First you need to create an SSH key. If you already own an SSH key, you can go to the next step.
A guide on how to create an SSH key can be found → here.

To connect to a server using SSHGATE as a jumphost use the following command.
ssh -J username@sshgate.zdv.uni-mainz.de loginname@Targetserver
The -J option tells ssh to use the first server as a jumphost.

You can add the SSHGATE server to your ssh config file. This way the connection can be called with a shortcut.
To add a shortcut you need to edit the file ~/.ssh/config.
You need to add the following lines.
After the file is edited you can call the shortcut with ssh ShortcutName.

To prevent abuse of our mail system, you need to sign in before you are allowed to send any mail, like you do with Outlook and Thunderbird. By doing so, the ZDV can differentiate between authorized and abusive use, e.g. making sure no one can send messages in someone else's name.

If the mail is sent by a specific program (and not a person,) this may not be possible. For this use case the ZDV provides a mailproxy.

To use the mailproxy, enter the following details into your specific program:
Mail- or SMTP-Server: mailproxy.zdv.uni-mainz.de
Port: 25
Connection security: Optional
Authentication (name and password): not necessary

This way, the mail is send to the mailproxy, the proxy checks if your server is allowed to send such a mail. To allow sending of mails, rules need to be created.

Rules are based on the receiver of the mail.
For sending mails via the mailproxy, the following restrictions apply:

• Sending mails with a personal address is not possible.
• If a reply is expected, the from address must be a working address, e.g. info@uni-mainz.de.
• If no reply is expected, the from address can be noreply@uni-mainz.de.
• If the mail is sent to an address outside of the university, the server part of the from address (e.g. "uni-mainz.de" for most university addresses) needs to be known outside of the university network. Otherwise the mail won't be accepted by the receiving server. This is the reason, why internal addresses like info@server.faculty.uni-maint.de are not usable.

It is possible to create any number of rules.
To create a rule, we need the following information:

• Name of your server
• Sending address
• Recipient address

Here are some examples:

System: internal-server.zdv.uni-mainz.de

Sending address: info@uni-mainz.de
Recipient: any, worldwide

Sending address: news@zdv.uni-mainz.de
Recipient: only Uni Mainz

Sending address: status@zdv.uni-mainz.de
Recipient: postmaster@uni-mainz.de

To create a rule, send an e-mail with the subject Mailproxy to: linux@uni-mainz.de.

To ensure safety of our university network, servers are, by default, not allowed to connect to the internet.

If you need to establish a connection from your your server to the internet, a rule needs to be created. These rules are created on the ZDV webproxy.
Your server sends a request to the webproxy. The webproxy then decides, if the connection is allowed or not.

Set up the proxy on your server

To add the proxy to your system, you need to add the following lines to /etc/enviroments.

http_proxy=http://webproxy.zdv.uni-mainz.de:3128
https_proxy=http://webproxy.zdv.uni-mainz.de:3128
no_proxy=localhost,0.0.0.0,127.0.0.1,127.0.0.0/12,.zdv.uni-mainz.de,.uni-mainz.de,zdv.net,rlp.net,*.zdv.uni-mainz.de,*.uni-mainz.de,*.zdv.net,*.rlp.net,10.94.0.0/12,10.96.0.0/12
HTTP_PROXY=http://webproxy.zdv.uni-mainz.de:3128
HTTPS_PROXY=http://webproxy.zdv.uni-mainz.de:3128
NO_PROXY=localhost,0.0.0.0,127.0.0.1,127.0.0.0/12,.zdv.uni-mainz.de,.uni-mainz.de,zdv.net,rlp.net,*.zdv.uni-mainz.de,*.uni-mainz.de,*.zdv.net,*.rlp.net,10.94.0.0/12,10.96.0.0/12

Add rules for your server

To add a rule, send an e-mail with the subject Webproxy to: linux@uni-mainz.de.

