Gentoo as server: questions

[Rottweiler]

I configure and support Linux servers for clients. I'm looking for a new server distro and there is much to like and respect about Gentoo. A few general questions please:

1. Resources: I know there is lots of activity around using Gentoo in a server / production role? Are there specific resources available? A webpage? Documentation? (I've perused the Security and Hardened guides and they look good.)
   
   
2. Installers: Are any of the alternative installers ready for primetime? I know there has been a fair bit of work with Anaconda. (I'm not knocking the Gentoo installation process - I just need to get the amount of time and heads-down work involved in installation down to a minimum.)
   
   
3. Package Building: Is there a procedure somewhere on how to build packages on a staging system that could then be installed as binaries on a production system?
   
   
4. Package Selection: Any documented thoughts on what packages ought to be added or removed on a fresh install of Gentoo for server use? (Not talking about big stuff like apache or samba, but common utilities that need to be there or things that perhaps shouldn't be on a server.)

Well, that's probably too many already. Thanks.

[agu5tin]

i use gentoo in my box, but u should think into using Debian Stable for a server, is kindda the best sever distro around.

[xces]

[ewan.paton]

[1] these forums have as much info as you need, you just need to search for specific packages

[2] the normal installer is good enough for most folks, if your setiing up a server you realy shouldnt need a gui installer

[3] emerge -B on one machine to build them then emerge -k to install them after you copy the tarballs over

[4] just install all the stuff you need then possibly remove the gcc to prevent anyone compling progs you havent built and tested, anything more and youd have to check out stuff like the nsa server spec thing
_________________
Giay tay nam | Giay nam cao cap | Giay luoi

[Suicidal]

[Rottweiler]

[Rottweiler]

[cuerty]

[Rottweiler]

[Kavika]

Ahh that page WOULD be highly useful to me right now, too. Can't connect.

Here's a good question, along the same lines. If I simply emerge the (stable) ebuild of apache2, is it decently secure for use as a server by default, or are there things I should change in the config off the bat for a (toy) "production server"?

I never thought it would be as simple as "emerge apache," "/etc/init.d/apache2 start," but that seems to give me a running server! I can't help but feel like I'm not done yet...

BTW, I don't need more than one domain on my system, except for paranoia, the default setup _seems_ fine to me.

If I set it up for FTP access, is there anything I should look out for? (the directory permissions/ownership is gonna have to change from root:root, am I right?)
_________________
If at first you don't succeed, RTFM
(advice I should take, myself =)

I'm a newb, I'm crunchy, and good with catsup!

[bonkalot]

yeah, Subverted.net which the GSP wiki is served from is down atm, due to the guy that hosts it, moving house and losing his cable connection....... but i hear theys are looking at getting it hosted at a dedicated hosting site.

[Mango]

[neuron]

if your building for many boxes look into rolling your own livecd (emerge -s catalyst), and put a custom install script on the cd.

so you can easily run a install script on a specific hd/partition and have it do most things for you.


also instead of removing gcc I'd chmod go-rwx the binaries. (if you want portage working I suppose you could make a compile group and chmod g+rx, keep in mind you also need to add the portage user to that grp).

[F.Ultra]

Besides making a livecd there is also the choice of creating a tar archive of a confiured server and simply untar it to the new one after you have fdisked it. This is the way I enroll all my servers.

[Mango]

[F.Ultra]

1. I have much different hardware. What I do is to set the USE flags to match the lowest spec, I have P3 and P4 so I always set "march=pentium3" in /etc/make.conf on the generic config. Then on my P4 servers I change to "march=pentium4" so that future emerges bets the highest optimization but it is really not needed as the difference should be quite small. I also recomile the kernel to support other nics or smp/up, but that does not take very long.

Since I know what kind of hardware my servers have I can always precompile a few kernels for the different hardware and copy them to \boot and then include \boot in the tar.


2. I havent found any problems with taring the whole computer while it is running (just make sure that you exclude /proc), as far as I know there are no hidden and locked files as in a Windows server (and of course no stupid registry).

A stage4 custom livecd might be a better solution, I don't really know since I have never tried that. For me it was quite simple to have one machine dedicated for this generic-server-config, keeping it up to date with the newest security pathces and kernels and taring the whole machine and when installing new servers simply fetch the tar archive via ftp from a livecd and untar to the new server, and reboot.

I use this to clone servers as well. For example our IPVS loadbalancers, there I configured the primary first and when it did work I simply tared it and untarred it to the secondary machine and changed only the ipaddresses and hostname and rebooted and it worked instantly.

On Windows I usually used Norton Ghost to create a complete image of the harddrive and thus cloned the whole disk, the drawback here was that it did take quite a while to do since it was many GB of data and that windows creates a unique key on each machine that uniqiely identifies them so RPC might not always work correctly between such machines, so the switch to Linux was very very welcome

edit: to clarify, I have a script called create_stage4 that creates the tar and it looks like this: