Debian

After installing the software you need for your system, it is good practice to check for updates at regular intervals. In particular, security updates are released as soon as possible after a security flaw in any Debian software is identified.

Itis easy to update a Debian system. After updating the package cache (see the previous section on Updating your package cache) so that it holds current information on all software in the repositories, the Synaptic mark all upgrades menu item, or the apt-get or aptitude upgrade command will update all software with any newer versions available.

Of course, Debian offers other backup packages as well. They are less complex than Amanda or Bacula, but more suited to smaller environments. Most use standard file archiving utilities, and offer remote storage options (either via standard remote file specification or by using a client and server approach). Some offer backup cycle management utilities, backup encryption, communications encryption, and even deduplication when using special backup storage formats. Synaptic or apt-cache can be used to search for these packages using the search term backup.

Some administrators prefer to keep iteven simpler and write their own short scripts which use the basic archiving commands (such as rsync, tar, or the EXT dumpj restore commands) to perform backups as a scheduled CRON job.

You've installed a basic system, now it's time to install additional software. Or, if you've selected some tasks during installation, you want to see what's installed and maybe remove some you won't use. Maybe your boss has asked for a report on what's installed. Or what about security updates?

All of these, and more, are the province of the Debian package management system. In this chapter, we'll cover package managers, software selection and maintenance, how to update your system, and how to set up automatic updating.

A note for beginners

TItis section assumes that you are familiar with using the root account. Information on accessing root account functions is available at https://wiki. debian.org/Root, and in the Debianreference manual at http://www .debian. org/doc/manuals/debianreference/. Quick help for commands mentioned in this chapter (as well as most Linux commands) can be obtained by executing man or info command name> from the command line, or using the help button available in most graphical applications. The Debian reference manual also contains more detailed information on using the package manager commands in this chapter.

One thing that the hardening packages do not provide is tools for protecting your systems via firewalls. This absence belies their importance in securing your systems, as a short search of Debian packages will show many tools for building firewalls. They vary from simple to complex, and from command line to full graphic interface. Nearly all are frontends for IPTABLES, the Linux kernel firewall modules and associated commands, and produce appropriate configuration files. Some provide a simple configuration language that is more readable than the standard iptables commands, which the tool then translates into the proper commands for you. Some provide a way of defining firewall policies, which are then translated into proper iptables configuration commands.

Even ifyour system is already behind a firewall, it is good practice to provide its own firewall as well. This multilayer approach provides additional protection in case the first firewall is somehow compromised.

Of course, with the variety of firewall packages available, itis difficult to recommend any particular package over the others. Each has strengths and weaknesses. However, if we restrict ourselves to the more popular packages, there are a few general recommendations that can be made.

First, for desktop and development systems which don't require extremely complex configurations, firestarter (for GNOME) or guarddog (KDE) are good starting points. They are oriented towards beginners but have advanced options that can be useful to more experienced users. Both are graphical applications. A special case is fireflier, which actually analyzes the applications traffic on the system and recommends rules. Mason is a similar application, but it does not offer a graphical interface.

For servers or systems that require more robust protection, consider fwbuilder. Itis similar to many enterprise firewall management systems and can provide configuration not only for Unux (both IPTABLES and IPCHAINS ruIes), but also BSD, Mac OS/X, and Osco access-lists as well. Configurations for muItiple servers can be kept in one place and installed remotely as needed. Refer to http://www. fwbuilder.org/ for more information.

A popular alternative is Shorewall, which can also handle traffic shaping and IPsec to some extent. Shorewall uses text configuration files rather than a graphic interface. More information may be found at http : / / shorewall .net/.

In all cases, for Debian Linux, the firewall packages control traffic by generating the IPTABLES rules used by the kernel modules to recognize, analyze, and control network traffic.

Many other formats are available, such as seQ's Unix BFS, QNX, and BSD's UFS. Although Unix-related, they are not considered appropriate for Linux root installations due to slight differences in attribute handling. They may work fine, but the Linux-specific fannats generally have better perfonnance and features.

There are many backup utilities available and they vary from simple ones appropriate for individual systems, to complex backup suites appropriate for managing backups for multiple production systems and clusters.

The simpler utilities generally provide file-level backups that are written to external media or even a remote network location. They frequently provide options for incremental backups, where only changed files are copied after the first, full backup. Mostly, these are command line utilities which can be scripted and executed periodically via a CRON job, although there are graphical front ends available. The disadvantage of most of these are that in the event you need to restore after a complete disk failure, you must have some other means of restoring the partition information correctly, and of recreating the boot sector information properly so the system will be bootable.

