Resources

Linux distributions can be broken down into three branches, named from their original distribution or their package managers: SLS, RPM, and DPKG.

This is actually a suite of packages, each covering a different major service. Unfortunately, this is not as universal as dpkg-reconfigure, but it does handle more complex configurations. The following services are covered as of Debian 7:

• Bind (DNS)
• OpenVPN (both client and server)
• ProFTPD (FTP)
• RSYNC
• Samba (Windows Shares)

It is a graphical tool, based on GTK (GIMP Tool Kit). It was developed to provide some administrator functions under the GNOME desktop environment. It will handle fairly complex configurations.

After installing the software you need for your system, it is good practice to check for updates at regular intervals. In particular, security updates are released as soon as possible after a security flaw in any Debian software is identified.

Itis easy to update a Debian system. After updating the package cache (see the previous section on Updating your package cache) so that it holds current information on all software in the repositories, the Synaptic mark all upgrades menu item, or the apt-get or aptitude upgrade command will update all software with any newer versions available.

Of course, Debian offers other backup packages as well. They are less complex than Amanda or Bacula, but more suited to smaller environments. Most use standard file archiving utilities, and offer remote storage options (either via standard remote file specification or by using a client and server approach). Some offer backup cycle management utilities, backup encryption, communications encryption, and even deduplication when using special backup storage formats. Synaptic or apt-cache can be used to search for these packages using the search term backup.

Some administrators prefer to keep iteven simpler and write their own short scripts which use the basic archiving commands (such as rsync, tar, or the EXT dumpj restore commands) to perform backups as a scheduled CRON job.

You've installed a basic system, now it's time to install additional software. Or, if you've selected some tasks during installation, you want to see what's installed and maybe remove some you won't use. Maybe your boss has asked for a report on what's installed. Or what about security updates?

All of these, and more, are the province of the Debian package management system. In this chapter, we'll cover package managers, software selection and maintenance, how to update your system, and how to set up automatic updating.

A note for beginners

TItis section assumes that you are familiar with using the root account. Information on accessing root account functions is available at https://wiki. debian.org/Root, and in the Debianreference manual at http://www .debian. org/doc/manuals/debianreference/. Quick help for commands mentioned in this chapter (as well as most Linux commands) can be obtained by executing man or info command name> from the command line, or using the help button available in most graphical applications. The Debian reference manual also contains more detailed information on using the package manager commands in this chapter.

One thing that the hardening packages do not provide is tools for protecting your systems via firewalls. This absence belies their importance in securing your systems, as a short search of Debian packages will show many tools for building firewalls. They vary from simple to complex, and from command line to full graphic interface. Nearly all are frontends for IPTABLES, the Linux kernel firewall modules and associated commands, and produce appropriate configuration files. Some provide a simple configuration language that is more readable than the standard iptables commands, which the tool then translates into the proper commands for you. Some provide a way of defining firewall policies, which are then translated into proper iptables configuration commands.

Even ifyour system is already behind a firewall, it is good practice to provide its own firewall as well. This multilayer approach provides additional protection in case the first firewall is somehow compromised.

Of course, with the variety of firewall packages available, itis difficult to recommend any particular package over the others. Each has strengths and weaknesses. However, if we restrict ourselves to the more popular packages, there are a few general recommendations that can be made.

First, for desktop and development systems which don't require extremely complex configurations, firestarter (for GNOME) or guarddog (KDE) are good starting points. They are oriented towards beginners but have advanced options that can be useful to more experienced users. Both are graphical applications. A special case is fireflier, which actually analyzes the applications traffic on the system and recommends rules. Mason is a similar application, but it does not offer a graphical interface.

For servers or systems that require more robust protection, consider fwbuilder. Itis similar to many enterprise firewall management systems and can provide configuration not only for Unux (both IPTABLES and IPCHAINS ruIes), but also BSD, Mac OS/X, and Osco access-lists as well. Configurations for muItiple servers can be kept in one place and installed remotely as needed. Refer to http://www. fwbuilder.org/ for more information.

A popular alternative is Shorewall, which can also handle traffic shaping and IPsec to some extent. Shorewall uses text configuration files rather than a graphic interface. More information may be found at http : / / shorewall .net/.

