IARC 207 Wiki - User contributions [en]

K1 Burn Notes

2016-12-21T01:37:21Z

137.229.92.136: /* Met Review */

===Met Review===
* 1999 All good
** Precip needs comparing to another site as it doesn't seem to record until end of summer.
* 2000 All Good
* 2001 All Good
** No precip for this year though (in NSIDC data set)
* 2002
** Missing data 1/1/ to 2/4
** AT/RH bad one @ 6/10/2002 15:00
* 2003 All Good
* 2004 All Good
* 2005 All Good
* 2006 Mostly Good
** Bear damage of 3m WS/WD?
* 2007 All Good
* 2008 All Good
* 2009 Problems... need to follow up with data from other sites.
AT/RH 1m: 6/4/2009 0:00 - 7/31/2009 16:00 (Bear Damage)
AT/RH 3m: 6/4/2009 0:00 - 9/25/2009 16:00
WS/WD need to compare to other Kougarok sites. 90% sure it is bunk. I don't trust specifically the anemometer being pointed north much of the time. Perhaps fixed on 9/25/2009 visit.
Precip -- Broken all year (tipping bucket removed by animal) but bucket replaced on 9/25/2009 trip.
* 2010
Precip -- possibly broken again until 6/25/2010 visit... need to compare to other sites.
If good: season starts 5/25/2010 9:00 if bad, season starts 6/23/2010 18:00 (data download time)
season ends 9/23/2010 2:00
* 2011
1m AT/RH -- 1/27/2011 0:00 - 8/18/2011 17:00 (Fox?)
3m AT/RH -- 4/29/2011 16:00 - 12/31/2011 23:00 (Bear)
Precip -- Broken all year it appears.
Wind -- 4/29/2011 16:00 - 12/31/2011 23:00 (Bear)
* 2012
1m AT/RH -- 5/12/2012 0:00 - 8/8/2012 18:00 (Animal)
3m AT/RH -- 1/1/2012 0:00 - 8/8/2012 18:00 (Bear)
Precip -- Broken until 8/8/2012 18:00; end of season 10/6/2012 22:00
Wind -- 1/1/2012 0:00 - 8/8/2012 18:00
* 2013
1m AT -- 7/7/2013 22:00 - 12/31/2013 0:00
1m RH -- 7/7/2013 22:00 - 9/16/2013 19:00
3m AT -- 7/7/2013 22:00 - 9/16/2013 19:00
3m RH -- 7/7/2013 22:00 - 9/16/2013 19:00
Precip -- Start: 5/21/2013 8:00 End: 10/22/2013 11:00
* 2014
1m AT --1/1/2014 0:00 - 7/24/2014 11:00
1m RH -- 6/3/2014 14:00 - 7/23/2014 21:00
3m AT -- 6/3/2014 14:00 - 7/23/2014 21:00
3m RH -- 6/3/2014 14:00 - 7/23/2014 21:00
(Still working up 2014)

===Soil Information:===

D:\projects_usb_drive\UAF\From Crane\archived files from past workers\ANDYS\ANDYWORK\SEWARD_PEN\KOUGAROK\K1_3MTOWERNIAGARA_\WORKING\2000K1.XLS
=IF(F3>60,6999,IF(F3<3,6999,IF(F3=0,6999,IF(F3=-6999,-6999,IF(F3=6999,6999,1/(0.00128+0.000237*(LN(F3*1000))+0.0000000906*((LN(F3*1000))^3))-273.15)))))
Thermistor String 1 -- 5, 10, 15, 20, 30, 40
Thermistor String 2 -- 25, 40, 55, 75, 100, 125
Soil Moisture Pit -- 5, 10, 15, 20, 30, 40

