| View previous topic :: View next topic |
| Author |
Message |
duh
n00b
Joined: 14 Jul 2003
Posts: 27
Location: Utrecht
|
 Posted: Thu Nov 20, 2003 12:42 pm Post subject: Is anybody using Gentoo on a co-located / production server? |
 |
|
Hi,
We are thinking of doing both an hardware as well as an OS upgrade for our co-located servers (it's about time;). Since we mostly use Debian Linux it seems a logical choice for server OS. It's stable, it's reliable and quite secure. However, I have been running Gentoo Linux for quite some time at home and I really enjoy it; it's so much up-to-date compared to Debian and the dependencies are managed very well. However, this can also oppose a problem security wise. Debian's old packages are thoroughly put to the security test and you can almost certainly be sure that there are no huge exploits, and if there are, they will quickly be fixed.
Therefore I wanted to see if any people on this forum are running Gentoo for OS on their large, co-located, public/production servers, and what their view and experiences are on reliablity, security and maintainability.
Any thoughts are welcome! 
Jeroen |
|
| Back to top |
|
 |
Oopsz
Guru
Joined: 08 Oct 2002
Posts: 340
|
| Posted: Thu Nov 20, 2003 2:26 pm Post subject: |
|
|
I'm running gentoo on my production server, venus.tripadelic.com.
The initial install was easy, as my host had a prepared gentoo image for my server configuration. I can't imagine doing a remote gentoo install (weeelll.. I guess it could be done, have them boot it off knoppix and run sshd, but I wouldn't want to do it.) I changed my cflags and arch (Nothing major, -Os -mmmx -msse + i686) and rebuilt the system using emerge -evD world. I don't use ~x86, and I've masked >=apache-2.0. It's stable, sturdy, and very easy to maintain. I'm happy with it. Though i'm not running any iptables filtering at the moment, and I think that might be a good idea.. maybe I'll set that up this weekend... I also want to try locking down my system with propolice and hardened gcc, but I want to make sure those patches are stable before doing another emerge -evD... I'd also like to set up prelude/piwi, but piwi is still masked in the portage tree, and for the moment I value stability over security (That sounds bad  but I mean, I prefer stability to added protection against attack)
_________________
Pop-before-SMTP with the Gentoo Virtual Mailhosting Guide |
|
| Back to top |
|
|
cschwede
n00b
Joined: 06 Sep 2002
Posts: 19
Location: Hamburg, Germany
|
| Posted: Fri Nov 21, 2003 11:12 am Post subject: |
|
|
We're running Gentoo also on our production servers. This includes Apache, MySql, Samba, Postfix, Cyrus Imap, Openldap, ....
I started one year ago with the first server, now all 4 main servers run on gentoo.
I'm really happay with it because administration is really nice (in my eyes).
And security: Some people say that there shouldn't be a compiler on a production server especially when it's connected to inet. From my point of view, when a compiler is a security flaw you have much more problems than the compiler itself 
ONe of the biggest advances is that you decide what to run and what not - you also know what you've installed.
I'm happy with my servers because I can sleep better than with redhat and suse.
For upgrading see the scripts at https://forums.gentoo.org/viewtopic.php?t=36086&highlight=[url][/url] |
|
| Back to top |
|
|
symbiat
n00b
Joined: 20 Aug 2003
Posts: 36
Location: New York
|
| Posted: Fri Nov 21, 2003 3:12 pm Post subject: |
|
|
| cschwede wrote: | | We're running Gentoo also on our production servers. This includes Apache, MySql, Samba, Postfix, Cyrus Imap, Openldap, .... |
How much disk space would a web server with MySQL take up? What sort of partitioning scheme are you using? Im switching to Gentoo from RedHat and wanna do my homework and get this right the first time round... |
|
| Back to top |
|
|
cschwede
n00b
Joined: 06 Sep 2002
Posts: 19
Location: Hamburg, Germany
|
| Posted: Fri Nov 21, 2003 6:37 pm Post subject: |
|
|
| symbiat wrote: | | How much disk space would a web server with MySQL take up? |
Mhm. Depends on your needs... I would say without the /usr/portage stuff around 1 GB. Remember that gentoo needs a compiler and this takes a lot of space 
| symbiat wrote: | | What sort of partitioning scheme are you using? |
I have 4 raid devices:
md0 for /boot, md1 for /, md2 for swap and on md3 is an lvm containing the rest of the system. Together with Grub this setup allows flexible harddisk changing, changing of partition size while running (using ReiserFS), snapshots for backups etc.
