Resources

The basic configuration file layout is as follows and is also documented in the /etc/apache2/apache2.conf:

/etc/apache21 1--apache2 .conf

1 ' --ports .conf 1--mods-enabled 1 1--'.load

1 ' --". conf 1--conf .d

! . sites-enabled

The files shown are the only ones that are considered part of the actual apache2 configuration by virtue of being included by commands in the main configuration file or one of the files it includes. Note that there is also a sites-available and a mods-available directory that are not automatically included in the configuration. The files in these latter two directories are included by virtue of links pointing to them from the mods-enabled and sites-enabled directories, which we will cover shortly.

In general, configuration changes will be limited to the ports.conf file, adding or modifying files in conf.d, and the links in mods-enabled and sites-enabled directories (and the files they point to). Any files you modify that are provided as part of one of the Debian packages will, of course, be checked during upgrades and you will be prompted for the proper action. Such files are generally only:

• envvars: This is the file containing environment variables used by Apache and the apache2ctl utility
• ports.conf: This is the file that controls which ports and IP addresses Apache listens on
• conf extension files in mods-available directory: These are the files which control the configuration of a module when loaded
• default and default-ssl in sites-available directory: These are the files which control the behavior of the default web service
• files in the conf.d directory: These are the files that are part of add-on packages, such as phpmyadmin

Modifications to these files should, of course, be kept to a minimum, but sometimes they are necessary. Most local configuration will be done by adding files to the conf.d directory, or to the sites-available directory (along with appropriate links in the sites-enabled directory), where virtual hosts are configured.

In Debian 7, the files are only included if they begin with a letter or number. It does not include .dpkg and do not contain anything other than letters, numbers, and underscores. In Debian 8, only files that end in .conf or .load will be included.

The package managers in Debian make it easy to upgrade software packages, and even upgrade to a new, major release level. Upgrades don't require major server downtime, although if they involve major software changes that modify how the software is configured or behaves, additional work may be required after the upgrade to return service to normal. Non-Debian repositories can be added so that the package managers can update non-Debian software just as easily as official Debian packages. Ifsoftware isn't available in Debian format, it can be packaged using the same tools Debian developers use, so that Debian package managers will handle it as well.

Usually after an installation or upgrade, there are additional steps that must be taken. The major one is package configuration, which we will cover in the next chapter.

Once the distribution upgrade is complete, there are still a few steps that should be taken. First, if the configuration file issues weren't resolved during installation, now is the time to do this. The new file is in the same place as the old one, with an added dpkg-new extension. Ifthe installer selected the developers' version, the old configuration is there with a dpkg-old extension. Either way, the administrator can check them for differences and make the necessary changes.

Next, if there are major changes in software operation, any applications that use the software should be modified, or the configuration updated to recreate the old behavior if possible. A good example of this issue is major changes to how PHP works, which often necessitates re-coding web pages that used the changed features or modifying the configuration when it supports operation in a legacy mode. Other major changes may affect users, such as the change from GNOME 2 to GNOME 3, which involves a major change in the user experience. Also, any post-installation steps noted in the release notes should be taken.

In addition to the considerations for High Availability clusters, more tightly coupled environments such as Beowulf clusters also require an infrastructure to manage and distribute computing tasks. There are several web pages devoted to creating a Beowulf cluster using Debian as well as packages that aid in creating such a cluster. One such page is https: / /wiki. debian. org/StartaBeowulf, a Debian Wiki page on Beowulf basics. The manual for FAI, mentioned previously in configuration management, also has a section on creating a Beowulf cluster. Books are available as well. Debian provides several packages that are helpful in building such a cluster, such as the OpenMPI libraries for message passing, and various utilities that run commands on multiple systems, such as those in the kadif package. There are even projects that have released scripts and live CDs that allow you to set up a cluster quickly (one such project is the PelicanHPC project, developed for Debian Lenny, hosted at http://www .pelicanhpc. org/.

This type of cluster is not something that you can set up and go. Beowulf and other tightly coupled clusters are intended for highly parallel computing, and the programs that do the actual computing must be designed specifically for such an environment. That said, some packages for specific parallel computations do exist in Debian, such as nwchem, which provides several applications for computational chemistry that take advantage of parallelism.