In all cases, for Debian Linux, the firewall packages control traffic by generating the IPTABLES rules used by the kernel modules to recognize, analyze, and control network traffic.

Many other formats are available, such as seQ's Unix BFS, QNX, and BSD's UFS. Although Unix-related, they are not considered appropriate for Linux root installations due to slight differences in attribute handling. They may work fine, but the Linux-specific fannats generally have better perfonnance and features.

There are many backup utilities available and they vary from simple ones appropriate for individual systems, to complex backup suites appropriate for managing backups for multiple production systems and clusters.

The simpler utilities generally provide file-level backups that are written to external media or even a remote network location. They frequently provide options for incremental backups, where only changed files are copied after the first, full backup. Mostly, these are command line utilities which can be scripted and executed periodically via a CRON job, although there are graphical front ends available. The disadvantage of most of these are that in the event you need to restore after a complete disk failure, you must have some other means of restoring the partition information correctly, and of recreating the boot sector information properly so the system will be bootable.

Among the more common of the simple utility commands are rsyne and tar. Frequently, these utilities are used in the more complex backup software to actually store the data. Ifyou use one of the EXT filesystems, the dump and restore commands are of particular interest, because they understand and take into account the filesystem's metadata and are thus faster and more efficient than the simpler copy utilities. The disadvantage, of course, is that restores may only be done to an equivalent EXT filesystem. Other utilities such as rsyne can restore to a completely different filesystem type, although certain metadata, such as file ownership and permissions, may be lost if the type is too different, such as backing up from an EXT4 filesystem and restoring to an NTFS partition.

More complex backup software is sometimes capable of so-called Bare Metal backups. These combine small, low-level backups of (or at least the ability to recreate) the non-filesystem structures such as the partition tables and boot sectors, with file-level backups of the filesystem contents. Many are multisystem backup solutions that can be administered from a central location and which can store the backups on various media in various locations. Usually, these multisystem suites include the ability to define and control backup schedules, contents, and locations as well as provide for off-site archiving.

Simply put, there is no paid version of Debian with extra features.

One of the side effects of this is that there is no official Debian-unified administration utility. SuSE, for example, provides YaST, and Ubuntu provides UCc. However, there are many configuration and administration tools available in the distribution, and the various window managers, such as GNOME and KDE gather their administrative menu entries in one place for easy use. likewise, there are third-party applications that work well on Debian that bring most, if not all, common tasks into a single place with a unified and user-friendly interface.

Probably the most important issue the administrator will run into is the problem of supported hardware. While Debian attempts to support as wide a variety of hardware as possible, some manufacturers don't provide information on their proprietary hardware. Without such information (required to write a driver), if a manufacturer doesn't provide a Linux driver, it won't be supported in Debian.

There are special cases. Certain Windows XP drivers can be used by Linux if they are available, but they require additional steps to install and activate them.

Actually, this isn't so much a Debian issue as a Linux issue. Some distributions that offer a paid version may include proprietary drivers in the enhanced version. However, in general, if your hardware is supported by Linux, it will work with Debian. There are a number of pages available on the Debian Wiki as well as other sites explaining how to get Linux and Debian to run on many systems with unusual hardware. Furthermore, with the gain in popularity of Linux, many manufacturers are providing the necessary drivers, if not free and with a license that allows them to be included in the base distribution, at least in a format that can be installed and used with Debian.

Best practice: check hardware support lists and compatibility sites for Linux before purchasing hardware or installing any distribution.

In Debian, as in nearly all Unix/Unux operating systems, run levels from 0 through 6 are available, defined as follows:

• 0: System Halt
• 1: Single User (maintenance)
• 2 to 5: Multi-User Modes
• 6: System Reboot

Note that run levels 2 through 5 are identical in Debian. This is unlike some other distributions, such as RedHat, Fedora, SuSE, or OpenSuSE, which give specific purposes to some of these run levels. For example, run level 2 in these distributions is often defined as one without network support, 3 with networking, 4 with file sharing, and 5 includes a display manager which isn't active in the other run levels.

