Some services are capable of running in a chroot environment without having to build a separate chroot environment for them. OpenSSH and bind9 are both examples of chroot aware services. Simple config options will get you on your way to secure use of either of those. But for other services, like Apache2, things get more complicated.

It’s sometimes helpful to make a stand alone chroot environment so that you can run multiple versions of software. For example, it’s sometimes useful to run one version of php for your live server and experiment with upgrading to the newest php by running the newest php in a chroot. But how can you interact with the services running in the chroot?  Read more...

I was passed a very loved copy of Rebel Code by Glyn Moody. It’s about the beginnings of GNU, GPL liscensing, Linux, the Free Software Foundation, and the Open Source movement.  Read more...

The Linux chroot environments are often used to run pieces of software that are not compatable with the running distribution. For example, people running 64 bit Linux distributions will often create a 32 bit chroot environment based on that same distribution to run 32 bit software that might have better support. Adobe’s flash is a good example from the past: before 64 bit linux really gained popularity, only the 32 bit version of Adobe flash was available natively. But what if you need to install something that isn’t supported natively by your distribution at all, but is under a different distribution, and you’d like to keep package management the same?  Read more...

Is the log for your custom app getting a little long? Have a need to keep your logs around but would like to keep their size down to a more managable size? Logrotate is the easy and powerful answer. You can tell logrotate to rotate your logs on various different triggers (daily, weekly, some other time, on a specific file size, on a specific number of lines, etc). You can tell it what to do before and after rotating (to put mysql into a safe state, or to restart apache to rebuild deleted log files, for example).  Read more...

There are several problems with trying to create a large filesystem to store important data:

• raid 5 isn’t expandable unless you find a harddrive that’s the same size as the others
• LVM (Linux Volume Management) isn’t fault tolerant by itself, so if you lose one drive, your data is lost.

One of the best solutions I’ve found in dealing with these problems involves combining LVM with the Linux software RAID. You can cut up your collection of harddrives into common sized partitions, raid them together into several RAID5 collections (or even RAID1 collections), and LVM the resulting RAIDs.  Read more...