# $Header: /global/src/etc/cl-manage-scripts/debs/RCS/R-tss,v 1.13 2026/08/26 18:59:09 mas90 Exp $

# Taken from the RPM repository groups file

# #       <!-- #2 General build host -->
# <packagereq type="default">rpm-build</packagereq>
# <packagereq type="default">createrepo</packagereq>
# <!-- #1 Needed for OTPW generation -->
# <packagereq type="default">CL-otpw</packagereq>
# <!-- #2 Generally useful -->
# <packagereq type="default">opera</packagereq>
# <packagereq type="default">vnc</packagereq>
# <!-- #2 allow DB access -->
# <packagereq type="default">perl-DBI</packagereq>
# <packagereq type="default">perl-DBD-Sybase</packagereq>
# <!-- #1 rs456 requested svn 2007/05/01 -->
# <!-- dual arch <packagereq type="default">subversion</packagereq> -->
# <!-- #1 rs456 2007/05/14 -->
# <packagereq type="default">cvs</packagereq>
# <!-- #1 amp12 wants (require 'tex-site) -->
# <packagereq type="default">emacs-auctex</packagereq>
# <!-- #4 mj201 wants acroread gv xfig xv -->
# <packagereq type="default">AdobeReader_enu</packagereq>
# <packagereq type="default">gv</packagereq>
# <packagereq type="default">xfig</packagereq>
# <packagereq type="default">xv</packagereq>
# <!-- #2 rs456 requested svn 2007/05/01, cvs 2007/05/14, c++ (for vondor) 2007/05/31 -->
# <packagereq type="default">subversion.x86_64</packagereq>
# <packagereq type="default">gcc-c++</packagereq>
# <!-- #1 rs416 as sphere is too old a version - temp? -->
# <packagereq type="default">inkscape</packagereq>
# <!-- #1 srk31 requested X library for private nedit rt#28807 -->
# <packagereq type="default">nedit</packagereq>
# <!-- #1 srk31 requested mercurial on slogin-serv* rt#34111 -->
# <packagereq type="default">mercurial</packagereq>
# <!-- #2 mgk25 requested irssi+screen on slogin-serv* rt#48280 -->
# <packagereq type="default">irssi</packagereq>
# <packagereq type="default">screen</packagereq>
# <!-- #1 mb566 requested git on slogin-serv rt#61330 -->
# <packagereq type="default">git</packagereq>
# <!-- #2 mas90 requested bzr on slogin-serv rt#71766 -->
bzr

# RT#91958
svn

NOT_desktop-base
NOT_emacs
NOT_krb5-auth-dialog
NOT_menu
NOT_orage
NOT_perl-doc
NOT_smartmontools
NOT_thunar-archive-plugin
NOT_thunar-media-tags-plugin
NOT_thunar-volman
NOT_xemacs21
NOT_xfce4
NOT_xfce4-mixer
NOT_xfce4-terminal
NOT_xfprint4
NOT_xfwm4-themes
NOT_xlockmore
NOT_xprintidle
NOT_xubuntu-default-settings

# ----------------------------------------------
# Package bundles expected on an slogin type box
# ----------------------------------------------
@R-texlive
@R-emacs
@R-CL-basics

# No longer support condor
#NOCONDOR @R-condor
NOT_condor
#NOCONDOR RUN cl-asuser ufw allow proto tcp from 128.232.0.0/17  to any port 9600:9700
#NOCONDOR RUN cl-asuser ufw allow proto udp from 128.232.0.0/17  to any port 9600:9700

# ------------
# From ramsey:
# ------------
#? wol

# rt#52205
alpine
git

# Additions
#CentOS perl-LWP-UserAgent-Determined -> liblwp-useragent-determined-perl
liblwp-useragent-determined-perl
#CentOS loaded by default?  perl-Compress-Zlib.x86_64 --> libio-compress-perl ?

