jonen/notes/notes_2003-02.twingle

<h3>jonen's notes - 2003-02</h3>
<hr/>

  - Unix-Systems
    o learn howto move/maintain /etc of servers at cvs !!
    Debian:
      x search if new packages available, do 'apt-get --dry-run upgrade'! 
       x build small systool script 'apt-get_remote.pl' which do a cronly 'apt-get --dry-run upgrade' and send output via mail
       o review 'apt-get_remote.pl'
         o what's about parsing some response for comand like installing some marked packages
    FreeBSD(stable):
      o read more about BSD package systems (pkg, cvsup)
        x for simple package installation/de-installation use pkg
          x install downloaded package:
              :# pkg_add <package>-<version>.tgz
          x install package via remote server(only if package is available as *latest*): 
                pkg_add -r <package>.tgz
        x using cvsup
          x newbies could use cvsupit (not what it really does..)
              :# pkg_add -r cvsupit.tgz
            - cvsupit will proberly ask you for the default values it
              place at /etc/cvsupfile, which is used by cvsup
            - after that it will start cvsup to update your system
          x if /etc/cvsupfile already exists and you know what you do,
             this command will update your system (maybe run it via cron...):
              :# /usr/local/bin/cvsup -g -L 2 /etc/cvsupfile
      o whats about daemon start-stop scripts (like at linux: /etc/init.d/) ?
      x configure and compile custom kernel:
        x read http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig-building.html
        x create custom kernel conf-file
          - cd usr/src/sys/i386/conf/
          - copy default kenrnel GENERIC to eg MYKERNEL
          - edit/modify MYKERNEL
        x configure sources(really?)
          - run /usr/sbin/config MYKERNEL
        x build kernel
          - cd ../../MYKERNEL
          - make depend
          - make
          - make install
      x use packet fiters (firewall):
        x read http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html
        x some options at the kernel have to be enabled:
          - options IPFIREWALL
           Compiles into the kernel the code for packet filtering.
          - options IPFIREWALL_VERBOSE
           Enables code to allow logging of packets through syslogd.
           Without this option, even if you specify that packets should be logged in the filter rules, 
           nothing will happen.
          - options IPFIREWALL_VERBOSE_LIMIT=10
           Limits the number of packets logged through syslogd on a per entry basis.
           You may wish to use this option in hostile environments in which you want to log firewall activity,
           but do not want to be open to a denial of service attack via syslog flooding.
           When a chain entry reaches the packet limit specified, logging is turned off for that particular entry.
           To resume logging, you will need to reset the associated counter using the ipfw(8) utility:
                  :# ipfw zero 4500
           Where 4500 is the chain entry you wish to continue logging.
          - options IPFIREWALL_DEFAULT_TO_ACCEPT
           This changes the default rule action from ``deny'' to ``allow''.
           This avoids the possibility of locking yourself out if you happen to boot a kernel with IPFIREWALL support but have not configured your firewall yet.
           It is also very useful if you often use ipfw(8) as a filter for specific problems as they arise.
           Use with care though, as this opens up the firewall and changes the way it works.
        x firewall is enabled at /etc/rc.conf (or /etc/rc.conf.local)
             firewall_enabled = "YES"
             firewall_type = "<firewall_type>"
          x <firewall_type> is either a case at /etc/rc.firewall (/etc/rc.firewall6 for ipv6)
             or some custom file to read rules from.
          x  Use firewall_type = "OPEN" for default policy 'OPEN' (allow all)
          
      
  - QoS (Quality of Services)
    o check it out !

  - Apache/php:
    - apache aliases - redirect '/' to index.php (used for url catching/rewriting)