K1 Burn Notes

2016-12-21T01:09:18Z

137.229.92.136: /* Met Review */

===Met Review===
* 1999 All good
** Precip needs comparing to another site as it doesn't seem to record until end of summer.
* 2000 All Good
* 2001 All Good
** No precip for this year though (in NSIDC data set)
* 2002
** Missing data 1/1/ to 2/4
** AT/RH bad one @ 6/10/2002 15:00
* 2003 All Good
* 2004 All Good
* 2005 All Good
* 2006 Mostly Good
** Bear damage of 3m WS/WD?
* 2007 All Good
* 2008 All Good
* 2009 Problems... need to follow up with data from other sites.
AT/RH 1m: 6/4/2009 0:00 - 7/31/2009 16:00 (Bear Damage)
AT/RH 3m: 6/4/2009 0:00 - 9/25/2009 16:00
WS/WD need to compare to other Kougarok sites. 90% sure it is bunk. I don't trust specifically the anemometer being pointed north much of the time. Perhaps fixed on 9/25/2009 visit.
Precip -- Broken all year (tipping bucket removed by animal) but bucket replaced on 9/25/2009 trip.
* 2010
Precip -- possibly broken again until 6/25/2010 visit... need to compare to other sites.
If good: season starts 5/25/2010 9:00 if bad, season starts 6/23/2010 18:00 (data download time)
season ends 9/23/2010 2:00
* 2011
1m AT/RH -- 1/27/2011 0:00 - 8/18/2011 17:00 (Fox?)
3m AT/RH -- 4/29/2011 16:00 - 12/31/2011 23:00 (Bear)
Precip -- Broken all year it appears.
Wind -- 4/29/2011 16:00 - 12/31/2011 23:00 (Bear)
* 2012
1m AT/RH -- 5/12/2012 0:00 - 8/8/2012 18:00 (Animal)
3m AT/RH -- 1/1/2012 0:00 - 8/8/2012 18:00 (Bear)
Precip -- Broken until 8/8/2012 18:00; end of season 10/6/2012 22:00
Wind -- 1/1/2012 0:00 - 8/8/2012 18:00
* 2013
1m AT -- 7/7/2013 22:00 - 12/31/2013 0:00
1m RH -- 7/7/2013 22:00 - 9/16/2013 19:00
3m AT -- 7/7/2013 22:00 - 9/16/2013 19:00
3m RH -- 7/7/2013 22:00 - 9/16/2013 19:00
Precip -- Start: 5/21/2013 8:00 End: 10/22/2013 11:00
* 2014
1m AT --1/1/2014 0:00 - 7/24/2014 11:00

===Soil Information:===

D:\projects_usb_drive\UAF\From Crane\archived files from past workers\ANDYS\ANDYWORK\SEWARD_PEN\KOUGAROK\K1_3MTOWERNIAGARA_\WORKING\2000K1.XLS
=IF(F3>60,6999,IF(F3<3,6999,IF(F3=0,6999,IF(F3=-6999,-6999,IF(F3=6999,6999,1/(0.00128+0.000237*(LN(F3*1000))+0.0000000906*((LN(F3*1000))^3))-273.15)))))
Thermistor String 1 -- 5, 10, 15, 20, 30, 40
Thermistor String 2 -- 25, 40, 55, 75, 100, 125
Soil Moisture Pit -- 5, 10, 15, 20, 30, 40

K1 Burn Notes

2016-12-20T22:11:41Z

137.229.92.136:

===Met Review===
* 1999 All good
** Precip needs comparing to another site as it doesn't seem to record until end of summer.
* 2000 All Good
* 2001 All Good
** No precip for this year though (in NSIDC data set)
* 2002
** Missing data 1/1/ to 2/4
** AT/RH bad one @ 6/10/2002 15:00
* 2003 All Good
* 2004 All Good
* 2005 All Good
* 2006 Mostly Good
** Bear damage of 3m WS/WD?
* 2007 All Good
* 2008 All Good
* 2009 Problems... need to follow up with data from other sites.
AT/RH 1m: 6/4/2009 0:00 - 7/31/2009 16:00 (Bear Damage)
AT/RH 3m: 6/4/2009 0:00 - 9/25/2009 16:00
WS/WD need to compare to other Kougarok sites. 90% sure it is bunk. I don't trust specifically the anemometer being pointed north much of the time. Perhaps fixed on 9/25/2009 visit.
Precip -- Broken all year (tipping bucket removed by animal) but bucket replaced on 9/25/2009 trip.
* 2010
Precip -- possibly broken again until 6/25/2010 visit... need to compare to other sites.
If good: season starts 5/25/2010 9:00 if bad, season starts 6/23/2010 18:00 (data download time)
season ends 9/23/2010 2:00
* 2011
1m AT/RH -- 1/27/2011 0:00 - 8/18/2011 17:00 (Fox?)
3m AT/RH -- 4/29/2011 16:00 - 12/31/2011 23:00 (Bear)
Precip -- Broken all year it appears.
Wind -- 4/29/2011 16:00 - 12/31/2011 23:00 (Bear)
* 2012
1m AT/RH -- 5/12/2012 0:00 - 8/8/2012 18:00 (Animal)
3m AT/RH -- 1/1/2012 0:00 - 8/8/2012 18:00 (Bear)
Precip -- Broken until 8/8/2012 18:00; end of season 10/6/2012 22:00
Wind -- 1/1/2012 0:00 - 8/8/2012 18:00
* 2013

===Soil Information:===

D:\projects_usb_drive\UAF\From Crane\archived files from past workers\ANDYS\ANDYWORK\SEWARD_PEN\KOUGAROK\K1_3MTOWERNIAGARA_\WORKING\2000K1.XLS
=IF(F3>60,6999,IF(F3<3,6999,IF(F3=0,6999,IF(F3=-6999,-6999,IF(F3=6999,6999,1/(0.00128+0.000237*(LN(F3*1000))+0.0000000906*((LN(F3*1000))^3))-273.15)))))
Thermistor String 1 -- 5, 10, 15, 20, 30, 40
Thermistor String 2 -- 25, 40, 55, 75, 100, 125
Soil Moisture Pit -- 5, 10, 15, 20, 30, 40

Decommisioned Serial Server Config and notes

2016-09-20T21:18:23Z

137.229.92.136: Created page with "/etc/network/interfaces <pre> auto lo iface lo inet loopback auto eth0 iface eth0 inet dhcp post-up /home/bob/bin/xmitip.sh #iface eth0 inet static # address 199.165.12..."

