Re: [gentoo-server] Re: Ideas for a server profile?

[Patrick Lauer]

On Tue, 2006-02-28 at 09:01 -0600, MIkey wrote:
> Patrick, lack of server support in the profiles is the bane of my existence.
> Thank you for starting to address it.
It's a known deficiency, so we should fix it :-)

> I would prefer for it to be kept as simple and stripped down, as possible.
> Particularly get rid of all of the USE flags that end up pulling in
> X/gnome/multimedia related packages without manually editing portage
> related files.  Don't assume all users want to use all things by default,
> pam and gpm, for examples.
gpm yes, pam no. Anyone not using pam should know how to change that, as a default it is "good enough"

> Here is my list of USE flags present in the 2006.0 profile that don't belong
> in a basic server profile:
>
> X alsa apache2 apm arts avi bitmap-fonts cups eds emboss encode esd
> foomaticdb gif gnome gpm gstreamer gtk gtk2 imlib ipv6 jpeg kde libg++
> libwww mad mikmod motif mp3 mpeg ogg opengl oss pam pdflib perl png python
> qt quicktime readline sdl spell truetype truetype-fonts type1-fonts vorbis
> xmms xv
Right. What's left after removing those?
(/me is lazy)
> Any competent server administrator should know to select which apache they
> want, which additional flags to add for php, and so on.
I would not mind a few sane default flags. Having to enable 15 flags just to get php working is annoying and should be avoided if possible
But I'm willing to compromise there as long as it's documented :-)

> As far as the hardened, I would prefer separate profiles be created for
> them.  Not everyone who runs servers knows how to use them :)
You shouldn't have to know how SSP works as long as it doesn't cause breakage and makes your system more secure.
I'd like to have as much as possible enabled without reducing usability.

> And finally, mask out php5 and newer versions of mysql until they work with
> the majority of packages in portage :)
I think if you create a new profile you can make disruptive changes,
so ... why not mask the "bad" packages? :-)

I think we have two groups of users here:
- people who want a really minimal base to build upon
- people who are lazy and want stuff to work out-of-the-box

Using stacked profile might help here with a "minimal" and a "default"
profile, but that'll be more work to maintain.


Patrick
-- 
Stand still, and let the rest of the universe move