2 Big Brother

2.1 Initial setup

Big Brother user:

bbuser

Big Brother group:

bbgroup

Big Brother Directory:

/var/bbuser

1. Create the group
   $ groupadd -g 101 bbgroup
2. Create the user
   $ useradd -u 201 -g bbgroup -d /var/bbuser -m bbuser
3. Leave the account without a login password.

2.2 Server Setup

Because we will run Big Brother from its own directory instead of from the DocumentRoot defined in the Apache configuration, a few changes have to be made in the installation

1. Add bbuser to the Apache web server group.
2. Become bbuser.
3. Change to the bbuser home directory if necessary
   $ cd
4. Extract the distribution archive to the bbuser home directory, This will create a directory called ``bb<ver>''.
5. Symlink bb<ver> to bb. This keeps upgrades from breaking scripts.
   $ ln -s bb<ver> bb
6. Symlink the user web directory - usually public_html - to bb/www
   $ ln -s bb/www public_html
7. Create a cgi-bin directory for Big Brothers cgi scripts
   $ mkdir public_html/cgi-bin
8. Run the install script
   $ cd bb/install
   $ ./bbconfig
9. The script will ask a number of questions most of which have reasonable defaults.
   1. Be certain that Big Brother is NOT allowed to run as root.
   2. If paging has not been set up, answer 'no' when asked of the server is to be used as a BBPAGER. If you are not sure, 'no' is safe.
   3. The base URL for BB will be /~bbuser.
   4. The CGI scripts directory will be <BB Home Directory>/public_html/cgi-bin.
   5. The base URL for CGI scripts is /~bbuser/cgi-bin
   6. The web server user id is apache.
10. Change to the source directory
    $ cd ../src
11. Add -DDATAMSG to the CFLAGS in the Makefile
12. Make and install
    $ make 
    $ make install
13. Make sure that the directory bb/www/rep is group writable by the Apache group. The install script should take care of this but if it doesn't.
    $ chgrp apache bb/www/ref 
    $ chmod g+rw bb/www/ref
14. Setup Apache to allow Big Brother to run cgi scripts
    # allow cgi scripts for big brother 
    <Directory "/var/bbuser/public_html/cgi-bin"> 
       AllowOverride None 
       Options ExecCGI  
       Order allow,deny 
       Allow from all  
    </Directory>
15. If necessary, add .sh to the AddHandler directive for cgi-scripts
    AddHandler cgi-script .cgi .sh

2.2.1 Secure Shell

The use the automatic scripts to push a new bb-hosts file out to UNIX clients, a secure shell key pair is needed.

1. Become bbuser
2. Change the bbuser home directory
   $ cd
3. If necessary create a .ssh directory
   $ mkdir .ssh 
   $ chmod 700 .ssh
4. Create a keypair for authentication. Use an empty passphrase.
   1. For ssh1: 
      $ ssh-keygen -t rsa1 -f ~/.ssh/rsa1_pushkey
   2. For ssh2 using DSA keys 
      $ ssh-keygen -t dsa -f ~/.ssh/dsa_pushkey
   3. For ssh2 using RSA keys:
      $ ssh-keygen -t rsa -f ~/.ssh/rsa_pushkey
5. Copy rsa1_pushkey.pub to authorized_keys
   $ cp .ssh/rsa1_pushkey.pub authorized_keys
6. Copy dsa_pushkey.pub to authorized_keys2
   $ cp dsa_pushkey.pub authorized_keys2
7. Or copy rsa_pushkey to authorized_keys2
   cp rsa_pushkey.pub authorized_keys2
8. Make a tar file of the authorized_keys files
   $ tar -cvf bb-publickey.tar authorized_keys*

   These are public keys so they do not have to be tightly secured.

9. Edit /var/bbuser/bb/bin/bb-cpu.sh script to properly detect multiple CPU's. (See Sec: 2.5)

2.3 Client setup

1. Create the Big Brother user as described in Sect 2.1)
2. Become bbuser
   $ sudo su - bbuser
3. Copy the appropriate client software and public key set using scp or anonymous ftp.
   $ scp <username>@chena:/var/bbuser/client/bb-linux.tar . 
   $ scp <username>@chena:/var/bbuser/client/bb-publickey.tar .

   If using ftp the files are stored in /pub/BB

4. Extract the tar files
   $ tar -xvf bb-linux.tar 
   $ tar -xvf bb-publickey.tar
5. If necessary, edit BBHOME in runbb.sh
6. You now should be able to log onto the client from the server as bbuser with no password.
7. Add the new client machine to the bb-hosts file on the BBDISPLAY server and push-hosts.pl.
8. Push out the modified bb-hosts file to all clients

2.3.1 Modify logwatch output for Big Brother

As installed, the output from the logwatch scripts sshd and secure will contain a lot of messages like:

Bad protocol version identification 'Big-Brother-Monitor-1.9c'

These can be eliminated by editing the scripts.

2.3.1.1 sshd

1. In the script /etc/log.d/scripts/services/sshd locate the lines: 
   # Report any unmatched entries...  
   unless (($ThisLine =~ /fwd X11 connect/)) { 
       push @OtherList,$ThisLine;
2. Edit the middle line above to read
   unless (($ThisLine =~ /Big\-Brother\-Monitor/) or ($ThisLine =~ /fwd X11 connect/)) {

2.3.1.2 secure

1. In /etc/log.d/scripts/services/secure locate the line:
   while (defined($ThisLine = <STDIN>)) {
2. Right after this add the lines:
   if ($ThisLine =~ m/Big\-Brother\-Monitor/) { 
      next; 
   }

2.3.1.3 secure 2

1. The Big Brother messages in /var/log/secure can be stopped entirely if the SyslogFacility in /var/ssh/sshd_config is changes from AUTHPRIV to AUTH. AUTHPRIV is the default configuration on some installations. Change the logging to:  
   SyslogFacility AUTH 
   LogLevel INFO
2. Restart sshd
3. I strongly suggest the first method.

2.4 Adding a Service to Client

1. Become bbuser
2. Put the script in bb/ext
3. Add the script name to BBEXT in bbdef.sh

2.5 bb-cpu.sh

Just before the call to bbd add:
#==========================================================  
# added to indicate number of processors 
#========================================================= 
PROCNUM="1 processor" 
THISOS=`uname`  
export THISOS  
TR="/usr/bin/tr -d" 
 
case "$THISOS" in  
   SunOS)  
      NP=`/usr/sbin/psrinfo | $WC | $TR " "` 
      ;;  
   Linux)  
      NP=`/bin/grep processor /proc/cpuinfo | $WC | $TR " "`  
      ;;  
   AIX) 
      NP=`lsof | grep Processors: | awk -F":" '{print $2}' | $TR " "` 
      ;; 
   *)  
      NP=1  
      ;;  
esac 
 
if test $NP -gt 1; then 
   PROCNUM="$NP processors"  
fi  
#============================================================

Then add $PROCNUM to the actual call to bbd:

# 
# NOW SEND THIS INFORMATION TO THE BIG BROTHER DISPLAY UNIT 
# 
$BBHOME/bin/bb-combo.sh add "status $MACHINE.cpu $COLOR `date` up: $UP, $U users, $P procs, load=${DISPAVG} ($PROCNUM) 
$LINE1 
$LINE2 
`cat $BBTMP/TOP.$$` 
"