LCP Infrastructure

LCP Infrastructure

Networks

- CSAIL                    192.168.100.0/24
- LCP 5th floor            192.168.1.0/24
- LCP 2nd floor            192.168.2.0/24
- Holyoke public           192.168.11.0/24
- Holyoke private          192.168.99.0/24
- LCP private BIDMC network 10.19.14.128/25

---

FreeIPA (Identity Management)

The firewall at CSAIL is Heimdallr (128.30.29.50 / heimdallr.csail.mit.edu). Heimdallr is also used to virtualize Poseidon.

Poseidon is a FreeIPA server. FreeIPA manages:

• Access for workstations and servers
• User accounts
• DNS
• Certificates (some expire yearly, others every 5–10 years)

IPA servers should be created using CentOS.

To add a machine to FreeIPA, you must have the "User Administrator" role. Currently only Benjamin and ftorres have admin privileges. All 5 roles are assigned to admin users.

FreeIPA servers:

- hades.ecg.mit.edu    (LCP 5th floor)
- zeus.ecg.mit.edu     (Holyoke private side)
- poseidon.ecg.mit.edu (CSAIL)

---

Firewalls

- heimdallr.csail.mit.edu     (CSAIL)
- nezha.mit.edu               (2nd floor)
- scheherazade.mit.edu        (5th floor)
- fw2.ecg.mit.edu             (BIDMC private side at LCP)
- prometheus.ecg.mit.edu      (access to private side at Holyoke)
- helios.mit.edu              (access to Holyoke public)
- imes-firewall.mit.edu       (access to bare metal at Holyoke)

---

VPN servers

- imes-firewall.mit.edu
- nezha.mit.edu
- heimdallr.csail.mit.edu
- aphrodite.ecg.mit.edu   (from Holyoke private to LCP private)
- cabg.kardia.mit.edu     (Windows machine VPN to BIDMC)

---

Public IPs at Holyoke

We have 5 public IPs (more can be requested):

18.13.52.201
18.13.52.202
18.13.52.203
18.13.52.204
18.13.52.205

---

Useful SSH aliases

Add to your ~/.bashrc or ~/.profile:

alias sshholyoke='sshuttle -r <USERNAME>@helios.mit.edu 192.168.11.0/24 192.168.99.0/24'
alias sshlcp='sshuttle -r <USERNAME>@scheherazade.mit.edu 192.168.1.0/24 ventricle'
alias sshcsail='sshuttle -r <USERNAME>@heimdallr.csail.mit.edu 192.168.100.0/24'

---

Virtualization (KVM at Holyoke)

Holyoke has 3 bare-metal machines: one firewall, one public-side machine, and one private-side machine. Access to the bare-metal firewall is root-only via SSH keys.

To access the virtual manager:

ssh -l root -AY imes-firewall.mit.edu
ssh -AY public
virt-manager

Replace public with private to access the private side.

Creating a new VM:

• Choose "Local install media" — ISOs are in /home/isos/
• Set RAM and CPU
• Create custom storage under vg00 (volumes can be resized later)
• Choose a name wisely — the name cannot be changed (only the title can)

Network interfaces:

Public side:

- br2  (192.168.11.0/24)
- br3  (public IP)

Private side:

- br2  (192.168.99.0/24)

To see which virtual interfaces belong to which bridge:

brctl show

---

Backup servers

- Metis   → public side at Holyoke
- Rhea    → private side at Holyoke
- BRP1    → at the lab (redundancy, holds both public and private)

---

Monitoring & maintenance notes

• Nagios monitors all servers. Dashboard: https://zeus.ecg.mit.edu/nagios/ (requires sshholyoke in a separate terminal). Per-server config is controlled by NRPE.
• Updates script lives in /root/ on rhea — SSH into all listed servers and checks for pending updates. New servers must be added manually along with their SSH public key.
• FreeIPA passwords expire every year.
• Fedora releases a new version every year — upgrade all Fedora servers annually.
• PhysioNet emails (@physionet.org) are archived at /var/archive/mail/new/ and tarballed monthly into /data/logs/mail/archive/.
• When adding a user in FreeIPA, the Job Description field should include a short description of the person's status or duration (e.g. "UROP Sept 2021–2022").