Top Ten Linux Configuration Tools? 651
jman251 asks: "I am presenting at a conference in September on a couple of Linux-centric topics. One of these is a collection of tips, tricks, and tools for configuring, securing, and maintaining a Linux-based server. I have a short list of tools I use, but would like some community input on the subject. What tools do you use that make your admin responsibilities easier or more automated on the Linux platform?"
Webmin is nice (Score:3, Informative)
Re:Webmin is nice (Score:1, Informative)
Make your life easier... (Score:2, Informative)
grep
gawk
xargs
for
Tripwire (Score:5, Informative)
Cfengine: It's all you need (Score:5, Informative)
the best automation tool for unix and unix-like
environments. Hands down.
It's a little hard to configure sometimes, but
worth the effort.
Re:Webmin is nice (Score:5, Informative)
sudo, screen (Score:4, Informative)
Learn it in detail. If you work with other people on the same machine, it will make your life a lot easier.
screen is pretty handy, too. Being able to detach sessions is also nice for when you've started sprouting icycles from your nostrils from the cold, cold server room.
My Top 10: (Score:5, Informative)
That's all I can think of now. I'll think of others later.
Dang! (Score:5, Informative)
Don't get me wrong, Webmin is great, it's at the top of my list fer shure, but that's not the be-all and end-all of systems management!! What about actual convenient tools like MRTG, Novell's eDirectory, RedCarpet, etc. etc.?
Heck, I'm reading this article hoping to pick up a few tips myself and all I'm seeing are scripting languages and text-editor flame wars, (all of which can/should be moderated Off-topic or Funny).
So, anybody actually got anything useful to contribute besides Webmin?
Re:CVS (or insert your favorite alternative here) (Score:5, Informative)
Things I do. syslog to a common place. I have cloning scripts to dup a machine to a basic setup (poor mans jumpstart but faster and easier).
Perl and sed come in handy. Rsync (again with ssh keys) is good.
Oh yeah,
With these tips and tricks I can do whatever I need to do over a dialup connection anywhere in the world (I've only tested this from coast to coast in the US thought, but I believe it will scale worlwide
My 10 (Score:3, Informative)
sudo
apt-get
wget
rsync
ssh
ps
php
pe
make
SSH. (Score:5, Informative)
There are four of us who do *nix admin for over 600 *nix machines, more than half of which are linux boxes (both workstations and servers.) SSH with X displayback on a 100Mbit switched network is such a godsend I can't even begin to imagine life without it. I probably generate more SSH sessions in a normal workday than I do HTTP sessions. (Yes, that does include
I also think it's well worth your while to understand SSH's more esoteric tunneling capabilities... Recently I had to support a research group who was doing a demo at JPL [nasa.gov] and they were behind a very restrictive firewall but needed to do control and image transfer from a robot framework here in Massachusetts, and the researchers who'd coded the software hadn't implemented any kind of authentication layer. We were able to do everything using SSH tunneling over one of the three ports allowed through JPL's firewall (and they could IMAP their mail from our servers as a side bonus) without exposing our servers or JPL to unencrypted protocols of any kind.
Re:Dave Lettermans Top 10 (Score:5, Informative)
more -- better less (Its not the 70s anymore people, you can search and go backwards in files since less first came about in the mid 80s. With the LESSOPEN varible set to something useful you can "browse" many, many filetypes too).
bash -- better zsh My shell can do anything your shell can do, but better!
Re:Dang! (Score:4, Informative)
Huh? I'm not that familiar with eDirectory or RedCarpet, but MRTG isn't an all in one configuration interface like webmin. I though the only webmin alternatives were commercial products like:
Ensim [ensim.com]
Plesk [sw-soft.com]
Cpanel [cpanel.net]
Are there free software uber-configuration products other than Webmin? I tend to stick to the command line over ssh myself.
My List (Score:5, Informative)
2. Logwatch [logwatch.org]: Logwatch is something that should be used by every Unix/Linux SA everywhere. It gives you a daily snapshot of events in your logs
3. Mon [slashdot.org]: Nice, simple, easy. If your webserver goes down, your secondary can bring up a virtual ip a couple of seconds later. No more annoying three am phone calls
4. Snort [snort.ortg]/ACID [sourceforge.net]: lets me know if a virus breaks out, or if there are stupid script kiddies trying to brute force their way in.
