[MIR] maas

Haven't done all of my review, but a couple quick things:
 * Test suite isn't being run, but one of the reasons given in bug 937121 for a standing freeze exception was the comprehensive test suite. This should be enabled in the build.
 * It carries duplicated internal copies of libjs-raphael and libjs-yui. Those should be dropped and the system ones should be used instead.

Hi Michael,

1. The test suite cannot yet be enabled because various of its components are install installed from pypi. Once the migration to use system packages is complete, it iwll be enabled.
2. I'll check with upstream and see whether these are intended or a mistake and will be fixed in the next upload.

Thank you!

MAAS aims to provide an easy to use system for provisioning bare metal servers like how cloud providers provision virtual servers. At this point in time, it is able to do a number of things, but is not complete. At my review there was little usable documentation and MAAS is still undergoing a lot of development. I did not perform extensive code auditing since MAAS is undergoing a lot of change and will continue to do so during the 12.04 lifecycle. This should be considered a shallow audit. Understandably at its early stages of development, there are a lot of bugs that I encountered that affected usability. On quality and usability, there are a number of problems that prevent me from endorsing it for main in its present state, but understanding that MAAS is strategic, undergoing active development and will receive substantial bug fixes and features in the 12.04 cycle, I will have to take it on faith that these issues will be addressed. That said, I have the utmost confidence that the server team will fix the current issues and any new issues that arise.

The basic architecture is that a MAAS server is installed. This installs (among other things) a webserver, dns, tftp, and dhcp services. MAAS maintains a database of nodes. A node corresponds to a machine and MAAS tracks a machine's MAC address and few other characteristics. MAAS has a superuser which is capable of adding nodes, users and setting preferences via the web ui. Non-admin users are used by people who want to provision machines (eg, someone using the maas provider in juju must have a corresponding user in MAAS). Non-admin users are able to add nodes, but their enlistment must be approved by an admin user. Nodes can also auto-enlist themselves via the server installer CD (which also must be approved by the admin). When a node starts, it PXE boots using small netboot iso images that are available after using maas-import-isos (via cobbler). After booting the image, package installation for the node happens over the network and packages are fetched from a caching proxy (squid-deb-proxy). After a node is brought up, it is shown in MAAS as being allocated to a specific user. It is important to note that nodes must first be added to (or enlisted in) MAAS before trying to PXE boot a machine. This can happen either by a human in the web ui or by installation media.

MAAS has a lot of dependencies that affect the security of the server and performing an 'apt-get install maas' results in the following open ports:
- apache (80, privilege-separated)
- squid (8000, acls should keep this safe, non-root)
- dnsmasq (53, 67, non-root)
- sshd (standard Ubuntu priv-separation)
- postgres (localhost:5432)
- mass-pserv (5241, runs as root)
- maas-txlongpoll (5242, runs as root)
- epmd (4369, non-root)
- rabbitmq (non-root)
- rsyslog (udp 514, non-root)
- tftpd (69, privilege-separated)
- cobbler (localhost:25151, root)

In using this with juju, it appears that the server really only needs to have the following ports open to the nodes on the LAN:
- apache (80)
- squid (8000)
- dnsmasq (53, 67)
- tftpd (69)
- rsyslog (udp 514)

Because MAAS uses MAC addresses (which are easily spoofed), dhcp and tftp for...

Actually, since all the tracking bugs are in place and this was pre-promoted, I am going to mark this as 'Fix Released'.

*Sigh*, please subscribe canonical-server (or similar) to all bug mail, then feel free to mark this as 'Fix Released'.

Robbie subscribed ubuntu-server to this, so marking Fix Released.