On Tue, 2014-02-25 at 15:42 -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
So, the Workstation group has done a truly fantastic job these last
couple of weeks designing their Technical Specification[1]. At today's
Server WG meeting, the topic came up about the "Core Services and
Features" section of this document. I think that much of it is reusable
for the Server Technical Specification, so I'm going to go through it
and make comments and recommendations. Please add your own thoughts and
I'll get them up on the wiki tomorrow.
> === File system ===
>
> The default file system type for workstation installs should be
> btrfs.
UGH! Certainly not on my hardware, hopefully this will be easy to
change.
The default file system is definitely up for some debate, but I'd
make
an argument for using XFS atop LVM[1] for the default filesystem in
the Fedora Server, at least in part because Red Hat's storage experts
have done the research for us already and determined that XFS is the
recommended fit for Red Hat Enterprise Linux 7.
Even if it weren't the default on RHEL7 I would second using XFS, it's
defeinitely the best Server File System we have available right now,
when you weight size/features/reliability
Btrfs still makes me somewhat nervous, given that its upstream
doesn't
consider it stable[3].
It is not stable yet, I do not think it makes sense for us to go btrfs
for a server. A desktop may get away with (although the one laptop where
I have it for testing sure would like to have something that is not that
slow)
> === Service management ===
>
> Systemd provides ways to control and monitor the activity and
> status of system services, resources they require, etc. System
> services are expected to provide systemd units. See the systemd
> [
http://0pointer.de/public/systemd-man/systemd.unit.html
> documentation].
>
I think we want to go along with this, but make a stronger statement
about systemd units.
"System services *must* provide systemd units to be included in the
Fedora Server standard installation."
I think this is a given, but if we feel the need to spell it out let's
do it.
> === Logging ===
>
> The systemd journal will be used as the local storage backend for
> system logs. For 'managed' scenarios (e.g the 'developer in a
> large organization' use case of the PRD), it will be possible to
> collect the logs in a centralized location, off the local machine.
>
> Applications and services can either use the syslog API or the
> journal APIs for their logging. See the journal API
> [
http://0pointer.de/public/systemd-man/sd-journal.html
> documentation].
>
I agree with this as well. We should focus on the use of journald as
the preferred log aggregator and make sure that it is fully capable of
aggregating those logs centrally. The advantages provided by
journald's structured logging will make processing of those logs much
easier.
That said, for the immediate future I think we also need to mandate
that the system MUST continue to be capable of exporting traditional
syslog messages to existing log aggregation systems.
I agree I think we MUST support full log aggregation via rsyslog, and
possibly make it easy to activate it.
> === Networking ===
>
> Network devices and connections will be controlled by
> NetworkManager. This includes support for VPN, which is relevant
> for 'corporate' scenarios. Applications are advised to use
> higher-level APIs (such as
> [
https://developer.gnome.org/gio/stable/GNetworkMonitor.html
> GNetworkMonitor] in GIO) to monitor online status.
>
This is going to be the contentious point, I expect. We've already
seen some chatter on this list around systemd-networkd and of course
there's a long history of wariness around NetworkManager as a
replacement for traditional network scripts.
This will need to come to a vote, but here are my feelings on the matter:
== Network Scripts ==
+ Powerful, stable and widely deployed.
- Configuration requires modification of a large number of plaintext
files. Central management of this configuration is difficult and
generally requires tools like Puppet and Chef to be deployed to do
so reliably.
- Complex configuration is highly prone to accidents necessitating a
visit from the "crash cart" in the data center.
I think we should stop with scripts in Fedora Server, they are brittle.
== Network Manager ==
+ Powerful and (now) stable with support for enterprise features like
bridging and bonding.
+ Consistent API allows for simplified configuration with fewer
opportunities for producing an unusable system.
+ Default networking stack for RHEL 7 means it will get considerable
bugfixing resources allocated to it.
- Requires a running daemon on the system (though work is under way to
have the daemon shut down except when needed)
- Bad PR history means that some administrators view it unfavorably
+1
== systemd-networkd ==
+ Very low overhead, tight integration with low-level plumbing
- Immature with few features. Only saw its first release this month.
- Not currently available on Fedora[4]
-1 on immature grounds in the short term
My personal view is that NetworkManager is the best option *today*
(understanding full well that there will need to be a fair amount of
marketing effort to educate people on how far it has come in the last
couple years), while systemd-networkd may become a highly interesting
option in the future. Given our focus in Fedora Server on making
configuration more approachable, I can't really see us recommending
network scripts as the *default* offering.
ack
> === Firewall ===
>
> A firewall in its default configuration may not interfere with the
> normal operation of programs installed by default.
I do not understand what "normal operation" means here.
What is normal is in part determined by what the user of the system
wants to accomplish.
I would extend this statement to include that the deployment of
Server
Roles should also adjust the firewall operation in a manner consistent
with user expectation.
Are we going to use something like firewalld or something else ?
Should we have the firewall configured by default, or not ?