  - PHP:
    x search for php widget lib
     x APL (http://apl.sourceforge.net) 
       - huge lib in pure C
     x phphtmllib (http://phphtmllib.newsblob.com)
         a mainly widget/render lib, written in php, complete OO-based
         and with nice DataList rendering (abstract source API)
       x integrated with flib
       x wrote some classes to browse data-objects via class DataList (new classes flibRPCDataSource, ObjectList, TsBackend)
         o rename flibRPCDataSource (maybe rework to get more abstract)
         o review ObjectList amd move it to phphhtmllib
       x semi-integraded with class FormBuilder from binarycloud via interface class FormElementsInterface
         x new class DataItem, which render one data object for viewing/editing
       x integrated new FormProcessing classes from phphtmllib (released one day after interface to binaryclouds Formbuilder was written ;)
         x refactored DataItem to use now phphtmllib form processing instead of interface to binarycload
           o review code and move to phphtmllib
                
     o XOOPS (http://xoops.org)
         XOOPS is a dynamic OO (Object Oriented) based open source portal script written in PHP.
         It is the ideal tool for developing small to large dynamic community websites, intra company portals, 
         corporate portals, weblogs and much more.
     o binarycloud (http://binarycloud.com)
         binarycloud is an enterprise class web application platform. binarycloud shares many of the capabilities of products 
         like Oracle 9i AS (Application Server) and IBM's WebSphere:
         Proper definition of a framework: "A framework supplies the infrastructure and mechanisms that execute a policy for 
         interaction between abstract components with open implementations" 
        - benefits:
            x much code done yet!
        - drawbacks: 
             o not-really 100% clean code
             o complex app which gives you only limited possibilities to use only some classes, so not very modular
   

  - OpenLDAP:
    - Contacts:
      o Evolution: modify/create schema (map Attribute) so the field 'Note' and others can be used

    - PAM + SASL
      o seems pam will only works(will only be activated) if plain passwords are used
      o read more about PAM special in co-operate with SASL !! 

    - Kerberos V
      x use GQ LdapBrowser with SASL to authenticate against ldap
         - this requires a 'kinit <username>' at the shell to get the kerberos ticket
         - ldap will check your ticket pricipial against its acl's !
      o 'libpam-ldap' from Turbo is bad, don't use it !! (remember at 'apt-get upgrade' !!)
      o write this down in some (existing e.g. sendmail?) howto
  
    - Sendmail
      o research some about sendmail-cluster, 2 mx records, howto to set up second mx/cluster?
       x backup mx:
          - set up second mx at dns
          - add at backup mx place some like this at /etx/mail/mailtertable:
               domain.com     esmtp:[123.123.123.123]
             where the ip points to the system the real user accounts
            and add every domain to /etc/mail/relay-domains:
               domain.com
             o whats about these *open* relaying rules(security ?!?)
       x simple load balancing:
          - set up two(or more) mx records with same priority at dns
          - add at every mx place some like this at /etx/mail/mailtertable:
               domain.com     esmtp:[123.123.123.123]
             where the ip points to the system the real user accounts are
          note: this will do load balancing between eg 2 mail server, but if one fails,
                   there is only a 50% chance that sent messages would arrive
      o change '/etc/init.d/amavisd' to '/etc/init.d/amavis-milter' in howto
      o migrationtools:
        o patch migrationtools for sendmail aliases support (/usr/share/migrationtools/migrate_aliases.pl)
        o create, or search web for, migrationtool for sendmail virtusertable (/usr/share/migrationtools/migrate_virtuser.pl)
        o review patched kerberosV support at /usr/share/migrationtools/migrate_user.pl?
  

  - MySQL:
    o move this to mysql-common-tasks howto
       - Create Database
         :# mysqladmin create <database>
       - Set Privileges on databases(creates user too, if not exists...):
           mysql>grant all on <database>.* to <user> identified by "<pass>";
           mysql>grant all on <database>.* to <user>@<domain> identified by "<pass>";


  - Document saving:
    o remember *.doc is a non-standard, bloated Mircosoft format, use HTML instead !!
       see http://www.fsf.org/philosophy/no-word-attachments.html

  - my documents:
    o convert all howto's to SDF format ( look at 'nfo/doc/computing/sysadmin/linux/example_sdf_howto.sdf' )
    o learn more about Lyx/LaTex
      o convert all howto's to LaTex format ( look at 'nfo/doc/computing/sysadmin/linux/example_latex_howto.lyx' )


future:
  o build 'black box' to trace for 'spys' at a isdn/internet connection ;)