| symbiat wrote: | Im switching to Gentoo from RedHat and wanna do my homework and get this right the first time round...
|
Good Luck!
Christian |
|
| Back to top |
|
|
symbiat
n00b
Joined: 20 Aug 2003
Posts: 36
Location: New York
|
| Posted: Fri Nov 21, 2003 8:21 pm Post subject: |
|
|
| cschwede wrote: |
I have 4 raid devices: md0 for /boot, md1 for /, md2 for swap and on md3 is an lvm containing the rest of the system. Together with Grub this setup allows flexible harddisk changing, changing of partition size while running (using ReiserFS), snapshots for backups etc. |
I was thinking:
/boot 100Mb
/ 500Mb
/usr 4Gb
/var 12Gb
/usr/local/web 36Gb
I want to use RAID, ReiserFS & LVM too. Im hoping / + /usr (4.5Gb) is enough to store build trees for Apache, MySQL, PHP, etc. I will be doing lots of logging and analysis hence /var is very big. All of our customers will live in /usr/local/web |
|
| Back to top |
|
|
cschwede
n00b
Joined: 06 Sep 2002
Posts: 19
Location: Hamburg, Germany
|
| Posted: Fri Nov 21, 2003 9:30 pm Post subject: |
|
|
| symbiat wrote: | I was thinking:
/boot 100Mb
/ 500Mb
/usr 4Gb
/var 12Gb
/usr/local/web 36Gb |
Sounds ok, but think of having your websites on /var/www/www.somedomain.com. It's the way gentoo does it from apache 1.3.29/2.0.48 on.
| Quote: | | I want to use RAID, ReiserFS & LVM too. |
Look at https://forums.gentoo.org/viewtopic.php?t=71860 for Infos regarding install on Software RAID.
| Quote: | | Im hoping / + /usr (4.5Gb) is enough to store build trees for Apache, MySQL, PHP, etc. |
Should be enough. I'm only using 30 MB for /boot and 250 MB for /
Christian |
|
| Back to top |
|
|
symbiat
n00b
Joined: 20 Aug 2003
Posts: 36
Location: New York
|
| Posted: Fri Nov 21, 2003 10:48 pm Post subject: |
|
|
| cschwede wrote: |
Sounds ok, but think of having your websites on /var/www/www.somedomain.com. It's the way gentoo does it from apache 1.3.29/2.0.48 on. |
Im assuming I can change this in the httpd config - unless there is a good reason not to?
(I prefer stuff under /usr/local). Also, I like to break out each virthost config into separate files too (I use Include directive in httpd.conf to load them at Apache startup). |
|
| Back to top |
|
|
EvilTwinSkippy
n00b
Joined: 20 Feb 2003
Posts: 63
Location: Philadelphia, PA
|
| Posted: Mon Dec 01, 2003 12:59 pm Post subject: Some Tips... |
|
|
I've been running a cluster of production machines off of Gentoo for almost a year.
My first tip is have an identical box to the production one to test all upgrades on. Before I put a server in the field I make a tarball of the file system. This way I can clone the box and test out everything before I discover halfway through a kernel upgrade that baselayout prevents the machine from booting. (Ugly, and it's happened.) If you are really clever, you build binaries from your clone and save your production machine the bother of compiling the code itself.