# rt#64349
w3m
#CentOS perl-JSON -> libjson-perl
libjson-perl

#CentOS  perl-Text-CSV -> libtext-csv-perl
libtext-csv-perl
#CentOS perl-Net-DNS -> libnet-dns-perl
libnet-dns-perl

# rt#75875
irssi

# rt#63286 / rt#77319 #CentOS jdk -> default-jre
default-jre

# Needed to keep things happy?
git-svn

python-software-properties
#NOT?RUN sudo add-apt-repository ppa:texlive-backports/ppa
# rt#79645 Force in with "--nodeps" (rf says that's OK)
latex2html
tgif

# -----------------
# From ssh-remote-0
# -----------------
CL-isidle-90-server.conf
NOT_CL-cron-isidle-halt
#CentOS OpenIPMI ->
#CentOS OpenIPMI-tools ->
ipmitool
CL-runas
clusterssh

# rt#80740
a2ps

# http://www.wiki.cl.cam.ac.uk/clwiki/SysInfo/Debian#packagehacks
#RUN  test -e /usr/lib/x86_64-linux-gnu/libtiff.so.3 || find /usr/lib -name libtiff.so.[456] -execdir sudo ln -sv {} libtiff.so.3 \; -ls
xv
libjpeg62

# Extras added on svr-ssh-remote-3
rcs

# Support kerberos access to aliases - Requires tweak to sshd-config
#RUN (LANG=C; b=/etc/krb5.keytab; s=-sum; sudo rm -f $b$s; (for f in $b-[A-Z]*; do echo rkt $f; done; echo wkt $b$s) | sudo ktutil; diff <(sudo klist -k $b|sort) <(sudo klist -k $b$s|sed "s=$b$s=$b=" | sort) || echo "# mv $b$s $b")

# Restrict service (rather than server) address
#RUN ipv4=$(host -t    A $(hostname | sed 's/svr-//') | sed -n 's/.* address //p')
#RUN ipv6=$(host -t AAAA $(hostname | sed 's/svr-//') | sed -n 's/.* address //p')
#RUN for h in $(host -t ptr nagios-serv|sed -n 's/.* name pointer //'p|while read a;do host -t A    $a;done|sed -n 's/.* has address //'p); do echo cl-asuser ufw insert 1 allow from $h to $ipv4 app OpenSSH; done
#RUN for h in $(host -t ptr nagios-serv|sed -n 's/.* name pointer //'p|while read a;do host -t AAAA $a;done|sed -n 's/.*IPv6 address //'p); do echo cl-asuser ufw insert 1 allow from $h to $ipv6 app OpenSSH; done
#RUN cl-asuser ufw allow from any                                      to $ipv4 app OpenSSH
#RUN cl-asuser ufw allow from 2001:0630:0212:0267:0216:3eff:fee8:0a35  to $ipv6 app OpenSSH
#RUN cl-asuser ufw allow from 2001:0630:0212:0267:0216:3eff:fee8:09fe  to $ipv6 app OpenSSH
#RUN cl-asuser ufw allow from 2001:630:212:200::/56                    to $ipv6 app OpenSSH
#RUN cl-asuser ufw allow from any                                      to $ipv6 app OpenSSH

# Restrict SSH to the server (rather than service) address from within the Lab only.
#RUN ipv4=$(host -t    A $(hostname                 ) | sed -n 's/.* address //p')
#RUN ipv6=$(host -t AAAA $(hostname                 ) | sed -n 's/.* address //p')
#RUN cl-asuser ufw allow from 128.232.9.254                            to $ipv4 app OpenSSH
#RUN cl-asuser ufw allow from 128.232.10.53                            to $ipv4 app OpenSSH
#RUN cl-asuser ufw allow from 128.232.0.0/17                           to $ipv4 app OpenSSH
#RUN cl-asuser ufw deny  from any                                      to $ipv4 app OpenSSH
#RUN cl-asuser ufw allow from 2001:0630:0212:0267:0216:3eff:fee8:0a35  to $ipv6 app OpenSSH
#RUN cl-asuser ufw allow from 2001:0630:0212:0267:0216:3eff:fee8:09fe  to $ipv6 app OpenSSH
#RUN cl-asuser ufw allow from 2001:630:212:200::/56                    to $ipv6 app OpenSSH
#RUN cl-asuser ufw deny  from any                                      to $ipv6 app OpenSSH

