{"id":669,"date":"2017-01-05T05:22:59","date_gmt":"2017-01-04T22:22:59","guid":{"rendered":"http:\/\/blog.trichev.com\/?p=669"},"modified":"2017-08-10T09:10:35","modified_gmt":"2017-08-10T02:10:35","slug":"rancid-linux-centos-7-installation-for-juniperciscoarista-devices","status":"publish","type":"post","link":"https:\/\/trichev.com\/blog\/2017\/01\/05\/rancid-linux-centos-7-installation-for-juniperciscoarista-devices\/","title":{"rendered":"Rancid linux CentOS 7 installation for Juniper\/Cisco\/Arista devices"},"content":{"rendered":"

Installation<\/strong><\/p>\n

yum install nano wget ftp telnet perl tcl expect gcc cvs rcs httpd autoconf openssh-clients postfix -y<\/p>\n

groupadd netadm
\nuseradd -g netadm -c “Networking Backups” -d \/usr\/local\/rancid rancid
\nmkdir \/usr\/local\/rancid\/pkg
\ncd \/usr\/local\/rancid\/pkg
\nwget ftp:\/\/ftp.shrubbery.net\/pub\/rancid\/rancid-3.4.1.tar.gz
\ntar zxvf rancid-3.4.1.tar.gz
\ncd rancid-3.4.1
\n.\/configure –prefix=\/usr\/local\/rancid\/
\nmake install<\/p>\n

Configuration<\/strong><\/p>\n

cp \/usr\/local\/rancid\/pkg\/rancid-3.4.1\/cloginrc.sample \/usr\/local\/rancid\/.cloginrc
\nchmod 0600 \/usr\/local\/rancid\/.cloginrc
\nchown -R rancid:netadm \/usr\/local\/rancid\/
\nchmod 775 \/usr\/local\/rancid\/
\ncp \/usr\/local\/rancid\/pkg\/rancid-3.4.1\/README \/usr\/local\/rancid<\/p>\n

SSH key\/keys generation<\/strong><\/p>\n

su – rancid
\nssh-keygen -t ecdsa (for Juniper)
\nssh-keygen -t rsa -b 4096 (for Cisco\/Arista devices)
\nssh-keygen -f .ssh\/id_rsa.pub -l (Show fingerprint of specified public key file)<\/p>\n

clogin configuration<\/strong><\/p>\n

vi \/usr\/local\/rancid\/.cloginrc
\n#add method * ssh
\n#add user * rancid
\n#add password * RancidPW EnablePW
\nadd password * blah<\/p>\n

#Juniper
\nadd user juniper-device-01 rancid
\nadd method juniper-device-01 {ssh}
\nadd identity juniper-device-01 $env(HOME)\/.ssh\/id_ecdsa<\/p>\n

#Cisco\/Arista
\nadd user ciscoarista-device-02 rancid
\nadd method ciscoarista-device-02 {ssh}
\nadd identity ciscoarista-device-02 $env(HOME)\/.ssh\/id_rsa
\nadd autoenable ciscoarista-device-02 1<\/code><\/p>\n

Rancid configuration<\/strong><\/p>\n

vi \/usr\/local\/rancid\/etc\/rancid.conf
\nLIST_OF_GROUPS=”LOC1 LOC2″
\nFILTER_PWDS=NO; export FILTER_PWDS
\nNOCOMMSTR=NO; export NOCOMMSTR<\/p>\n

Once happy with your groups, you need to run rancid-cvs to create the directories\/files required as the rancid user
\nsu – rancid
\n\/usr\/local\/rancid\/bin\/rancid-cvs<\/p>\n

router.db config<\/strong>
\ncat “juniper-device-01;juniper;up” >> \/usr\/local\/rancid\/var\/LOC1\/router.db
\ncat “ciscoarista-device-02;arista;up” >> \/usr\/local\/rancid\/var\/LOC1\/router.db or cat “ciscoarista-device-02;cisco;up” >> \/usr\/local\/rancid\/var\/LOC1\/router.db<\/p>\n

vi \/etc\/aliases:
\nrancid-LOC1: mail1@mail.com
\nrancid-admin-LOC1: mail1@mail.com
\nrancid-LOC2: mail1@mail.com
\nrancid-admin-LOC2: mail1@mail.com<\/code><\/p>\n

newaliases<\/p>\n

SMTP postfix relay configuration<\/strong><\/p>\n

vi \/etc\/postfix\/main.cf
\ninet_interfaces = 192.168.0.100
\nalias_maps = hash:\/etc\/aliases
\nalias_database = hash:\/etc\/aliases
\nrelayhost = 192.168.0.111
\nsmtp_fallback_relay = 192.168.0.112
\nmydomain = subdomain.domain.com
\nmyorigin = monhost.subdomain.domain.com
\nmydestinations = monhost.subdomain.domain.com
\nlocal_transport = error:local mail delivery is disabled<\/code><\/p>\n

systemctl restart postfix
\nsystemctl status postfix<\/p>\n

Juniper device configuration<\/strong>
\n set system login class RANCID permissions access
\n set system login class RANCID permissions admin
\n set system login class RANCID permissions firewall
\n set system login class RANCID permissions flow-tap
\n set system login class RANCID permissions interface
\n set system login class RANCID permissions network
\n set system login class RANCID permissions routing
\n set system login class RANCID permissions secret
\n set system login class RANCID permissions security
\n set system login class RANCID permissions snmp
\n set system login class RANCID permissions storage
\n set system login class RANCID permissions system
\n set system login class RANCID permissions trace
\n set system login class RANCID permissions view
\n set system login class RANCID permissions view-configuration
\n set system login user rancid full-name RANCID
\n set system login user rancid uid 2020
\n set system login user rancid class RANCID
\n set system login user rancid authentication ssh-ecdsa \"ecdsa-sha2-nistp256 loooooooooooooooong-hash LOC1MGMTRANCID\"<\/code><\/p>\n

