Knowledgebase

Government Data Center(GDC) infrastructure is housed in Thimphu Tech Park Limited(TTPL). It is built on 1000 sq ft block at Thimphu Tech Park Ltd (TTPL). All the required facilities like dual feed power redundancy, Diesel Generator, Uninterrupted Power Supply (UPS), redundant connectivities from ISPs (minimum of 10 Mbps each from BT and TashiCell) and Thimphu Wide Area Network (Government Network) with high bandwidth capacity, fire suppressants, Network Operation Center (NOC), Media Distribution Center (MDC), Building Management System with surveillance CCTV, Biometric authentication are installed and operational.

GDC is Tier-2 Data Center which is based on design principles such as reliability, availability, serviceability and scalability. The GDC facility is tested to ensure performance over time without failing.

Any agency of RGoB can host their system at GDC free of cost provided that the system is approved by eGIF.

GDC is based on the model of Infrastructure As A Service where storage, network, compute and server resources are provisioned and managed by GDC.

GDC primary backup system is hosted at TWAN/GovNet server room located at DITT. GDC also has secondary back up being done on Tape Library.

System backup policy is dependent on respective system and it’s criticality. Backup policy can be discussed with GDC and implement accordingly.

GDC is facilitated with redundant internet connection with at least 10 Mbps leased line each from BT and TashiCell. 

GDC is also a member of BtIX with 1Gbps fiber connection.

GDC is also connected with TWAN/GovNet with 10 Gbps fiber connection.

An agency can submit server request form from GDC website :

https://www.neyduetewa.gov.bt/?page_id=93

At the submission of server request form, GDC team receives email notification. GDC team then evaluates and process it further. 

“neyduetewa” is the translation of data center in national language Dzongkha.

GDC space allocation will generally be completed within 3 days and user credentials will be shared with the agency’s ICT personnel through mailvelope(refer “Creating Mailvelope Account for pgp Email Encryption” section). The space provided will be in staging environment.

Once staging space is provided, the agency is required to migrate copy of the system to it. GDC Security Operations Center(SOC) team, Bhutan Cyber Incident Response(BtCIRT) team will then scan the system for vulnerabilities and provide advisory of vulnerability fixes if any is found. Only after the GDC SOC team issue the system as clean, the system is processed and migrated to production environment by GDC.

An agency and GDC is mandated through APA to migrate their system to production environment within 5 weeks after staging space is provided.

After a system has been successfully migrated to GDC Production environment, a system owner is required to create a user account in GDC Ticketing System  to raise any future issues regarding the system. 

When a ticket is raised, notification is automatically sent to GDC Team and GDC Support Team. The raised ticket will be tended as soon as possible and GDC Team will strive to address it within a day. 

Ticket status can also be tracked by an individual.

VPN connection can be used by an agency to connect to their server located in GDC from internet wherein there is no GovNet connection. To establish a VPN connection, agency need to raise ticket asking for VPN connection. VPN credentials will then be created and shared with the agency.

To establish VPN Connection, system owner needs to install Cisco Anyconnect VPN client on their machine.
->Visit GDC VPN Server Site https://secure.neyduetewa.gov.bt
-> use the provided VPN credentials to log into
-> follow the instructions; download and install the client

Once installed, input “https://secure.neyduetewa.gov.bt” to connect  to GDC vpn server and then input the provided vpn credentials to establish connection.

GDC implements port white listing at network level. Only port TCP-80, TCP-443 and ICMP are allowed in GDC network. 

Any other ports if required must be put to GDC with justification through GDC ticketing system.

Any one requiring access from global network should use GDC VPN facility.

Responsibilities of the System Owner, GDC Technical Support Team and BtCIRT are as follows:

For more details please refer to the document.

$sudo su –           //switch to sudo root user
                                 //enter current user password to get root privileges

Linux System Induction 2019 Presentation
Linux System Induction 2019 Lab Practices
Linux.com
Red Hat
NSRC

$ssh user_account@ip_address
                           /etc/ssh/ssh_host.pub           //file location in the host server where the public key is stored
                          ~/.ssh/known_hosts                //file location in local machine where the key is stored

(For Linux/BSD)

***In your local machine***
$ssh-keygen                                                                                //to generate public private key
$ssh-copy-id user_account@ip_address                    //to copy public key to destination host server
$ssh-add                                                                   //adds passphrase to agent so that you don’t have to enter passphrase every time
$ssh user_account@ip_address    

                ~/.ssh/id_rsa                         //file location in local machine where the private key is stored
                /home/user_account/.ssh/id_rsa.pub               //file location in host server where public key is stored

$ssh-add -l                                                      //to see what identities (decrypted private keys) your agent has in memory
$ssh-add -d                                                    //to forget all identities
$ssh-agent bash                                          //to start a new subshell with ssh-agent if you don’t have an agent
                     
For more information ssh with public/private key ssh authentication agent

$sudo vi /etc/ssh/sshd_config //edit the the configuration file /etc/ssh/sshd_config
     AllowUsers user1 user2 user3      //add the line towards the end of the file to allow ssh for only specific users,
save and exit.

$sudo systemctl restart sshd               //restart sshd service to implement changes

Manual for mailvelope can be found in the link :