Resources

Above everything else, Debian developers believe in free software, as defined by the Free Software Foundation. In essence, this definition ensures that users have the freedom to:

• Run the program for any purpose
• Study how the program works and make modifications
• Redistribute copies
• Distribute copies of modified versions

All of this is embodied in the Debian Social Contract, and the Debian Free Software Guidelines (DFSG), both of which may be found at http://www.debian.org/social_contract. All Debian developers commit to this social contract, which states the guiding principles for the Debian Project, and influences all decisions as to what's included in the distribution and how it is distributed and maintained. Of particular note are the provisions for non-free software, and support in many different computing environments.

The non-free provision not only allows for such software to run on Debian systems but provides for special Debian repositories for that software which can be released without payment. Such software is, in fact, supported by Debian developers who package and support it. The primary distinction is that it is not a part of the official Debian distribution, due to licensing restrictions. Of course, software that must be paid for can also be run on Debian distributions. It just can't be included in the Debian repositories.

So, how do you know what configuration facilities are provided and what the recommended approach to local configuration is? The best place to begin is the README. debian file that comes with the package. Itis a requirement of the Debian Policy manual that this file explains any special configuration issues, how configuration under Debian differs from the configuration provisions of the original software developers, and recommended ways to handle local configuration. It also explains any utilities Debian has added to aid in the software configuration. 1bis file exists in Iusr I shareI docI
, which also contains any original software documentation, plus any added by the Debian developers. lbis directory is standard with nearly all Debian packages, and is mandatory for any that have extensive documentation or special configuration issues.

Some packages have such extensive documentation that it is provided in a separate package so that it can be installed on a separate system providing faster, local access to the information without requiring space or processing on the server on which the software is installed.

Let's take a look at some examples that involve fairly complex configuration file sets.

Read the release notes! This can't be emphasized enough. The Debian developers are careful to include all the important details on what has changed between releases, and any special steps required prior to and after the upgrade process.

There are two ways to handle a major upgrade: all-at-once, and a little at a time (which we'll refer to as a partial upgrade). The all-at-once upgrade basically involves a single command that updates all packages. The partial upgrade method involves selecting a group of packages and updating them and their dependencies. This reduces the dependency calculations to a more easily handled subset. Generally, one selects one of the meta packages, such as GNOME or Apache2, or a selected set of packages to update, and uses the install command in either apt-get or aptitude, or selects the packages in dselect, aptitude, or Synaptic. After they are upgraded, the next set is chosen and updated, until all packages have been updated, along with any new dependencies or removals required. At some point, after the majority of software has been upgraded, the remainder of the upgrade can be handled all at once.

Choosing a subset of packages is fairly simple. The apt-get dist-upgrade command and aptitude full-upgrade command will provide information on what will be added, upgraded, and removed and ask you to confirm the selection. At this point, you can tell them not to perform the upgrade, then review the packages proposed for upgrading, and select one or a few to use with the apt-get or aptitude command line install command (which upgrades already installed packages). A similar procedure works with Synaptic.

One way to ease the upgrade process is to perform a standard package upgrade first. This will perform the simpler, standard package upgrades that don't require major changes in dependencies. Once this is done, the full distribution upgrade will involve fewer packages

A cluster is a group of systems that work together in such a way that the whole functions as a single unit. Such clusters can be loosely coupled or tightly coupled. A loosely coupled environment, each system is complete in itself, and can handle all of the tasks any of the other systems can handle. The environment provides mechanisms for redundancy, load sharing, and fail-over between systems, and is often called a High Availability (HA) cluster. In a tightly coupled environment, the systems involved are highly dependent on one another, often sharing memory and disk storage, and all work on the same task together. The environment provides mechanisms for data sharing, avoiding storage conflicts, keeping the systems in synchronization, and splitting up tasks appropriately. This design is often used in super-computing environments.

Qustering is an advanced technique that involves more than just installing and configuring software. It also involves hardware integration, and systems and network design, and implementation. Along with the URLs mentioned below, a good text on the subject is Building Gustered Linux Systems, by Robert W. Lucke, Prentice Hall. Here we will only touch the very basics, along with what tools Debian provides.

Let's take a brief look at each environment, and some of the tools used to create them.

Debian software is grouped together in a release. All of the software in a release is available as a set of purchased or downloaded media (CDs, DVDs, or new with Debian 7, Blue-ray Discs), or as individual packages grouped in an online repository. While dpkg works only on packages already downloaded (or on media mounted locally), the other package management utilities understand offline media, and local and remote repositories, which must be configured.

Probably one of the most important ways to protect private networks while still providing services available to the public Internet is by using a perimeter network. Often called a De-Militarized Zone (DMZ), it is a buffer between attackers and your internal network.