CL-boot-mc

# rt#85465 rt#123939
#texlive-math-extra
texlive-science

CL-amttool
libsoap-lite-perl
@R-amtsol

CL-anacron-krenew-all

#NOT?RUN sudo add-apt-repository ppa:texlive-backports/ppa
@R-CL-extras

rpm

# rt#87385 want htpasswd
apache2-utils

#NOT-USED https://launchpad.net/~w-rouesnel/+archive/openssh-hpn
#NOT-USED sudo add-apt-repository ppa:w-rouesnel/openssh-hpn 

nmh
exmh

libjansson4
cups-bsd
openxenmanager

# RT#89320
libc6-dev-i386

NOT_avahi-utils

ttf-mscorefonts-installer

# am21 wantd dc and xcalc RT#90123
dc
x11-apps
# from ssh-remote-3

#RUN cl-asuser ufw allow proto udp from 128.232.0.0/17        to any port 123
#RUN cl-asuser ufw allow proto udp from 2001:630:212:200::/56 to any port 123
#metamail

#RUN apt-key list | grep Kspl > /dev/null || sudo wget -O- -N https://www.ksplice.com/apt/ksplice-archive.asc | sudo apt-key add - # Harmlessish
# uptrack-manager
ksplice

# Local ...
# Ensure that user ssh keys are cached so non krb5 clients can login
#RUN  f=/etc/cron.d/cl-update-ssh-authorized_keys; test -e $f || sudo cp -v --preserve=timestamps /global/src$f $f # PKG
wsmancli

#RUN f=/etc/update-motd.d/99-footer; test ! -e $f && (echo '#!/bin/sh'; echo '[ -f /etc/motd.tail ] && cat /etc/motd.tail || true' ) | sudo tee -a $f && sudo chmod a+x $f

##OLD # In /etc/default/docker.io, set: DOCKER_OPTS="--bip=192.168.8.0/24"
##OLD docker.io
# https://docs.docker.com/installation/ubuntulinux/
#RUN-docker sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9
#RUN-docker echo deb https://get.docker.com/ubuntu docker main  | sudo tee /etc/apt/sources.list.d/docker.list
#docker lxc-docker

# RT#91846 for oc243 - pb 2014/07
# Dropped from Ubuntu 24.04
#monkeysphere

ispell

# RT#9183 avoid evince
okular

# Setup system to monitor as host go up and doen (using nmap)
nmap
#RUN-nmap  test -e /usr/bin/ping-log > /dev/null || sudo cp -pv --no-preserve=owner ~pb22/pl/ping-log.pl /usr/bin/ping-log # PKG
#RUN-nmap  test -e /var/log/HOSTS || (scp sandy:/var/log/HOSTS /tmp/; sudo mv -v /tmp/HOSTS /var/log/)
#RUN-nmap  test -e /etc/cron.hourly/cl-nmap || sudo cp -pv --no-preserve=owner /global/src/etc/cron/cl-nmap /etc/cron.hourly/ # PKG
#RUN-nmap  test -e /usr/bin/cl-lockfile || sudo cp -pv --no-preserve=owner /global/src/usr.bin/src/lockfile /usr/bin/cl-lockfile # PKG

#RUN  apt-key list | grep 0A53F9FD > /dev/null || sudo add-apt-repository ppa:x2go/stable
x2goserver
x2goserver-xsession

# Support for TGT server - allow remote user requests (identd), user checks
# (cl-tgt,dot) and management of pseudo ysers without a shell.
# Also patch ldap.conf to allow pseudousers - pb22 - 2014/07
oidentd
CL-tgt.dot
CL-shell-rsync-to-tmp
CL-check-tgt-fresh
# add "cl-tgt boot" to /etc/rc.local or otherwise arrange to pre-load
# set TMPTIME=1 in /etc/default/rcS

# Allow CMS managers to tweak things
#RUN  test -e /etc/sudoers.d/cl-rt94846-mgk25-sudo-wwwupdate || sudo cp -pv --no-preserve=owner /global/src/etc/sudoers.d/cl-rt*www* /etc/sudoers.d/ # PKG

# Get /global/src/usr.bin/otpw/otpw-1.5 to compile
# Logical libpam-dev
libpam0g-dev
#RUN-otpw  grep otpw /etc/passwd > /dev/null || sudo useradd -r otpw -d /var/spool/otpw -m 
#RUN-otpw  test -e /usr/bin/cl-otpw-gen || (sudo cp -pv --no-preserve=owner otpw-gen /usr/bin/cl-otpw-gen; sudo chown -c otpw /usr/bin/cl-otpw-gen; sudo chmod -c +s /usr/bin/cl-otpw-gen) # PKG
#RUN-otpw  test -e /lib/x86_64-linux-gnu/security/pam_otpw.so || sudo cp -pv --no-preserve=owner pam_otpw.so /lib/x86_64-linux-gnu/security/ # PKG
#RUN-otpw  test ! -e /usr/share/pam-configs/cl-otpw && sudo cp -pv --no-preserve=owner /global/src/etc/pam.d/ubuntu/cl-otpw /usr/share/pam-configs/ && sudo pam-auth-update --package # PKG
#RUN-otpw  test -e /usr/bin/cl-pam_ssh_exec || (sudo cp -pv --no-preserve=owner /global/src/usr.bin/src/cl-pam_ssh_exec.pl /usr/bin/cl-pam_ssh_exec; sudo chmod -c a+x /usr/bin/cl-pam_ssh_exec) # PKG

