Debian

So, what are some of the utilities provided for Debian administration? We've already mentioned a couple of specialized ones for GRUB and sendmail. There are many others that handle specific software or services, either included in the Debian package itself, or in a separate package. Here, however, we're concerned with more general utilities. The two main ones are dpkg-reeonfigure and gadmin.

In addition to Webmin, there is a server called Usermin which may be installed from the same repository as Webmin. It allows individual users to perform a number of functions more easily, such as changing their password, accessing their files, read and manage their email.andmanagingsomeaspectsoftheiruserprofile.Itis also modular and has the same security features as Webmin.

dselect, APT, aptitude, and Synaptic, all provide some form of automatic dependency resolution. In rare cases, a dependency can't be resolved automatically, and user intervention is required. aptitude will calculate alternatives and ask the user to select from them. APT and Synaptic generally require the user to add packages to the command line or selection list manually.

Such problems generally only occur in the testing and unstable releases, where software dependencies are constantly updated and some may not completely resolve until all of the software involved has been updated and placed in the release. However, one common source of this problem occurs in the stable release as well, and is due to a dependency on a virtual package.

A virtual package is not the name of an actual package, but the name of a library or function that anyone of a number of packages can provide. Since there are usually multiple packages that can satisfy the dependency, the user must choose one to manually install, after which the remainder of the original dependencies can be satisfied automatically. TIlis rarely occurs during a standard upgrade, and almost never during a distribution upgrade, where such virtual packages are selected automatically.

In general, you will only see this probland then rarely, when installing single packages manually.

For many years, the University of Maryland (UoM) Computer Science department was the source of quality, free software that rivaled or even surpassed proprietary solutions. The Advanced Maryland Automatic Network Disk Archiver (AMANDA), is one such solution. Although no longer supported by UoM, it is now hosted on SourceForge, where it remains in active development. In addition to the free Community edition, there is a paid Enterprise edition that includes additional features, such as a graphical configuration utility.

Originally oriented heavily towards centralized tape backup of many networked systems, it now supports disk and even cloud-based storage of backup data as well. Amanda requires a software client running on the systems to be backed up. Oients are available for most Unix type systems, as well as Mac as/X and various Windows releases. The server side will run on pretty much any Unix-or Linux-based system. This makes Amanda especially useful for large, heterogeneous sites.

Amanda uses standard tape and disk file formats, which allows standard tools, such as mt and tar, to be used to browse or even recover data if desired. Amanda provides for parallel backups of many systems at once, backup file management; restore utilities that are easy to use, and several layers of security (including encryption of the backup data over the network, and encryption of the backup files). Amanda is implemented as a single central server that communicates with multiple clients.

A discussion of Amanda configuration could take up a whole book and is very dependent on the type of backup media you use and the systems you are backing up. However, briefly, the community (free) version of Amanda must be configured manually, by adding subdirectories and configuration files to the /ete/amanda/ configuration directory. Refer to the documentation that comes with Amanda, or visit the www •amanda. org website for further information. Also, several commercially published books on backup and recovery have chapters on Amanda configuration.

The actual installation is quite straightforward, and is considered one of the simplest distributions for base installs. Boot up the installation disk, and answer the necessary questions. A help button is frequently available to provide additional information during the installation. Also, standard and advanced installation subjects (including much of what is discussed in this chapter) are covered in detail in the Debian installation guide for the current release, available at http://www.debian.org/

releases/stable/installmanual.

software (such as the desktop environment which installs KDE, GNOME, XFCE, or LXDE, "Laptop" which installs software commonly used on laptops, and so on, all described io the installation guide). Doing this installs a standard set of additional software that suits most users' needs.

Root access to a system is a serious issue. Anyone who knows the root password can do great damage, and the more people who know it, the greater the chance of the password getting into the wrong hands. To avoid this problem, the Budo package provides the ability to run commands as if one were the root user (including, if desired, a shell with full root permissions) without requiring the root password, only the user's own password and proper authorization. The advantage of this is that authorized commands are logged with the user's ID, providing an audit of who actually performed the command.

When Budo is used on a system, the only remaining use for the administrator password is when the system is booted into maintenance (single user) mode. Most Linux distributions, including Debian, reqtrire the root password before providing the root shell prompt in single user mode. However, this requirement can be bypassed in several ways by someone with access to the physical console. Therefore, many administrators completely disable the root password. When this is done, booting into maintenance or single user mode no longer prompts for the root password.

By disabling the root password completely, root-level access to the system via any method other than Budo, other programs that provide root privileges to normal users (also known as setuid programs), or via boot into single user mode is not possible. Note that, since booting into maintenance mode no longer requires a password, physical access to the system console must be controlled in some other way. This may be done by physical means, by requiring a password for the system boot via BIOS (Basic Input/Output System) or UEFI (Unified Extensible Firmware Interface), or by password protecting the GRUB or other system boot loader.

Best practice is to disable the root account login completely. Ubuntu , now does this by default, and Debian is moving in that direction Make sure you either restrict physical access to the console or password protect the boot process.

The /ete/sudoers file and files in the /ete/sudoers.d directory are where sudo access is configured. The details are provided in the sudo package documentation. Briefly, access to commands can be allowed or restricted by individual user, group members, or even lists and can allow access to commands depending on the remote host from which the user is accessing the system.

There are various fonnats supported for clustered systems, including AFS and GFS2. In general, they are not used for the basic system files required for booting, but are better suited for shared data. It is possible to set up such systems for booting, but this is beyond the scope of this discussion. Ifyou are interested, there are a number of publications available on Linux clustering. A good starting point might be the Wikipedia article on clustered filesystems at http:/len. wikipedia.org/wikil Clustered_file_system.

Low-level disk image or so-called Bare Metal backups, are byte-level copies of a full partition or even a complete logical or physical disk. Some utilities will only include used sectors in the copy, thus reducing the size and speed of the backup and restore operations, but this is not always the case. When restoring such a backup, some sort of media, such as a live CD, is required in order to boot up the software to restore the image.

Full disk byte-Ievel backups are useful ifyou need to duplicate or restore a system quickly, as long as the disk being restored is the same or larger. Partition backups of this type may also be done, but in order to restore them you will need some way to restore the partition information to the disk partition table.

Low-level backups are useful in two situations:

• When a system must be replaced and restored quickly with identical hardware
• When a system needs to be duplicated many times on identical hardware

A good example of the latter is when a company provides workers with preconfigured systems all with identical or nearly identical initial configurations. In this case, itis easy just to restore the disk from a standardized copy whenever a new system is required or an old one needs to be returned to its original condition for a new employee.

Now that we have the background on how Debian is organized and developed, the question to be answered is, "how does this affect the administrator."

There are three primary areas which an administrator needs to be aware of. They are as follows:

• The availability of support
• The availability of proprietary features
• licensing issues

Aside from configuring individual software packages, an administrator is responsible for managing how the various services on his systems are started and stopped, managing network connections, maintaining the filesystem, managing system logs, and configuring the face the system shows to the users.