F21 Self Contained Change: Replace Bacula with Bareos
by Jaroslav Reznik
= Proposed Self Contained Change: Replace Bacula with Bareos =
https://fedoraproject.org/wiki/Changes/Bareos
Change Owner(s): Simone Caronni <negativo17 at gmail.com>
The powerful Bacula network backup solution has switched from being Open
Source friendly to being almost closed source. Originally the project was
conceived totally as Open Source, but since the creation of Bacula Systems and
its proprietary Bacula Enterprise Edition product, the Open Source (now called
"Community Edition") has received less and less updates and is mostly
abandoned.
== Detailed description ==
The most important points that are left "abandoned" are the following:
* Installation scripts and updates to makefiles are not updated anymore.
* New plugins and functionalities are not added anymore, except those in the
"core" daemons.
* Gaphical (and buggy) console has not received any update in almost two
years.
* Patches and bugs opened in the bug tracker are mostly left abandoned. Even
trivial fixes are not imported in the source.
* Windows binaries are no longer provided, nor the source for the clients has
been updated. Even if compiled with difficulties, there is no support for recent
Windows versions.
A former Bacula developer, frustrated by the situation created the fork Bareos
a long time ago from Bacula 5.2.x (the current Fedora and RHEL 7 version).
This version has now received '''a lot of bugfixes''' compared to the original
Bacula source. This makes compilation and installation a lot easier than it
was with Bacula.
On top of this, a '''lot of new features''' have been added; some unique to
Bareos but many available only in the closed source Bacula Enterprise.
Here is the list of new features compared to the current Bacula 5.2.13:
* http://www.bareos.org/en/whats_new.html
Some highlights include NDMP support for enterprise class storage (NetApp,
etc.), support for enterprise class tape libraries and Windows support
(including Windows Server 2012) with Bareos generated binaries.
For further details on why a Bacula fork was created please look at the
following links:
* http://www.bareos.org/en/faq/items/why_fork.html
Bareos can also be '''fully compatible with Bacula''' by setting a specific
configuration directive in the Daemon configuration files; thus providing the
option for RHEL 6/7 users to interoperate with Fedora systems.
* http://www.bareos.org/en/faq/items/bareos_bacula_compatibility.html
== Scope ==
To accomplish the goal, the following Bacula packages need to be replaced with
Bareos equivalents:
bacula
bacula-docs
Currently, the same Fedora packages can be rebuilt as they are, to work also
on CentOS/RHEL 5 and 6, upgrading the EPEL or official Bacula packages in the
distributions. This is to have a consistent backup infrastructure across all
the Fedora/CentOS/RHEL ecosystem.
To ease installation, a repository for installing those packages on a
CentOS/RHEL system do exist:
http://repos.fedorapeople.org/repos/slaanesh/bacula/README.txt
The idea is the same for Bareos: import into Fedora 21 packages that can be
rebuilt for all supported Fedora/RHEL/CentOS releases and provide a repository
that can upgrade any Bacula release currently installed in the system with the
new one. In detail; the upgrade scenarios supported when going from Bacula to
Bareos would be:
From Bacula 2.4:
* RHEL/CentOS 5 with EPEL repository
From Bacula 5.0:
* RHEL/CentOS 6
From Bacula 5.2.13:
* Fedora 18+
* RHEL/CentOS 5
* RHEL/CentOS 6
As written before, the change is impacting only Fedora 21, the list of
upgrades supported are only for users who want a consistent backup solution
across the enterprise.
=== External activities ===
Proposal owners: I'm the current Bacula mantainer in Fedora and will complete
the transition in time for the release.
Other developers: N/A (not a System Wide Change)
Release engineering: the release engineering team should make sure the new
Bareos packages are in place instead of the current Bacula packages for the
new release.
Policies and guidelines: N/A (not a System Wide Change)
_______________________________________________
devel-announce mailing list
devel-announce(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce
5 years, 10 months
Configurable version of suexec in Debian but not Fedora?!
by Neal Gompa
So a friend of mine has been wrangling with suexec trying to configure it
for his needs, and he has become quite furious over the fact that suexec
isn't configurable.
Then he finds out that Debian actually has a version of suexec[1] that lets
you use a conf file to configure suexec. My question is, why the heck isn't
this in Fedora? How is it that Debian can offer both versions[1][2], but
Fedora cannot?
I'm honestly surprised that Fedora doesn't offer this little piece of
flexibility. I would think that this would be in Fedora and RHEL, because
of how useful this would be. So what's going on here?
[1]: https://packages.debian.org/sid/apache2-suexec-custom
[2]: https://packages.debian.org/sid/apache2-suexec-pristine
--
真実はいつも一つ!/ Always, there's only one truth!