#RUN-otpw  grep P-sshd_config-otpw /etc/user-config/patches > /dev/null || echo P-sshd_config-otpw >> /etc/user-config/patches
#RUN-otpw  grep P-pam.d-sshd-otpw  /etc/user-config/patches > /dev/null || echo P-pam.d-sshd-otpw  >> /etc/user-config/patches

# ksplice - https://wiki.ubuntu.com/Ksplice
# Uncomment lines in /etc/apt/sources.list.d//ksplice.list
#	deb http://www.ksplice.com/apt trusty ksplice
#	deb-src http://www.ksplice.com/apt trusty ksplice

#RUN-uptrack  apt-key list | grep B6D4038E > /dev/null || wget -qO- https://www.ksplice.com/apt/ksplice-archive.asc|sudo apt-key add -
#?? uptrack
#?? uptrack-manager
# Patch /etc/uptrack/uptrack.conf to have autoinstall = yes
#RUN-uptrack  type uptrack-upgrade > /dev/null 2>&1 && sudo uptrack-upgrade -y

# RT#92488 epstopdf
texlive-font-utils
ibritish

# Database and LDAP access from Perl
libclass-dbi-perl
libdbix-class-perl
libdbd-sybase-perl
libnet-ldap-perl

#RUN  f=/etc/logrotate.d/cl-pam_ssh; test -e $f || (sudo cp --no-preserve=owner -pv /global/src/etc/logrotate.d/cl-pam_ssh $f; sudo chown -c root.root $f) # PKG
#RUN  f=/usr/bin/cl-pam_ssh_exe; test -e $f || (sudo cp -pv --no-preserve=owner /global/src/usr.bin/src/cl-pam_ssh_exec.pl $f; sudo chown -c root.root $f) # PKG
#RUN  f=/etc/pam.d/sshd; grep cl-pam_ssh $f > /dev/null || echo session optional pam_exec.so seteuid log=/var/log/cl-pam_ssh /usr/bin/cl-pam_ssh_exec | sudo tee -a $f


# RT#93696
texlive-pstricks
# The following extra packages will be installed: texlive-extra-utils texlive-generic-recommended texlive-pstricks-doc
# Suggested packages: chktex fragmaster xindy latexdiff lacheck latexmk dvidvi purifyeps dvipng
# The following NEW packages will be installed: texlive-extra-utils texlive-generic-recommended texlive-pstricks texlive-pstricks-doc

NOT_qemu-kvm
libnss-ldap
autofs-ldap

# vagrant
# lxc
automake
# this clashes with gnuplot-x11 ... gnuplot-nox
debconf-utils

# RT#94705 - reduce noise in /etc/motd
#RUN ! debconf-get-selections | grep 'debconf-set-selections' && echo landscape-common landscape-common/sysinfo select Do not display sysinfo on login | sudo debconf-set-selections && sudo dpkg-reconfigure landscape-common