/etc/network/interfaces
<pre>
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
post-up /home/bob/bin/xmitip.sh

#iface eth0 inet static
# address 199.165.126.161
# gateway 199.165.126.129
# netmask 255.255.255.128
# dns-nameservers 8.8.8.8 8.8.4.4

</pre>
/etc/ser2net.conf
<pre>
# BNZ Radio
6786:raw:25:/root/devices/bnz_radio:57600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
# IARC radio
7808:raw:25:/root/devices/iarc_radio:57600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
# IARC CR10
7809:raw:25:/dev/ttyUSB2:9600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
</pre>
/etc/iptables.firewall.rules
<pre>
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# from Jim:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT
-A INPUT -s 137.229.94.2 -d 244.0.0.1 -j ACCEPT
#-A INPUT -s 224.0.0.1 -p udp -m udp -j ACCEPT

# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
#-A INPUT -p tcp --dport 80 -j ACCEPT
#-A INPUT -p tcp --dport 443 -j ACCEPT

-A INPUT -s 192.168.0.0/16 -p tcp -m tcp --dport 6786 -j ACCEPT
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 6786 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport 6786 -j ACCEPT
-A INPUT -s 0.0.0.0/0 -p tcp --dport 6786 -j DROP

-A INPUT -s 192.168.0.0/16 -p tcp -m tcp --dport 7808 -j ACCEPT
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 7808 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport 7808 -j ACCEPT
-A INPUT -s 0.0.0.0/0 -p tcp --dport 7808 -j DROP

-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 192.168.0.0/16 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 0.0.0.0/0 -p tcp --dport 7809 -j DROP

-A INPUT -s 137.229.0.0/16 -p udp -m udp -j ACCEPT

# Allow SSH connections
#
# The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Log iptables denied calls (disabled once I saw what all was getting blocked)
##-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT
</pre>

Computers

2016-09-20T21:03:43Z

137.229.92.136: /* Serial Server Systems */

Stub here to act as a table of contents sorts to our important computers / servers / related information.
===Loggernet Systems===
* Lognet (listed lower on the page) - [https://docs.google.com/a/alaska.edu/spreadsheets/d/1CFV-2dh7pPBvACJbi8AFLTF7aF6Bf3JSwRjbcY5aBMY/edit?usp=sharing LoggerNet configuration] (Partial GIPL & IARC) 
* Monitor real time connections here:
** http://ngeedata.iarc.uaf.edu/data/data.html
* Super Site Debian Laptop
** exclusively handles Super-site Data loggers at Poker Flat Research Range on an MD485 wired network

===Serial Server Systems===
What is a [[Serial Server]]? 
[[Several Important Network Devices]] (Covers much of the same ground) 
* [https://docs.google.com/a/alaska.edu/document/d/1rRO1Ess8hwZkxBgZB5HRP-FZ8u2NcKENp2TvAYmtYTE/edit?usp=sharing Fairbanks IARC Base Station server (Ralph) Configuration] 

* [https://docs.google.com/a/alaska.edu/document/d/1cvtqjE0w6MpFALUuruchsc71XF1WgvOJFbtLxnAWBQo/edit?usp=sharing Barrow Base Station server (Trout) Configuration] 

* [https://docs.google.com/a/alaska.edu/document/d/108gA9FC5sTJvvMaQ039XtKBFk9DH31bilRKUuF3_hq4/edit?usp=sharing Barrow BARC bandwidth tester (Grayling)Configuration ] 
* [https://docs.google.com/a/alaska.edu/document/d/1Fmh8lsWiJdNqu79rQfaMm7dj6GnruNk2WSrbzFa3pBg/edit?usp=sharing Lab 113 (Salmon) Configuration]
* [[Ser2Net Config Reference]] (Hopefully this reflects all of them)