6 years
Expanding the list of "Hardened Packages"
by Dhiru Kholia
Hi,
This proposal was originally at https://fedorahosted.org/fesco/ticket/1104
(mitr asked me to move the discussion to fedora-devel to get more
attention and feedback)
...
http://fedoraproject.org/wiki/Hardened_Packages page mentions
that "FESCo requires some packages to use PIE and relro hardening by
default."
It would be great if this list could be expanded to include even more
packages which are at comparatively more risk of being exploited (locally
or remotely).
Such packages will typically include various system daemons, network
daemons and network enabled applications.
Lot of network daemons are already using PIE and RELRO (e.g. httpd,
MariaDB). So a natural question is why packages in same "network
daemons" class like PostgreSQL, Dovecot and MongoDB aren't being
hardened?
Some of the ways to implement this proposal are,
1. Hardening flags should be turned on (by default) for all packages
which are at comparatively more risk of being exploited or which meet
some well-defined criteria (suggestions welcome).
"Packaging Guidelines" say that "Other packages may enable the flags at
the maintainer's discretion."
Thinking from a security perspective, I find "Hardening flags can only
be disabled for other packages at the maintainer's discretion provided
enough justification is given to FESCo" to be more appropriate.
2. An alternate approach is to come up with an expanded list of packages
which should be hardened.
Any feedback is welcome!
--
Dhiru
6 years, 7 months
default local DNS caching name server
by Chuck Anderson
Back in 2012 there was a discussion about having Fedora default to
using a local DNS caching name server [1]:
[1] http://comments.gmane.org/gmane.linux.redhat.fedora.devel/166018
I think this needs to be revisited. While DNSSEC support has
historically been a driving factor for implementing this, there is an
even more fundamental need due to the poor performance of the system
in case the first listed nameserver in /etc/resolv.conf fails for some
reason. It is shameful that Linux systems and applications in general
still, after 20+ years, can't perform adequately after a primary DNS
server failure. The stub resolver in glibc which uses
/etc/resolv.conf can decide that the first listed nameserver entry is
down, but this decision has to be made over and over in every single
process on the system that is doing DNS resolution, resulting in
repeated long application hangs/delays. We need an independent,
system-wide DNS cache, and always point resolv.conf to 127.0.0.1 to
solve this fundamental design problem with how name resolution works
on a Linux system. Windows has had a default system-wide DNS cache
for over a decade. It is about time that Linux catches up.
Yesterday, a new version of dnsmasq was released [2] that adds full
DNSSEC support and provides an alternative to unbound which
dnssec-trigger requires. There has also been great work done to solve
the NTP/DNSSEC bootstrap problem [3]. What options are currently
available in e.g. NetworkManager for using a local DNS cache and what
is the current status of this integration? Is it ready yet for
turning on by default in all Fedora products?
[2] http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2014q2/008416.html
[3] http://comments.gmane.org/gmane.comp.embedded.cerowrt.devel/2244
6 years, 7 months
Package reviev : tayga
by William
Hi,
I am looking to have the following package reviewed for inclusion into
fedora.
Tayga is a NAT64 implementation in userland. With the help of DNS64
(BIND), it allows an ipv6 only client to communicate with the ipv4
internet. http://www.litech.org/tayga/
I have attached the SRPM of what I have created.
There are a few things that could change. First, I had thought that I
would need more selinux policy than I did. At the moment the policy just
provides a filecontext. Is there a better way to do this?
The ifup / ifdown script read their variables from the /etc/tayga
configuration file. In most scenarios, a system will run only one
instance of this. However I would like feedback on:
Should I enable it so that the ifup/down can accept a tayga.conf
parameter to read
OR
Should the ifup/ifdown script generate the tayga.conf on the fly to
say /var/run/tmp somewhere from values provided in the ifup / ifdown?
Additionally, what I have in these scripts should really be reviewed, as
I have never written them before.
Finally, tayga is a long running process, as such, I have enabled the
hardened build. It is possible to run as an alternate user and in a
chroot of it's DB dir. What is the best way to go about adding a user
for this package for the daemon to run as?
Looking forwards to comments and advice,
--
Sincerely,
William Brown
http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0xEFC416D781A8099A
6 years, 7 months
libgcrypt soname bump in rawhide
by Tomas Mraz
I'm rebasing libgcrypt in rawhide to libgcrypt-1.6.1. The new upstream
release contains many improvements over the old one especially in terms
of new crypto algorithm support and performance improvements.
Unfortunately the rebase bumps soname to libgcrypt.so.20 due to dropping
some long-ago deprecated API calls. This should not break builds of any
reasonably current software. I've included the temporary old shared
library so the buildroots are not broken.
I will try to rebuild the dependencies eventually.
Regards,
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)
_______________________________________________
devel-announce mailing list
devel-announce(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce
6 years, 8 months
F21 System Wide Change: Fedora 21 Make 4.0 Update
by Jaroslav Reznik
= Proposed System Wide Change: Fedora 21 Make 4.0 Update =
https://fedoraproject.org/wiki/Changes/F21Make40
Change owner(s): Patsy Franklin <pfrankli(a)redhat.com>
This change brings Make 4.0 to Fedora 21.
