1 |
I don't see why you'd want to have a dhcp client on a server but any |
2 |
way... |
3 |
|
4 |
How about the profile contains minimal packages like say no |
5 |
productivity/office packages, no X like you said no games (besides maybe |
6 |
game servers) basicly clear out every thing that doesn't make sence on a |
7 |
server. |
8 |
A great Idea would be some thing like virtual packages with flexible use |
9 |
flags that represent use full combinations of packages on production |
10 |
servers. What I'm getting at is this: There are some greate Howto this |
11 |
with that and that articles in the gentoo sysadmin docs as well as |
12 |
www.gentoo-wiki.com why not create say -- a virtual_postfix package with |
13 |
appropriate use flags to combine say your choice of imap/pop server, db |
14 |
backend, authentication system, antivirus and spamfilters -- all in one |
15 |
package! |
16 |
It might even be better if such a packages default use flags are so use |
17 |
full that most would use it - a sort of standard. |
18 |
|
19 |
a nother issue I find very taxing is scanning thru config files |
20 |
during/after updates to try catch the configs that would break my setup. |
21 |
Can't we have some means to check whether or not the admin has ever |
22 |
edited a config file by hand and if so be more don't auto update but if |
23 |
so do. |
24 |
I guess I'm getting at a more complex config management system. |
25 |
It might also have helped if config files where more standard - say if |
26 |
they all used some vaguely similar xml format |
27 |
|
28 |
-----Original Message----- |
29 |
From: Patrick Lauer [mailto:patrick@g.o] |
30 |
Sent: Tuesday, February 28, 2006 12:37 PM |
31 |
To: gentoo-server@l.g.o |
32 |
Subject: [gentoo-server] Ideas for a server profile? |
33 |
|
34 |
Hi all, |
35 |
|
36 |
I've been thinking about a restricted profile for servers. It should be |
37 |
minimal (no crap useflags) and as secure as possible by default. |
38 |
What I think should be in there: |
39 |
|
40 |
- no X and multimedia useflags by default (-esd -gnome -gtk -kde ...) |
41 |
- put a dhcp client back in system. Not having that sucks, and we can |
42 |
spare the 135kB installed. |
43 |
- put gentoolkit in. equery, revdep-rebuild etc. are needed. |
44 |
- having cron, atd, ... in system would be nice, do we want that? |
45 |
- use as much from hardened profiles as we can. SSP is good :-) |
46 |
(- use hardened-sources by default if possible, PaX etc. is very very |
47 |
good ) |
48 |
- keep default CFLAGS simple - "-O2 -pipe" should be good enough |
49 |
- no LDFLAGS unless there are no known bugs (e.g. "-O1" breaks prelink |
50 |
in some cases) |
51 |
|
52 |
What applications do you install on every system? What sshould be |
53 |
provided for logging, monitoring, intrusion detection? |
54 |
Is there anything that sucks in the default profiles? |
55 |
|
56 |
Thanks for the feedback, |
57 |
|
58 |
Patrick |
59 |
-- |
60 |
Stand still, and let the rest of the universe move |
61 |
|
62 |
-- |
63 |
gentoo-server@g.o mailing list |