* '''Barrow Dreamplug''' -- Kind of decommissioned at this point.
** Related though is [https://docs.google.com/document/d/1YK5Bt3QrWyU5LtWgWrdJ9skdwRxcxilH--8yFzSlQJ4/edit# Network Information on Barrow]
** It is old and still up in Barrow in the control shed. Still works but I sent the raspberry pis up to replace it. My plan is to replace it with a small server with a different computer architecture this winter. The reason for that over these small ARM processors is that I'm still trying to work around this weak telemetry problem. Thinking that if it is an x86 (well 64 bit but that style of CPU) that we can leave a copy of loggernet running up there so that when the network goes down as long as the unit is on we are still in business. I am working to put all of its configs in one location though. What was unique to it that hasn't been documented yet is that it used its second ethernet port as a DHCP server in support of a PTZ web cam. That required an additional package, special iptables rules, and some scripts in /usr/local/bin. On the to do list to get going at some point.
* [[Decommisioned Serial Server Config and notes]]

===Virtual Machines===
What is a [[Virtual Machine]]? 
====LogNet====
Primary LoggerNet server
* CentOS Linux virtual machine
* Located in IARC server room
* Function is ''main LoggerNet server'' for related projects.
* This computer pushes data to ngeedata after automated retrievals.
* [https://docs.google.com/a/alaska.edu/spreadsheets/d/1CFV-2dh7pPBvACJbi8AFLTF7aF6Bf3JSwRjbcY5aBMY/edit?usp=sharing LoggerNet configuration] (Partial GIPL & IARC)

====NGEEDATA====
Primary Data processing server & data sharing web server 
* Debian Linux virtual machine
* Located in IARC server room
* Function is ''main data processing server'' and ''web server'' for sharing data with 3rd parties
* Online repositories for processing scripts:
** Cron related: https://github.alaska.edu/rcbusey/processing_bash_scripts
** Bash Utilities: https://github.alaska.edu/rcbusey/bash_utilities
** Python Utilities: https://github.alaska.edu/rcbusey/python_utilities
** DataPro V3 & other python utilities from Ross: https://github.com/rwspicer/csv_utilities

===Other===
* [[High precision computer logger]]
* [[Airplane Computer 2016]]

===Other Important Information===
* [[Initial Debian Server Setup]] 
* [[Baud Rate Backgrounder]] - (I know...) 
* [[Automated System Work Flow]]
* [[IP Tables Firewall Example]]
* Disable Autoreboot in windows 10 update: http://www.tenforums.com/windows-updates-activation/17530-disable-automatic-reboot-updates.html

Computers

2016-01-29T00:00:00Z

137.229.92.136: /* Serial Server Systems */

Stub here to act as a table of contents sorts to our important computers / servers / related information.
===Loggernet Systems===
[https://docs.google.com/a/alaska.edu/spreadsheets/d/1CFV-2dh7pPBvACJbi8AFLTF7aF6Bf3JSwRjbcY5aBMY/edit?usp=sharing LoggerNet configuration] (Partial GIPL & IARC) 
* Monitor real time connections here:
** http://ngeedata.iarc.uaf.edu/data/data.html

===Serial Server Systems===
What is a [[Serial Server]]? 
[Several Important Network Devices] (Covers much of the same ground) 
* [https://docs.google.com/a/alaska.edu/document/d/1rRO1Ess8hwZkxBgZB5HRP-FZ8u2NcKENp2TvAYmtYTE/edit?usp=sharing Fairbanks IARC Base Station server (Ralph) Configuration] 

* [https://docs.google.com/a/alaska.edu/document/d/1cvtqjE0w6MpFALUuruchsc71XF1WgvOJFbtLxnAWBQo/edit?usp=sharing Barrow Base Station server (Trout) Configuration] 

* [https://docs.google.com/a/alaska.edu/document/d/108gA9FC5sTJvvMaQ039XtKBFk9DH31bilRKUuF3_hq4/edit?usp=sharing Barrow BARC bandwidth tester (Grayling)Configuration ] 
* Salmon
* [[Ser2Net Config Reference]] (Hopefully this reflects all of them)

Barrow Raspberry Pi 1 ''Lost in the mail *Sad Emoji*'' 
Barrow Raspberry Pi 2 ''Lost in the mail *Sad Emoji*'' 
Barrow Dreamplug -- Kind of decommissioned at this point. It is old and still up in Barrow in the control shed. Still works but I sent the raspberry pis up to replace it. My plan is to replace it with a small server with a different computer architecture this winter. The reason for that over these small ARM processors is that I'm still trying to work around this weak telemetry problem. Thinking that if it is an x86 (well 64 bit but that style of CPU) that we can leave a copy of loggernet running up there so that when the network goes down as long as the unit is on we are still in business.

===Virtual Machines===
What is a [[Virtual Machine]]? 
[[LogNet]] -- Primary LoggerNet server 
[[NGEEDATA]] -- Primary Data processing server & data sharing web server 

===Other===
[[High precision computer logger]]

===Other Important Information===
[[Initial Debian Server Setup]] 
[[Baud Rate Backgrounder]] - (I know...)

