I mentioned on the list a few months back a technique for having YUM automatically use a local mirror without any configuration changes on the clients. A few people sent me emails asking for more details, so I was goaded/spurred into implementing it and have now documented the procedure in a new GURU GUIDE.
GOALS:
* Deploy a local Fedora mirror for core package installation and updates * Have local Fedora boxes automatically use the local mirror with ZERO configuration changes
Since ZERO configuration change occurs on the Fedora box, if the Fedora box is moved outside the local network (common with laptops) it will automatically use the stock behavior of accessing the Fedora Mirror system.
BENEFIT:
Greatly reduced Internet bandwidth utilization for organizations with many Fedora users as well as the Fedora mirrors. Plus, install/updates occur at LAN speeds.
AUDIENCE:
The solution detailed in the GURU GUIDE is ideal for any organization such as a corporation, school/university, hosting company or ISP who has multiple Fedora users on their network.
URL: http://www.gurulabs.com/goodies/YUM_automatic_local_mirror.php
I hope other organizations with Fedora users find this solution as useful as we have.
Dax Kelson Guru Labs
On Tue, May 22, 2007 at 05:58:03PM -0600, Dax Kelson wrote:
I mentioned on the list a few months back a technique for having YUM automatically use a local mirror without any configuration changes on the clients. A few people sent me emails asking for more details, so I was goaded/spurred into implementing it and have now documented the procedure in a new GURU GUIDE.
Dax, very cool. Thanks for posting this.
One thing I added to mirrormanager[1] was the ability for a mirror host to specify the set of IP netblocks that should use the local mirror. When a yum client hits the mirrorlist CGI, such as:
http://mirrors.fedoraproject.org/mirrorlist?repo=core-6&arch=i386
it looks up the client IP address in mirrormanager's database. If one or more of the hosts in that database claim that IP address as "local" to them, the CGI returns just those hosts.
In mirrormanager, you can have private mirror sites and private mirror hosts, so they never appear on the public list of servers, but the mirrorlist CGI can still handle them. The drawback is that mirrormanager can't crawl private mirror sites (generally). So, you have to use mirrormanager's report_mirror script[2], which runs on your private mirror, to tell the mirrormanager database what content you have. With this little bit of setup, you can get much the same benefit as your setup provides.
Some ISPs are already using this to direct their clients at their local mirrors, which reduces their bandwidth costs, without needing to make DNS changes that affect their clients.
Thanks, Matt
[1] https://admin.fedoraproject.org/mirrormanager [2] http://git.fedoraproject.org/?p=hosted/mirrormanager;a=tree;f=client;h=f7b9b...
On Tue, 2007-05-22 at 22:45 -0500, Matt Domsch wrote:
On Tue, May 22, 2007 at 05:58:03PM -0600, Dax Kelson wrote:
I mentioned on the list a few months back a technique for having YUM automatically use a local mirror without any configuration changes on the clients. A few people sent me emails asking for more details, so I was goaded/spurred into implementing it and have now documented the procedure in a new GURU GUIDE.
Dax, very cool. Thanks for posting this.
One thing I added to mirrormanager[1] was the ability for a mirror host to specify the set of IP netblocks that should use the local mirror. When a yum client hits the mirrorlist CGI, such as:
http://mirrors.fedoraproject.org/mirrorlist?repo=core-6&arch=i386
it looks up the client IP address in mirrormanager's database. If one or more of the hosts in that database claim that IP address as "local" to them, the CGI returns just those hosts.
In mirrormanager, you can have private mirror sites and private mirror hosts, so they never appear on the public list of servers, but the mirrorlist CGI can still handle them. The drawback is that mirrormanager can't crawl private mirror sites (generally). So, you have to use mirrormanager's report_mirror script[2], which runs on your private mirror, to tell the mirrormanager database what content you have. With this little bit of setup, you can get much the same benefit as your setup provides.
Matt, mirrormanager is very cool!
For YUM to automatically find a mirror I believe the cleanest and best solution is have it be done within Yum itself. Possibly with a WPAD-like or DNS SRV technique. It should be on default.
The idea of the main mirrorlist CGI having a database of local IPs and mirrors is actually a solution that I ran through mentally awhile back and came to the conclusion that security concerns and technical limitations made it unworkable.
When you attach your computer to a network there is some level of implicit trust in the local network (and whoever manages it). But this is a two party relationship and doesn't involve a third party who is a random stranger on the internet.
The main security concern I have with the DB of local IPs, is what is to prevent someone from listing my IP network as local to their mirror? This could be accidental via a netmask typo, or with a more sinister intent (cross your fingers that your users pay attention to gpg messages from yum).
IMHO, this should not be possible. If mirrormanager intends to maintain a DB of local IPs for a mirror, then the ownership/control of the IP range *must* be strongly authenticated. It should be done securely, or not at all.
Different people have different security requirements, but I believe that some people will be in for a shock and react poorly/predictably when they find out that their IP netblocks (or any portion thereof) could be redirected.
The technical limitation of the DB of local IPs is that it doesn't work for organizations who run their mirrors on a RFC1918 IP and use NAT to get out to the internet. This scenario is very common.
Dax Kelson Guru Labs
On Wed, 2007-05-23 at 14:57 -0600, Dax Kelson wrote:
For YUM to automatically find a mirror I believe the cleanest and best solution is have it be done within Yum itself. Possibly with a WPAD-like or DNS SRV technique. It should be on default.
Or perhaps using Zeroconf? See:
https://lists.dulug.duke.edu/pipermail/yum-devel/2007-May/003654.html
Jeff
"JCO" == Jeffrey C Ollie jeff@ocjtech.us writes:
JCO> Or perhaps using Zeroconf?
Unfortunately I'm not sure zeroconf is useful in an environment where you actually have configured DNS and DHCP servers or assigned IPs. So while it's a cool solution, folks like me still need something that runs on SRV records or the like.
But that plugin is simple enough that it's useful as an example of how to do this. I'm trying to learn enough python to do it, but everyone else is welcome to beat me to it.
- J<
-
Dax Kelson -
Jason L Tibbitts III -
Jeffrey Ollie -
Matt Domsch