Debian

One of the stability requirements for Debian is that when a package is installed, it should not adversely affect the system. Often, this is as simple as providing a standard configuration, such as Apache's simple It works! page. In other cases, however, at least some information must be provided during installation in order to create a basic, working configuration. This is handled by having the installation procedure ask the necessary questions during the installation process in order to create a working configuration. Infact, Debian developers have created the extensive debconf subsystem for this purpose.

The debconf subsystem provides the ability to configure packages before, during, and after installation, and it is integrated into all Debian packages that require configuration. Itsupports a number of frontend user interfaces, prewritten answers that can be input to the installation process, a simple interface for asking questions and providing the answers to the installation scripts, and even ways to reconfigure packages any time after installation. In general, this method of configuration provides only the most commonly used configuration options. More complex configurations must be handled by using any utilities provided by the packages, or by editing the configuration files directly.

Even if you edit configuration files directly, Debian admirristrators have passed on various techniques to the developers to ease this process. In some cases, they have created alternative and more understandable configuration files that are scanned and used to create the actual, complex configuration by scripts provided in the package. A good example of this is the GRUB2 boot loader. An administrator makes whatever modifications to the configuration files in Jete/default and /ete/grub. d, and then runs update-grub to create the actual file that GRUB uses to load the operating system. The script then executes the necessary commands for creating and installing the configuration, as well as the necessary updates of other files affected by GRUB reconfiguration. This is just one example of how various utilities created by the Debian developers and other third parties have simplified Debian administration.

Another good example is sendmail. Administrators often modify the files and various database files required by sendmail to tailor it for large, corporate installations. However, instead of compiling the configuration and databases, then forcing sendmail to load the new configuration, a single command, sendmaileonfig, will perform all of the necessary steps at once, with minimal interruption in server operation.

Security is always a concern when remote access to a system is involved. Webmin handles this by requiring authentication and providing for detailed access restrictions that provide a layer of control beyond the firewall. Webmin users can be defined separately, or certain local users can be designated. Access to the various modules in Webmin can be restricted to certain users or groups of users, and detailed logs of Webmin actions are kept.

One of the most useful package types is called meta packages. These are packages that contain no software themselves, but that require other packages to be installed, and thus provide a unified set of software for a particular purpose. This works because, although no actual software is in the meta package, the package manager will select and install all of the required dependent packages, providing a complete set of features in a single, easy installation step.

Frequently, there are multiple packages with slightly different names that install a slightly different set of dependencies. A good example is GNOME. You can install the GNOME meta package, which will provide a complete GNOME installation, including many extras. Or, you can elect to install gnome -core, which provides only the basic desktop environment, and select from any of the additional packages that provide additional features and functions, such as:

• evolution (e-mail software, similar to Outlook)
• gnome-documents (document management features)
• gnome-games
• gnome-media (multimedia applications)
• libreoffice-gnome (office suite) and others

One minor problem with meta packages is that there is no easy way to search for them. Many do have 'meta' in their descriptions, which can facilitate some searches, but this is not universally true. The GNOME packages mentioned previously do not follow this convention as of Debian 7. Nevertheless, they are often fairly obvious, and not too difficult to find.

If you're in charge of one or more systems that are installed at a distant location, backing them up individually can be a large chore. Fortunately, there are a number of packages that can help. Most backup packages, even those intended to create a backup of a single machine, have options to send the data to a remote location for actual storage. Ofcourse, any of the packages with this capability can be used on multiple machines. However, there are two popular packages that not only provide backup services to multiple hosts from a central location, but provide for management of backup cycles and automated runs as well. They are Amanda and Bacula. Of course, other such packages exist, and there are some excellent third-party backup solutions as well. However, both Amanda and Bacula are provided as part of Debian, so they are free as well as able to handle many systems and a variety of backup media.

There are two primary disadvantages to disk or directory encryption. The first is probably the most serious; if the password is forgotten, the data is permanently lost and completely unrecoverable unless unencrypted backups (or encrypted backups where the password has not been lost) are available. The second disadvantage is performance. Most software encryption modules perform well, but there is no avoiding some overhead, even if it is minimal. Hardware encryption, such as that provided by the motherboard or the disk controller or drive itself, generally does not have significant overhead.

Best practice is to evaluate whether the disadvantages of encryption outweigh the potential damage from compromised or stolen systems.

Most corporate policies require partial or full (if available) disk encryption on laptops, and directory encryption as a minimum on public servers.