5. Nessus [nessus.org]: run it early, run it often. Figure out any holes you have in your security, and make sure you fix them.
There's more, but you should really do some of your own homework.
Re:rm (Score:5, Informative)
So now "rm -fr /" won't work even as root as it will properly give you :
So there you are, you pesky root of all evil. Oh bummer, now I can't make any new files in /home/dude ....
Re:Dave Lettermans Top 10 (Score:4, Informative)
Whilst you are correct this works for non-interactive processes, you can't use nohup to keep a copy of say, Lynx, running when you logout. Then return to it later and pick off where you left it.
Instead you should look at GNU Screen [gnu.org] which allows this and more.
(It's essentially a windowing system for consoles, with the ability to detach and resume at will, and definately one of my top ten Unix utilities).
Here is one Screen tutorial [kuro5hin.org] which explains basic operation well.
Re:Dave Lettermans Top 10 (Score:5, Informative)
1) programable tab completion - yes folks there is more to tab completion besides beeping all the time. When I hit cd fooTAB the list of completions only shows _directories_ beginning with foo
2) sane invocation - zsh is the only shell that has one file that is sourced _on all invocations of the shell_ so you can do stuff like have a consistant PATH and other env stuff
3) global aliases - zsh provides an alias that works _anywhere on the commandline_ I have 'G' mapped to '| grep -i', I have 'L' mapped to '| less' and 'vi' mapped to 'vim' (why? So sudo vi FILE gives me vim if the system has vim), etc, etc
4) the only shell that supports working 'vi' style history editing
5) multiple commandline commands are not rewritten as commands with ';' in them (what I typed is what I get, see 4)
6) too many features to name. Like I said, my shell can do anything your shell can do, but better.
Re:Dang! (Score:2, Informative)
nagios - monitor remote server, setup notifications via email, pager, etc. Comes with many plugins to monitor specific thins like disk usage or ports.
ganglia - sort of like mrtg geared towards clusters.
Very easy to setup but requires multicast communication between nodes.
You can see one here
http://wulf.chem.valdosta.edu:8000/ganglia/
Kerberos and OpenLDAP - if you ever need to maintain a large number of machines sharing common authentication. Kerberos enabled SSH is a great way to avoid typing passwords or sharing key for passwordless authentication.
Systemimager - if you have many machine sharing common configuration (like corporate network or server farm) this is absolutely a must. Very easy to configure and use. Images that systemimager create can be chrooted to just like regular systems. Creating image, updating image, updating machines is very easy and fast.
Finally Debian is the best tool (and a distro) for maintaining a stable, reliable Linux system that does not get in your way like YAST or other "candy " tools. While Debian is a bit harder to get used to then GUI-centric distros like Fedora and SuSe, the benefit of learning Debian is great if you are serious about Linux.
Re:Tripwire (Score:3, Informative)
Tripwire is a file integrity auditing tool to ensure that files that should remain static do in fact remain static.
I would have to say that the top of any config tool list will have to be $favoritetexteditor. Each distribution is going to have a number of tools, both text and GUI, but the text editior rules *NIX when it comes down to indispensible configuration tools. Webwin deserves to be on the list just because it is a non-distro specific config tool... I personally don't use it, but lots of people do.
Otherwise, toss YaST, redhat/fedora-config-foo, drakfoo, etc-update, and so on to the list.
If the list was to be extended beyond Linux, the AIX people out there would probable love to see smitty on there.
Radmind (Score:3, Informative)
learn more at radmind.org
Re:Dang! (Score:2, Informative)
ethereal/tcpdump
I've also heard that nessus is nice to use.
And, I've just remembered, google.
But, really, it doesn't seem like it would be easy to have a Linux Sysadmin's Toolkit CD where you could run programs on a live system (rather than boot into another one like with Knoppix) due to the different systems out there using different distros with different file tree structures and different versions of [g]libc.
Also, most of the tools are so simplistic that it's hardly worth mentioning them. Need to reset a root password and you don't know the current one? Mount the filesystem and edit
Also, FWIW, screen [kuro5hin.org] is likely very useful to many admins. I just find it useful for keeping terminals available without cluttering up my desktop. An added benefit is that I can ssh in from elsewhere and work with them from there, too. I've wanted for a while to fiddle with ratpoison [sourceforge.net] to get a similar effect for X programs.