In most Debian systems, there is no difference between the multiuser run levels, and all of the init scripts default to active in levels 2 through 5. This doesn't mean you can't define your own purposes for different run levels. However, ifyou do choose to do this, do not manually edit the various links to init scripts in the run level directories. The update-re. d command should be used instead. The reason for this is that Debian now defaults to dependency based boot sequencing.

Debian is just one of many Linux distributions. Selecting which distribution is best for your deployment can be a rather daunting task. The reason for so many distributions is that the developers or sponsors of each have a different vision of which software should be installed by default, which software is appropriate for particular tasks, and how the system is best administered. This means that selecting a distribution that matches your purpose and preferences will make installation and administration easier.

Any distribution can be made to reflect an administrator's preferences, by installing non-default software or, in some cases, software not native to the distribution software and using non-default configurations.

However, selecting an appropriate distribution means less effort is necessary to fulfill the and administrator's requirements.

This utility reruns the same configuration scripts that run during installation. It is run from the command line, and options can be used to vary the level of complexity of the questions asked. It is generally used when extensive, local modifications aren't required and the admirristrator just wants to update the basic configuration as provided by the installation scripts. It is also useful if the basic configuration has been corrupted, or changes made that have caused the package to stop working, to return it to the configuration provided immediately after installation.

Itis generally not useful if the configuration requires options that are not commonly used, or if the configuration requires extensive local modifications that aren't normally covered by the installation scripts, except perhaps to return the configuration to a post-installation condition as noted previously.

Several powerful and flexible central backup solutions exist that help manage backups for multiple remote servers and sites. Debian provides packages that assist in building High Availability and Beowulf style multiprocessing clusters as well. And, whether you are involved in managing clusters or not, or even a single system, Webmin can ease an administrator's tasks.

Removing packages is also handled by any of the package managers. Something to be aware of, however, is that apt-get and Synaptic do not automatically remove dependencies after the package that depends on them is removed. The command apt-get autoremove should be used to do this, no matter which package manager was used for installation and removal. aptitude does this automatically.

Bacula is another popular free backup package. Itis designed to be more modular than Amanda. Like Amanda, itrequires a client on the system to be backed up. In addition to the client, however, there is an administrative console service, a status monitor service, a backup director which controls the actual backup operations, a storage service that keeps the actual backup data, and a database service where the backup information and catalogs are mamtained. Of course, except for the client (which must reside on the systems being backed up), these services may be spread among different systems or consolidated on a single server.

Bacula configuration is object-oriented, in that you define clients, jobs, schedules jobs, file sets (to be backed up), storage pools to hold the backup data, messages (to handle emailing of reports), the catalog database, and the director which coordinates the whole thing. There are many useful functions, including some that allow restoration of a system without access to the catalog, creation of boot CDs which will allow a full, bare metal restore.

One thing to note is that the Bacula rescue CD is set up to restore disk partitions exactly as they existed at the time of the disk creation. Ifyou need to run a bare metal restore to a system with a different disk configuration, the rescue CD also provides the fdisk utility, and you can add other utilities to it ifyou wish.

The Bacula director and storage components run on Linux, FreeBSD, or Solaris. Ithas also been reported to work on some Windows versions, Mac OS/X, and other BSD variants, although this is not officially supported. The client is available for many different systems, including various Linux, Windows, Mac, and BSD systems. Bacula is also reported to work on AD, BSDI, and HPUX systems, although this is not officially supported.

Installing Bacula on Debian is straightforward. There are packages for each of the various parts, as well as, several meta packages. The bacula meta package installs both the bacula-client and bacula-server meta packages. The client package installs the Bacula console and file daemon (client). The server package installs the Bacula director and storage packages. There are several choices for the Bacula director, depending on what database you wish to use for your catalogs. The packages may be installed either via the meta packages or individually, as desired.

As with Amanda, Bacula is a comprehensive and complex solution. Aside from the comprehensive documentation available on the Bacula web site, there are several books available that cover itwell, including one available from www.packtpub.com(Network Backup with Bacula How-to}.by Yauheni V. Pankav, pACKT Publishing). Briefly, though, Bacula uses text files for configuration, in directories under jetc/bacula. The Bacula console package provides a graphical console application, although in practice the interface is actually a command line utility.