== Detailed Description ==
The purpose of this update is to synchronize Fedora with the most recent Make
release.
Several new features, new command line options, new variables, and bug fixes
have been implemented in Make 4.0.
Improved error reporting may result in log file differences. If a recipe
fails, the makefile name and linenumber of the recipe are shown.
There is one backwards-incompatibility regarding the use of .POSIX. Make 4.0
will adhere to POSIX requirements for backshlash/newline handling. See the
link included under Documentation for more details.
A new subpackage make-devel will be created containing gnumake.h,a new file
containing externally-visible content.
== Scope ==
* Proposal owners:
** Rebase to make-4.0
** 6 patches need to be updated to work with new sources
** 14 patches will be removed as they are already supported by the make-4.0
rebase
** make.spec will be updated
** local build and test (already completed for glibc and gcc)
** patch created and submitted
** build
* Other developers: There are some minor error message changes that may show
up as log file differences.
If a package's makefile requires a specific version of make, the makefiles may
need editing to include make 4.0.
* Release engineering: There will be a new subpackage make-devel.
* Policies and guidelines: N/A
_______________________________________________
devel-announce mailing list
devel-announce(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce
6 years, 8 months
F21 Self Contained Change: Remote Journal Logging
by Jaroslav Reznik
= Proposed Self Contained Change: Remote Journal Logging =
https://fedoraproject.org/wiki/Changes/Remote_Journal_Logging
Change owner(s): Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl>
Systemd journal can be configured to forward events to a remote server.
Entries are forwarded including full metadata, and are stored in normal
journal files, identically to locally generated logs.
== Detailed Description ==
Systemd's journal currently provides a replacement for most functionality
offered by traditional syslog daemons,
with two notable exceptions: arbitrary filtering of messages and forwarding of
messages over the network. This Change targets the latter.
The high-level goal is to have a mechanism where journal logging can be
extended
to keep a copy of logs on a remote server, without requiring any maintenance,
done
fairly efficiently and in a secure way.
Two new daemons are added as part of the systemd package:
* on the receiver side systemd-journal-remote accepts messages in the Journal
Export Format [1]. The export format is a simple serialization of journal
entries, supporting both text and binary fields. This means that the messages
are transferred intact, apart from the "cursors", which specify the location
in the journal file. Received entries are stored in local journal files
underneath /var/log/journal. Those files are subject to normal journald rules
for rotation, and the older ones will be removed as necessary to stay within
disk usage limits. Once entries have been written to the journal file, they
can be read using journalctl and the journal APIs, and are available to all
clients, e.g. Gnome Logs [2].
* on the sender side systemd-journal-upload is a journal client, which exports
all available journal messages and uploads them over the network. The (local)
cursor of the last message successfully forwarded is stored on disk, so when
systemd-journal-upload is restarted (possibly after a reboot of the machine),
it will send all recent messages found in the journal and then new ones as
they arrive.
The communication between the two daemons is done over standard HTTPS,
following rather simple rules, so it is possible to create alternate
implementations without much work. For example, curl can be easily used to
upload journal entries from a text file containing entries in the export
format. Basically, the data are sent in an HTTP POST to /upload with Content-
Type: application/vnd.fdo.journal. When doing "live" forwarding, the size of
the transfer cannot be known in advance, so Transfer-Encoding: chunked is
used. All communication is encrypted, and the identity of both sides is
verified by checking for appropriate signatures on the certificates.
== Scope ==
* Proposal owners:
The code in systemd for systemd-journal-remote and systemd-journal-upload will
have to be added. The first is done, and has already been released in the
latest Rawhide systemd package. The second is mostly done, and will be
submitted upstream soon. Necessary units will have to be created, and a
location with suitable permissions will have to be created so that systemd-
journal-remote can run unprivileged. This means that systemd-journal-remote
should probably be packaged as a separate subpackage, similarly to systemd-
journal-gatewayd. systemd-journal-upload uses libcurl, and thus should be also
packaged as a separate subpackage to avoid introducing a new dependency for
systemd.
Suitable defaults for timeouts for transfers and maximum accepted entry sizes
have to be chosen.
A port will have to be picked: systemd-journal-gatewayd uses 19531, so
systemd-journal-remote should probably use 19532.
Two new users will have to be created when the packages are installed.
* Other developers: N/A (not a System Wide Change)
* Release engineering: N/A (not a System Wide Change)
* Policies and guidelines: N/A (not a System Wide Change)
[1] http://www.freedesktop.org/wiki/Software/systemd/export/
[2] https://wiki.gnome.org/Apps/Logs
_______________________________________________
devel-announce mailing list
devel-announce(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce
6 years, 8 months