Debian

Configuration files are placed in / etc by most software developers, and this is standard practice for Debian packages. If the file is fairly simple, and the only file required, it is often placed directly in / etc with a .conf extension, such as / etc/ inetd. conf for the openbsd-inetd package. For packages that require a more complex configuration, usually via multiple configuration files, those files are placed in a subdirectory of /etc which is generally named after the package. A good example of this is the apache2 package, which has its configuration files in / etc/ apache2 and its subdirectories.

Multiple files in a subdirectory are used for a number of reasons. In some cases, it is because the original software uses different files for different purposes. In other cases, it is done to organize configuration items into a more manageable and understandable group. Occasionally, Debian developers have modified the package to organize the configuration to simplify or streamline administration.

A good example of this is Apache. Normal Apache configuration is either by a single file or multiple files that are included by the master configuration file. Traditionally, SSL (Secure Sockets Layer) certificates and keys, and Virtual Host configuration files are contained in a subdirectory, but all major options are configured in one or a few files in the main directory. Debian has actually split the configuration into many files in various subdirectories. This allows Debian to supply separate packages that provide certain features via individual configuration files that are added to the proper directory, rather than requiring modification of the primary configuration files. Also, there are subdirectories for modules and virtual hosts prefixed by available-or enabled-. This allows a simple script to activate or deactivate modules and virtual hosts easily and quickly.

As it's not yet available in the stable release, Debian developers are taking this concept further in future releases, by providing a config-available and config-enabled directory, as well as allowing features to be activated and deactivated without editing config files or installing or removing feature packages. This will probably be available in Debian 8, code-named Jessie.

Webmin understands the configuration file layout of many distributions. The main problem is when a particular module does not handle certain types of configuration in the way the Debian developers prefer, which can make package upgrades somewhat difficult.

This can be handled in a couple of ways. Most modules provide a means to edit configuration files directly, so if you have read the Debian documentation you can modify the configuration appropriately to use Debian specific configuration techniques. Or, you may choose to allow Webmin to modify files as it sees fit, and handle any conflicts manually when you upgrade the software involved. Finally, you can avoid those modules involved with specific software that are more likely to cause problems.

Webmin modules are constantly changing, and some actually recognize the Debian file layouts well, so it is not possible to give a comprehensive list of modules to avoid at this time.

Best practice when using Webmin is to read the documentation and check the configuration files for specific software prior to using Webmin. Then, after configuring with Webmin, check the files again to determine whether changes may be required to work within the particular package's Debian configuration framework. Based upon this, you can decide whether to continue to configure using Webmin or switch back to manual configuration of that particular software.

Webmin runs in the background, and provides an H1TP or H1TPS server on localhost port 10,000. You can use any web browser to connect to http:// loealhost: 10000/ to access Webmin. Upon first installation, only the root user or those in a group allowed to use sudo to access the root account, may log in but Webmin users can be managed separately or in conjunction with local users.

Webmin provides extensive and easy to understand menus and icons for various configuration tasks. Webmin is also highly modular and extensible, and an extensive list of standard modules is included with the base package. Itis not possible to cover Webmin as fully here as it deserves, but a short list of some of its capabilities includes:

• Configuration of Webmin itself (the server, users, modules, and security)
• Local system user and password management
• Filesystem management
• Bootup and service management
• CRON job management
• Software updates
• Basic filesystem backups
• Authentication and security configuration
• APAo-IE, DNS, SSH, and FTP (if you're using ProFTP) configuration
• User mail management
• Qmail or sendmail configuration
• Network and Firewall configuration and management
• Bandwidth monitoring
• Printer management

There are even modules that apply to clusters. Also, Webmin can search and allow access to other Webmin servers on the local network or you can define remote servers manually. This allows a central Webmin server, installed on a particular system, to be the gateway to all of the other servers in your environment, essentially providing a single point of access to manage all Webmin enabled servers.

Both aptitude and dselect provide a basic, interactive interface as well. You can navigate through a list of available packages, classified according to sections, or you can search for packages using a number of criteria. The interface is based on the simple curses library, and can seem cumbersome at times, although it is an improvement over the command line utilities mentioned previously. One advantage of these interfaces (as well as the command line utilities) is that they can be used in a terminal environment and do not require a graphic desktop environment be installed. They are frequently used on high-performance servers where a graphic desktop environment is not installed for security or performance reasons.

On the other hand, Synaptic provides a full GUI interface for browsing, searching, and selecting packages, as well as configuring repositories, selecting installation options, and providing information on available and installed packages. It requires a graphic desktop environment, such as GNOME or KDE, in order to operate.

Synaptic can be run remotely, over a Secure Shell connection, from " a system that does have a graphic window manager installed. Some administrators install Synaptic on servers without graphical desktops and use it in this manner to avoid security or performance issues of graphic environments on the server itself.

In this final chapter, we'll cover briefly several advanced administration subjects. Remote backups and configuration administration will be covered, and we will briefly look at cluster management. Finally, we will look at one of the most useful administration tools for any Linux system, Webmin.

An alternative to encrypting full partitions or disks is to encrypt portions of a filesystem, usually a directory and everything below it in the hierarchy, by using special features of Linux so that the encryption and decryption are handled automatically by the kernel or special software in the background. Thus, there are no implications for booting (as long as the boot directory isn't encrypted) and no installation issues, as it is configured after installation. Directory encryption is appropriate for servers containing sensitive information that resides in certain parts of the directory hierarchy.

Debian provides several packages for this type of encryption. The two most common are encls and cryptsetup.

Traditionally, there are two ways to set up the default group assigned to a new user. The first is to have everyone assigned to a single users group. This will allow all users on the system access files and directories with group read (and execute) permissions, and write to files with group write permissions.