Single machine or multiple machines? (Score:5, Informative)
Who exactly is your target audience? People who've never seen UNIX, people who've worked on UNIX environment for years? What is it you are attempting to accomplish with them?
Most of my list would be boring to people who know a lot about UNIX, however some of them are Linux specific.
MOD PARENT DOWN (Score:3, Informative)
Re:More or Less ? (Score:2, Informative)
Re:Webmin all the way (Score:4, Informative)
cfengine works really well, but you don't appreciate its features until you hit the 70+ machine mark - the "trick" is that cfengine with it's inheritance and boolean class logic excels for systems that are different but have bits in common. Such different bits ALWAYS turn up with 70+ machines, simply because PC-class hardware's failure rate means something will have been changed on some machine somewhere at any given time. But if you've only got tens of machines runnning one OS rather than hundreds running five different OSes, it all seems like very hard work to set up your cfengine configuration files. The other "trick" is that cfengine is mostly multiuser and you can allow different users perform different actions, so when you've got a team of admins of different ability,
johnny-adds-visitor-laptops-to-vlan-17 just can't fuck up mordred-rules-production-database-servers-with-ir
Re:Dave Lettermans Top 10 (Score:3, Informative)
Your question is flawed, thus you have no answers. (Score:4, Informative)
But I can sum up some the key points and bits of wisdom I have picked up over the years.
1) Ascii text is your friend. 98% of all the configuration files for UN*X programs live in ascii files and they "usually" live in
2) Pick a programming language. Perl, AWK, Sed, ksh, all of them. You can use that programming language to role out changes as needed, or make a lot of changes really quickly. RSH/SSH allows you to do that across multiple systems. Use it carefully!
3) Design your environment. If you know what you are going to be using the servers, workstations and/or Linux embedded appliances for you can better decide how to automate it.
4)"Crunchy Cookie, Liquid Center".
In the end you will be automating certain administrative tasks over and over, but not all of them. That's why one size fits all won't work. It becomes a bloated security hole, so you only automate what you need and you automate it in an original and secure fashion.
As for some rock solid TLA recommendations.
SSH - SSH is your friend and as a replacement for RSH and its ilk you can use it to securely automate tasks. read up on ssh-agent for automating ssh access across multiple machines.
mon - How do you know it's working if you don't test it? You need to turn on monitoring, the more specific the test and monitor the better. mon is a good PERL framework for performing any test, and it has a lot of prepackaged/contributed test scripts that come in handy.
LDAP - Lots of UN*X environments are moving to LDAP to store enterprise wide information. It depends on how big of a UN*X environment you are setting up but having a centralized directory ala LDAP can be quite handy.
PAM/NIS - Plug In Authentication Modules. You can use these to have a centralized authentication server, cuts down on password updates. NIS+ is a tried and true system for stitching UNIX Systems together but I've only seen it installed in 1 UN*X environment and I've worked in several.
If you are looking for a prebuilt system or paradigm like Microsoft Server then you need to look to Redhat, Debian, else you are going to work from the need/application outwards.
Whatever you do more than once you will automate. When you no longer can budget the amount of UN*X Admins you will need you will start to build "tools" to delegate routine tasks, these will eventually become web pages, the web page will become an application. The application will become an acronym. The acronym will become a skill. The skill will become a job requirement HR will use to backfill a position. That's the way it goes.
Enjoy!
Re:Dave Lettermans Top 10 (Score:3, Informative)
"Bash" also supports programmable tab completion - it's possible to do stuff such as:
Tab completion after the command
And my favorite:
apt-get install, which will complete to packages known to apt
There are lots more of them, and of course, since it's programmable, more can be added to suite ones needs.
Re:Webmin is nice (Score:2, Informative)
Re:More or Less ? (Score:5, Informative)
Just so you know, when you accidentally cat a binary file and it changes all the letters in your console to garbage characters, just blindly type
reset
and hit Enter. Fixes it every time.
Re:Cfengine: It's all you need (Score:2, Informative)
We use this in combination with OS autoinstallation scripts to deploy new servers really quickly. Autoinstall to get a base OS on. A few minutes to get hostname/IP right. Cfengine to blast the right packages and config files. Voila...working dns server, or web server, etc.