In the previous diagram, there are two architectures given. The traditional design uses two firewalls with the perimeter network placed in between them. The reason for this is that if the external firewall which is exposed directly to the Internet and attack is compromised, the attacker still has to get through the internal firewall before he has access to systems on your internal network. Experience has shown that firewall compromise is uncommon enough that a single firewall can be used reasonably safely, as shown on the right. The dual firewall architecture is still preferred for high security environments.

In all cases, the only systems that can be accessed from the Internet are those on the perimeter network. Those servers must not have any access to internal servers through the firewall. Internal servers can connect to the perimeter systems and thus allow two-way communication, but servers on the perimeter should never be able to initiate connections to internal systems. This prevents a compromised server from further endangering your internal network.

So, now you have your system properly firewalled. As mentioned previously, you will still be attacked, and eventually compromised. The next section deals with how to detect both the attempts and any compromise as soon as possible.

Logical Volume Management, or LVM, is a format pretty much exclusive to Linux. It is an alternative to partitions which makes space management much easier. Logical volumes can be resized at will, and can span multiple disks. They can be migrated to different disks without interrupting services (live migration). There are also striping and mirroring features that are similar to RAID 0 and RAID 1.

LVM is more complex than basic partitioning, and not commonly used except in large storage installations.

Technically, L VM is a structure that overlays the physical disk partitioning.

Straight servers, as opposed to development servers, generally do not require a display manager. Of course, development servers and those servers that do provide the ability to log in to a managed display environment do require both a display manager and a window manager. The former handles the creation and security of the X-Windows display environment and resources required, while the latter handles the actual desktop environment presented to the user.

There are several major environments, each with its associated Display and Window Managers. The two major environments are GNOME and KDE. Both support a variety of graphic toolkit libraries, so that most applications that run in one will run in the other, provided the necessary services are available. These services are usually installed as a dependency when the application is installed ifyou don't install the basic meta package for either GNOME or KDE. So if, for example, you like the KcacheGrind tool for browsing program profiling data, but are using GNOME, you can go ahead and install and use it under GNOME. It will work fine. Likewise, ifyou prefer the K Display Manager (KDM) that comes with KDE to the GNOME Display Manager (GDM) provided by GNOME, it will work just as well.

Given this interoperability, why choose one over the other? It is mostly a matter of personal preference. As mentioned in the first chapter, KDE is usually preferred by European users, while GNOME is more of an American preference. Our main concern in this section will be where to find configuration files or applications for each.

Where did my desktop go?

Both GNOME and KDE, like the new Windows 8, have abandoned the old desktop metaphor for a more activity or task oriented look. It takes some getting used to and Can be disconcerting at first. Covering the changes from the old look to the new would take a book for each Desktop Manager! However, the home sites for both KDE and GNOME provide tutorials and documentation to help you get started. If you prefer the older desktop metaphor, both GNOME and KDE provide ways to set this up as well.

BIOS is the traditional boot method, and is well-supported by Debian. There are several choices for the placement of the boot code. Common practice is for it to be placed in the MBR at the beginning of the boot disk. However, if there are multiple operating systems already installed (especially Microsoft Windows), this replaces the installed bootloader with the one common to Linux. This is generally not a problem, since the installation and update process searches for other operating systems and includes the ability to boot them as an alternative in the boot menu.

, The current bootloader for Debian on Intel is called GRUB2, although 'If:;.> other, older loaders exist and may be installed as an alternative.

However, there are occasions where the original, non-Linux bootloader is preferred. For example, some Windows installations won't update properly ifa non-Windows bootloader is installed. Inthis case, the Linux boot code can be placed at the beginning of the Linux boot partition rather than the MBR at the beginning of the drive, where the non-Linux bootloader can usually find it and offer it as an alternative on its boot menu.

The problem of Windows updates when using the Linux GRUB2 bootloader is quite complex. The issue seems to occur primarily with major Internet Explorer version upgrades, and the reasons remain unclear, at least in any discussions and bug reports I've been able to find. Adding to the problem is the occasional report of inconsistent recognition of Linux boot partitions by the Windows loader. There seems to be no hard-and-fast guideline as to which Windows installations will experience problems and which will not. The only certain way to know is to try it, and that requires patience, good backups, and a willingness to start over ifit doesn't work.

So, ifyou are planning to use a dual or multiboot layout that includes Windows, and you don't have the time, patience, and determination to actually try all the alternatives, the answer comes down to the following practical considerations:

• Can you live without a major version upgrade to Internet Explorer?
• Can you run Windows as a VM instead of as part of a dual or multiboot system?
• Will your Windows bootloader recognize the Linux boot partition?

