Weblog entry #2 for jpk
See all weblog entries made by jpk.
I've been working on migrating existing Sarge based domU's to Etch. I have decided to do everything from scratch instead of trying to migrate the domU's.
It is a home based system I'm running, with mail server, webservers, db servers, dns servers etc. So basically each server type gets it's domU, or in some cases more. These domU's is running on 3 computers, and I am the only lucky administrator.
As a preparation I have prepped a domU template with all common stuff as a base image for the domU's. I can then use Xen-Tools to use the image when creating the ordinary domU's. When the domU's are created, the actual server software is installed and configured.
What I have included/configured as a common base in the template image after the base etch debootstrap install is
SSH
- Copied nesecarry keys to authorized keys
- Disabled root login
- Enabled only specific users
- Enabled only specific ip addresses
- Disabled password based logins
RSYNC
Used for backup of the server image ( over ssh )
SUDO
Used to handle the backup user, and limiting what it can do
MUNIN
Installed munin agent for basic monitoring
SYSLOG-NG
Replaced sysklogd with syslog-Ng
STUNNEL
Installed stunnel for use with syslog-ng and central logserver, and copied the logserver certificate.
APT-CACHER
Configured aptitude to go through an apt-cacher proxy instance
NULLMAILER
Installed and configured nullmailer to forward all system mail to my admin address
CRON-APT
Installed cron-apt to check for security updates , and send mail when updated packages are updated
MAILX
Installed mailx to get cron-apt to send mail.
OSSEC-HIDS
Installed an ossec-hids agent, binary install. No debian packages for this one.
FIREHOL
Installed Firehol to handle the firewall stuff
Any suggestions to what I have forgotten , that should be a part of such a base image ?
Comments on this Entry
[ Parent | Reply to this comment ]
After a quick browse throuh some of mr. google's findings....
Hmm, interesting.
Not shure if it's worth the effort though. This beeing a hobby project and I have limited time to play around with my setup. I will try to read up on cfengine, and start with the articles here on Debian Administration.
Thanks for the tip !
Jan-Petter ::-Q
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
It definitely looks a lot more usable and less "beta" these days, compared to when I first examined the project.
I'm planning a series of articles in the near future, aimed at a similiar level to the cfengine introductions.
[ Parent | Reply to this comment ]
Yes, Puppet came up as an reference when I was browsing around for cfengine. I've pretty much decided to go in the direction of Puppet if I should decide to look into these kind of tools for my system.
Jan-Petter ::-Q
[ Parent | Reply to this comment ]