<hr/>
$Id$
     
1	jonen	1.1	<h3>jonen's notes - 2003-02</h3>
2			<hr/>
3
4			- Unix-Systems
5			o learn howto move/maintain /etc of servers at cvs !!
6			Debian:
7			x search if new packages available, do 'apt-get --dry-run upgrade'!
8			x build small systool script 'apt-get_remote.pl' which do a cronly 'apt-get --dry-run upgrade' and send output via mail
9			o review 'apt-get_remote.pl'
10			o what's about parsing some response for comand like installing some marked packages
11			FreeBSD(stable):
12			o read more about BSD package systems (pkg, cvsup)
13			x for simple package installation/de-installation use pkg
14			x install downloaded package:
15			:# pkg_add <package>-<version>.tgz
16			x install package via remote server(only if package is available as latest):
17			pkg_add -r <package>.tgz
18			x using cvsup
19			x newbies could use cvsupit (not what it really does..)
20			:# pkg_add -r cvsupit.tgz
21			- cvsupit will proberly ask you for the default values it
22			place at /etc/cvsupfile, which is used by cvsup
23			- after that it will start cvsup to update your system
24			x if /etc/cvsupfile already exists and you know what you do,
25			this command will update your system (maybe run it via cron...):
26			:# /usr/local/bin/cvsup -g -L 2 /etc/cvsupfile
27			o whats about daemon start-stop scripts (like at linux: /etc/init.d/) ?
28			x configure and compile custom kernel:
29			x read http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig-building.html
30			x create custom kernel conf-file
31			- cd usr/src/sys/i386/conf/
32			- copy default kenrnel GENERIC to eg MYKERNEL
33			- edit/modify MYKERNEL
34			x configure sources(really?)
35			- run /usr/sbin/config MYKERNEL
36			x build kernel
37			- cd ../../MYKERNEL
38			- make depend
39			- make
40			- make install
41			x use packet fiters (firewall):
42			x read http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html
43			x some options at the kernel have to be enabled:
44	jonen	1.2	- options IPFIREWALL
45			Compiles into the kernel the code for packet filtering.
46			- options IPFIREWALL_VERBOSE
47			Enables code to allow logging of packets through syslogd.
48			Without this option, even if you specify that packets should be logged in the filter rules,
49			nothing will happen.
50			- options IPFIREWALL_VERBOSE_LIMIT=10
51			Limits the number of packets logged through syslogd on a per entry basis.
52			You may wish to use this option in hostile environments in which you want to log firewall activity,
53			but do not want to be open to a denial of service attack via syslog flooding.
54			When a chain entry reaches the packet limit specified, logging is turned off for that particular entry.
55			To resume logging, you will need to reset the associated counter using the ipfw(8) utility:
56			:# ipfw zero 4500
57			Where 4500 is the chain entry you wish to continue logging.
58			- options IPFIREWALL_DEFAULT_TO_ACCEPT
59			This changes the default rule action from ``deny'' to ``allow''.
60			This avoids the possibility of locking yourself out if you happen to boot a kernel with IPFIREWALL support but have not configured your firewall yet.
61			It is also very useful if you often use ipfw(8) as a filter for specific problems as they arise.
62			Use with care though, as this opens up the firewall and changes the way it works.
63	jonen	1.1	x firewall is enabled at /etc/rc.conf (or /etc/rc.conf.local)
64			firewall_enabled = "YES"
65			firewall_type = "<firewall_type>"
66			x <firewall_type> is either a case at /etc/rc.firewall (/etc/rc.firewall6 for ipv6)
67			or some custom file to read rules from.
68			x Use firewall_type = "OPEN" for default policy 'OPEN' (allow all)
69
70
71
72			- QoS (Quality of Services)
73			o check it out !
74
75			- Apache/php:
76			- apache aliases - redirect '/' to index.php (used for url catching/rewriting)
77
78			- PHP:
79			x search for php widget lib
80			x APL (http://apl.sourceforge.net)
81			- huge lib in pure C
82			x phphtmllib (http://phphtmllib.newsblob.com)
83			a mainly widget/render lib, written in php, complete OO-based
84			and with nice DataList rendering (abstract source API)
85			x integrated with flib
86			x wrote some classes to browse data-objects via class DataList (new classes flibRPCDataSource, ObjectList, TsBackend)
87			o rename flibRPCDataSource (maybe rework to get more abstract)
88			o review ObjectList amd move it to phphhtmllib
