Skip to main content

Debian

Removing Debian packages

Removing packages is also handled by any of the package managers. Something to be aware of, however, is that apt-get and Synaptic do not automatically remove dependencies after the package that depends on them is removed. The command apt-get autoremove should be used to do this, no matter which package manager was used for installation and removal. aptitude does this automatically.

Bacula

Bacula is another popular free backup package. Itis designed to be more modular than Amanda. Like Amanda, itrequires a client on the system to be backed up. In addition to the client, however, there is an administrative console service, a status monitor service, a backup director which controls the actual backup operations, a storage service that keeps the actual backup data, and a database service where the backup information and catalogs are mamtained. Of course, except for the client (which must reside on the systems being backed up), these services may be spread among different systems or consolidated on a single server.

Bacula configuration is object-oriented, in that you define clients, jobs, schedules jobs, file sets (to be backed up), storage pools to hold the backup data, messages (to handle emailing of reports), the catalog database, and the director which coordinates the whole thing. There are many useful functions, including some that allow restoration of a system without access to the catalog, creation of boot CDs which will allow a full, bare metal restore.

One thing to note is that the Bacula rescue CD is set up to restore disk partitions exactly as they existed at the time of the disk creation. Ifyou need to run a bare metal restore to a system with a different disk configuration, the rescue CD also provides the fdisk utility, and you can add other utilities to it ifyou wish.

The Bacula director and storage components run on Linux, FreeBSD, or Solaris. Ithas also been reported to work on some Windows versions, Mac OS/X, and other BSD variants, although this is not officially supported. The client is available for many different systems, including various Linux, Windows, Mac, and BSD systems. Bacula is also reported to work on AD, BSDI, and HPUX systems, although this is not officially supported.

Installing Bacula on Debian is straightforward. There are packages for each of the various parts, as well as, several meta packages. The bacula meta package installs both the bacula-client and bacula-server meta packages. The client package installs the Bacula console and file daemon (client). The server package installs the Bacula director and storage packages. There are several choices for the Bacula director, depending on what database you wish to use for your catalogs. The packages may be installed either via the meta packages or individually, as desired.

As with Amanda, Bacula is a comprehensive and complex solution. Aside from the comprehensive documentation available on the Bacula web site, there are several books available that cover itwell, including one available from www.packtpub.com(Network Backup with Bacula How-to}.by Yauheni V. Pankav, pACKT Publishing). Briefly, though, Bacula uses text files for configuration, in directories under jetc/bacula. The Bacula console package provides a graphical console application, although in practice the interface is actually a command line utility.

Summary of Filesystem Layout in Debian

Prior to installiog Debian, or any Linux distribution for that matter, an administrator should know whether he/she will be using single or dualfmultiboot, and what his boot firmware is (BIOS or UEFI). Itis also good to have some idea of where he/she will place the boot code, what filesystem types he/she will use, and some idea of his partitioning scheme. Ifunsure, the defaults offered by the Debian installer can be taken safely. Iffull disk encryption will be used, the setup depends on the hardware implementation and will probably need to be set up prior to installation. Directory encryption can be set up after the installation.

Once your system is set up, the next major issue to address is installing additional packages, which leads us to the next chapter on package management.

Debian hardening packages

Debian provides several packages to assist the administrator in securing the system. They are all meta packages, and include:

  • harden: lbis installs harden-environment and harden-servers
  • harden-clients: lbis prevents installation of software clients that have the potential to expose critical information or allow unauthorized access to your system
  • harden-environment: lbis installs tools for intrusion detection
  • harden-nids: 1bis installs tools for network intrusion detection
  • harden-servers: lbis prevents installation of services that are potentially insecure and could allow unauthorized access to your system
  • harden-tools: 1bis installs tools to help enhance and analyze system security

There are other hardening packages that install tools to analyze or audit systems remotely, and help developers create more secure programs. The packages can be found by searching the package cache for "harden". One way to do this is the command apt-cache search harden.