# RT#91958 - cd200 wants to use R - pb22 2015/03
r-base-core


# See /etc/user-config/bundles /usr/share/ufw/iptables/user.rules /etc/ssh/sshd[23]_config/etc/ssh/sshd2_config{,.banner} /etc/init/ssh[23].conf 'ufw allow 22[23]'
# Allow ssh to differefnt IP addresses to provide different services, by tweaking the called port, amd listening on different ports. Firewall sees the post-tweaked port
# Need to:
# 1) tweak the port from 22 to 22X (live and in startup scripts)
# 2) tweak ufw to allow the traffic
# 3) create a new service sshdX: /usr/sbin/ has the binary; /etc/pam.d/ has the rules; /etc/init need a copy with '-f /etc/ssh/sshdX_config; /etc.init.d should have a copy; create /etc/ssh/sshdX_config.banner and make sshd_config use it
#RUN for n in 4 5 6; do p=$((n-2)); cl-asuser iptables -t nat -A PREROUTING -p tcp --dport 22 --dst 128.232.0.7$n -j DNAT --to 128.232.0.7$n:22$p; cl-asuser ufw allow proto tcp to 128.232.0.7$n port 22$p; test -e /usr/sbin/sshd$p || sudo ln -v /usr/sbin/sshd /usr/sbin/sshd$p; test -e /etc/pam.d/sshd$p || sudo ln -v /etc/pam.d/sshd /etc/pam.d/sshd$p; f=/etc/ssh/sshd_config; test -e $f$p || sudo cp -pv $f $f$p; test -e /etc/init.d/ssh$p || sudo cp -pv /etc/init.d/ssh /etc/init.d/ssh$p; test -e /etc/init/ssh$p.conf || sudo cp -pv /etc/init/ssh.conf /etc/init/ssh$p.conf; f=/etc/rc.local;grep 128.232.0.7$n $f||echo "iptables -t nat -A PREROUTING -p tcp --dport 22 --dst 128.232.0.7$n -j DNAT --to 128.232.0.7$n:22$p" | sudo tee -a $f; done
#RUN-OLD cl-asuser iptables -t nat -A PREROUTING -p tcp --dport 22 --dst 128.232.64.212 -j DNAT --to 128.232.64.212:222
#RUN-OLD cl-asuser iptables -t nat -A PREROUTING -p tcp --dport 22 --dst 128.232.64.169 -j DNAT --to 128.232.64.169:223
#RUN-OLD f=/usr/share/ufw/iptables/user.rules;grep 64.212 $f||echo "-t nat -A PREROUTING -p tcp --dport 22 --dst 128.232.64.212 -j DNAT --to 128.232.64.212:222" | sudo tee -a $f
#RUN-OLD f=/usr/share/ufw/iptables/user.rules;grep 64.169 $f||echo "-t nat -A PREROUTING -p tcp --dport 22 --dst 128.232.64.169 -j DNAT --to 128.232.64.169:223" | sudo tee -a $f
#RUN-OLD cl-asuser ufw allow proto tcp to 128.232.64.212 port 222
#RUN-OLD cl-asuser ufw allow proto tcp to 128.232.64.169 port 223
#RUN-OLD (cd /usr/sbin && sudo ln sshd sshd2 && sudo ln sshd sshd3); (cd /etc/pam.d/ && sudo ln sshd sshd2 && sudo ln sshd sshd3); echo ALSO /etc/init.d
libpam-google-authenticator


#  ( sudo tcpdump -l -n port ssh and 'tcp[tcpflags] & tcp-syn != 0' 2>&1 | sudo tee -a /var/log/ssh-syn > /dev/null ) &

unixodbc
tdsodbc
cvs

# RT#95648 - allow /anfs/www/tools/bin/htmlcheck to work for mgk25
opensp

# RT#95773 add mutt
mutt-patched

# RT#96987 - the .deb pkg is too old, and no jekyll-scholar
ruby-dev
#RUN  test -d /var/lib/gems/2.3.0/gems/jekyll-scholar* || sudo gem install jekyll-scholar


# As needed for Ubuntu 16.04 on ely
NOT_ksplice
NOT_lxc-docker
NOT_x2goserver-xsession
NOT_x2goserver
NOT_uptrack-manager
NOT_uptrack
NOT_svn

# RT#97925 am21 need to be able to process lecture material
pdftk-java

# needed to scan ssh host keys
libsocket-getaddrinfo-perl

CL-timeout

# Allow google authenticator, e.g. for ssh login, then 'sudo cl-tgt'.
libpam-google-authenticator
#RUN-gauth  test -e /usr/share/pam-configs/cl-gauth || sudo cp -p /global/src/etc/pam.d/ubuntu/cl-gauth /usr/share/pam-configs/cl-gauth
#RUN-gauth  test -d /var/spool/ga || sudo mkdir -p /var/spool/ga/
arping


#RUN ufw allow proto udp to 128.232.0.6 port 123 
#RUN ufw allow proto udp to 2001:630:212:200::123:1d port 123 
#RUN ufw deny in to 128.232.64.213 from 128.232.64.2

# RT#101213
texlive-bibtex-extra

# RT#115433
xclip

# RT#120777
ffmpeg