Ser2Net Config Reference

2016-01-28T23:59:33Z

137.229.92.136: /* Salmon */

===Trout===
<pre>7808:raw:25:/dev/ttyUSB0:115200 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL</pre>
===Ralph===
<pre>
# BNZ Radio
6786:raw:25:/root/devices/bnz_radio:57600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
# IARC radio
7808:raw:25:/root/devices/iarc_radio:57600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
# IARC CR10
7809:raw:25:/dev/ttyUSB2:9600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
</pre>
===Salmon===
<pre>7808:raw:60:/dev/ttyUSB0:115200 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
7809:raw:60:/dev/ttyUSB0:9600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL</pre>

Ser2Net Config Reference

2016-01-28T23:59:24Z

137.229.92.136: Created page with "===Trout=== <pre>7808:raw:25:/dev/ttyUSB0:115200 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL</pre> ===Ralph=== <pre> # BNZ Radio 6786:raw:25:/root/devices/bnz_radio:..."

===Trout===
<pre>7808:raw:25:/dev/ttyUSB0:115200 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL</pre>
===Ralph===
<pre>
# BNZ Radio
6786:raw:25:/root/devices/bnz_radio:57600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
# IARC radio
7808:raw:25:/root/devices/iarc_radio:57600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
# IARC CR10
7809:raw:25:/dev/ttyUSB2:9600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
</pre>
===Salmon===
<ore>7808:raw:60:/dev/ttyUSB0:115200 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
7809:raw:60:/dev/ttyUSB0:9600 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL</pre>

Computers

2016-01-28T23:49:54Z

137.229.92.136: /* Serial Server Systems */

Stub here to act as a table of contents sorts to our important computers / servers / related information.
===Loggernet Systems===
[https://docs.google.com/a/alaska.edu/spreadsheets/d/1CFV-2dh7pPBvACJbi8AFLTF7aF6Bf3JSwRjbcY5aBMY/edit?usp=sharing LoggerNet configuration] (Partial GIPL & IARC) 
* Monitor real time connections here:
** http://ngeedata.iarc.uaf.edu/data/data.html

===Serial Server Systems===
What is a [[Serial Server]]? 
[Several Important Network Devices] (Covers much of the same ground) 
* [https://docs.google.com/a/alaska.edu/document/d/1rRO1Ess8hwZkxBgZB5HRP-FZ8u2NcKENp2TvAYmtYTE/edit?usp=sharing Fairbanks IARC Base Station server (Ralph) Configuration] 

* [https://docs.google.com/a/alaska.edu/document/d/1cvtqjE0w6MpFALUuruchsc71XF1WgvOJFbtLxnAWBQo/edit?usp=sharing Barrow Base Station server (Trout) Configuration] 

* [https://docs.google.com/a/alaska.edu/document/d/108gA9FC5sTJvvMaQ039XtKBFk9DH31bilRKUuF3_hq4/edit?usp=sharing Barrow BARC bandwidth tester (Grayling)Configuration ] 
* [[Ser2Net Config Reference]] (Hopefully this reflects all of them)

Barrow Raspberry Pi 1 ''Lost in the mail *Sad Emoji*'' 
Barrow Raspberry Pi 2 ''Lost in the mail *Sad Emoji*'' 
Barrow Dreamplug -- Kind of decommissioned at this point. It is old and still up in Barrow in the control shed. Still works but I sent the raspberry pis up to replace it. My plan is to replace it with a small server with a different computer architecture this winter. The reason for that over these small ARM processors is that I'm still trying to work around this weak telemetry problem. Thinking that if it is an x86 (well 64 bit but that style of CPU) that we can leave a copy of loggernet running up there so that when the network goes down as long as the unit is on we are still in business.

===Virtual Machines===
What is a [[Virtual Machine]]? 
[[LogNet]] -- Primary LoggerNet server 
[[NGEEDATA]] -- Primary Data processing server & data sharing web server 

===Other===
[[High precision computer logger]]

===Other Important Information===
[[Initial Debian Server Setup]] 
[[Baud Rate Backgrounder]] - (I know...)

IP Tables Firewall Example

2016-01-28T20:38:29Z

137.229.92.136:

From here but then I expanded a bit for my needs (and dropped the block china part):
*https://mattwilcox.net/web-development/unexpected-ddos-blocking-china-with-ipset-and-iptables

I'm still learning how this all goes together however... and one thing. for some reason here, flushing the iptables rules rather than restarting the computer locks you out. It must be something I don't have quite right so watch out for that when configuring and testing. As far as I can tell though, this rule set is a good base and my intention is that it restricts access to just the UAF domain for the radio as well as ssh. 
What is set up to do:
* Allow http & https to UAF domain
* Allow ser2net port access to UAF domain
* Allow SSH access from anywhere
** I go back and forth on this. I think for serial servers that it's probably legit to assume that they will only be accessed from UAF and ssh access could be limited accordingly.