Installing any of these packages is just a start, and won't automatically make your system secure. They are just a way of installing groups of security related packages, or preventing certain packages from being installed ifthey have potential security issues. In particular, ifyou install harden-environment, harden-nids, and hardentools, you will also need to consult the appropriate package documentation and configure them properly to detect and analyze security issues, issue the proper warnings, or take the necessary actions.

One thlng to be aware of is that some of these packages prevent the installation of certain services, such as an F1P server. Ifyour server must provide F1P services (for example), then first install the appropriate hardening packages. After the install completes, install the F1P package confirming that you want to remove the hardening package. That way, you at least know that insecure services other than FlP have not been installed. To mamtam that assurance, periodically test what harden-servers would remove ifinstalled. This can be done, for example, by running apt-get -dry-run install harden-servers, and examining the output to see what would be done.

Non-Linux formats

The Linux kernel supports many additional formats, such as Microsoft's NTFS, the various FAT formats, the old OS/2 HPFS, and Apple's HFS. These formats do not support the attributes required by a Linux system, and are thus not appropriate for a root filesystem. They could be used for other data should it be necessary. Note that these formats lack the basic Linux security attributes, although there is some provision for translating the attributes that do exist into their approximate Linux equivalents.

Debian File-level backups help

File-level backups can be as simple as a file-by-file copy of everything in your directory hierarchy, to a backup that takes into account the filesystem metadata structures and that doesn't store duplicate data (commonly called data de-duplication). Restoration generally requires a minimal installed system, or a live CO. File-level backups do not have the ability to restore boot sectors or partition tables, so these must already exist or be created prior to restoring your files. Many file-level backup utilities provide the ability to back up only files that have changed since a previous backup.

File-level backups are most useful when individual files or directories are lost or corrupted, or need to be reverted to an earlier version, as only the files necessary need to be restored. This is not possible with low-level image backups.

Debian Support

The Debian Project has a very large and well-defined support structure that includes a lot of documentation, a Wiki, mailing lists and newsgroups, websites, and forums. live help is available on IRe, and there is a well-developed and effective bug tracking system, usable by anyone. It is also possible to contact Debian developers and package maintainers directly, something not always possible with other distributions. These and other available support resources may be found at http://www.debian.org/support.

The thing to remember is that these are volunteers (some of them are, in fact, paid by companies that officially donate their time to the Debian Project). A major release occurs about every two years and is supported with updates for three years, or about a year after the following major release. The response to bug reports and support requests, in my experience, is quite good, and sometimes faster than paid support. Of course, the quality of advice in places like the forums varies with the experience of the person giving the advice. Nevertheless, this works very well for the majority of users. The fact that Debian releases are extremely stable, to begin with, help.

For those who prefer to pay for support, there are a number of companies and individuals that provide such a service. In fact, the Debian website has a page that lists such consultants all over the world.

In a similar vein, although Debian is freely available by downloading from any of the numerous Debian servers and mirror sites, and burning one's own set of installation CDs, DVDs, or Blue-ray discs from the images so obtained, it is also possible to purchase ready-made installation media from third-party vendors.

Startup and shutdown

The proper startup and shutdown of services required for a system to function and fulfill its purpose is central to its management. While Unix init scripts (also known as System V or Sys V scripts, due to their origin in Unix System V) have a long history and are in one form or another, common to all Unix and Unux systems, the way in which they are managed, sequenced, enabled, disabled, and the preferred script format often differs somewhat between distributions. The primary areas to be aware of for Debian startup and shutdown scripts include the purpose of run levels, dependency-based sequencing, and utilities available for administering the boot sequence.

Debian Server Operating System Help

"What is the best distribution for my needs? What do I need to know to administer a Debian system? What's different about Debian? What is the best way to handle something specific in Debian? I ran an Internet search on these questions and got millions of results. Now, what do I do? Can someone help me?"

The answer to the last question is yes. Answering the others requires a bit of background. This discussion is oriented towards those who are new to Debian. In it, we'll cover Debian's place among the various Linux distributions, project organization (and how that impacts administration), and licensing issues. Those who are already familiar with Debian may wish to skip ahead to the next chapter.