Re: Anyone interesting in building "immune" Linux machines?

[Tim Nelson]

On Mon, 15 Nov 2004, martin f krafft wrote:

> also sprach Tim Nelson <architect@webalive.biz> [2004.11.14.2354 +0100]:
> > > define a configuration plan,
> >
> >         I did a search for "debian configuration plan", and "debian FAI
> > plan", and didn't find anything.  Is there documentation on this?
>
> "Plan your installation, and FAI installs your plans"

        Yeah, I saw that :).

> No, this is where you must do manual work. :/

	Ok.  When you said "Define a configuration plan", did you mean 
"Set up FAI"?

> >         Luke Kanies was looking at a cfengine/Debian based system, but I
> > don't know where he got to.
>
> I have not yet arrived either. Unfortunately, FAI does not make it
> easy to continue using cfengine afterwards (yet).

        What does it do that makes it difficult?

> > > and of you go. If you want an immune machine, you have to
> > > rely on high-quality packages and fast security updates that make
> > > minimal changes. Only Debian provides that.
> >
> >         ...for free.  Redhat seems to do that if you pay.
>
> RedHat does not have hgh-quality packages. Or else you would not
> screw up your system with x.0, tear out your hair when x.1 comes
> out, basically reinstall x.2, until you finally get a working x.3.

	Sounds like you encountered Redhat around version 7 :).  Redhat's 
essentially got 3 layers like Debian; Unstable (Fedora Beta), Testing 
(Fedora core) and stable (RHEL).  No, it's not exactly that way, but it's 
like that.  Redhat have changed their upgrade philosophy, and they do 
their upgrades on a per-package basis now, rather than big releases.  So 
you'll notice that Redhat versions from (IIRC) 8 (or maybe 9) onwards 
don't have .x after the release number (ie. 7.1, 7.2, 7.3, 8, 9...)

	I've been using RHEL here for around 6 months, and have only had 
one problem with automatic updates, and that was due to our non-standard 
configuration, I think.

	Just for the record, I like Debian from what I've heard, but 
Redhat is what I know, and what they already had when I started working 
here.

        :)

--
Tim Nelson
Server Administrator
WebAlive Technologies Global
Level 1 Innovation Building, Digital Harbour
1010 LaTrobe Street
Docklands, Melbourne, 
Vic, 3008
Phone: +61 3 9934 0812
Fax: +61 3 9934 0899
E-mail: tim.nelson@webalive.biz
http://www.webalive.biz/