The other way is to give each user his own groups, usually with the same name as his user ID. This is the default in Debian, and this scheme is often referred to as user private groups. Ifuser A wants others to be able to access certain files or directories via the group permissions, someone with system privileges that allow group modification must add the appropriate user IDs to user A's group.

At one point, a single users group was common practice. Best practice at present, though, is to use user private groups.

This is similar to the most common way to handle developer's access to each other's files. In this case, though, a new group, such as web-dev or whatever you feel is an appropriate group name, is created and the developers are assigned to it as necessary. A similar technique is used for some administration tasks as well. For example, an ftpadmin group that is allowed to modify the FTP server directories and files in ways that the normal (and especially the anonymous) ftp user cannot. Careful creation and assignment of groups can facilitate proper user access to files while preventing undesired access or modification.

User and group maintenance is handled by the standard command-line functions, such as useradd, usermod, userdel, groupadd, groupmod, and groupdel, all documented in the passwd package. Of course, there are GUI utilities available for user and group maintenance as well.

Reiser File System (ReiserFS) was intended to supplant ext3 as the filesystem of choice for Linux, offering improved performance. At one point, ReiserFS version 3 was the default format choice for SuSE Linux. Version 4 was released, but development waned when the company went out of business, and SuSE eventually decided to go back to ext3 as its default.

ReiserFS offered some advantages over fonnats existing at the time, but it has fallen behind in some performance areas. It does support dynamic resizing, while other filesystems must be offline in order to be resized, or use a logical volume manager to provide virtual resizing support.

Partition resizing may be required ifyou need more space. To get a quick overview of your disk space usage, use the df command. There is also a disk usage (du) command that summarizes file and directory space. Refer to the manual pages for details.

Ifyou must resize a disk partition, the procedures are fairly straightforward but there are some considerations.

There is always a risk in modifying your partition layout. Make sure you have current backups prior to modifying the layout.

If the partition is being expanded, there must be room to expand it. Ifyou are using Logical Volume Manager (LVM), this can be as simple as adding a physical volume to the volume group ifthere is not enough space left in it. If you are not using L VM, or ifyou have multiple partitions configured on the same logical volume, then there must be free space available on the physical disk or logical volume following the end of the partition to be expanded. Ifthere isn't, it must be created somehow. Ifthe partition is to be shrunk, space is not an issue, although you may want to move or expand other partitions to use the space freed up by shrinking. Also, it is sometimes necessary to move partitions around. This is not necessary ifyou use L VM and assign one partition per logical volume.

Moving or shrinking a partition may only be done with unmounted (offline) partitions, since itrequires moving files and risks corruption ifany files are in use. Some filesystems, EXT3 and EXT4 in particular, may be expanded while the partition is still mounted, however, since this doesn't require moving any files, just modifying the filesystem metadata.

While each filesystem architecture has appropriate tools for resizing and there are simple tools for managing the partition table, the primary tool for managing partitions is parted. There are other, mostly commercial tools, but parted does pretty much everything that is necessary, is available as an easy to use graphical utility (gparted), and it is free. There is even a live CD version you can boot to manage your partitions regardless of what operating system is installed. Many Windows administrators use it quite successfully. Ithandles both enlarging and shrinking partitions as well as moving them, and will handle many different filesystem architectures, and ensures that the partition table matches the filesystem sizes.

Unfortunately, neither parted nor gparted will not allow you to expand a mounted partition. Ifyou must expand a partition while it is in use, you must delete and recreate the partition with the same, identical beginning position, force a reread of the partition table, and then use the appropriate filesystem resizing commands. This is extremely dangerous and should never be used for resizing the root partition.

The procedures for modifying partition layout are straightforward. .ct Note that ifyou aren't booted from a gparted live CD or similar utility disk, you cannot unmount partitions required to run the necessary utilities and operating system services.

To manually modify your partition layout:

1. Ensure there is adequate space for the expanded partition, or to hold the partition being moved. If necessary, shrink or move other partitions or expand the logical volume.
2. You must ensure the partition table matches the resized or moved partition exactly. Failing to do this can result in corrupted or lost data. gparted will handle this for you automatically.
3. To shrink a partition, it must be offline (unmounted). Resize the filesystem first, then modify the partition table to match the new size.
4. To expand a partition, modify the partition table first, then expand the filesystem. Ifyou are doing this with a mounted partition, you must use the procedure outlined previously.
5. To move a partition, you must first create a new partition of the same size as the original. Then you must unmount the current partition, copy the data to the new partition exactly, and delete the old partition.

In all cases, the partition must be clean prior to modifying or moving it, and should be checked afterwards prior to mounting it. The gparted utility or similar will handle the steps above automatically, including the necessary filesystem checks, data movement, and partition table modifications.

Note that either gparted or the manual procedures may be used on a Jive system, provided the partitions being modified can be unmounted, or if a mounted partition must be modified, itis only being expanded and gparted is not being used.

Unless you must expand a partition while it remains mounted and in use, the recommended procedure is to boot from a gparted live CD. lhis greatly simplifies the whole process, allows modification of all partitions, not just those that aren't required for operating system services and necessary utilities, and reduces the risk of corruption.

Another result of Debian's licensing policies is the existence of three distinct software repositories:

• main: These are packages whose license conforms to the DFSG
• contrib: These packages have licenses that also conform to the DFSG, but that depend on other packages or libraries that do not
• non-free: These are packages whose license does not conform to the DFSG but that are allowed to be distributed with Debian

Users are free to choose whether to allow software from the contrib and non-free classes to be installed. If it is installed, the users are responsible for knowing and following the appropriate licenses.

Other, non-official repositories also exist, which host software that, for one reason or another, isn't included in any of the official Debian repositories.