89			x semi-integraded with class FormBuilder from binarycloud via interface class FormElementsInterface
90			x new class DataItem, which render one data object for viewing/editing
91			x integrated new FormProcessing classes from phphtmllib (released one day after interface to binaryclouds Formbuilder was written ;)
92			x refactored DataItem to use now phphtmllib form processing instead of interface to binarycload
93			o review code and move to phphtmllib
94
95			o XOOPS (http://xoops.org)
96			XOOPS is a dynamic OO (Object Oriented) based open source portal script written in PHP.
97			It is the ideal tool for developing small to large dynamic community websites, intra company portals,
98			corporate portals, weblogs and much more.
99			o binarycloud (http://binarycloud.com)
100			binarycloud is an enterprise class web application platform. binarycloud shares many of the capabilities of products
101			like Oracle 9i AS (Application Server) and IBM's WebSphere:
102			Proper definition of a framework: "A framework supplies the infrastructure and mechanisms that execute a policy for
103			interaction between abstract components with open implementations"
104			- benefits:
105			x much code done yet!
106			- drawbacks:
107			o not-really 100% clean code
108			o complex app which gives you only limited possibilities to use only some classes, so not very modular
109
110
111			- OpenLDAP:
112			- Contacts:
113			o Evolution: modify/create schema (map Attribute) so the field 'Note' and others can be used
114
115			- PAM + SASL
116			o seems pam will only works(will only be activated) if plain passwords are used
117			o read more about PAM special in co-operate with SASL !!
118
119			- Kerberos V
120			x use GQ LdapBrowser with SASL to authenticate against ldap
121			- this requires a 'kinit <username>' at the shell to get the kerberos ticket
122			- ldap will check your ticket pricipial against its acl's !
123			o 'libpam-ldap' from Turbo is bad, don't use it !! (remember at 'apt-get upgrade' !!)
124			o write this down in some (existing e.g. sendmail?) howto
125
126			- Sendmail
127			o research some about sendmail-cluster, 2 mx records, howto to set up second mx/cluster?
128			x backup mx:
129			- set up second mx at dns
130			- add at backup mx place some like this at /etx/mail/mailtertable:
131			domain.com esmtp:[123.123.123.123]
132			where the ip points to the system the real user accounts
133			and add every domain to /etc/mail/relay-domains:
134			domain.com
135			o whats about these open relaying rules(security ?!?)
136			x simple load balancing:
137			- set up two(or more) mx records with same priority at dns
138			- add at every mx place some like this at /etx/mail/mailtertable:
139			domain.com esmtp:[123.123.123.123]
140			where the ip points to the system the real user accounts are
141			note: this will do load balancing between eg 2 mail server, but if one fails,
142			there is only a 50% chance that sent messages would arrive
143			o change '/etc/init.d/amavisd' to '/etc/init.d/amavis-milter' in howto
144			o migrationtools:
145			o patch migrationtools for sendmail aliases support (/usr/share/migrationtools/migrate_aliases.pl)
146			o create, or search web for, migrationtool for sendmail virtusertable (/usr/share/migrationtools/migrate_virtuser.pl)
147			o review patched kerberosV support at /usr/share/migrationtools/migrate_user.pl?
148
149
150			- MySQL:
151			o move this to mysql-common-tasks howto
152			- Create Database
153			:# mysqladmin create <database>
154			- Set Privileges on databases(creates user too, if not exists...):
155			mysql>grant all on <database>.* to <user> identified by "<pass>";
156			mysql>grant all on <database>.* to <user>@<domain> identified by "<pass>";
157
158
159			- Document saving:
160			o remember *.doc is a non-standard, bloated Mircosoft format, use HTML instead !!
161			see http://www.fsf.org/philosophy/no-word-attachments.html
162
163			- my documents:
164			o convert all howto's to SDF format ( look at 'nfo/doc/computing/sysadmin/linux/example_sdf_howto.sdf' )
165			o learn more about Lyx/LaTex
166			o convert all howto's to LaTex format ( look at 'nfo/doc/computing/sysadmin/linux/example_latex_howto.lyx' )
167
168
169
170
171			future:
172			o build 'black box' to trace for 'spys' at a isdn/internet connection ;)
173
174			<hr/>
175			$Id$
176
MailToCvsAdmin">MailToCvsAdmin	ViewVC Help
Powered by ViewVC 1.1.26