Debian

You've selected the packages to upgrade (or are performing an all at once upgrade), and started the process. The first thing to note is what packages are going to be removed. If one or more of them appear to be packages you need, cross-check them with the packages being installed to see if they are being replaced by a new package with similar functions. If they are not, make a note to follow the upgrade with a separate installation of whatever packages are required.

During a distribution upgrade, the system can generally remain in operation, although there will be slight disruptions when a package requires certain services to be restarted or libraries to be loaded.

These disruptions are more severe than a nonnal upgrade, particularly in cases where a package is removed and replaced with a different one to fulfill the same function, or removed because it is obsolete. Therefore, you may want to infonn users prior to the upgrade, and keep system activity to a minimum.

The next thing to watch for is the upgrade notes. Major changes are in how some software works are displayed (and e-mailed to the root account for later checking as well) in order to notify the installer of necessary post-installation steps to be taken.

Finally, when the administrator has made changes to the configuration of a package, the upgrade process will notify him/her of the non-default configuration and ask for help in resolving the differences. This involves leaving the current local version in place, replacing itwith the developers' version, or pausing the installation so the differences can be examined and resolved manually.

Often there are new options or defaults that should be added to the old configuration. Best practice is to either resolve the changes immediately, or keep the old configuration and cross-clteck it later with the new default

configuration (which is placed in the same directory with a modified name to keep it inactive but available for just this reason).

Two primary functions are required to implement a high availability cluster:

1. A way to handle load balancing and individual host fail-over.
2. A way to synchronize storage so that all servers provide the same view of the data they serve.

Debian includes meta packages that bring together software from the Linux High Availability project, including cluster-agents and resource-agents, two of the higher-level meta packages. These packages install various agents that are useful in coordinating and managing load balancing and fail-over. In some cases, a master server is designated to distribute the processing load among other servers.

Data synchronization is handled by using shared storage and any of the filesystems that provide for multiple accesses and shared files, such as NFS or AFS.

High Availability clusters generally use standard software, along with software that is readily available to manage the dynamics of such environments.

All of the configuration for media or repositories resides in /etc/apt, in a file called sources . list and any files in /etc/apt/sources .list.dwith a .list extension. These files can be modified manually using your preferred editor, manipulated by various API utilities such as apt-add-repository or apt-spy, or via a menu item in the Synaptic Gill. Details on how each method works are available in various man pages, such as those for sources . list, apt-add-repository and apt-spy, and so on, or in the help files for Synaptic. However, since they all depend on the same configuration files and format, the required entries are all similar.

Each line includes an indicator of whether the repository contains binary packages or source packages (from which binary packages can be built), the location of the repository, the identity of the release, and the sections from which software may be selected. Generally, an entry for the media from which you installed Debian has already been made during the installation process, along with an entry for the online repositories if they were used during installation as well.

All package sources are identified by a URI, described in the sources . list man page. The release is identified by its release name (such as squeeze for Debian 6, or wheezy for Debian 7) or by a generic term such as stable, which refers to whatever the current stable release is.

The current Debian stable release is Debian 7, code named wheezy, released on 4 May, 2013. At the time of writing, stable is a synonym for wheezy. Debian releases are named in order to make the mirroring of various distributions easier. The code names to date are all taken from the movie Toy Story. This tradition apparently began in 1996 when Bruce Perens, who worked for Pixar at that time, took command of the Debian Project.

Taking all these together, a set of repositories as they might appear in /etc/apt/ sources . list would look like the following:

i deb cdram:Debian GNU/Linux 7.0.0 -Wheezy· -Official amd64 \

NETINST Binary-l 20130504-14.4311 stable main

deb http://ftp.ua.debian.org/debian/ wheezy main non-free contrib

deb-arc http://ftp.ua.debian.org/debian/ wheezy main non-free \

contrib

deb http://security.debian.org/ wheezy/updates main contrib \

non-free

deb-arc bttp://security.debian.org/ wheezy/updates main contrib \ non-free

wheezy-updates, previously known as •volatile,

deb http://ftp.us.dabian.org/debian/wheezy-update.main contrib \ non-free

deb-arc http://ftp.us.debian.org/debian/ wheezy-updatea main \

contrib non-free

Some of the lines in the example are too long for the page and are split into two lines, using the common convention of adding a backslash (\) at the end of the first line to indicate it is continued. In reality, these

lines should not be split in the APT sources configuration illes.

Let's take the lines one at a time.

The first line begins with a #, meaning this entry is disabled. This entry was made by a network installation, wherein a minimal CD is mounted, and basic software is installed to allow the remainder of the software to be installed from online repositories as listed in the later lines. Only the main section is required, as shown at the end of the line.