Many users never upgrade major versions of Internet Explorer, and are perfectly satisfied with security and feature updates to their current version. If this works for you, then proceed with the default placement in the MBR. Ifyou absolutely must have the ability to upgrade major Internet Explorer versions, consider running Windows as a VM rather than as part of a dual or multiboot system. Ifyou do not wish to do so (usually because of virtual hardware compatibility or licensing issues), then go with installing the Linux bootloader at the beginning of the Linux partition. Recent versions of Windows (since Vista) are pretty good about recognizing the Linux boot partition and adding it to the boot menu.

Best practice is to use the default placement in the MBR. Only ifyou truly need the original bootloader should you place the Linux boot code at the beginning of the Linux boot partition and, ifnecessary, configure the non-Linux bootloader to include it in the boot menu, ifit doesn't do so automatically.

As flexible as the /etc/network/interfaces configuration is, many administrators prefer a more graphical interface to network configuration that may be used in a more dynamic network environment. Network Manager is most often used to manage wireless connections. It consists of a background process that does the actual connection management and has both a command line and a graphical utility that allows you to configure and control the managed connections.

The graphical utility displays available access points and provides a menu and an easy way to configure the connection. It can also be used for wired connections and can manage VPN connections to a private network as well. The main disadvantage of Network Manager is that it does not handle bridging, VLANs, or the IPX protocol. Of course, command line tools can be used to supplement Network Manager in order to configure these options, or the interfaces file can be used to manually configure them while Network Manager handles the rest.

There are other packages that provide a GUI interface for network configuration. One of the main ones is wicd. Some users prefer it as it handles wireless connections in a different manner that may allow certain wireless cards to work better, but it has fewer features.

Debian is, at its heart, a totally free, volunteer-supported distribution. Unlike Ubuntu, Red Hat, or SuSE, it is not sponsored by any corporation. This does not mean it is any less organized. The Debian project is, in fact, well-organized, with a well-defined government, detailed standards and guidelines, and specified procedures for software release, maintenance, and support.

The name Debilm comes from the names of the project founder, Ian Murdock, and his wife Debra.

Many software packages not only support separate, local configuration files, but also provide a special subdirectory to help organize and manage multiple configuration files. In some cases, the files in these directories require a specific extension in order to be considered active or enabled. lbis makes it easy to enable or disable software features. In other cases, all files in the directory are considered as part of the configuration, and a different method is used to enable and disable specific files or features, such as used in the Debian Apache software packages.

In any case, Debian developers usually recommend care in adding your own files, usually by including the word local somewhere in the name, or by placing them in directories that are provided specifically for local files.

As mentioned previously, itis simple to update your system. The commands (or menu items) for upgrading your system to the next official release are different from the standard updating commands. The apt-get command dist-upgrade or the aptitude full-upgrade will perform the necessary special calculations to upgrade to the next major distribution release after the package information cache has been updated (either using the normal update command if you have configured the release name as stable, or after changing to the new release name and executing the update command). The reason for the special commands is that there are major changes in package dependencies between official releases, and the way some software is configured, as well as the removal of obsolete packages, all of which require special calculations not involved in a normal package upgrade.

Synaptic can also handle a full distribution upgrade, but instead of a different command, it handles such upgrades when 'smart upgrade' is set in Preferences instead of 'default upgrade'.

There are other packages that can be used to manage a distributed environment, such as Chef and BCFG2. While simpler than Puppet or FAI, they support similar functions and have been used in some distributed and clustered environments.

The use of FAI, Puppet, and others in cluster management warrants a brief look at clustering next, and what packages in Debian support clustering.

Synaptic is a package manager with a complete GUI interface and no command line capability. Itoffers most of the capabilities of aptitude along with many of the repository handling features of dseleet. Uke the menu-based dselect and aptitude utilities, it provides a software list divided into sections of interest, such as databases, development, editors, and many more, which allow an administrator to browse available software more effectively. It also has search functions which allow easy discovery of packages for specific purposes.

Best practices are as follows:

• For general use -Synaptic
• For automated installation -APr
• For dependency resolution in difficult cases -aptitude

Most administrators are not concerned with traffic on the local loopback interface. This is because such traffic is often necessary for proper operation of the local system. It is also rather difficult to analyze in order to determine what is necessary and what may be safely blocked without affecting normal operation. The major reason to firewall loopback traffic is that if rogue software is installed on the system by a virus or worm, then that software has more avenues to further attack the local system over the unprotected loopback interface. It may allow a minor compromise to exploit the opening to become a major system takeover.

The major trade-off here is whether the likelihood of compromise and the resulting potential for damage justify the additional time and effort required to analyze and create a proper firewall for the loopback interface.