My second tip is never rely on being able to run "emerge sync" from the gentoo network. I have my own server running a mirror of the portage tree. In this way I'm a) being a good citizen to the network and b) ensuring that all of my servers are working from the same portage tree. This enables me to build binaries that are compadible across my entire network. c) If for some reason the internet isn't available...
It may sound paranoid, but there is nothing more annoying than starting a datacenter upgrade on Monday only to discover that something has changed by Friday. (Throws dart at picture of maintainer of baselayout package.  )
There are also a few chicken and egg problems that rolling binaries solve. One that comes to mind is that to run LDAP and SASL you somehow need to compile both at the same time. (LDAP: I need SASL. SASL: I need LDAP.) My answer it so yank the use flags for both LDAP and SASL, build the two seperately, and then re-add the SASL and LDAP use flags and rebuild both packages. If you save the resulting binary, your slave nodes are blissfully unaware of the chicken-n-egg dependency.
Binaries also allow you to re-build a server in a hurry. You take your last backup snapshot of the machine, and emerge -uK world.
On one or 2 machines it's overkill. But when you get up to 10 it's essential.
_________________
I've found that people will take what you say more seriously if you tell them Ben Franklin said it first. |
|
| Back to top |
|
|
EvilTwinSkippy
n00b
Joined: 20 Feb 2003
Posts: 63
Location: Philadelphia, PA
|
| Posted: Mon Dec 01, 2003 1:06 pm Post subject: Iptables Lockdown Script |
|
|
Someone was mentioning locking down matters with IPTABLES. Here is a script I use:
| Code: |
#! /bin/sh
###
# Sean's Netfilter Lockdown
# Should run on most distros of Linux with IPTABLES installed
#
# This file is released under terms of the GNU Public License (GPL).
#
# You must be root to run this script!
#
# This script works by opening only a known set of ports to the outside
# world, and blocking everything else with extreme predjudice.
#
# Please review the ports blocked and add any networks that require
# unrestricted access. Note: SSH is left enabled. This is a safety
# for those folks who are remote managing a box and forget to whitelist
# themselves.
###
###
# iptables: Where is the iptables commmand (/sbin)
# rcpath: Where are your init scripts (/etc/init.d)
# untrusted: Which ethernet device are we locking down (eth0)
###
iptables="/sbin/iptables"
rcpath="/etc/init.d"
untrusted="eth0"
###
# Shut down iptables
###
${rcpath}/iptables stop
###
# Traffic that is allowed
###
# Allow all traffic from a range of addresses
# Add a new line for each network
#${iptables} -A INPUT -i $untrusted -s 192.168.1.0/255.255.255.0 -j ACCEPT
# Allow the box to be pinged
${iptables} -A INPUT -i $untrusted -p icmp -j ACCEPT
# Allow certain traffic by port
${iptables} -A INPUT -i $untrusted -p tcp --dport domain -j ACCEPT
${iptables} -A INPUT -i $untrusted -p udp --dport domain -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport http -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport https -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport ftp -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport pop3 -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport pop3s -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport smtp -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport ssh -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport imap2 -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport imap3 -j ACCEPT
${iptables} -A INPUT -i $untrusted -p tcp --dport imaps -j ACCEPT
##
# Allow all connections initiated by this computer to get out
# to the world at large
###
${iptables} -A INPUT -i $untrusted -m state --state RELATED,ESTABLISHED -j ACCEPT
# EXPLICITLY BLOCK MYSQL and RPC
${iptables} -A INPUT -i $untrusted -p tcp --dport 3306 -j DROP
${iptables} -A INPUT -i $untrusted -p tcp --dport sunrpc -j DROP
${iptables} -A INPUT -i $untrusted -p udp --dport sunrpc -j DROP
########
###
# Block ALL other traffic
###
${iptables} -A INPUT -i $untrusted -j DROP
${rcpath}/iptables save
|
_________________
I've found that people will take what you say more seriously if you tell them Ben Franklin said it first. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