Danny
Keychain (Score:5, Informative)
http://www.gentoo.org/proj/en/keychain.xml
Also, (obligatory) perl is great and larry wall is my hero...
*drake (Score:4, Informative)
If you look at Mandrake, there's tons of great config tools there:
diskdrake for disk partitioning
harddrake for hardware configuration
userdrake for user configging (or userconf)
XFdrake for X config
mousedrake for mouse config
printerdrake absolutely rules for CUPS, better than localhost:631 if you ask me
drakconf for ALL mandrake tools together
rpmdrake is good for package managing...
Oh and of course linuxconf is still nice! netconf is the network partition of that I think. The list goes on i bet
Re:CVS (or insert your favorite alternative here) (Score:1, Informative)
It sounds dumb, but... (Score:1, Informative)
And yes, I did try the web interface built-in to CUPS, but I would run into things like the "Location" blank. What's that?
"There's got to be a better way," I said to myself. Lo and behold, KDE Print Manager. Worked like a charm. Even informed me that "location" was an optional string of text for users. Sure, Print Manager isn't perfect, but then again, who is?
Re:Single machine or multiple machines? (Score:4, Informative)
Googling around, that's the best link I've seen, but it's relatively short. I haven't looked into in about a year. There is a patch to mount that will allow you to use let you setup cryptoloop (the loopback block device with encryption built in). The maintainer of mount (Andries Bouwer), however wouldn't accept the patch for some legalistic reasons (copyright and/or encryption, I've forgotten the details). Try "man losetup" for information on how to get crypto loop working.
What you do, is have no swap partition, then at the end of the bootup sequence run losetup to setup loopback encryption to either a file or a partition. Then initialize the swap file or partition using mkswap, then swapon /dev/loop0 (or whatever loop device you used).
So something like this:
losetup -e DES /dev/loop0 /tmp/swapfile
mkswap /dev/loop0
swapon /dev/loop0
However, I can't seem to get that working, as my RHEL doesn't have DES as a modules, and losetup doesn't support AES yet. So there's probably a kernel patch to track down. However, it sounds like Mandrake supports this out of the box.
Finally, I'm not much of a 2.6 user, what I described above will work in 2.4. 2.6 I believe either has in the main tree, or it's coming "Real Soon Now", a feature called dm-crypt. dm stands for device mapper. It's the low level replacement for the guts of LVM from the 2.4 kernel. It sounds like a layered/plugin type feature, one of which you can put LVM on top of. Some clever fellows decide to put crypto on top of it. I don't know a thing about that, and have never used it. However, search for dm-crypto in google, here's the most useful page I found in a single query:
http://www.saout.de/misc/dm-crypt/
Good luck.
Kirby
Re:Dave Lettermans Top 10 (Score:4, Informative)
Re:No, no! (nano nano) nanoo nanoo (Score:2, Informative)
I've also heard nano is a smaller executable and runs much faster. I haven't really tested that, however.
Re:Or sudo (Score:4, Informative)
Yes, but rm FILE [OPTIONS] is much safer. Compare hitting enter to early when deleting a directory.
Man pages are generally unmaintained. Eg, man resolv.conf says the file is generally unnecessary as most machines have a DNS server installed on them.
infrastructures.org, cfengine, and the like (Score:1, Informative)
1. Go to www.infrastructures.org
2. Read each section, and select a tool which achieves the goal of the section
3. ???
4. Profit
The steps above will generate a good top 10 list.
Alternatively, you can use my list:
1. cfengine
2. Templating on cfengine config files (I use perl to template them); cfengine is better than anything else similar I've tried (although I haven't tried LCFG), but it still needs perl templating to make it work properly
3. Some kind of database; see http://astro.uchicago.edu/~davidr/cfengine-tools/
4. An ACAP server: http://infotrope.clues.ltd.uk/ (ok, I admit -- I've never set up an ACAP server, but they could become increasingly useful in the future, reducing support costs and the like)
5. Learn how not to be stupid about administration: http://users.sunet.com.au/~tsn/sysadmin/good_sysa
PS. Sorry about the anonymous posting, but this is a public terminal
Re:Ahem (Score:3, Informative)