CFEngine is a program to administrate a number of computers via a central server. This way, there is no need to set up every computer manually.
On ZDV Linux and virtual servers CFEngine comes preinstalled and configured.

CFEngine consists of 2 components.

1. A local client, which makes changes to the system.
2. A server, which provides information to the client on what to change.

Changes could be creation, deletion or changing of files.
Different changes are made based on the computer. For example, a desktop needs other changes than a server.
To differentiate between the different computers, CFEngine assigns different classes to each computer.
The server instructs the client to make a changes to a specific group. The client checks, if the computer is a member of this group and applies the change accordingly.
During this process, local changes can be overridden.

---

Local changes are overridden by CFEngine

If local changes are overridden by CFEngine, exceptions can be made to preserve local changes.
If you need an exception for your computer, please send an e-mail with the subject CFEngine to unix@uni-mainz.de.
We will work with you to add such an exception.

Which files are changed by CFEngine?

The need for different configurations may change over time, based on the type of computer. The instructions for the clients are kept up to date by the ZDV. This means, changes made by CFEngine to a computer can change over time, based on the type of computer.

This documentation explains how to check what changes are made on a computer. To do so, you need to check the classes of the computer and the changes assigned to this class.

What classes are associated with my computer?

To get a list of all classes your computer is associated with, type
cf-promises --show-classes
with roots rights into a terminal.

Where can I find changes made to my computer?

All changes made by CFEngine are stored in .cf files. These files can be found at /var/lib/cfengine3/inputs/local.
The name of the file indicates what it configures.

Reading a .cf file

.cf files are divided into different sections. Everything belonging to a section is indented.
Changes of files are found at the files section.
Here is a snippet of the backup.cf file.

...
	files:

		burpclients.!backup_01::

		    "/etc/cron.d/burp"
                        copy_from	=> secure_cp_b("$(g.dir_masterfiles)/etc/cron.d/burp", $(sys.policy_hub));

		burpclients::

		    "/etc/burp/burp.conf"
                        copy_from	=> secure_cp_b("$(g.dir_masterfiles)/etc/burp/$(sys.host).conf", $(sys.policy_hub));

		    "/etc/burp/clientconfdir/incexc/zdv"
                        copy_from	=> secure_cp_b("$(g.dir_masterfiles)/server/backup-01/etc/burp/clientconfdir/incexc/zdv", $(sys.policy_hub));
...

Line 2: This marks the start of section "files:" everything that is indented belongs to this section.

Line 4: Sets the classes which the changes should apply to. Every indented line will be executed, if the classes are met.
Checking for a class can be done in different ways:

• class1:: If the computer is in class1.
• class1.class2:: The dot means the computer needs to be in class1 and in class2.
• class1|class2:: The | means the computer needs to be in class1 or in class2.
• class1.!class2:: The ! stand for not. The computer needs to be in class1, but mustn't be in class2.

In this case the computer needs to be in class burbclients and musn't be in in class backup_01.

Line 6: Which file is going to be changed.

Line 7: How the file is changed. In this case a new file is copied from the server and replaces the old one.

Line 9: A new rule is set for all computers in class burbclients.

Line 11, 14: Which files are changed, same as in line 6.

Line 12, 15: How the file is changed, same as in line 7.

 

---

Configure your own server

If you use a ZDV Linux version or a virtual server provided by the ZDV, CFEngine is installed and configured by default.
If you installed Linux by yourself, you need to install and configure CFEngine manually.

Keep in mind, that the ZDV doesn't provide configurations for all distributions. If your distribution is not in any class configured by the ZDV, no changes will be made.

Installation
Install the CFEngine package provided by your distribution e.g. cfengine3(Debian, Ubuntu), cfengine(Suse, Fedora).

Bootsrap
After installation, enter cf-agent -B config-01 with root rights into your terminal.

The university provides an OpenID Connect server. With OpenID connect, you can authenticate a user via the ZDV and request data about this user.