The next two lines are for binaries (deb) and source packages (deb-src), to be obtained from an HTTP server (http://ftp .us. debian. org/debian). The release is wheezy, and all three sections-main, contrib, and non-free-will be available. Following the main repository lines are two lines for binary and source package updates. This is where security updates to the stable release are available.

Even if you prefer to use media for the release, rather than online repositories, you should include the update repositories, as this is the only way to obtain security fixes that are released as necessary.

Finally, there is a comment, and two lines for what used to be called the 'volatile' repository, and is now just referred to by the release code name followed by -updates. This repository contains packages that are routinely updated throughout the life of the release, much more often than the security update repository. Packages that include virus definitions are examples of software included in this repository.

While the various methods of configuring the repositories have slight differences, the same basic infonnation will be required, no matter which method you use. Also, since all of the utilities use the same configuration files and fonnat, information entered, deleted, or modified by one method will be immediately visible to all of the utilities.

All of the previous lines were pre-configured by the installation procedure, and did not need to be modified. However, there are often reasons to modify or add repositories. You may want to add repositories for software that isn't available directly from Debian, or modify the URL to use a different, better performing server, or different access method.

For example, HITP is more resistant to network delays or error, while FfP is somewhat faster. Also, not all mirrors support both methods, so if you change servers, you may need to change the access method as well.

There are a number of non-Debian repositories that contain software that is not included in the standard Debian release. Usually, this is due to licensing issues, or because development takes place outside of the Debian Project policies and there is no sponsor to integrate it into Debian. Some of the more useful ones are as follows:

• Deb Multimedia: As it says, this is primarily a multimedia package that can't be included in the normal distribution
• Webmin: This is a web-based system administration software
• Oracle: This provides Oracle Express software
• Skype: This provides the Skype software
• MongoDB: This is a software from the NoSQL MongoDB project

As an example, the following is a /etc/apt/sources .list.d/webmin.list file for the Webmin archive just mentioned:

dab http://download.wabmin.com/download/rapoBitory Barga contrib

deb http://wabmin.mirror.aameraettech801utioDB.co.uk/repo8itory \ Barge cOlltrib

Generally, sites that offer such repositories will include instructions for configuring the sources list file for their repository.

Debian includes a number of intrusion detection applications. There are three basic classes: Network Intrusion Detection Systems (NIDS), File Monitors, and System Scanners. The former works by scanning network traffic to detect attempts to discover and exploit allowed network connections. The latter works by scanning a known clean system, then monitoring it for new, deleted, and modified files.

If available, a swap file or partition is used by Linux when memory paging to disk is necessary. With the advent of cheap memory, such paging is often infrequent with one exception: system hibernation. This is where the system is paused and the memory contents are written to disk prior to power off in order to allow the system to resume from the saved state. While this is commonly associated with laptop systems, servers sometimes make use of it as well.

Swap files are single files created within an existing filesystem, while swap partitions are exactly that -a specially formatted disk partition. In general, swap files are only used when additional swap space is necessary for some reason, as it has all the additional overhead (metadata, journaling, allocation, and such) of the filesystem in which it resides.

Unless an administrator is absolutely certain a system will never need to swap to disk or require the ability to hibernate, a swap partition equal in size to the installed memory is recommended.

Solid-state drives (SSD), so-called flash drives, were once considered . an exception. In that the limited write cycles were considered a problem if swap files were placed on such a drive. However, with modem flash technology, this is no longer an issue, especially since the swapping has been greatly reduced by the large amounts of memory in current systems.

The current GNOME release in Debian 7 is 3.4. Ifyou install the gnome meta package, all major GNOME applications as well as the window and display managers, will be installed. Configuration is pretty straightforward, as the user menu provides a System Settings application to access the major settings of your workspace in order to alter how it looks and feels.

Modifying the GNOME login screen, GDM3, ifyou don't want the default behavior, requires manual editing of /etc/gdm3/greeter .gsettings and /etc/gdm3/ daemon. conf as the root user. Then execute the dpkg-reconfigure gdm3 command.

Part of the reason for this is that GDM is being integrated more fully into GNOME, and is being moved to the dconf settings framework from the old GNOME 2 gconf based settings. At some point, the GNOME control center should provide the appropriate utility but, at this time, there is no official GDM3 setup utility. An unofficial utility called gdm3setup exists, but has not found its way into Debian, yet.