> We should detect when the system is on a public or untrusted
> network and prevent the user from unwanted sharing of e.g. music or
> other media in this situation. A firewall (and network zones as
> currently implemented by firewalld) may or may not be part of a
> solution to this.
>
The concept of network zones should probably be basically ignored for
Fedora Server, as we should generally default to closing all ports
except for those made available for installed Roles. (Also, the Role
configuration should optionally be able to specify on which interfaces
it wishes to operate, so we can restrict internal vs. external
operation in a multi-homed environment).
What do we gain from a firewall that any application can poke holes at ?
Can someone state the benefits, or a situation where the default
configuration would be safer with a firewall ?
> === SELinux ===
>
> SELinux will be enabled in enforcing mode, using the targeted
> policy.
>
+1000
The base install and all approved Server Roles must operate in
targeted enforcing mode.
+1
> === Problem reporting ===
>
> Problems and error conditions (e.g. kernel oopses, Selinux AVCs,
> application crashes, OOM, disk errors) should all be reported in
> the systemd journal.
Ack
Is there another place they may be reported to ?
> Sending this information to a central place (like abrt does for
> crashes today) should be possible, but not mandatory. Depending on
> the use case, it may be turned off, enabled manually on a
> case-by-case basis, or entirely automatic without user
> intervention.
>
In the case of the Fedora Server, I think that reporting information
to a central location must be mandatory. Most servers in real-world
deployment are headless in a datacenter somewhere. Administrators will
need to be able to see all issues from a standard console.
There is a problem with sending information from things like abrtd to a
central location by default, in that sensitive information may get
disclosed unless the log server is reached only through authenticated
and encrypted connections.
Ideally we have a way to signal the trustworthiness of the log and
change behavior accrodingly and automatically. Whether we can do this in
the short/medium term I do not know.
But technically rsyslog can secure connections and even do mutual
authentication as it supports both TLS and GSSAPI. I also discussed at
DevConf.cz with the rsyslog maintainer some secure store-and-forward
techniques to use with ephemeral encryption keys and such so it is an
option.
Also, we need to keep in mind that the majority of servers will
*not*
have visibility to the internet, so transmitting ABRT results directly
to Bugzilla is often impossible. We will need to be able to aggregate
the issues on a network-local management server. (Note: IMHO this is
not a blocker requirement on F21)
Whether it is "possible" or not automatic transmission is almost always
inappropriate IMO. Too much potentially sensitive info can be
transmitted with these kinds of reports, they have to be validated and
approved for transmission by an admin.
I think this should be an actual requirement for the Server platform.
> === Session tracking ===
>
> Logind will be used as the session tracking facility.
>
> Applications that need to interact with sessions can use the
> logind
> [
http://www.freedesktop.org/software/systemd/man/sd_session_is_active.html
>
>
library API], the
> [
http://www.freedesktop.org/wiki/Software/systemd/logind/ D-Bus
> API], or a higher-level API
>
+1
> === Account handling ===
>
> SSSD is providing the backing storage for identity management. For
> 'managed' scenarios (e.g. the 'developer in a large organization'
> use case of the PRD), it will be possible to configure it to rely
> on a directory service for this information. The accountsservice
> is providing a D-Bus interface for user account information; this
> may be integrated into SSSD at some point.
>
> Depending on their needs, application and services can either use
> the POSIX APIs (getpwent(), etc) or the accountsservice D-Bus
> interface to obtain user information.
>
As the Fedora Server is more likely than Workstation to require
central management, I think we need to adopt this wholeheartedly.
Also, realmd should be considered a core piece of our story, as it
enables automatic configuration of SSSD with either FreeIPA (our
Domain Controller Role) or Active Directory (Microsoft Windows Domain
Controller).
+1 (though I have a conflict of interest here :-)
> === Software updates ===
>
> gnome-software will use PackageKit with the hawkey backend to
> obtain and install software updates for packaged applications and
> the OS itself. The recommendation for applications is to use the
> PackageKit APIs to interact with the underlying packaging system.
>
Software updates on a server system should be designed in such a way
that they can be enforced centrally. With Fedora Server, this probably
means picking one of the common config management systems such as
Puppet, Chef, Red Hat Satellite or else relying on OpenLMI for
performing central software upgrades.
I think you forgot spacewalk here.
For single-server manipulation, I think we should focus on
supporting
yum/dnf.
I think yum/successor CLI tool should be the default here indeed.
> === Miscellaneous system information ===
>
> System locale, timezone, hostname, etc. will be managed through
> the services provided by systemd for this purpose. See developer
> documentation for
> [
http://www.freedesktop.org/wiki/Software/systemd/localed/
> localed],
> [
http://www.freedesktop.org/wiki/Software/systemd/timedated/
> timedated] and
> [
http://www.freedesktop.org/wiki/Software/systemd/hostnamed/
> hostnamed]
>
I also think we should stick with the systemd-offered mechanisms for
this functionality (and I know that Cockpit is already interfacing
with much of it).
