RE: [gentoo-server] Gentoo for server

I would definitely NOT use the unstable tree for everything, by using ~x86 in package.keywords.  There's really no justification for that, even on a bleeding edge server.  I have found many packages in the unstable tree to be fine, even for server use, and sometimes I do need them right away for security fixes, but there are numerous packages in the unstable tree that cause problems.

Second, there are some special considerations for "production" servers although, they may not be big issues for home use.  I would at the very least distribute compiling so that you are not tying up the cpu on your server.  If you setup your config files correctly, using distcc you can put a very light load on the server during compiling.  Even better is to compile on a separate machine.  You can use emerge or quickpkg to build binary packages on another system and then distribute them to your server.  You still get all the advantage of a customized binary, but don't place any compiling load on the server.  

When supporting multiple servers, it often advantageous to mount /usr/portage/distfiles from a remote share.  You can then synch only one tree, which saves a good bit of time and processing on your other servers.

If you compile on your server, you probably want to have /var/ /var/tmp or /var/tmp/portage on a separate partition (preferably on a disk on a different controller).

Gentoo works well for me on servers because it is so cutting edge.  If there's a security update, I don't want to wait any longer than necessary for a fix, and I find that Gentoo packages are often out before rpm packages.  If necessary I'll just compile from source (downloaded from the application website) which is always easier on Gentoo and causes fewer problems than doing the same on an rpm based distribution.  If necessary you can always inject what you compiled into portage later.  Additionally the ease with which you can add, remove options from applications is a big boost to performance, security, and stability.  

You mentioned security, again I wouldn't use ~x86, the unstable tree, unless you need to for a very recent security fix or feature.  Customize your logging properly, setup your partitions correctly (with the right options like noexec on data only partitions), use tcp wrappers (very easy to configure on Gentoo), use a firewall, and configure your daemons correctly and you won't have any problems.  If you are really paranoid, you can add intrusion detection, log monitors, hardened kernel sources, etc.  Gentoo gives you a huge number of options to create a server as secure as you would like, you just have to learn a lot to be able to do it, which is no small task!

Finally the ease with which other applications are installed, or configured on Gentoo is unmatched, and this too is a big benefit.  Easily being able to choose my logger, a firewall front-end, mail server, etc.  makes it a lot easier to build and maintain a secure server.

I see a lot of discussion elsewhere about how Gentoo is not for servers.  I've used probably over 20 distributions in enterprise environments over the last 10 years or more, and I honestly can't imagine ever using another distribution on a workstation or server.


Vern Wilkins
Senior Technology Specialist
Indiana University Libraries





-----Original Message-----
From:	Simon Striker [mailto:simon@×××××××××.net]
Sent:	Mon 12/6/2004 6:20 PM
To:	gentoo-server@l.g.o
Cc:	
Subject:	[gentoo-server] Gentoo for server
Hi!

I have just installed Gentoo on my laptop and I am very satisfied with
it! I really like the portage feature and other Gentoo philosophy.

At home and at "week-end house" I have a Linux server with Slackware
distribution installed. Now I am thinking of reinstalling my servers and
installing the Gentoo Linux on them, but I am a bit worried
because all packages in Portage tree are NOT up-to-date.

I am using servers for: Mail-server, web-server, printer-share,
firewall, router, backup-server, webmail, mysql etc.

I would like to know, how do you maintain your servers? Is it safe to
have Gantoo as a server?

What do you think of putting all installed packages into
/etc/portage/packages.keywords (~x86) for server?

I would like to make my Linux server "insensitive" for hackers or
intruders. Is it possible with Gentoo?

I will be very gratefull to hear some of your opinion or exepriences.

Thanks in advance!

Best regards, Simon
-------------

Simon Striker
Rusjanov trg 2
1000 Ljubljana      [phone]
Europe (Slovenia)

E-mail: simon@×××××××××.net