Dump the following into ''/etc/iptables.firewall.rules''

<pre>
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# from Jim:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT
-A INPUT -s 137.229.94.2 -d 244.0.0.1 -j ACCEPT
#-A INPUT -s 224.0.0.1 -p udp -m udp -j ACCEPT

# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allow HTTP and HTTPS connections from UAF (the normal ports for websites and SSL).
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 443 -j ACCEPT

# Allow Ser2net connections from UAF
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 7808 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 7808 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport 7808 -j ACCEPT

# I think this drops all others to 7808.
-A INPUT -s 0.0.0.0/0 -p tcp --dport 7808 -j DROP

# Allow Ser2net connections from UAF
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 0.0.0.0/0 -p tcp --dport 7809 -j DROP

-A INPUT -s 137.229.0.0/16 -p udp -m udp -j ACCEPT

# Allow SSH connections
# Access controlled through sshd configuration and jail2ban usage
# The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Log iptables denied calls (disabled once I saw what all was getting blocked)
##-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT
</pre>

Those are our rules. Then, need to tell the computer to run them at boot up:
<pre>sudo nano /etc/network/if-pre-up.d/firewall</pre>
Add the following to that file:
<pre>
#!/bin/sh
/sbin/iptables-restore < /etc/iptables.firewall.rules
</pre>

Next, make sure it is executable:
<pre>sudo chmod +x /etc/network/if-pre-up.d/firewall</pre>

Should be golden.

IP Tables Firewall Example

2016-01-28T20:35:49Z

137.229.92.136:

From here but then I expanded a bit for my needs (and dropped the block china part):
*https://mattwilcox.net/web-development/unexpected-ddos-blocking-china-with-ipset-and-iptables

I'm still learning how this all goes together however... and one thing. for some reason here, flushing the iptables rules rather than restarting the computer locks you out. It must be something I don't have quite right so watch out for that when configuring and testing. As far as I can tell though, this rule set is a good base and my intention is that it restricts access to just the UAF domain for the radio as well as ssh.

Dump the following into ''/etc/iptables.firewall.rules''

<pre>
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# from Jim:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT
-A INPUT -s 137.229.94.2 -d 244.0.0.1 -j ACCEPT
#-A INPUT -s 224.0.0.1 -p udp -m udp -j ACCEPT

# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

# Allow HTTP and HTTPS connections from UAF (the normal ports for websites and SSL).
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 443 -j ACCEPT

# Allow Ser2net connections from UAF
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 7808 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 7808 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport 7808 -j ACCEPT

# I think this drops all others to 7808.
-A INPUT -s 0.0.0.0/0 -p tcp --dport 7808 -j DROP

# Allow Ser2net connections from UAF
-A INPUT -s 137.229.0.0/16 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 199.165.0.0/16 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -p tcp -m tcp --dport 7809 -j ACCEPT
-A INPUT -s 0.0.0.0/0 -p tcp --dport 7809 -j DROP

-A INPUT -s 137.229.0.0/16 -p udp -m udp -j ACCEPT

# Allow SSH connections
# Access controlled through sshd configuration and jail2ban usage
# The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Log iptables denied calls (disabled once I saw what all was getting blocked)
##-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT
</pre>

Those are our rules. Then, need to tell the computer to run them at boot up:
<pre>sudo nano /etc/network/if-pre-up.d/firewall</pre>
Add the following to that file:
<pre>
#!/bin/sh
/sbin/iptables-restore < /etc/iptables.firewall.rules
</pre>

Next, make sure it is executable:
<pre>sudo chmod +x /etc/network/if-pre-up.d/firewall</pre>

Should be golden.

Initial Debian Server Setup

2016-01-28T20:29:04Z

137.229.92.136: /* Update Firewall: */

[[IARC Server List]]
==Step by step (roughly) procedure for getting a Debian-ARM server up and running for remote deployment as a serial radio base or a number of other things==
Been meaning to put this together for a while.
===Download media===
A lot of these ARM based systems have a microSD or SD card image that can be flashed from an online source. I like to use the most recent stable version of Debian if it's available and also the minimum size image so that less extra cruft is installed (don't need a window manager etc) 
This is my current favorite system to deploy: 
http://wiki.solid-run.com/doku.php?id=products:imx6:cubox-i 

The RaspberryPis work well, too but have less horsepower under the hood: 
https://www.raspberrypi.org/ 

We also have a few units (the DreamPlug and the GuruPlug) from GlobalScale but the power supplies have become flaky over time and I think the cubox-i is current favorite. 
https://www.globalscaletechnologies.com/ 

I guess in addition, also using intel based NUC which is slightly larger, maybe more powerful but the cpu instruction set is x86 rather than ARM. For Debian, that means nothing but it should also mean we can run loggernet for linux further afield. (this is on my later in the winter list).