To be honest I find hostnamed quite inadequate for a server case as it
introduced confusion in the naming and by default will mangle perfectly
valid fqdns that the admin want to assign to the machine.
I think we should carefully evaluate these mechanisms.
For example, messing up with the hostname often has annoying
consequences when a server is enrolled into a central identity
management system.
> === Virtualization ===
>
> libvirt-daemon will be used to manage virtualization capabilities.
>
We probably want to use libvirt-daemon for virtualization and focus on
systemd-nspawn for containerization.
what about libvirt-lxc/docker ?
> === Display manager ===
>
> gdm will be used as the display manager. It is responsible for
> showing a login screen on each seat. It will be able to launch
> both X-based sessions and Wayland sessions.
>
> Desktop environments are expected to make themselves known as an
> available session option on the login screen by dropping a
> .desktop file into /usr/share/xsessions (or its wayland
> equivalent).
>
> Other facilities provided by the display manager include screen
> unlock authentication and user switching.
>
Display manager is irrelevant to the Server product.
We already discussed in some cases we will need them as some server
software unfortunately need a grpahical session for
installation/configuration purposes.
So we should have at least a recommendation of how to start a graphical
session if required, even if it is just a manual startx or if the
recommendation is to use Xvnc and a vnc client or other similar options.
> === Accessibility ===
>
> The accessibility support in the workstation includes a screen
> reader, a high-contrast theme and a zoom capability, amongst
> others. The screen reading is provided through orca, which runs as
> a session service and requires the at-spi infrastructure.
> Applications are expected to provide suitable information to the
> screen reader via the toolkit's accessibility support. Applications
> are also expected to work acceptably in the high-contrast theme.
> The zoom is implemented in the desktop shell and does not need any
> application support.
>
Accessibility on the server is a topic I'm fairly comfortable with
deferring to the management tools such as Cockpit and Katello/Foreman.
On the pure command-line, I think the most we can do is assert that
any interactive operation we enable should have a configurable timeout
to deal with potentially slow typists.
We should at least support braille devices out of the box for console
interaction IMO.
> === Input Methods ===
>
> The input method framework on the workstation is provided by ibus.
> Input methods and keyboard layouts can be configured in the
> control-center, and selected in shell keyboard menu. The supported
> application toolkits all support ibus.
>
I'm not sure this is a situation we need to get ourselves involved in.
Most interaction will be in the shell, so hopefully the LOCALE setting
will be sufficient.
> === Graphics ===
>
> The workstation session will switch to using a Wayland compositor
> as soon as feasible. Until then, it will be based on X11. Even
> after the switch, an X server will be included, so applications can
> either connect to Wayland natively, or run as an X client.
>
Not applicable
See above.
> === Media support ===
>
> Sound hardware and audio streams will be managed by pulseaudio.
> Applications are recommended to use the
> [
http://gstreamer.freedesktop.org/documentation/ gstreamer]
> framework for media playback.
>
Not applicable
There are server side media streamers, DLNA, etc.. we can defer taking
any action but it is incorrect to say that a server os has nothing to do
with media support.
> === Appearance ===
>
> The workstation will ship with a single theme, which will have
> support for the included toolkits: gtk3, qt and gtk2. Applications
> are expected to work well with this theme, as well as with the
> high-contrast theme that is used for accessibility. The theme will
> include a dark variant that applications can opt into using (this
> is most suitable for certain content-focused applications). The
> theme also includes an icon theme that provides named icons
> according to the icon-naming spec, plus symbolic variants.
>
> We will be using the Adwaita theme, with a yet-to-be-written qt
> variant.
>
As for "appearance", my view is that Cockpit should be the official
"face" of the Fedora Server. Opinions welcome :)
Should we say something about how the shell is configured, defaults,
bash-completion, vim-enhanced/emacs/other plugins ?
> === Application Integration ===
>
> Installed applications are expected to install a desktop file in
> /usr/share/applications and an application icon in the hicolor
> icon theme.
>
> Packaged applications are also expected to provide
> [
http://people.freedesktop.org/~hughsient/appdata/ appdata] for
> use in the application installer.
>
Not applicable
> === System Installer ===
>
> The desired installation experience for the workstation product is
> to limit the pre-installation user interaction to the minimum. The
> storage configuration UI should be focused on the classes of
> hardware that are expected in workstation-class machines. Package
> selection is not necessary: the installer will install the
> workstation product as defined. Tweaks, customizations and software
> additions should be performed after the installation.
>
> One aspect of storage configuration that will be needed is support
> for dual-boot setups (preserving preexisting Windows or OS X
> installations), since e.g. students may be required to run
> software on those platforms for their coursework.
>
> gnome-initial-setup already provides support for post-install user
> creation, language selection, timezone configuration, etc. If
> necessary, it should be extended to cover all required setup
> tasks.
I'm not even sure where to begin here. The system installer discussion
probably needs to have its own thread.
+1
Simo.
--
Simo Sorce * Red Hat, Inc * New York