Aside from backup, recovery, and damage limitation, there are administrative functions that may differ depending on how a disk is partitioned. In particular, using a single partition for an entire disk relieves an administrator from having to modify partition sizes if one partition fills up and more space is necessary. TIlls is frequently why a single disk partition (plus swap space) is the recommendation for new users who are uncertain how they want to partition their drives.

Early BIOS systems could not boot from locations beyond the first 1024 cylinders of the disk. Thus, at one time, it was necessary to create a small/boot partition below that limit so that the system code (which could access larger areas) could be booted.

So, does an administrator need to wade through all of the log entries daily? That would be an extremely tedious task, and is really not necessary. A number of packages exist in Debian that will scan the logs for certain conditions and email the results to the administrator for further checking and action. The most common is logcheck, which checks the latest log cycles against a database of entries that an administrator might be interested in. It then emails the important ones to the administrator for further checking. There are also packages that perfonn various analysis tasks, such as email statistics or lITTP access statistics, using the system logs often combined with other information sources. They may be found using the Debian package management search facilities.

What package you use to check the logs, or even whether you use your own scripts based on string searches, is not important. The critical thing is to check the logs regularly. They can give you timely warning of impending hardware issues, software instabilities, programming problems, and attacks on your system.

Up until the late 1990s, the Basic Input/Output System, or BIOS, was the way all Intel-based systems were booted. Its disk partitioning information was held in a Master Boot Record (MBR) with additional code in the first sector of each bootable partition. With the advent of the Microsoft-sponsored Secure Boot feature, and its associated boot mechanism known as the Universal Extensible Firmware Interface (UEFI), there is a new partitioning layout and additional considerations.

This is the traditional method for setting up networking on a Debian system. It involves a series of files in fete/network. RPM-based systems such as RedHat Fedora and SuSE Linux use a different layout in /ete/syseonfig/network that is managed by their own utilities.

The /ete/network/interfaees file is probably the simplest way to get a network up and running. While it must be edited manually, it is easy to understand and a minimum number of configuration lines are needed to handle most situations. In fact, the Debian installation process will set up this file for you. lf you use the same networking configuration as you used for installation, the network will work immediately and require minimal tweaking. In fact, a minimal interfaces file is usually sufficient for most servers that aren't part of a cluster. Even if you do use an alternate method for network configuration, such as Network Manager, the local loopback interface is usually left configured in the interfaces file to keep the alternate configuration uncluttered, since it requires only basic configuration and doesn't normally need to be modified.

The interfaces file, while it can be very simple, also offers many options for more complex setups. You can configure wired, wireless, VLAN (Virtual Local Area Network) and Bridge interfaces, IP tunnels, and Point to Point (PPP) interfaces. Each interface can be configured to use DHCP or a static IP address, with both IPv4 and IPv6 supported as well as Novell's IPX protocol. A simple interfaces file is shown as follows:

# This file describes the network interfaces available on your # system and how to activate them. For more infor.mation, see # interfaces(S).

# The loopback network interface auto 10 ifaae 10 inet loopback

# The primary network interface

a11ow-hotp1ug athO

ifacs ethO iust static address 192.168.3.52

natmask 255.255.255.0 gateway 192.168.3.1

Lines beginning with # are comments, of course. The purpose of other lines is as follows:

• auto 10: The 10 interface is brought up whenever ifup is run with the -a option, as itis during system initialization
• iface 10 inet 100pback: This defines the basic loopback interface; the address is always 127 . 0 . 0 . 1 or : : 1 for IPv6
• allow-hotplug ethO: This brings up Ethernet a ifit is available and plugged in
• iface ethO inet static: This defines Ethernet a as an interface with a static IP address
• address, netmask, and gateway: These define Ethernet a's address, net mask, and the default IP gateway, respectively.

Simple and to the point. This file was actually set up during Debian installation and works as is. Ofcourse, there are many other options available which are documented in the interfaces manual page that allow you to handle much more complex configurations. The details on setting up the interfaces file may be found in the interfaces manual page. Itincludes information on setting up IPv6 and many other protocols.

In addition to the interfaces file, there are a number of scripts in the fete/network hierarchy that are related. In particular, the subdirectories if-pre-up. d, if-up. d, if-down. d, and if-post -down. d contain scripts that are run automatically when interfaces are brought up or down. Inaddition, specific scripts can be identified in the interfaces file to be executed when a particular interface is brought up or down (this is especially useful in configuring Bridges). The major disadvantage to using the fete/network/interfaces file is that there is no provision to configure Virtual Private Networks (VPN). However, in general, these can be configured using command line tools.