===First step===
#Download the current image of the OS available online to your computer
## http://wiki.solid-run.com/doku.php?id=products:imx6:software:os:debian 
## https://www.raspberrypi.org/downloads/raspbian/ 
# Flash it to the appropriate media (microSD or SD card typically). Something like this:
## sudo dd if=~/Downloads/ignition.img of=/dev/rdisk2 bs=4096 ''' (cubox-i example)'''
## sudo dd if=2015-11-21-raspbian-jessie-lite.img of=/dev/rdisk2 bs=4096 '''(Raspberry Pi example)'''
# Look up online the default user / password to get into the system once it is up and running, too.
## A simple search for something like "''Raspberry pi default user name and password''" should get you close.
# Once you're up and running, log in as the default user and then let's do some set up in an interactive sudo session:
<pre> sudo -i</pre>

===For raspberry pi, change keyboard layout to US===
Default is UK English layout... before you change the passwords you should get a US layout keyboard. Here is a good resource 
https://wiki.debian.org/Keyboard 
<pre>dpkg-reconfigure keyboard-configuration</pre>
<pre> service keyboard-setup restart</pre>

=== Create user accounts===
(junk name here not what you might see on our systems)
<pre> adduser scientist</pre>

=== give the user extended permissions===
https://wiki.debian.org/sudo
<pre>adduser scientist sudo</pre>

===Tighten up remote ssh access===
Been having some issues with port scanning and automated log in attempts from all over the world. You can initially lock things down by disabling the default account from ssh login (after creating your first other user in the previous step). First up, edit the ssh server configuration. The file is found in ''/etc/ssh/sshd_config'':
<pre> editor /etc/ssh/sshd_config</pre>
Add these lines to that file (or verify that they are there / double check that you aren't duplicating and creating confusion for the daemon):
<pre>
## Disable root login:
PermitRootLogin no
##specify which users can log in over ssh:
AllowUsers scientist
</pre>
With that out of the way, restart the ssh server and you have taken a step towards better securing the system:
<pre>service ssh restart</pre>
===Update Firewall:===
Firewall is complicated. I'm not 100% I have this correct but it's quite a bit more secure than the defaults and such. It's worth its own entry though:
* [[IP Tables Firewall Example]]

===update apt & all packages===
<pre>
apt-get update
apt-get upgrade
</pre>

===Raspberry Pi specific: Resize Partition===
Run this utility as root:
<pre>raspi-config</pre>
One of the options (the first one) is:
<pre>1 Expand Filesystem Ensures that all of the SD card storage is available to the OS </pre>
Select that and the file system will go from the default, like 1.3 GB and expand to consume the whole card. See here for a bit more discussion: 
http://raspberrypi.stackexchange.com/questions/499/how-can-i-resize-my-root-partition

===Install additional packages===
Great, if you've made it this far then you should have a decently secure system, nearly ready for deployment. There are a few more pacakges it is smart to install... kind of depends on what you are doing whether you add all of them or not but there first are a good move.

<pre> apt-get install nmap ntp less imagemagick python mailutils fail2ban ser2net git telnet screen</pre>
* '''nmap''' is useful for checking out the internet presence of your device. Kind of optional but nice to have installed if you need it at a later date.
** https://packages.debian.org/stable/nmap
* '''ntp''' is the time server, used to get internet time. It should be installed by default but I have found it isn't alway. So, best to be explicit and install it here.
** https://packages.debian.org/jessie/ntp
* '''less''' is a simple command line utility for reading text files. A gain, it should be installed by default but I have run into it not being installed.
** https://packages.debian.org/jessie/less
* '''imagemagick''' is a great command line based image manipulation library. Used by a few different utilities. I think we use it to resize / slice automatically generated plots, and to do some other stuff in Barrow.
** https://packages.debian.org/jessie/imagemagick
* '''python''' common programming language we use extensively and should be added to the system.
* '''mailutils''' is a simple email package. Used by crontab & the security updates system (as well as others I'm forgetting) to give you status information.
* '''fail2ban''' is used to lockdown ssh a bit further than the default ip tables rules. It blocks IP addresses that try to log in too often with a bad user/password. Intended to reduce workload of these simple computers handling garbage so they can focus on serving as a serial base station etc.
* '''ser2net''' pretty solid utility for getting serial port access (or usb to serial access) via sockets. This is the primary thing we use to handle getting data logger information available over the internet. For multipoint radios, there is also a '''ser2nets''' which can allow more than one LoggerNet instance to access the radio network simultaneously. I haven't used ser2nets but have thought about experimenting with it.
* '''git''' we use this for distributing datapro and other utilities
* ''telnet'' useful for testing ser2net's operation.
* ''screen'' useful for testing the usb to serial device