A tutorial on how to implement OpenID Connect can be found here.

The current ZDV server configuration is available at openid.uni-mainz.de/.well-known/openid-configuration.

OpenId connect can only be implemented after prior consultation with the ZDV. Please send an e-mail with the subject OpenID Connect to hotline@uni-mainz.de.

To set up OpenID Connect access, the ZDV needs the following information:

• Which claims are needed
• A valid redirect_url for your website.
  If you want to develop an own application, this will be coordinated individually.
• Which flow is being used:
  • Authorization Code Flow (It's recommended to use this flow.)
  • Implicit Flow
  • Hybrid Flow

The ZDV defines the following parameters:

• client_id
• client_secret (if necessary)

To install an add-on, open Thunderbird and click on the the lines at the top right corner. A menu opens. Click on Add-ons:

---

Next, click on Extensions on the left hand side:

---

At the top right, a search box will appear. Enter the name of the add-on you want to install into this search box and press Enter.

---

If you found the right add-on, click on Install.

If the add-on is installed you will see "TBSync: idle" at the bottom right corner of Thunderbird. Click on this text:

---

A new window opens. Click on Account actions → Add new account → Exchange ActiveSync (EAS).

---

A window opens. There, enter the following:
Account Name: How you want to name this account.
User name (email address):Your uni-mainz email address.
Password: Your password

Once you have finished this, click on Autodiscover settings and add account:

---

A popup should appear, telling you that auto discover was successful. Click on OK to close the popup.

---

You will be forwarded to a new window. The only thing you should change there is the "Sync interval (minutes)" otherwise you have to sync manually.
Once you have finished, click on Enable account & try to connect to server:

---

You will see a window showing calendars, contacts and tasks with the status OK. You may close this window now.

---

Even after the status shows OK, it will take a little while until the server provides all information. Just keep Thunderbird running - after a while all data will be synced. After the initial setup the sync won't be delayed.

If the add-ons are installed you will see "TBSync: idle" at the bottom right corner of Thunderbird. Click on this text.

---

A new window opens. Click on Account actions → Add new account → Exchange ActiveSync (EAS).

---

Inside the new window, enter:
Account name: How you want to name this account
User name (email address): UNI-MAINZ/username
Password: Your password
Set server configuration to Custom configuration.

Once you have finished, click on Add account.

---

You will be forwarded to a new window, where you may enter the following:
Server address: mail.uni-mainz.de
Set ActiveSync version to v14.0.
Sync interval (minutes): to set up how often you want to sync the data. If this is set to 0, you need to sync manually.
Once you have finished, click on Enable account & try to connect to server.

---

You will see a window showing calendars, contacts and tasks with the status OK. You may close this window now.

---

Even after the status shows OK, it will take a little while until the server provides all information. Just keep Thunderbird running - after a while all data will be synced. After the initial setup the sync won't be delayed.

All commands and changes need to be executed with root privileges.

1. Create config files

TSM config files are stored in /opt/tivoli/tsm/client/ba/bin/.

To set up TSM, you need to create dsm.opt, dsm.sys and excludelist configuration files.
Create these files with these commands.
touch /opt/tivoli/tsm/client/ba/bin/dsm.opt

touch /opt/tivoli/tsm/client/ba/bin/dsm.sys

touch /opt/tivoli/tsm/client/ba/bin/excludelist

Now all files are created.

2. Change configuration files

Open /opt/tivoli/tsm/client/ba/bin/dsm.opt and enter:

Open /opt/tivoli/tsm/client/ba/bin/dsm.sys and enter:

You need to make a change in line two starting with NODENAME. Replace your.node.name with the nodename provided to you.

The file /opt/tivoli/tsm/client/ba/bin/excludelist holds information about files and folders excluded from backup.
To exclude a file use EXCLUDE path.to.file.
To exclude a folder and all it's content use EXCLUDE.DIR path.to.folder.
You may use /.../ for multiple paths.