Among the more common of the simple utility commands are rsyne and tar. Frequently, these utilities are used in the more complex backup software to actually store the data. Ifyou use one of the EXT filesystems, the dump and restore commands are of particular interest, because they understand and take into account the filesystem's metadata and are thus faster and more efficient than the simpler copy utilities. The disadvantage, of course, is that restores may only be done to an equivalent EXT filesystem. Other utilities such as rsyne can restore to a completely different filesystem type, although certain metadata, such as file ownership and permissions, may be lost if the type is too different, such as backing up from an EXT4 filesystem and restoring to an NTFS partition.

More complex backup software is sometimes capable of so-called Bare Metal backups. These combine small, low-level backups of (or at least the ability to recreate) the non-filesystem structures such as the partition tables and boot sectors, with file-level backups of the filesystem contents. Many are multisystem backup solutions that can be administered from a central location and which can store the backups on various media in various locations. Usually, these multisystem suites include the ability to define and control backup schedules, contents, and locations as well as provide for off-site archiving.

Simply put, there is no paid version of Debian with extra features.

One of the side effects of this is that there is no official Debian-unified administration utility. SuSE, for example, provides YaST, and Ubuntu provides UCc. However, there are many configuration and administration tools available in the distribution, and the various window managers, such as GNOME and KDE gather their administrative menu entries in one place for easy use. likewise, there are third-party applications that work well on Debian that bring most, if not all, common tasks into a single place with a unified and user-friendly interface.

Probably the most important issue the administrator will run into is the problem of supported hardware. While Debian attempts to support as wide a variety of hardware as possible, some manufacturers don't provide information on their proprietary hardware. Without such information (required to write a driver), if a manufacturer doesn't provide a Linux driver, it won't be supported in Debian.

There are special cases. Certain Windows XP drivers can be used by Linux if they are available, but they require additional steps to install and activate them.

Actually, this isn't so much a Debian issue as a Linux issue. Some distributions that offer a paid version may include proprietary drivers in the enhanced version. However, in general, if your hardware is supported by Linux, it will work with Debian. There are a number of pages available on the Debian Wiki as well as other sites explaining how to get Linux and Debian to run on many systems with unusual hardware. Furthermore, with the gain in popularity of Linux, many manufacturers are providing the necessary drivers, if not free and with a license that allows them to be included in the base distribution, at least in a format that can be installed and used with Debian.

Best practice: check hardware support lists and compatibility sites for Linux before purchasing hardware or installing any distribution.

In Debian, as in nearly all Unix/Unux operating systems, run levels from 0 through 6 are available, defined as follows:

• 0: System Halt
• 1: Single User (maintenance)
• 2 to 5: Multi-User Modes
• 6: System Reboot

Note that run levels 2 through 5 are identical in Debian. This is unlike some other distributions, such as RedHat, Fedora, SuSE, or OpenSuSE, which give specific purposes to some of these run levels. For example, run level 2 in these distributions is often defined as one without network support, 3 with networking, 4 with file sharing, and 5 includes a display manager which isn't active in the other run levels.

In most Debian systems, there is no difference between the multiuser run levels, and all of the init scripts default to active in levels 2 through 5. This doesn't mean you can't define your own purposes for different run levels. However, ifyou do choose to do this, do not manually edit the various links to init scripts in the run level directories. The update-re. d command should be used instead. The reason for this is that Debian now defaults to dependency based boot sequencing.

Debian is just one of many Linux distributions. Selecting which distribution is best for your deployment can be a rather daunting task. The reason for so many distributions is that the developers or sponsors of each have a different vision of which software should be installed by default, which software is appropriate for particular tasks, and how the system is best administered. This means that selecting a distribution that matches your purpose and preferences will make installation and administration easier.

Any distribution can be made to reflect an administrator's preferences, by installing non-default software or, in some cases, software not native to the distribution software and using non-default configurations.

However, selecting an appropriate distribution means less effort is necessary to fulfill the and administrator's requirements.

This utility reruns the same configuration scripts that run during installation. It is run from the command line, and options can be used to vary the level of complexity of the questions asked. It is generally used when extensive, local modifications aren't required and the admirristrator just wants to update the basic configuration as provided by the installation scripts. It is also useful if the basic configuration has been corrupted, or changes made that have caused the package to stop working, to return it to the configuration provided immediately after installation.

Itis generally not useful if the configuration requires options that are not commonly used, or if the configuration requires extensive local modifications that aren't normally covered by the installation scripts, except perhaps to return the configuration to a post-installation condition as noted previously.