---

title: Using VCL to Broker Access to Pre-installed Machines

The Lab.pm provisioning module is used to broker access to standalone pre-installed Linux or Solaris machines. These machines could be in an existing walk-in computer lab or racked in a server room.

There are four main parts needed to setup a standalone machine to use with the Lab.pm module.

1. a non-root account called vclstaff on the target machines
2. ssh idenitity key for vclstaff account, this key is used by the vcld process on the management node
3. ssh service running on port 24 of the target machines
4. vclclientd running on the target machines, vclclientd in the bin directory of the vcld release

For distribution to a large set of machines, an rpm or package could be created to distribute vclclientd and related files.

How it works

The Lab.pm module confirms an assigned node or lab machine is accessible using the ssh identity key on port 24. If this succeeds, then a small configuration file with the state, user‘s id and the users’ remote IP address is sent to the node along with a flag to trigger the vclclientd process to either open or close the remote access port. Currently this module only supports Linux and Solaris lab machines.

How to setup:

All commands are run as root.

1. Create the non-root vclstaff account on target machine

   on linux: useradd -d /home/vclstaff -m vclstaff
   

2. Generate ssh identity keys for vclstaff account. Do not enter a passphrase for the key, just hit enter when prompted.

   su - vclstaff
   ssh-keygen -t rsa
   Generating public/private rsa key pair.
   Enter file in which to save the key (/home/vclstaff/.ssh/id_rsa):
   Created directory '/home/vclstaff/.ssh'.
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /home/vclstaff/.ssh/id_rsa.
   Your public key has been saved in /home/vclstaff/.ssh/id_rsa.pub.
   The key fingerprint is:
   

   At this point we have created a private key /home/vclstaff/.ssh/id_rsa and the public key /home/vclstaff/.ssh/id_rsa.pub.

3. Copy the public key to /home/vclstaff/.ssh/authorized_keys file

   cat /home/vclstaff/.ssh/id_rsa.pub > /home/vclstaff/.ssh/authorized_keys
   

4. Copy the private key to the management node. This can be stored in /etc/vcl/lab.key. This private key is used by vcld to remotely log into the the lab machine.

5. Edit /etc/vcld.conf Set the variables IDENTITY_linux_lab and IDENTITY_solaris_lab to use this new key. It should look like:

   IDENTITY_solaris_lab=/etc/vcl/lab.key
   IDENTITY_linux_lab=/etc/vcl/lab.key
   

6. Test out the newly created key from the vcl management node:

   ssh -i /etc/vcl/lab.key vclstaff@target_lab_machine
   

7. Set ssh server on target machine to listen on port 24. Edit /etc/ssh/sshd_config on target lab machine(s).

   echo "Port 24" >> /etc/ssh/sshd_config
   

   For advanced ssh configurations one may need to also add vclstaff to the AllowUsers directive or some other group which would work with ones existing campus ssh login restrictions, if any.

8. restart sshd

   /etc/init.d/sshd restart
   

9. retest to make sure sshd is accessible on port 24

   ssh -p24 -i /etc/vcl/lab.key vclstaff@target_lab_machine
   

10. Copy vclclientd and vclclientd init script to target_lab_machine, from managenment node:

    scp -P24 /usr/local/vcl/bin/vclclientd vclstaff@target_lab_machine:/home/vclstaff
    scp -P24 /usr/local/vcl/bin/S99vclclient.linux target_lab_machine:/etc/init.d/S99vclclient.linux
    

    add this start up script to the appropriate run time levels

11. Start vclclientd:

    /etc/init.d/S99vclclient.linux start
    

12. Add computers to the VCL database as one normally would. Make sure to set the type of the computer to lab and the Provisioning Engine to Computing Lab

13. Insert an image into the image table for this lab machine. You can set name and prettyname to whatever you want. We'll use “lab-machine-image1” and “Lab Machine image” in the example SQL:

    INSERT INTO `vcl`.`image`
    (`name`,
    `prettyname`,
    `ownerid`,
    `imagetypeid`,
    `platformid`,
    `OSid`,
    `lastupdate`,
    `forcheckout`)
    VALUES
    ('lab-machine-image1',
    'Lab Machine image',
    '1',
    (SELECT id FROM imagetype WHERE name = 'lab'),
    '1',
    (SELECT id FROM OS WHERE name = 'centos5'),
    NOW(),
    '1');
    

14. Insert a record into the imagerevision table. Note ‘Lab Machine image’ can be what ever you want.

    INSERT INTO `vcl`.`imagerevision` (
    `imageid` ,
    `revision` ,
    `userid` ,
    `datecreated` ,
    `deleted` ,
    `production` ,
    `imagename`)
    VALUES (
    (SELECT id FROM image WHERE name = 'lab-machine-image1'),
    0,
    1,
    NOW(),
    0,
    1,
    'lab-machine-image1')
    

15. Insert a record into the resource table.

    INSERT INTO `vcl`.`resource` (
    `resourcetypeid` ,
    `subid`
    )
    VALUES (
    13,
    (SELECT id FROM image WHERE name = "lab-machine-image1")
    )
    

16. Set up the image to computer group mappings and grant access.

    These next steps will be done using the VCL web interface

    1. Create a new Image group

       Manage Groups->Add New Resource Group

    2. Create a new Computer group

       Manage Groups->Add New Resource Group

    3. Add new image (inserted above) to the image group just created in step 1.

       Manage Images->Edit Image Grouping

    4. Add machines that have vclclientd to the computer group created in step 2

       Manage Computers->Edit Computer Grouping

    5. Assign new computer group to be controlled by management node

       Management Nodes->Edit Management Node Mapping

    6. Grant access to the new lab image and computer group in the privilege tree.