9.2/data
export PGDATA

LD_LIBRARY_PATH=/opt/PostgreSQL/9.2/lib/postgresql
export LD_LIBRARY_PATH

PATH=$PATH:/opt/PostgreSQL/9.2/bin
export PATH
b)      Log in as postgres user and test that the environment variables set previously are available.
2.1.    Load ST_Geometry
a)      Copy st_geometry.so from you DatabaseSupport folder in your Desktop10.2 folder in windows to your linux distro. Typical location for the library file is; “C:\Program Files (x86)\ArcGIS\Desktop10.2\DatabaseSupport\PostgreSQL\9.2\Linux64”
b)      In the home directory / opt/PostgreSQL/9.2 change directory to the bin folder. Run the below command to find the location of the dynamically loaded modules
./pg_config –pkglibdir
c)      Copy and place the provided st_geometry.so into the location “/opt/PostgreSQL/9.2/lib/postgresql”.
Ensure st_geometry.so is owned by postgres user and has 755 permissions by issuing the below commands as user root.
chown postgres.postgres st_geometry.so
chmod 755 st_geometry.so
NB. No need to log out of postgres but open a new tab in the terminal and elevate your rights to the root user by issuing command below;
2.1.    Alter PostgreSQL Configuration Files
a)      Log out as root and log in as postgres user account
b)      Alter pg_hba.conf to include IP addresses of the client machines.
1.       Open a terminal.
2.       Issue the below command as user postgres .Backup pg_hba.conf and postgresql.conf
cd data
vim pg_hba.conf
1.       Allow all users who supply a valid password to connect to any of the databases on the PostgreSQL instance from addresses beginning with say 192, you would add a line similar to the following to the pg_hba.conf file:
host all all 192.0.0.0/8 md5
2.       Exit and save vim by issuing command after pressing esc key to exit edit mode
:wq
c)      Confirm postgresql.conf file “Connections and Authentications” section is similar to the below entries in
2.5.    Security Wall and Firewall
a)      Add port 5432 to the firewall of the linux distro as the root user.
2.1.    ArcGIS Client
a)      On windows, install the ArcGIS client from which you will create the geodatabase.
b)      Download the PostgreSQL client libraries (if your ArcGIS client is on Windows) or RPM (if your ArcGIS client is on Linux) from the Esri Customer Care portal and place them in the bin directory of the ArcGIS client you installed in the last step.
c)       Copy 32 bit files from “..\ArcGIS 3rd Party\PostgreSQLClientLibs922\32bit” to the bin folder of your ArcGIS for Desktop 10.2 installation
d)      Similarly copy the 64 bit client in “..\ArcGIS 3rd Party\PostgreSQLClientLibs922\64bit” libraries for server to ArcGIS for server bin folder.
e)      See Setting up a connection to PostgreSQL for more information.
f)      Security and Firewall
Except port 5432 on Windows firewall or on your Antivirus.
2.7.    Test Connection
a)      Run Create Enterprise Geodatabase tool in ArcToolbox > Geodatabase Administration >
Wait for the create enterprise geodatabase process.This creates the ArcSDE repository (system tables and sql code) in the database plus configuring the sde geodatabase administrator user.
b)      Process of creating an ArcSDE geodatabase. Close the  dialog showing the geodatabase has been created.
c)      Create database connection.
d)      Load data through the connection to the database

Saturday, February 16, 2013

GIS Republic: SECURING YOUR LINUX SERVER DEPLOYED IN THE CLOUD ...

GIS Republic:
SECURING YOUR LINUX SERVER DEPLOYED IN THE CLOUD ...
: SECURING YOUR LINUX SERVER DEPLOYED IN THE CLOUD OR ENTERPRISE Table of Contents ADD A USER . 2 Using SSH Key Pair Authent...


SECURING YOUR LINUX SERVER DEPLOYED IN THE CLOUD OR ENTERPRISE

Table of Contents



 SECURING YOUR LINUX SERVER DEPLOYED IN THE CLOUD OR ENTERPRISE


ADD A USER


Execute command below
adduser dmuthami













Add user to administrators group
usermod -a -G sudo dmuthami






Logout


 




Login in using created user account from your desktop using command below














Using SSH Key Pair Authentication


Execute command below to create a public and private key as root or any other user in your desktop computer.

ssh-keygen

















Upload public key to your server by executing command below
scp ~/.ssh/id_rsa.pub dmuthami@176.58.114.103:





Make directory in the profile for the user created e.g dmuthami for this case
mkdir .ssh










Move public key
mv id_rsa.pub .ssh/authorized_keys





Grant user appropriate permissions to the ssh directory
chown -R dmuthami:dmuthami .ssh
chmod 700 .ssh
chmod 600 .ssh/authorized_keys









Disabling SSH Password Authentication and Root Login


Login as root and open the below file on terminal
vim /etc/ssh/sshd_config















Scroll down change sections as shown below; 

PasswordAuthentication no

PermitRootLogin no

Save the file by pressing: wq





Restart the SSH service to load the new configuration by entering below command

service ssh restart









Creating a Firewall


Check your Linode's default firewall rules.
iptables –L











Create a file to hold your firewall rules.
vim /etc/iptables.firewall.rules

Place text below and Save changes

*filter

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allow SSH connections
#
#  The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT














Activate firewall

iptables-restore < /etc/iptables.firewall.rules





Recheck firewalls table.
iptables -L
















Ensure that the firewall rules are activated every time you restart your server.
vim /etc/network/if-pre-up.d/firewall
Copy and paste the following lines in to the file you just created:
#!/bin/sh
/sbin/iptables-restore < /etc/iptables.firewall.rules















Save the script & set the script's permissions by entering the following command:
:wq
chmod +x /etc/network/if-pre-up.d/firewall

 


Installing and Configuring Fail2Ban


Install Fail2Ban by entering ban below
apt-get install fail2ban










Override the default Fail2Ban configuration by creating a new jail.local file
vim /etc/fail2ban/jail.local