The UEFI is a recent development by Intel and Microsoft that supports what is called Secure Boot, which requires all the loaded firmware to be signed or it won't be loaded. This is a problem for Linux, since the keys required for signing must, under the current GPL, be made public. This, of course, defeats the purpose. There are several workarounds, including some being used by Red Hat, SuSE, and Ubuntu, which are being discussed by the Debian developers and will probably be included in an update at some future point. For now, the UEFI specification allows Secure Boot to be disabled, and that is the recommended way to install Debian so that it boots under UEFI. It is also possible to switch on the legacy mode in most UEFI implementations, which allows the old MBR method to work as well.

Under UEFI, boot code is placed in a subdirectory in a special partition. Generally, this will be a subdirectory of /EFI in the first partition on the disk (formatted with the FAT32 filesystem). Generally, the boot modules and configuration files are placed in the /EFI/grub directory in the UEFI partition. Itis not a good idea to replace the default EFI module (usually /EFI/Boot/bootx64. efi) by copying the grubx64. efi module over it, as some have recommended in the past. Debian installation generally takes care of including the GRUB loader as one of the options when booting, and if it isn't the default option, the boot settings menu should be used to set it as the default. It can also be used to add it as an option if the installation doesn't do this for you.

Getting into the UEFI boot settings menu usually involves holding down certain keys while booting the computer, very similar to the way the old BIOS menus were invoked. Itis different for each computer model.

It is possible to combine both the interfaces file and Network Manager methods of network configuration, with each responsible for a portion of the configuration. This technique might be used when certain features are required that only one of the methods support. For example, Network Manager doesn't handle network bridging, and the interfaces file generally can't be used to configure VPN connections. If you needed both, you would set up bridging using the interfaces file and configure your VPN connection using Network Manager.

For those unfamiliar with network bridging, a good example would be a development system that runs one or more virtual machines that require direct access to the network (meaning its connection must behave as if it is an actual interface with a direct network connection).

Note that the host machine now uses br0 instead of eth0 as its primary interface. The bridge interface uses eth0 to connect to the actual network. The VM (Virtual Machine) will set up its own network interface (or you will set it up). These are generally set up as a tap or tunnel interface (hence the name tap0).

To set it up, the basic interfaces file might look like the following listing (assuming the hardware Ethernet card is eth0):
# TAP setup
auto tap0
iface tap0 inet manual
pre-up /usr/sbin/tunctl -t tap0
# Bridge setup
auto br0
iface br0 inet dhcp
bridge_ports eth0 tap0

This sets up a TAP device using the tunctl command to create the device. It must appear before the bridge or it won't be there when the bridge device is initialized and attempts to connect it to the bridge. The bridge setup creates the bridge interface and uses DHCP to obtain the IP address. The bridge_ports line indicates that it bridges traffic to the real interface (eth0) and the tap0 interface, which will be used by the VM. I've left out the loopback entry for clarity. In this example, VPN and wireless connections are left for Network Manager to handle. 

More about network bridging may be found in the bridge-utils package, and network tap and tunnel interfaces are covered by the uml-utilities package.

Above everything else, Debian developers believe in free software, as defined by the Free Software Foundation. In essence, this definition ensures that users have the freedom to:

• Run the program for any purpose
• Study how the program works and make modifications
• Redistribute copies
• Distribute copies of modified versions

All of this is embodied in the Debian Social Contract, and the Debian Free Software Guidelines (DFSG), both of which may be found at http://www.debian.org/social_contract. All Debian developers commit to this social contract, which states the guiding principles for the Debian Project, and influences all decisions as to what's included in the distribution and how it is distributed and maintained. Of particular note are the provisions for non-free software, and support in many different computing environments.

The non-free provision not only allows for such software to run on Debian systems but provides for special Debian repositories for that software which can be released without payment. Such software is, in fact, supported by Debian developers who package and support it. The primary distinction is that it is not a part of the official Debian distribution, due to licensing restrictions. Of course, software that must be paid for can also be run on Debian distributions. It just can't be included in the Debian repositories.

So, how do you know what configuration facilities are provided and what the recommended approach to local configuration is? The best place to begin is the README. debian file that comes with the package. Itis a requirement of the Debian Policy manual that this file explains any special configuration issues, how configuration under Debian differs from the configuration provisions of the original software developers, and recommended ways to handle local configuration. It also explains any utilities Debian has added to aid in the software configuration. 1bis file exists in Iusr I shareI docI
, which also contains any original software documentation, plus any added by the Debian developers. lbis directory is standard with nearly all Debian packages, and is mandatory for any that have extensive documentation or special configuration issues.

Some packages have such extensive documentation that it is provided in a separate package so that it can be installed on a separate system providing faster, local access to the information without requiring space or processing on the server on which the software is installed.

Let's take a look at some examples that involve fairly complex configuration file sets.