Prior to installiog Debian, or any Linux distribution for that matter, an administrator should know whether he/she will be using single or dualfmultiboot, and what his boot firmware is (BIOS or UEFI). Itis also good to have some idea of where he/she will place the boot code, what filesystem types he/she will use, and some idea of his partitioning scheme. Ifunsure, the defaults offered by the Debian installer can be taken safely. Iffull disk encryption will be used, the setup depends on the hardware implementation and will probably need to be set up prior to installation. Directory encryption can be set up after the installation.

Once your system is set up, the next major issue to address is installing additional packages, which leads us to the next chapter on package management.

Debian provides several packages to assist the administrator in securing the system. They are all meta packages, and include:

• harden: lbis installs harden-environment and harden-servers
• harden-clients: lbis prevents installation of software clients that have the potential to expose critical information or allow unauthorized access to your system
• harden-environment: lbis installs tools for intrusion detection
• harden-nids: 1bis installs tools for network intrusion detection
• harden-servers: lbis prevents installation of services that are potentially insecure and could allow unauthorized access to your system
• harden-tools: 1bis installs tools to help enhance and analyze system security

There are other hardening packages that install tools to analyze or audit systems remotely, and help developers create more secure programs. The packages can be found by searching the package cache for "harden". One way to do this is the command apt-cache search harden.

Installing any of these packages is just a start, and won't automatically make your system secure. They are just a way of installing groups of security related packages, or preventing certain packages from being installed ifthey have potential security issues. In particular, ifyou install harden-environment, harden-nids, and hardentools, you will also need to consult the appropriate package documentation and configure them properly to detect and analyze security issues, issue the proper warnings, or take the necessary actions.

One thlng to be aware of is that some of these packages prevent the installation of certain services, such as an F1P server. Ifyour server must provide F1P services (for example), then first install the appropriate hardening packages. After the install completes, install the F1P package confirming that you want to remove the hardening package. That way, you at least know that insecure services other than FlP have not been installed. To mamtam that assurance, periodically test what harden-servers would remove ifinstalled. This can be done, for example, by running apt-get -dry-run install harden-servers, and examining the output to see what would be done.

The Linux kernel supports many additional formats, such as Microsoft's NTFS, the various FAT formats, the old OS/2 HPFS, and Apple's HFS. These formats do not support the attributes required by a Linux system, and are thus not appropriate for a root filesystem. They could be used for other data should it be necessary. Note that these formats lack the basic Linux security attributes, although there is some provision for translating the attributes that do exist into their approximate Linux equivalents.

File-level backups can be as simple as a file-by-file copy of everything in your directory hierarchy, to a backup that takes into account the filesystem metadata structures and that doesn't store duplicate data (commonly called data de-duplication). Restoration generally requires a minimal installed system, or a live CO. File-level backups do not have the ability to restore boot sectors or partition tables, so these must already exist or be created prior to restoring your files. Many file-level backup utilities provide the ability to back up only files that have changed since a previous backup.

File-level backups are most useful when individual files or directories are lost or corrupted, or need to be reverted to an earlier version, as only the files necessary need to be restored. This is not possible with low-level image backups.

The Debian Project has a very large and well-defined support structure that includes a lot of documentation, a Wiki, mailing lists and newsgroups, websites, and forums. live help is available on IRe, and there is a well-developed and effective bug tracking system, usable by anyone. It is also possible to contact Debian developers and package maintainers directly, something not always possible with other distributions. These and other available support resources may be found at http://www.debian.org/support.

The thing to remember is that these are volunteers (some of them are, in fact, paid by companies that officially donate their time to the Debian Project). A major release occurs about every two years and is supported with updates for three years, or about a year after the following major release. The response to bug reports and support requests, in my experience, is quite good, and sometimes faster than paid support. Of course, the quality of advice in places like the forums varies with the experience of the person giving the advice. Nevertheless, this works very well for the majority of users. The fact that Debian releases are extremely stable, to begin with, help.

For those who prefer to pay for support, there are a number of companies and individuals that provide such a service. In fact, the Debian website has a page that lists such consultants all over the world.

In a similar vein, although Debian is freely available by downloading from any of the numerous Debian servers and mirror sites, and burning one's own set of installation CDs, DVDs, or Blue-ray discs from the images so obtained, it is also possible to purchase ready-made installation media from third-party vendors.