One of the more subtle changes often made, other than adding non-Debian repositories, has very important implications. Note that the release name in most of the lines from the previous Debian release sources . list is wheezy. This means that the packages available through the package managers will always be from the Debian 7 release. Some administrators change the release name to stable. This has both advantages and disadvantages.

One advantage is that, when a new major version is released, your package managers will immediately recognize this and update package lists and dependencies accordingly. The disadvantage related is that major releases involve major changes in package dependencies. While package managers can handle this, such major changes usually result in many new packages being installed to satisfy new dependencies, many old ones being deleted due to changing dependencies or obsolescence, and major version changes that often change the way the software behaves. These changes can be quite disruptive to server operation, or to developers' or users' habits.

Best practice to ensure stability is to leave the official release name in place until you are ready to upgrade to the next release. Then change the name in the package manager configuration, and perform a manual upgrade.

Network Intrusion Detection basically involves monitoring network interfaces, analyzing all the packets seen, and providing alerts when certain attack characteristics are seen. On Debian, the primary tool for this is Snort. Snort will be installed if you install harden-nids, mentioned previously. Other packages are also available in Debian as well.

Snort can be paired with a package called fwsnort to not only detect potential attacks, but block them dynamically via adding IPTABLES rules when attacks are detected.

One caveat is that NIDS can only analyze traffic they actually see. They will see all traffic on whatever interfaces they monitor (in fact, Snort will see it before IPTABLES does, ensuring that all traffic is analyzed). However, if your system is protected by an external firewall (for example, if it's on a perimeter network), it will only see packets that are allowed through the external firewall. Because of this, NIDS may be of limited use unless it is run on the external firewall. Nevertheless, it is still useful to detect attack attempts that manage to get through the external firewall.

The single partition (plus swap space) per disk scheme is the most common nowadays, as it is simple to create and manage. Multiple partitions may be used in the special cases mentioned previously, although, in general, the quality and speed of current backup utilities minimizes the need for separate partitions just for backup efficiency. Ifthe system has multiple disks and may require resizing or live migration in the event of hardware changes, then L VM should be considered.

In general, the Debian defaults follow best practice. This usually means a single root partition and a single swap partition. Ifthe administrator wants multiple partitions but isn't certain of the sizes required and doesn't want to use L VM, the defaults for the multipartition setup are a good starting point.

An exception to accepting the single root and single swap partitions default is the case of disk encryption discussed later. Ifimplemented via the Linux kernel, an unencrypted/boot partition is required.

The current KDE release for Debian 7 is 4.8.4. The kde-full meta package will provide all KDE applications as well as the window and display managers. The KDE user environment provides a System Settings application just as GNOME does, but it is a bit more comprehensive as it includes the ability to configure KDM, the display manager responsible for the login screen. In fact, because of this, some administrators use KDM as the display manager, even though the default session may be GNOME.

Other desktops

XFCE and LXDE are the most common alternatives to KDE or GNOME, although there are others. Neither one provides a display manager for login screens, although LXDE recommends LightDM, a lightweight display manager. XFCE and LXDE (as well as LightDM) retain the old desktop metaphor, and are designed to place a minimal load on the system, making them appropriate for older hardware.

During the time Linus Taroalds abandoned GNOME3, he ran XFCE.

Like both GNOME and KDE, both XFCE and LXDE provide a system settings application to control the look and feel. LightDM also provides a graphical settings utility.

Showing your best face

Take time to at least look into the settings for your chosen display manager. Unless you are running a server that never sees a graphical login, this is the first and last thing your users see. You may also want to look into appropriate backgrounds for your users' desktops. They don't need to be fancy but they do make an impression.

Selecting a filesystem format is the next major choice before installing Debian. The supported formats that are appropriate for a Linux installation include ext2, ext3, ext4, JFS, XFS, ReiserFS, and Btrfs. The first three are actually progressive versions of the extended filesystem (ext) developed specifically for Linux.

Network Manager is automatically installed with the GNOME Window Manager. It is especially useful in a laptop environment. For servers, the interfaces file is probably the best and most flexible option. Of course, ifyou require certain features available only in one or the other, use whatever provides them, combining the two techniques if necessary.

Don't attempt to control the same interface using both methods. While Network Manager will refuse to manage a connection defined in the interfaces file, and the ifup command will generate an error if it attempts to set up an interface already controlled by Network Manager, it is possible to circumvent these protections.