Cisco device configuration<\/strong>
\n#You could find ssh rsa key fingerprint by ssh-keygen -f .ssh\/id_rsa.pub -l <\/code>command
\n username rancid privilege 15
\n ip ssh pubkey-chain
\n username rancid
\n key-hash ssh-rsa ssh-rsa-fingerprint-without-colons<\/code><\/p>\n

Arista device configuration<\/strong>
\n aaa authorization exec default local none
\n username rancid privilege 15 secret secret-password
\n username rancid sshkey ssh-rsa ssh-rsa-key-public-part-from-id_rsa.pub rancid@monhost<\/code><\/p>\n

Check if ssh password less configuration works fine<\/strong>
\n#juniper
\n\/usr\/local\/rancid\/bin\/jlogin -c “show version” juniper-device-01
\n#arista\/cisco
\n\/usr\/local\/rancid\/bin\/jlogin -c “show configuration” ciscoarista-device-02<\/p>\n

Rancid manual start<\/strong>
\n\/usr\/local\/rancid\/bin\/rancid-run<\/p>\n

CRON setup<\/strong>
\ncrontab -u rancid -e<\/p>\n

1 * * * * \/usr\/local\/rancid\/bin\/rancid-run<\/p>\n

# Daily Clean Up of Diff Files at 11 50 pm
\n50 23 * * * \/usr\/bin\/find \/usr\/local\/rancid\/var\/logs -type f -mtime +2 -exec rm {} \\;<\/p>\n

# Daily Clean Up of .SITE.run.lock Files at 11 50 pm
\n50 23 * * * rm \/tmp\/.*.lock<\/code><\/p>\n

ViewVC installation<\/strong><\/p>\n

I suggest if RANCID has been provisioned as a VM, snapshot at this point in case you make a any mistakes configuring View VC.<\/p>\n

cd \/usr\/local\/rancid\/pkg
\nwget http:\/\/viewvc.tigris.org\/files\/documents\/3330\/49392\/viewvc-1.1.23.tar.gz
\ntar -zxvf viewvc-1.1.23.tar.gz
\ncd viewvc-1.1.23
\n.\/viewvc-install ## we set the installation path as \/usr\/local\/viewvc<\/p>\n

Consult the INSTALL document for detailed information on completing the installation and configuration of ViewVC on your system. Here\u2019s a brief overview of the remaining steps:<\/p>\n

1) Edit the \/usr\/local\/viewvc\/viewvc.conf file.<\/p>\n

2)Copy \/usr\/local\/viewvc\/bin\/cgi\/viewvc.cgi to an already-configured cgi-bin directory.<\/p>\n

vi \/usr\/local\/viewvc\/viewvc.conf<\/p>\n

root_parents = \/usr\/local\/rancid\/var\/CVS : cvs
\nrcs_dir = \/usr\/bin\/
\n#use_enscript = 1
\n#enscript_path = \/usr\/bin\/
\n#use_highlight = 1
\n#highlight_path = \/usr\/bin<\/code><\/p>\n

cp \/usr\/local\/viewvc\/bin\/cgi\/*.cgi \/var\/www\/cgi-bin\/<\/p>\n

chown apache:apache \/var\/www\/cgi-bin\/query.cgi
\nchown apache:apache \/var\/www\/cgi-bin\/viewvc.cgi<\/p>\n

vi \/etc\/httpd\/conf\/httpd.conf
\nScriptAlias \/rancid \"\/var\/www\/cgi-bin\/viewvc.cgi\"
\nScriptAlias \/query \"\/var\/www\/cgi-bin\/query.cgi\"<\/p>\n

<Location \/viewvc>
\nAuthType basic
\nAuthName "Client Access"
\nAuthUserFile \/usr\/local\/viewvc\/passwd
\nRequire valid-user
\n<\/Location><\/code><\/p>\n

htpasswd -c \/usr\/local\/viewvc\/passwd admin<\/p>\n

systemctl restart httpd<\/p>\n

Links:
\nhttps:\/\/www.cryptomonkeys.com\/2013\/09\/rancid-junos\/<\/a>
\nhttps:\/\/www.ip-life.net\/rancid-setup-on-ubuntu-10-04-lts\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Installation yum install nano wget ftp telnet perl tcl expect gcc cvs rcs httpd autoconf openssh-clients postfix -y groupadd netadm useradd -g netadm -c “Networking Backups” -d \/usr\/local\/rancid rancid mkdir \/usr\/local\/rancid\/pkg cd \/usr\/local\/rancid\/pkg wget ftp:\/\/ftp.shrubbery.net\/pub\/rancid\/rancid-3.4.1.tar.gz tar zxvf rancid-3.4.1.tar.gz cd rancid-3.4.1 .\/configure –prefix=\/usr\/local\/rancid\/ make install Configuration cp \/usr\/local\/rancid\/pkg\/rancid-3.4.1\/cloginrc.sample \/usr\/local\/rancid\/.cloginrc chmod 0600 \/usr\/local\/rancid\/.cloginrc chown -R rancid:netadm \/usr\/local\/rancid\/ […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[231],"tags":[212,32,213,28,14,11],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/669"}],"collection":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/comments?post=669"}],"version-history":[{"count":12,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/669\/revisions"}],"predecessor-version":[{"id":681,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/669\/revisions\/681"}],"wp:attachment":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/media?parent=669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/categories?post=669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/tags?post=669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}