This can be useful to exclude temporary files.
Here is an example to exclude all files named core and folder and sub folder of /tmp, /var/log, /var/run and /var/tmp.

❗ Attention: Encrypted folder
If you use virtual file systems like encfs or ecryptfs (e.g. used by Ubuntu to encrypt your home folder) to encrypt your data, TSM only backs up your encrypted files by default.
If you want to back up plain text files you need to add a virtual mount point, this will tell TSM to back up all data inside a folder, even though they are saved encrypted somewhere else.
To add a virtual mount point you need to add the following line in /opt/tivoli/tsm/client/ba/bin/dsm.sys.

3. Start and log in

To start TSM type dsmc inside your terminal.

You will be asked for your username and password. Your user id is your nodename and it should be seen inside < > brackets. If this is the case you can press Enter without typing it again. Use the password provided to you.

4. Autostart

To autostart TSM and enable automatic backups run update-rc.d dsmcad enable with root rights.
Restart your computer.
Tp make sure everything runs without a problem, type:
cat /var/log/dsmwebcl.log.
You should see time and date for the next backup.

5. configure firewall

To use automatic backups port 1501 needs to be open. On ZDV virtual servers you can open this port by using this command ufw allow TSM.

If you only want to access the archive function you need to create two config files.
Create these files with these commands.
touch /opt/tivoli/tsm/client/ba/bin/dsm.opt

touch /opt/tivoli/tsm/client/ba/bin/dsm.sys

Open /opt/tivoli/tsm/client/ba/bin/dsm.opt with root rights and enter:

Open /opt/tivoli/tsm/client/ba/bin/dsm.sys with root rights and enter:

You need to make a change in line two starting with NODENAME. Replace archive.name with the archive name provided to you.

You may use an archive alongside your backup. To access your archive, you need to log in with a different nodename. It's the same as logging in with a different account.
To access the archive you need to add "-virtualnodename=archive.name" after the dsmc command.
Change archive.name to the name of the archive you want to access.

To open the archives inside command line, type (change archive.name to the archive name you want to access):
dsmc -virtualnodename=archive.name

Create initial backup

To create an initial backup of your system use the command backup. Backups will run automatically. There is no need to perform manual backups.

Restore files/folder

To restore a file/folder, use restore "path to file/folder". This will restore the selected file/folder to its original location.
In most cases you need to add additional options to your command if you want to restore files in a specific way. You may combine the different options to restore files/folder the way you want.

Restore files/folder to a different location
restore "path to file/folder" "path where to restore".

Restore deleted or older files
TSM differentiates between active and inactive files. All files of the last backup are treated as active files. Older or deleted files are treated as inactive files. By default, TSM only shows and restores active files.
To restore the latest backed up file no matter if it's active or not, use:
restore "path to file/folder" -inac=yes.

Restore sub folder
By default, TSM only restores the folder or file you have chosen. This means that if you choose a folder, no data in sub folders will be restored. To restore all data (including all data in sub folders), use:
restore "path to folder" -sub=yes.

Select the files/folder to restore
TSM can show you a interactive list of backed up files/folders. You can select which files/folders to restore. This may be helpful if you only want to restore a file from inside a folder and don't know how the file was named or if you want to restore an older backup of the file. To show you the list of files use:
restore "path to file/folder" -pick.
This option is most useful if combined with the -inac=yes and/or -sub=yes option.

Examples

• Restore a deleted file to a specific location.
  restore "path to file" "path where to restore" -inac=yes
• Select between all backed up versions of a file inside a folder and restore them at their original location.
  restore "path to folder" -pick -inac=yes
• Select between all versions of backed up files and folders inside a folder, including files in subfolders and restore them at a specific location.
  restore "path to folder" "path to restore" -pick -sub=yes -inac=yes

Archive files and folders

To make it easier to find and restore archived data, it is best to provide a description when using the archive function. To do so, use -desc='Your Description'. ❗ Attention: Your description must be written between the ' ' symbols.