====Automatically install security updates:====
The last generally mandatory package to add is the Unattended security updates. There are couple packages to install but there are also some configs to modify It's best to just read this page. 
https://wiki.debian.org/UnattendedUpgrades 
But, I can also give you a hint that you'll need to do at least these three things from the command line:
<pre>apt-get install unattended-upgrades apt-listchanges</pre>
<pre>editor /etc/apt/apt.conf.d/50unattended-upgrades</pre>
<pre>editor /etc/apt/apt.conf.d/20auto-upgrades</pre>

===Other packages===
So, those are typically the base to get you up and running. Then, this next set are slightly more specialized. If you are going to do any data processing or use the WERC data retrieval tools these are good to install:
<pre> apt-get install build-essential libdbi-perl libconfig-yaml-perl python-numpy python-tz </pre>

===check timezone===
Important to confirm we are using UTC:
<pre>sudo dpkg-reconfigure tzdata </pre>

===Next steps===
So, at this point you have a system that has now been tailored to generic deployment. With that out of the way there are some specific things and tools / scripts that are nice to give you a bit more feedback. For example. it needs to tell you its IP address routinely so there are some things to set up in order to make that happen like:
* set up a private key in the ''scientist'' user account so you can automate the transfer
** follow this: http://troy.jdmz.net/rsync/index.html
** '''ssh-keygen -t rsa -b 2048 '''
** then, add the key to the server you want to push too:
*** '''ssh-copy-id scientist@ngeedata.iarc.uaf.edu'''
* set up the crontab so that the automated stuff is configured to happen... do all of this from your user account rather than your root account.
<pre>
mkdir ~/bin
nano ~/bin/main_cron
</pre>
* add something like this to the file main_cron to transmit the IP address every 10 minutes:
<pre>
*/10 * * * * /sbin/ifconfig > /home/scientist/grayling_ip.txt
*/10 * * * * scp -oport=2222 /home/scientist/grayling_ip.txt user@ngeedata.iarc.uaf.edu:/home/user/remote_ips/
</pre>
* add this to the crontab:
<pre> crontab ~/bin/main_cron</pre>
* confirm that it is in the crontab:
<pre> crontab -l</pre>
Great,
* set up a few more bash scripts... running out of steam here I'm just going to list commands for a bit and then annotate later.
* this gets Ross' csv utilities with datapro plus a number of other things installed
<pre>
cd ~/bin/
git clone https://github.com/rwspicer/csv_utilities.git
python ~/bin/csv_utilities/get_ip.py --infile=/home/scientist/extra/grayling_ip.txt --outfile=/home/scientist/grayling_ip
</pre>

* also need to configure ser2net:
<pre>sudo nano /etc/ser2net.conf</pre>
* remove the existing lines at the bottom of the configuration and add this:
** specifying the port as ''7808''
** data type is '''''raw''''' ''(default is telnet)''
** serial to usb device is ''/dev/ttyUSB0''
** speed and data information (this is standard of most of our serial things though the baud rate may change depending on application): ''115200 8DATABITS NONE 1STOPBIT''
** a few additional parameters to close the connection and reset the radio after each use: '' HANGUP_WHEN_DONE RTSCTS LOCAL''
<pre>
# IARC radio
7808:raw:25:/dev/ttyUSB0:115200 8DATABITS NONE 1STOPBIT HANGUP_WHEN_DONE RTSCTS LOCAL
</pre>
* now, reload ser2net daemon with new configuration:
<pre>service ser2net restart</pre>
* next, test your setup:
<pre> telnet localhost 7808</pre>
** then hit enter a bunch and watch for a reply from the data logger. If you see it, awesome. to close the program, hold down the control key and press the close bracket key. This will bring up a new prompt:
<pre><CONTROL><]></pre>
** then:
<pre>close</pre>
* if that works, fantastic. If that doesn't, try connecting directly to the serial port using ''screen'':
<pre>sudo screen /dev/ttyUSB0 9600</pre>
** If that works, awesome! To quit screen then enter:
<pre>
<CONTROL> - <A> (press and hold control, then press A)
<COLON>
<TYPE> quit </TYPE>
</pre>
* if that works, then you have a good serial connection and may just need to tweak the ser2net configuration.
** I just noticed here that <pre>service ser2net restart</pre> didn't properly reload the configuration file. However this did:
<pre>service ser2net stop
service ser2net start</pre>

===Yet to come===
So, at this point you have a solid serial server. There is often more functionality you can add though depending on how things go. For instance, the speed test bash script may need to be installed, there might be webcam