The means of achieving the goals of the Debian Social Contract is outlined in the Debian Constitution. It lays out the formal structure and decision-making process. The project has a full organizational structure that includes Officers, Distribution, Publicity, Support, and Infrastructure divisions, with specific positions and responsibilities. Although Debian is an all-volunteer organization, it is every bit as organized as any large corporate entity.

Here we will look at the Apache web server software configuration and see how Debian handles it. The details on what the configuration actually does will not be covered, as they are complex and covered in the package documentation. However, we will look at how the files are set up, and what procedures are provided by Debian for configuration maintenance.

The first thing to observe about the Debian Apache packages is that the type of server, threaded, non-threaded, event-driven, or multi-user, is determined by which package is installed to satisfy the server dependency in the main apache2 meta package. In addition, the documentation is split off into a separate package, which places the Apache manuals in a web directory and adds the necessary configuration files so that Apache can serve them up as web pages.

You've selected the packages to upgrade (or are performing an all at once upgrade), and started the process. The first thing to note is what packages are going to be removed. If one or more of them appear to be packages you need, cross-check them with the packages being installed to see if they are being replaced by a new package with similar functions. If they are not, make a note to follow the upgrade with a separate installation of whatever packages are required.

During a distribution upgrade, the system can generally remain in operation, although there will be slight disruptions when a package requires certain services to be restarted or libraries to be loaded.

These disruptions are more severe than a nonnal upgrade, particularly in cases where a package is removed and replaced with a different one to fulfill the same function, or removed because it is obsolete. Therefore, you may want to infonn users prior to the upgrade, and keep system activity to a minimum.

The next thing to watch for is the upgrade notes. Major changes are in how some software works are displayed (and e-mailed to the root account for later checking as well) in order to notify the installer of necessary post-installation steps to be taken.

Finally, when the administrator has made changes to the configuration of a package, the upgrade process will notify him/her of the non-default configuration and ask for help in resolving the differences. This involves leaving the current local version in place, replacing itwith the developers' version, or pausing the installation so the differences can be examined and resolved manually.

Often there are new options or defaults that should be added to the old configuration. Best practice is to either resolve the changes immediately, or keep the old configuration and cross-clteck it later with the new default

configuration (which is placed in the same directory with a modified name to keep it inactive but available for just this reason).

Two primary functions are required to implement a high availability cluster:

1. A way to handle load balancing and individual host fail-over.
2. A way to synchronize storage so that all servers provide the same view of the data they serve.

Debian includes meta packages that bring together software from the Linux High Availability project, including cluster-agents and resource-agents, two of the higher-level meta packages. These packages install various agents that are useful in coordinating and managing load balancing and fail-over. In some cases, a master server is designated to distribute the processing load among other servers.

Data synchronization is handled by using shared storage and any of the filesystems that provide for multiple accesses and shared files, such as NFS or AFS.

High Availability clusters generally use standard software, along with software that is readily available to manage the dynamics of such environments.

All of the configuration for media or repositories resides in /etc/apt, in a file called sources . list and any files in /etc/apt/sources .list.dwith a .list extension. These files can be modified manually using your preferred editor, manipulated by various API utilities such as apt-add-repository or apt-spy, or via a menu item in the Synaptic Gill. Details on how each method works are available in various man pages, such as those for sources . list, apt-add-repository and apt-spy, and so on, or in the help files for Synaptic. However, since they all depend on the same configuration files and format, the required entries are all similar.

Each line includes an indicator of whether the repository contains binary packages or source packages (from which binary packages can be built), the location of the repository, the identity of the release, and the sections from which software may be selected. Generally, an entry for the media from which you installed Debian has already been made during the installation process, along with an entry for the online repositories if they were used during installation as well.

All package sources are identified by a URI, described in the sources . list man page. The release is identified by its release name (such as squeeze for Debian 6, or wheezy for Debian 7) or by a generic term such as stable, which refers to whatever the current stable release is.

The current Debian stable release is Debian 7, code named wheezy, released on 4 May, 2013. At the time of writing, stable is a synonym for wheezy. Debian releases are named in order to make the mirroring of various distributions easier. The code names to date are all taken from the movie Toy Story. This tradition apparently began in 1996 when Bruce Perens, who worked for Pixar at that time, took command of the Debian Project.