To archive a file type: archive -desc='description' "path to file".
To archive a folder type: archive -desc='description' "path to folder". ❗ Attention: By default TSM doesn't transfer the content of sub folders.
To archive a folder and sub folder type: archive -desc='description' -sub=yes "path to folder".

Retrieve files from archive

To get a file/folder from an archive, use the retrieve "path to file/folder" command. This will retrieve the file/folder from its original location.
By adding options to this command, you can change how to retrieve the file/folder. You can combine these options to retrieve files/folders, depending on what you need.

Retrieve file/folder to a different location
retrieve "path to file/folder" "path where to restore"

Retrieve sub folders
TSM doesn't retrieve content of sub folders by default. If you want to retrieve content of sub folders use:
retrieve "path to folder" -sub=yes

Retrieve by description
If you only want to retrieve files with a certain description, use
retrieve "path to file" -desc='description you want to retrieve'. ❗ Attention: The description must be inside the ' ' symbols.

Pick files/folders to retrieve
TSM can show you an interactive list of archived files/folders. This way you may select which files/folders to retrieve. This can be helpful if you only want to restore a file from inside a folder and don't know how the file was named. To show you the list of files use:
retrieve "path to file/folder" -pick.

Examples

• Retrieve a folder including all sub folders to a specific location.
  retrieve "path to folder" "path to restore to" -sub=yes
• Show a list of files/folder including sub folders with the description 'Very important data' and retrieve them to a specific location.
  retrieve "path to folder" "path to restore to" -sub=yes -pick -desc='Very important data'

To use archives alongside backups, you must enter -virtualnodename=archive.name at the end of the dsmc command, if you want to interact with the archive.
If you want to use an interactive shell, this would look like this:
dsmc -virtualnodename=archive.name.
If you use the terminal directly, this would look like this:
dsmc "your command" -virtualnodename=archive.name.
In both cases replace the archive.name with the archive name you want to access.

You need to install Putty. Putty is also available as a ZDV App. If you install Putty, Puttygen will be installed with it. This program is used to create SSH keys.

Create an SSH key

Open Puttygen.

Change the 'numbers of bits generated' to 4096 (written in 2017).

Click on Generate.

Move your mouse over the blank area. If you move your mouse, the progress bar will move forward.

Once the key is generated you can protect it with a password. Enter you password inside the key passphrase field and confirm it.

To create a key which includes your name and e-mail address enter your name, family name, e-mail separated by a , into the Key comment field. This allows an association between the key and you as a person.

Click Save public key to save your public key and Save private key to save your private key.
It's important to remember where you saved your keys.

Authenticate with SSH key

To authenticate with an SSH key, your public key must be added to the remote computer.
You need to add your SSH key to your connection. Navigate to
Connection/SSH/Auth in the left menu. Click on Browse and select your private key:

If you establish a connection, you will be asked for your private key password.

There is a downside to this method: every time you establish a connection, you will be asked for your private key password. To avoid entering your password each time you make a connection, you may use a software called Pageant. Pageant is part of the Putty installation.

Open Pageant. You will see a tray icon:

Doubleclick on this icon. A new window will open:

You need to add your private key here. Click on Add Key and choose your private key.
You will be asked for your private key password.

After you entered your password, your key should appear inside the window:

As long as Pageant is running, you do not need to add your private key to Putty. If you establish a connection, your SSH key will be used automatically.

If you close Pageant, all added keys will be deleted and will then need to be added manually each time you open Pageant again. However, there is a way to load your key whenever Pageant is started.
To do so, create a Pageant shortcut. Right click the shortcut and select properties.
You need to change the target line:

Add a space behind the existing line and then add "the path to your private key". It's important that you use the "" symbols.
If you start Pageant using this shortcut, your private key will be loaded automatically and you just have to enter your password once.