While the traditional user/group/world permissions structure is adequate for many systems, there are times when more fine-grained control is required. This may be handled by using Access Control Lists (ACL). ACLs are implemented using the extended attributes available in various filesystems and are available by default in the EXT filesystems normally used in Debian Linux. The details may be found in the Debian ael package. In particular, check out the manual pages for the getael, setael, and ehael commands.

While ACLs are useful, there are some issues to be aware of. For example, most graphical file managers do not support them, and some utilities (EMACS comes to mind) clear the file ACL list when updating a file. This can be addressed somewhat by setting a default ACL for the directory, but non-default file ACLs will still need to be reconstructed ifthey are lost. Another issue is performance. On some filesystems, the existence of an ACL delays the initial file access due to the additional access verification required. Since this occurs only on the initial access, its impact is often minimal in practice. Finally, there is the issue of backups when you use ACLs. Most backup utilities now recognize ACLs. In Debian Linux, both rsyne and tar now have options to allow them to recognize and back up ACLs, but they are only handled ifyou use the proper command options. The EXT backup utilities dump and restore also handle ACLs. However, some utilities may not recognize or handle ACLs properly, so always check the package documentation and manual pages if you use Access Control Lists.

Note that, if you do use ACLs, you are not reqtrired to use them for all mes and directories. It is quite possible to set them on only those files and directories that need them. Judicious use of file ACLs and default ACLs set for certain directories will help streamline ACL management.

B-Tree File System (Btrfs) is the next Linux filesystem format. It focuses on faulttolerance, repair, and easy administration, with the ability to scale up to larger storage configurations. ext-based systems can be easily converted to Btrfs. For the moment, Btrfs is still under heavy development, although only forward-compatible fonnat changes are anticipated. Debian 7 does allow it to be used, but it is not yet recommended for production systems.

In general, there are two types of backups: low-level image backups, and file-level backups.

Debian includes a wide variety of software as possible. As of this writing, the Debian stable distribution contains over 48,000 pre-compiled in the latest stable version. According to some counts, this is more than any other Linux distribution. To be fair, many of these are niche applications that do not have a wide user base. But the number of packages is only a part of the story.

The support of many different environments is also a distinguishing characteristic of Debian distributions, and probably one of the most startling. In fact, Debian is unique in the number of different processors supported. At the time of writing, they include both 32-bit and 64-bit Intel and AMD chips, ARM (EABI or little endian version), Intel Itanium, MIPS (both big and little endian), PowerPC (yes, this means it will run on ffiM servers!), System/390 (the old ffiM architecture), and SPARe. In addition, the Alpha architecture was supported up until Debian 6.0, and there are unofficial ports to other ARM architectures as well as Amtel's RISC chip (A VR32), HP's PA-RISe chip (up until Debian 6.0), the Motorola 68000, ffiM system Z, and Hitachi SuperH processors. There is also support for FreeBSD as the primary operating system instead of Linux on Intel 32-bit and 64-bit architectures, and there are other unofficial or experimental non-Linux-based Debian distributions for the GNU Hurd operating system.

This commitment results in a distribution that is extremely flexible, which can be used in a great many environments. Because of this, the Debian developers have chosen not to design a default installation package suitable for most users. A default Debian installs (with no optional software selected) includes only the basics. The administrator is expected to select as options, or install later, the appropriate software. This is not difficult as the base system includes everything necessary to easily install additional software.

This contrasts with Ubuntu Linux, which is based on Debian. A basic Ubuntu installation is designed to work out of the box for the majority of users. Thus, it includes more software, making it an appropriate distribution for a new Linux user without extensive knowledge of what may be available, or a preference for exploring what is there, as opposed to wading through packages offered for optional installation. However, this may also result in an installation with unnecessary components. Of course, they may be easily removed, but it is another example of choosing the proper distribution to reduce the administrator's workload.

This is one reason Debian is one of the major players in commercial servers, as only the software and services necessary are installed, which generally leads to better performance and simpler system management. This also means that Debian will run acceptably on older, poorer performing equipment. Note that, in spite of this, it is also most certainly possible to install a wide variety of software, both during and after installation, which will allow a Debian system to fulfill even the most insatiable developers.

Although Debian stays close to the upstream software developer's configuration methods, the Debian developers frequently modify configuration file layout to simplify local configuration and upgrades, and often provide additional utilities to ease the administrator's job. Third-party utilities are sometimes available as well, but the administrator should understand that the output of these utilities may not always follow the Debian configuration layout.

Now, with basic software configuration out of the way, it's time to cover more system wide administration issues.