Taking all these together, a set of repositories as they might appear in /etc/apt/ sources . list would look like the following:

i deb cdram:Debian GNU/Linux 7.0.0 -Wheezy· -Official amd64 \

NETINST Binary-l 20130504-14.4311 stable main

deb http://ftp.ua.debian.org/debian/ wheezy main non-free contrib

deb-arc http://ftp.ua.debian.org/debian/ wheezy main non-free \

contrib

deb http://security.debian.org/ wheezy/updates main contrib \

non-free

deb-arc bttp://security.debian.org/ wheezy/updates main contrib \ non-free

wheezy-updates, previously known as •volatile,

deb http://ftp.us.dabian.org/debian/wheezy-update.main contrib \ non-free

deb-arc http://ftp.us.debian.org/debian/ wheezy-updatea main \

contrib non-free

Some of the lines in the example are too long for the page and are split into two lines, using the common convention of adding a backslash (\) at the end of the first line to indicate it is continued. In reality, these

lines should not be split in the APT sources configuration illes.

Let's take the lines one at a time.

The first line begins with a #, meaning this entry is disabled. This entry was made by a network installation, wherein a minimal CD is mounted, and basic software is installed to allow the remainder of the software to be installed from online repositories as listed in the later lines. Only the main section is required, as shown at the end of the line.

The next two lines are for binaries (deb) and source packages (deb-src), to be obtained from an HTTP server (http://ftp .us. debian. org/debian). The release is wheezy, and all three sections-main, contrib, and non-free-will be available. Following the main repository lines are two lines for binary and source package updates. This is where security updates to the stable release are available.

Even if you prefer to use media for the release, rather than online repositories, you should include the update repositories, as this is the only way to obtain security fixes that are released as necessary.

Finally, there is a comment, and two lines for what used to be called the 'volatile' repository, and is now just referred to by the release code name followed by -updates. This repository contains packages that are routinely updated throughout the life of the release, much more often than the security update repository. Packages that include virus definitions are examples of software included in this repository.

While the various methods of configuring the repositories have slight differences, the same basic infonnation will be required, no matter which method you use. Also, since all of the utilities use the same configuration files and fonnat, information entered, deleted, or modified by one method will be immediately visible to all of the utilities.

All of the previous lines were pre-configured by the installation procedure, and did not need to be modified. However, there are often reasons to modify or add repositories. You may want to add repositories for software that isn't available directly from Debian, or modify the URL to use a different, better performing server, or different access method.

For example, HITP is more resistant to network delays or error, while FfP is somewhat faster. Also, not all mirrors support both methods, so if you change servers, you may need to change the access method as well.

There are a number of non-Debian repositories that contain software that is not included in the standard Debian release. Usually, this is due to licensing issues, or because development takes place outside of the Debian Project policies and there is no sponsor to integrate it into Debian. Some of the more useful ones are as follows:

• Deb Multimedia: As it says, this is primarily a multimedia package that can't be included in the normal distribution
• Webmin: This is a web-based system administration software
• Oracle: This provides Oracle Express software
• Skype: This provides the Skype software
• MongoDB: This is a software from the NoSQL MongoDB project

As an example, the following is a /etc/apt/sources .list.d/webmin.list file for the Webmin archive just mentioned:

dab http://download.wabmin.com/download/rapoBitory Barga contrib

deb http://wabmin.mirror.aameraettech801utioDB.co.uk/repo8itory \ Barge cOlltrib

Generally, sites that offer such repositories will include instructions for configuring the sources list file for their repository.

Debian includes a number of intrusion detection applications. There are three basic classes: Network Intrusion Detection Systems (NIDS), File Monitors, and System Scanners. The former works by scanning network traffic to detect attempts to discover and exploit allowed network connections. The latter works by scanning a known clean system, then monitoring it for new, deleted, and modified files.

If available, a swap file or partition is used by Linux when memory paging to disk is necessary. With the advent of cheap memory, such paging is often infrequent with one exception: system hibernation. This is where the system is paused and the memory contents are written to disk prior to power off in order to allow the system to resume from the saved state. While this is commonly associated with laptop systems, servers sometimes make use of it as well.

Swap files are single files created within an existing filesystem, while swap partitions are exactly that -a specially formatted disk partition. In general, swap files are only used when additional swap space is necessary for some reason, as it has all the additional overhead (metadata, journaling, allocation, and such) of the filesystem in which it resides.

Unless an administrator is absolutely certain a system will never need to swap to disk or require the ability to hibernate, a swap partition equal in size to the installed memory is recommended.

Solid-state drives (SSD), so-called flash drives, were once considered . an exception. In that the limited write cycles were considered a problem if swap files were placed on such a drive. However, with modem flash technology, this is no longer an issue, especially since the swapping has been greatly reduced by the large amounts of memory in current systems.

The current GNOME release in Debian 7 is 3.4. Ifyou install the gnome meta package, all major GNOME applications as well as the window and display managers, will be installed. Configuration is pretty straightforward, as the user menu provides a System Settings application to access the major settings of your workspace in order to alter how it looks and feels.

Modifying the GNOME login screen, GDM3, ifyou don't want the default behavior, requires manual editing of /etc/gdm3/greeter .gsettings and /etc/gdm3/ daemon. conf as the root user. Then execute the dpkg-reconfigure gdm3 command.

Part of the reason for this is that GDM is being integrated more fully into GNOME, and is being moved to the dconf settings framework from the old GNOME 2 gconf based settings. At some point, the GNOME control center should provide the appropriate utility but, at this time, there is no official GDM3 setup utility. An unofficial utility called gdm3setup exists, but has not found its way into Debian, yet.

The UEFI is a recent development by Intel and Microsoft that supports what is called Secure Boot, which requires all the loaded firmware to be signed or it won't be loaded. This is a problem for Linux, since the keys required for signing must, under the current GPL, be made public. This, of course, defeats the purpose. There are several workarounds, including some being used by Red Hat, SuSE, and Ubuntu, which are being discussed by the Debian developers and will probably be included in an update at some future point. For now, the UEFI specification allows Secure Boot to be disabled, and that is the recommended way to install Debian so that it boots under UEFI. It is also possible to switch on the legacy mode in most UEFI implementations, which allows the old MBR method to work as well.

Under UEFI, boot code is placed in a subdirectory in a special partition. Generally, this will be a subdirectory of /EFI in the first partition on the disk (formatted with the FAT32 filesystem). Generally, the boot modules and configuration files are placed in the /EFI/grub directory in the UEFI partition. Itis not a good idea to replace the default EFI module (usually /EFI/Boot/bootx64. efi) by copying the grubx64. efi module over it, as some have recommended in the past. Debian installation generally takes care of including the GRUB loader as one of the options when booting, and if it isn't the default option, the boot settings menu should be used to set it as the default. It can also be used to add it as an option if the installation doesn't do this for you.

Getting into the UEFI boot settings menu usually involves holding down certain keys while booting the computer, very similar to the way the old BIOS menus were invoked. Itis different for each computer model.

It is possible to combine both the interfaces file and Network Manager methods of network configuration, with each responsible for a portion of the configuration. This technique might be used when certain features are required that only one of the methods support. For example, Network Manager doesn't handle network bridging, and the interfaces file generally can't be used to configure VPN connections. If you needed both, you would set up bridging using the interfaces file and configure your VPN connection using Network Manager.

For those unfamiliar with network bridging, a good example would be a development system that runs one or more virtual machines that require direct access to the network (meaning its connection must behave as if it is an actual interface with a direct network connection).

Note that the host machine now uses br0 instead of eth0 as its primary interface. The bridge interface uses eth0 to connect to the actual network. The VM (Virtual Machine) will set up its own network interface (or you will set it up). These are generally set up as a tap or tunnel interface (hence the name tap0).

To set it up, the basic interfaces file might look like the following listing (assuming the hardware Ethernet card is eth0):
# TAP setup
auto tap0
iface tap0 inet manual
pre-up /usr/sbin/tunctl -t tap0
# Bridge setup
auto br0
iface br0 inet dhcp
bridge_ports eth0 tap0

This sets up a TAP device using the tunctl command to create the device. It must appear before the bridge or it won't be there when the bridge device is initialized and attempts to connect it to the bridge. The bridge setup creates the bridge interface and uses DHCP to obtain the IP address. The bridge_ports line indicates that it bridges traffic to the real interface (eth0) and the tap0 interface, which will be used by the VM. I've left out the loopback entry for clarity. In this example, VPN and wireless connections are left for Network Manager to handle. 

More about network bridging may be found in the bridge-utils package, and network tap and tunnel interfaces are covered by the uml-utilities package.